This blog has moved

This blog is now located at http://tsibouris.blogspot.com/.
You will be automatically redirected in 30 seconds, or you may click here.

For feed subscribers, please update your feed subscriptions to
http://tsibouris.blogspot.com/feeds/posts/default.

Read More...

NJ Supreme Court Addresses Privilege in Employee Web-Based Personal Email Accounts

by Mehmet Munur

New Jersey Supreme Court ruled on March 30, 2010 that an employee did not waive attorney-client privilege to the emails she sent using her personal, web-based, password-protected email account from a computer owned by the employer. The employer had an Electronic Communication Policy that limited the employee’s expectation of privacy but did not explicitly discuss the use of personal email accounts on employer owned computers. The Court also stated in dicta that even a more clearly written policy would not be enforceable due to the public policy concerns over the attorney-client privilege. The Court also placed the burden of compliance with the ruling on attorneys by referring to the Rules of Professional Conduct. The case may require a re-write of electronic communication policies, at least as it relates to NJ employees. The case illustrates the importance of having clearly written policies that not only address the realities of personal use of employer-owned computers, but also the importance of properly implementing such policies.


The plaintiff, Marina Stengart, sued her former employer Loving Care Agency for employment discrimination. Stengart used the laptop provided by Loving Care to send emails to her attorney using her personal, web-based, password-protected Yahoo email account before turning in her laptop at the end of her employment. While she intended such communication to remain confidential, her laptop cached the emails in the temporary files folder. Loving Care imaged the laptop’s hard-drive for electronic discovery and found 7-8 of these emails, which had attorney-client privilege disclaimers. Attorneys for Loving Care reviewed these emails and referenced them in answering interrogatories. Plaintiff requested the immediate return of all other communication. Loving Care’s attorneys refused, Stengart moved for a temporary restraint. The trial court judge denied Stengart’s motion and found that the emails were not protected by attorney-client privilege because Loving Care’s Electronic Communication Policy had placed Stengart on notice that that the emails would be company property. The Appeals Court reversed and the New Jersey Supreme Court agreed with the Appeals Court. The New Jersey Supreme Court held that the Policy was ambiguous, that Stengart had both an objective and a subjective expectation of privacy, that the attorney-client privilege applied to the emails, and that the privileged had not been waived.

I. The Appeals Court Decision.

The Appeals Court overruled the trial court on four issues. First, the Appeals Court held that there was a genuine issue of material fact as to whether the Policy had been properly implemented. Second, it held that the Policy was ambiguous and that it did not specifically address web-based email use for personal reasons. Third, the Appeals Court held that the Policy was not enforceable due to the application of the attorney-client privilege. Lastly, it held that Loving Care’s attorneys were bound by the rules of professional conduct to bring the emails to the attention of the plaintiff’s attorneys or the court for a determination on the application of privilege.

First, the Appeals Court examined whether Loving Care’s Electronic Communication Policy had properly been implement. Stengart argued, with certification in support from former executives, that the Policy was not supposed to apply to Executives and that the Policy was not in effect during her time there. The Appeals Court concluded that there was a genuine issue of material fact as to whether the Policy applied to Stengart as an executive. The Appeals court relied on the multiple versions of the Policy that it found on the record with no information as to the effective dates of the Policy. This portion of Appellate Court Opinion highlights the importance of properly implementing Electronic Communication Policies. Such policies should be properly dated and properly disseminated to the workforce to extinguish any arguments that they are not applicable.

Second, the Appeals Court examined whether the terms of the Policy were sufficiently clear to warrant enforcement and whether the Policy covered the web-based Yahoo email account that Stengart used to communicate with her attorney. The trial court had held that the Policy put Stengart on notice that her communication would be subject to review as company property. The Appeals Court disagreed. Loving Care’s Electronic Communication Policy read:

[1] The company reserves and will exercise the right to review, audit, intercept, access, and disclose all matters on the company's media systems and services at any time, with or without notice. . . .


[2] E-mail and voice mail messages, internet use and communication and computer files are considered part of the company's business and client records. Such communications are not to be considered private or personal to any individual employee.


[3] The principal purpose of electronic mail (e-mail) is for company business communications. Occasional personal use is permitted.

The Appeals Court held that “company’s media systems and services” was not defined and it was not clear whether that included personal, password protected, web-based email accounts. Furthermore, the Appeals Court held that the lack of privacy for business communications conflicted with the occasional personal use that was permitted. Therefore, the Appeals Court held that the Policy was ambiguous.

Third, the Appeals Court turned to whether the Policy was enforceable. The Appeals Court examined the short history of employee manuals and their enforceability in contract theory. The Appeals Court wanted to reign in employee policies and wanted to create a reasonableness requirement on such policies before they could be enforced. Weighing the legitimate business interests of the employer against the interest in privacy of the employee, the Appeals Court appeared to argue that an employer could not make personal communications into company property by placing such language in a policy. Only after going into the history of employee-employer relationships and other cases in this area did the Appeals Court finally turn to the attorney-client privilege issues. The court held that “the company policy is of insufficient weight when compared to the important societal considerations that undergird the attorney-client privilege.”

Fourth, the Appeals Court addressed the issue of whether counsel for Loving Care had violated New Jersey Rule of Professional Conduct 4.4 requiring a “lawyer who receives a document and has reasonable cause to believe that the document was inadvertently sent . . . not [to] read the document [,] to, if he or she has begun to do so, . . . stop reading the document, [to] promptly notify the sender, and [to] return the document to the sender.” The trial court found that Loving Care’s attorneys did not have an affirmative duty to alert the plaintiff that it was in possession of the emails. The Appeals Court was not convinced and held that the Loving Care attorneys had violated the rule. The Appeals Court remanded the case to determine whether counsel should be disqualified.

Thus, the Appeals Court reversed the trial court, ordered the emails to be destroyed, and remanded the case for a hearing on disqualification of Loving Care’s attorneys.

II. The Supreme Court Opinion

The Supreme Court modified and affirmed the judgment of the Appellate court and created a bright line rule in dicta for attorney-client privileged communications from personal web-based accounts using employer owned computers. On appeal, the Supreme Court only addressed the ambiguity of the Policy, the application of the privilege, and the application of the ethics rule. Unlike the Appeals Court, the Supreme Court did not determine whether the Policy had been properly implement. Instead, the Court simply assumed that the Policy applied.

The Supreme Court agreed with the Appeals Court that the language of the written policy was ambiguous. The court then turned to the reasonable expectation of privacy by Stengart in her communications with her attorney. However, the Supreme Court did not take the same reasonableness approach to limit all employer policies regarding electronic communication as the Appeals Court did. Instead, the court distinguished between company provided email accounts and web-based personal email accounts based on 4th Amendment cases by analogy, tort of intrusion on seclusion, NERA v. Evans, Quon v. Arch Wireless, In re Asia Global Crossing, and others. The Court also emphasized the importance of company policies in diminishing the reasonableness of employee’s claim to privacy. The Court analyzed the reasonableness of Stengart’s expectation of privacy both objectively and subjectively. Her use of a web-based, password protected account—the password to which she did not save on her computer—led the Court to conclude that Stengart had a subjective expectation of privacy for the communication. The ambiguity of the Policy and the fact that it did not address personal email accounts led the Court to conclude that her expectation of privacy was objectively reasonable. The Court rejected any arguments of waiver as well and concluded that the communications were privileged.

The New Jersey Supreme Court also went one step further and created a bright line rule in dicta. Court did not mention the same reasonableness requirement in Electronic Communication Policies that the Appeals Court mentioned. Instead, the court stated that companies were free to “adopt lawful policies relating to computer use to protect assets, reputation, and productivity of a business and to ensure compliance with legitimate corporate policies.” However, the Court stated that

Employers have no need or basis to read the specific contents of personal, privileged, attorney-client communications in order to enforce corporate policy. . . . [E]ven a more clearly written company manual – that is, a policy that banned all personal computer use and provided unambiguous notice that an employer could retrieve and read an employee’s attorney-client communications, if accessed on a personal, password protected e-mail account using the company’s computer system – would not be enforceable.

The Court then turned to the ethics issue and agreed with the Appeals court. In effect, both courts appointed the attorneys for the employer as the custodian of an employee’s communication with his attorneys. Loving Care’s attorneys argued that the New Jersey Rule of Professional Conduct 4.4 was meant to address situations where attorneys inadvertently received communications from third parties and not this particular situation where the plaintiff had left them behind. The Court disagreed with the characterization of emails found in the cache of a browser as “left behind” and agreed with the Appeals Court in stating that the counsel for Loving Care had violated the New Jersey Rule of Professional Conduct 4.4 by not setting aside the privileged communications, and failing to notify its adversary or the court. Therefore, in New Jersey, if a company finds potentially privileged emails, its attorneys will be ethically bound to inform opposing counsel or the court about these emails before they use them, or risk disqualification.

With this decision, the New Jersey Supreme Court joins a line of cases, similar to NERA v. Evans,  holding that attorney-client communications creates a special case for employer Electronic Communication Policies. However, it is unique for creating a bright line rule for attorney-client privileged emails using personal web-based email accounts. Additionally, by placing the onus of compliance with the rule on the attorneys instead of the businesses, the court ensures that the rule will be followed.

The decision is also important because the Supreme Court did not follow the reasonableness approach to Electronic Communications Policies that the Appeals Court wanted to put in place. Such an approach for the content of all Policies could not simply be based on the attorney-client privilege, but would have to have another basis in the tort of intrusion upon seclusion. Interestingly, the Supreme Court neither struck down, nor agreed with that portion of the Appeals Court opinion.

III. Conclusion

The New Jersey Supreme Court opinion demonstrates the importance of proper drafting and implementation of Electronic Communication Policies. Such Policies should be updated to take into effect the realities of employee’s use of personal web-based email use at work. Companies may either completely ban the use of employees’ personal use of company computers or allow such personal use but specifically address issues related to the privacy of such communications. Updating such Policies will allow companies to decide to what extent they will limit an employee’s expectations of privacy in the personal of use employer-owned computers. Either way, the employer’s decision regarding attorney client privileged communications must be accurately reflected in their policies, or such policies may not be upheld in court. Additionally, such policies should be properly dated and properly disseminated to the workforce to extinguish any arguments that they are not applicable.

Read More...

Insurance Provider Settles Case Due to Deficiencies in Electronic Signatures, Electronic Evidence, and Contract Drafting

By Mehmet Munur

A District Court in New York recently decided a case where the perfect storm of messy contract drafting, which left a key term undefined and ambiguous, lack of proper evidence to prove the date of formation of the contract, and deficiencies in electronic signatures forced a life insurance provider to settle the case. While the court held that the electronic signatures used to sign the life insurance application survived summary judgment, the definition of the term Participant was vague and could not result in summary judgment for the insurance company. The case highlights the importance of precisely defining terms in a contract, building appropriate procedures for proving the existence of electronic contracts, and procedures for identifying the person electronically signing documents.

Neil Dukoff, an AICPA member, and Shari Dukoff, as his dependent, entered into a group life insurance contract with Prudential Insurance for Mrs. Dukoff using an electronic application in 2004. After Shari Dukoff passed away in May 2006, Prudential refused to honor the insurance contract arguing that the insurance contract was based on material misrepresentations in the application related to Mrs. Dukoff’s cancer surgery. Both sides moved for summary judgment, both motions were denied.

I. Prudential’s Arguments for Summary Judgment

Prudential made two arguments for summary judgment. First, it argued that there was no valid contract because Mr. Dukoff was not a party to the contract. Second, Prudential argued that the contract was procured through fraud and was, therefore, invalid. In both cases, Prudential could have helped resolved the issues by properly defining and using the words “Participant,” “Dependent,” “I,” and “My.”

A. Parties to the Contract

The court denied Prudential’s motion for summary judgment on the ground that Mr. Dukoff was not a party to the contract because there was enough doubt as to whether Mr. Dukoff or Mrs. Dukoff signed the contract. The court also found that the contract was ambiguous as to who was the intended party.

Prudential argued that there was no contract because Mrs. Dukoff was in the hospital recovering from surgery during the time she was to have signed the contract. Prudential offered as evidence a computer printout showing that the contract was submitted on May 15, 2004, the date on which both parties agree that Mrs. Dukoff was recovering from surgery in the hospital. However, Mr. Dukoff stated under oath that the contract was signed around March or April 2004. The court held that this printout was not sufficient to accurately show that the date reflected was the date of submission.

Needless to say, this is far too small a digital footprint for a contract that was formed online. Prudential could have built systems that logged applications submitted on its servers. In this log, Prudential could have recorded the time, location by IP address, unique cookie information, and other information related to the submission of the application and produced this evidence in trial. Prudential could have sent an automatic confirmation email to the email address of the applicant right after the submission of the application online. Finally, Prudential could have shown that a confirmation letter was sent several days after the submission with welcome letters and the signed contract. It is likely that Prudential had one or more of these processes in place. However, Prudential did not present any of more evidence than the printed contract with the date. Counsel for Prudential may have been more worried about the ambiguities in the contract than the proving the exact date of formation of the contract.

The court then turned to the language of the contract to address these ambiguities. In at least one section, “the applicant state[d] that ‘I’ authorize Prudential to access ‘my’ medical records to determine eligibility for insurance.” Considering that Mr. Dukoff did not need to provide his medical records, the court concluded that this language pointed to Mrs. Dukoff as the party to the contract. The certificate of coverage was of no use because it stated both names on it. Adding apparent authority and ratification issues to the mix, the court decided that there was a genuine issue of material fact as to who were the parties to the contract.

B. Procurement through Fraud

The court then turned to Prudential’s second argument for motion for summary judgment: fraud. However, the court did not need to address the admissibility of the evidence related to Mrs. Dukoff medical records and fraud. Once again, there was a genuine issue of material fact as to whether Prudential challenged the validity of the contract in the appropriate time.

Prudential contested the validity of the insurance policy after more than 2 years of its effective date. However, Prudential argued that the contract allowed it to contest its validity using Mrs. Dukoff’s statements 2 years after her death. The court found that the undefined term “Participant” made the language related to challenge within 2 years ambiguous. The contract and the certificate of insurance stated:

Incontestability of Dependents Life Insurance
This limits Prudential’s use of a Participant’s statements in contesting an amount of Dependents Life Insurance for which the Participant is insured with respect to a dependent. These are statements made to persuade Prudential to accept you for insurance.
They will be considered to be made to the best of your knowledge and belief. These rules apply to each statement:
(1) It will not be used in the contest unless:
(a) it is in a written instrument signed by the Participant; and
(b) A copy of that instrument is or has been furnished to the Participant or the Participant’s Beneficiary.
(2) If it relates to the dependents [sic] insurability, it will not be used to contest the validity of Dependents Life Insurance which has been in force, before the contest, for at least two years during the Participant’s lifetime.

The court held that the term Participant was not expressly defined and could refer to either Mr. Dukoff or Mrs. Dukoff. On the one hand, the terms “Participant Insurance” and “Dependent Insurance” appropriately and respectively referred to Mr. Dukoff and Mrs. Dukoff. On the other hand, the sentence above relating to “statements made to persuade Prudential accept you for insurance” suggested that Mrs. Dukoff was the Participant.

Most importantly, the last statement quoted from the contract above suggested that the Participant’s statements would not be used to contest validity of the Dependent’s life insurance for at least two years during the Participant’s lifetime. However, the lack of definition of the words “Dependent” and “Participant” resulted in ambiguity in deciding whose words could be used against whom. Therefore, the court returned to basic contract interpretation and sought extrinsic evidence, considered the New York statute where the language was supposed to have come from, and lacking additional evidence to the parties’ intent, rejected Prudential’s motion for summary judgment.

Such key terms should have been appropriately and clearly defined, especially if they were capitalized. Additionally, Prudential might have been better served by inserting the required language directly from the statute, which referred to “statements made by any person” instead of the complex Participant and Dependent scheme that Prudential created.

II. Mr. Dukoff’s Arguments for Summary Judgment

In its motion for summary judgment, Mr. Dukoff argued, among other things, that the statements related to Mrs. Dukoff’s health were not signed due to the failure of the electronic signatures scheme that Prudential used. The court held that particular information used in the application was sufficient to identify her as the person signing the application; therefore, Mr. Dukoff was not entitled to summary judgment on the issue.

The insurance contract prohibited the use of statements made by the insured that was not “in a written instrument signed by the [insured]” to contest the contract. Thus, Mr. Dukoff argued that Mrs. Dukoff did not sign her statements. In return, Prudential argued that the electronic signature on the application satisfied the NY Electronic Signatures and Records Act as well as the contractual requirement for written statement and signature. The New York law states that electronic signature “shall have the same validity and effect as a signature affixed by hand.” The law also defines electronic signature as “an electronic sound, symbol, or process, attached to or logically associated with an electronic record and executed or adopted by a person with the intent to sign the document.” The court then turned to Prudential’s application process to determine whether it complied with NY law.

Prudential used a “standard” click through that included the following language at the end:

*I agree By submitting this form, I hereby request coverage under the CPA Spouse Life Insurance Plan. I have read the Conditions Applicable to This Subscription on this web site and agree to those statements and conditions. I also hereby subscribe to the AICPA Insurance Trust in accordance with Member’s Subscription and agree to the applicable conditions.

The applicants also had to enter home address and social security numbers. Prudential argued that this click-through agreement and the use of the identifiers satisfied the definition of electronic signature under NY law.

Not finding any case that invalidated a contract based on electronic signatures, the court turned to State of New York Insurance Department opinions. One particular Opinion stated that, generally speaking, a checked box on an electronic form on the Internet constitutes a valid electronic signature so long as it abides by the definition of electronic signature under the New York law. However, the opinion then added that such technology must be “capable of verifying that the person providing the electronic signature is actually the party to be charged. “ The Opinion further stated that “without such verification measure in place, the Department would not consider a checked box to be a valid signature.” Based on this Opinion, Mr. Dukoff argued that Prudential did not have the means to verify the identity of the person electronically signing the document.

The court deferred to the Opinion but it seemed puzzled by one finding. The NY legislature had removed a reference to a requirement for the electronic signature to include a unique identifier capable of verification from the law several years ago. More specifically, the NY law used to require a unique identifier “capable of verification, under the sole control of the person using it, attached to or associated with data in a manner that authenticates the attachment of the signature to particular data.” The court must have felt that the Opinion inserted back this unique identifier and verification requirement. Therefore, in its interpretation, the court changed the “actual identification” language of the Opinion to “reasonable identification” of the person. However, this being a motion for summary judgment, the court’s finding that “it is at least possible that Prudential satisfied this requirement” by using identifying information, such as address, social security number, and physical description, is excusable.

However, considering that the electronic signature in this case was supposed to be able to distinguish between a husband and a wife signing an application for a $500,000 life insurance, the click-through could not have satisfied the standard created by the Opinion. Under the circumstances, provision of the three pieces of information cannot actually identify the person signing the document. The technology supporting the electronic signature was required to identify the person signing the application to a higher degree of certainty than reasonable identification. Here, Prudential did not have the technology or the processes in place to ensure that Mrs. Dukoff and not Mr. Dukoff electronically signed the application. Considering the amount of money at stake, Prudential could have authenticated the signature by sending a password via text message to her cell-phone, via email to her email address, via mail to her home address, or using any other similar method. The first two methods would likely help distinguish between a husband and a wife signing a document under most circumstances. However, it is unlikely that any of these circumstances would help distinguish between the two when one of them is in the hospital recovering from surgery. This is probably one reason that other life insurance companies require applicants to sign their applications over the phone using a voice signature.

In sum, this perfect storm of electronic signatures that barely survived legal scrutiny, lack of evidence proving the date on which the contract was signed, and contract terms that were confusing even to the court to interpret resulted in Prudential having to settle the case shortly after it lost its motion for summary judgment. This case is just another reminder that companies must continue to pay attention to the fundamentals of contract drafting while at the same time paying particular attention to electronic signatures and electronic evidence relating to those contracts.

The case is Prudential Ins. Co. of Am. v. Dukoff, No: 2:07-cv-01080-ADS-MLO (E.D.N.Y. Dec. 18, 2009).

Read More...

Court Upholds Forum Selection Clause in B2B Clickwrap

By Mehmet Munur

A District Court in Indiana recently held that NexTag’s clickwrap Terms of Service was enforceable against Appliance Zone despite arguments by Appliance Zone that no contract was formed and that if an agreement were formed it was procedurally unconscionable. Ironically, NexTag was helped by the fact that Appliance Zone was an ecommerce merchant that used a similar sign-up process and similar website terms of use in its own business.

Appliance Zone advertises and distributes appliance parts and accessories through its commercial website. NexTag operates a commercial comparison website and advertises the goods of third parties such as Appliance Zone. NexTag refers customers to the third parties’ website where they can purchase the good and charges a few dimes for every referral.

When Appliance Zone found out that NexTag used Appliance Zone’s trademark to promote the prices of goods of Appliance Zone’s competitors, Appliance Zone brought a trademark infringement suit under the Lanham Act against NexTag in Indiana. NexTag, being a Delaware corporation based out of California, argued improper venue due to the forum selection clause in its Terms of Service Agreement, which every business must agree with before listing their products on NexTag. Thus, the court had to decide whether the forum selection clause in NexTag’s Terms of Service Agreement was enforceable.

Appliance Zone raised three arguments to state that the forum selection clause not applicable: 1) there was no agreement between the parties; 2) if there was an agreement, it was unconscionable; and 3) the lawsuit did not arise out of the agreement and thus it was not governed by the forum selection clause.

First, Appliance Zone argued that the employee that signed up with NexTag did not have the authority to enter into the contract. The court held that the employee had apparent authority to enter into the contract. The employee clicked the radio box next to the statement “I accept the NexTag Terms of Service,” uploaded 20,000 product descriptions and 14,000 product images onto NexTag’s website, and Appliance Zone paid for NexTag’s services. Therefore, the conduct demonstrated acceptance of a valid contract.

Second, Appliance Zone argued that the Terms of Service Agreement was unconscionable because 1) it was inconspicuous, 2) parties had unequal bargaining power, and 3) Appliance Zone did not read it. The court rejected each of these arguments. The court held that the presentation of the Terms of Service Agreement was typical for the online retail industry, that it was clearly labeled, and that it was placed in a highly visible portion of the web page. Appliance Zone also had to check a box to manifest assent to the Agreement. The court also cited Appliance Zone’s similar sign-up process and similar language in its Terms of Use against Appliance Zone to state that NexTag’s Terms of Service Agreement was not procedurally or substantively unfair. The court also stated that Appliance Zone had failed to demonstrate the disparity in the bargaining power and that Appliance Zone would be presumed to have read the terms and agreed to them when it signed them as a matter of fundamental contract principle.

Finally, the court addressed Appliance Zone’s argument that the trademark issue did not arise out of the Terms of Service Agreement. The court held that the binding precedent required that the Agreement govern the dispute between the parties—Appliance Zone had cited to persuasive 2nd Circuit Precedent.

This case highlights how electronic Business-to-Business agreements are more difficult to overturn than electronic Business-to-Consumer agreements. Plaintiff’s arguments related to not having read the agreement, uneven bargaining positions, and unconscionability are mostly arguments raised in Business-to-Consumer settings. However, such arguments are unlikely to work in cases where the party arguing against the enforceability of the contracts employs a similar contract in a similar settings.

The case is Appliance Zone, LLC v. NexTag Inc., No:4-09-cv-0089-SEB-WGH (S.D. In. Dec. 22, 2009).

Read More...

Article 29 Working Party Releases 12th Annual Report

By Mehmet Munur

The Article 29 Working Party, a group created under the EU Data Protection Directive and made up of the data protection regulators of each Member State to provide guidance on data protection and privacy issues, has released its 12th Annual Report. The Chairman, Alex Turk, states that the four main issues of the year were protection of children’s personal data, search engines and the large of amounts of data they gather, international transfer of personal data with emphasis on the use of Binding Corporate Rules, and air passenger name records. Overall, Enforcement by the DPAs appears to have increased compared to the previous year.

The report serves as a summary of all EU DPAs’ reports on the implementation of the EU Data Protection Directive, the E-Privacy Directive, major case law, and major specific issues. The following are some of the interesting tidbits from the Annual Report.

The Austrian DPA found that a whistle-blower hotline of a US multinational required that the Austrian subsidiary be considered a data controller. The Austrian DPA held that data transfers by the employees would be imputed to the employer because the employer’s Code of Conduct required its employees to report illegal or unethical activity.

The Danish DPA highlighted the case of a nightclub that wanted to create an electronic access control system that used fingerprints, photos, and black lists of unwanted customers who would be rejected at the door. The DPA allowed the database so long as customers gave explicit consent and data was deleted after consent was withdrawn.

The French DPA, CNIL, stated that it had been in session 50 times and adopted 586 resolutions during the year, an increase of 50% compared to previous year. CNIL also handled 4,244 complaints during the year. It conducted 218 inspections, “an increase of 33 % compared to the previous year.” The DPA imposed fines ranging between $30,000 to $100. CNIL also issued 126 warnings, an increase of 20% compared to the previous year.

The Dutch DPA greatly increased its enforcement activity compared to the previous years. It carried out 95 investigations, an increase of 50% compared to the previous year, and imposed sanctions or threatened to impose sanctions on 68 cases, compared to 39 in the previous year and 2 the year before.

The Spanish DPA, AEPD, was just as active as it was in the previous year. The DPA did not disclose how much money it collected in fines; however, it reported a sharp increase in reported offences. AEPD continued to focus on telecommunications, financial institutions, and video surveillance issues during its investigations. In fact, the financial sector and the telecommunications sector made up the top two spots for fines imposed during the year. The Spanish DPA has also been increasing its activities in the international arena. In addition, AEPD is taking larger leadership role in the Ibero-American Network for Data Protection. During the 31st International Data and Privacy Protection Conference, AEPD made a “Joint Proposal to Draft International Standards for Protection of Privacy and Personal Data” that was unanimously adopted. AEPD is now in charge of developing international standards for the protection of privacy with regard to processing of personal information.

You may read our blog post on the previous year’s report here.

Read More...

Article 29 Working Party Adopts Documents, Deems Israel and Andorra Adequate

The Article 29 Working Party started the new year with a volley of announcements. The Working Party document WP 165 states that Israel guarantees an adequate level of protection and WP 166 states that Andorra has adequate privacy protections. Additionally, the Working Party issued WP168 on “The Future of Privacy: Joint contribution to the Consultation of the European Commission on the legal framework for the fundamental right to protection of personal data.”

WP168 is a response to the Consultation by the European Commission asking for views on whether the EU’s current legal framework was satisfactory for the challenges posed by new technology and shifts in culture since the adoption of the EU Data Protection Directive in 1995. The Working Party, with the cooperation of the Working Party on Police and Justice, state that “the main principles of data protection are still valid despite the new technologies and globalisation.” However, the consultation also proposes that concepts of consent and transparency be clarified, additional principles such as privacy by design and accountability be adopted, bureaucratic burdens be simplified, and that fundamental rights be unified to apply to police and judicial cooperation in criminal matters. This document suggest the direction that European Data Protection is likely to take in the near future.

Read More...

Florida Ethics Opinion Underscores Risks Associated with Social Media for Attorneys

by Mehmet Munur

Florida Judicial Ethics Advisory Committee recently issued an opinion that answered the question “Whether a judge may add lawyers who may appear before the judge as ‘friends’ on a social networking site, and permit such lawyers to add the judge as their friend” in the negative. Though social media can be a valuable tool for any profession, the opinion emphasizes why attorneys should consider the risks involved in contributing to social media. While not mentioned in the opinion, attorneys should also consider other risks associated with listing specialties, receiving client testimonials, and unintentionally forming attorney-client relationships.

Commentators, such as Professor Stephen Gillers (see NY Times Article) have argued that the judges may be oversensitive to judges “friending” attorneys in Facebook, I believe that the opinion is just the beginning in a series of opinion that are likely to highlight related issues that may come up in social media. Before joining LinkedIn, we considered the Ohio Supreme Court’s guidance on some of the issues mentioned above. First, we considered whether we could join such an organization in the first place and be listed as attorneys. Ohio Supreme Court Opinion 88-4, though superseded by the Ohio Rule of Professional Conduct 7.4, stated:

A lawyer may ethically be listed in a legal directory or law list provided the listing does not contain a false, fraudulent, misleading, or deceptive statement or claim.

This opinion probably refers to MartinDale Hubbell listings, which are dominated by attorneys. While LinkedIn is professional in nature, attorneys in no way dominate it. I remember seeing that LinkedIn included about 700,000 attorneys (apologies for the lack of citation) out of their 50 million professionals. Nevertheless, the Ohio Supreme Court opinion highlights issues involved in joining such social media outlets in the first place. Therefore, attorneys must ensure that their listings in any social media do not contain false, fraudulent, misleading, or deceptive statements.

Issues related to attorneys’ specialties may also arise on social networks. The Supreme Court of Ohio only recognizes a few areas of specialization, such as admiralty, trademark, and patent law. Therefore, avoid listing specialties unless you are actually specialized under Rule 7.4. LinkedIn includes a "specialties" section by default field in profiles, which if overlooked, may inadvertently describe an attorney to have specialized in those areas. Therefore, double-check your profile to ensure that you have accurately listed your specialization.

Another cause for concern is client testimonials. While the prohibition against client testimonials have been superseded, Model Rule 7.1 states that a “lawyer shall not make or use a false, misleading, or nonverifiable communication about the lawyer or the lawyer’s services.” Note that the Model Rule, which came into effect in 2007, “does retain the DR 2-101 prohibition on unverifiable claims.” Therefore, “[w]hatever means are used to make known a lawyer’s services, statements about them must be truthful.” The Ohio Supreme Court Opinion 2000-6 further states that:

a law firm’s public communication of client quotations describing the general nature of the legal services provided, responsiveness of the law firm, and other non-substantive aspects of the firm’s representation is improper under the professional rules of conduct. This view is based on the current rules in the Ohio Code of Professional Responsibility and is consistent with ABA Model Rule 7.1, the Comment thereto, and the advice offered by the Board in Opinion 89-24.

Therefore, it may be a good idea to ensure that client testimonials are verifiable to an objective degree or avoid client testimonials altogether.

While the Model Rules are silent on the issue of the formation of an attorney-client relationship, the Restatement Third of the Law Governing Lawyers section 14 provides that:

A relationship of client and lawyer arises when:
(1) a person manifests to a lawyer the person's intent that the lawyer provide legal services for the person; and ...
(b) the lawyer fails to manifest lack of consent to do so, and the lawyer knows or reasonably should know that the person reasonably relies on the lawyer to provide the services

Such an issue may arise while answering LinkedIn questions or a direct inquiry by another Facebook or LinkedIn member. Inadvertent formation of an attorney-client relationship bring with it all of the conflicts issues that an attorney should consider before representing a client.

Therefore, attorneys should double-check their jurisdictions’ ethics guidance to ensure that they are not running afoul of ethical rules that have been in at work for some time but may arise in ways not previously imagined.

See also Legal Blog Watch regarding a related South Carolina opinion regarding law enforcement officials and judges.

You can also find a link to the ABA Model Rules here.

Read More...

Court Rejects Plaintiff’s Argument that Overbroad Privacy Policy Led to Waiver of 1st Amendment Rights

By Mehmet Munur

A federal district court in Missouri ruled on December 9 that the broad website privacy policy of a newspaper did not lead to an anonymous commenter’s contractual waiver of his First Amendment rights. While the case does not break new ground in First Amendment jurisprudence, it emphasizes some of the shortcomings of the self-regulatory system of privacy regulation of the web in the US. Such overbroad privacy policies and underlying practices may be one reason why the FTC is shying away from the Notice-Choice paradigm.

The plaintiff brought a motion to compel in order to reveal the identity of an anonymous commenter, who was not a party to the litigation, for comments posted on a News-Leader article. First, the Plaintiff argued that the anonymous commenter’s speech was not given absolute protection. While the court agreed, it stated that political speech was given high level of protection especially in circumstances where the commenter was not a party to the litigation and dismissed the argument.

Second, the plaintiff argued that the anonymous commenter agreed to the News-Leader’s Privacy Policy during the sign-up process and, therefore, waived his First Amendment rights to anonymous speech. The Privacy Policy stated:

We also reserve the right to use, and to disclose to third parties, all of the information collected from and about you while you are using the Site in any way and for any purpose, such as to enable us or a third party to provide you with information about products and services that may be of interest to you. In some cases we will use and/or share only non-personally identifiable information, but in other cases we may use and share personally identifiable information.

The District Court rejected this argument as well because “a contractual waiver of constitutional rights ‘must, at the very least, be clear.’” Therefore, the District Court declined to reveal the identity of the anonymous poster.

Leaving aside the free speech issues, the case also highlights some of the issues with the current state of privacy regulation on the web in the US. First, FTC’s aspirational Fair Information Practice Principles seek to stop such overreaching privacy policies. The Notice principle, which is “the most fundamental” of the principles, states that the entity collecting the data should “properly inform” consumers “of the uses to which the data will be put” and the “identification any potential recipients of the data.” Therefore, stating that the data transferred to any third party for any purpose does not properly inform a consumer. Nevertheless, this inconsistency does not create any liability because the FIPPs are only guidelines and they are not enforceable. FTC expects the industry participants to regulate themselves and only appears to bring enforcement actions against the most egregious of violators.

In contrast, websites in jurisdictions with omnibus data protections laws, such as the EU, would be hard pressed to implement such privacy policies. The EU Data Protection Directive states in Article 6 that personal data must be “collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.” Since the purposes in the privacy policy are neither specified nor explicit, any further use by the collecting entity or a third party would violate the Directive and its national counterparts.

However, this difference in approaches to privacy regulation may be changing. Commentators and regulators in the EU and the US recognize the shortcomings of the Notice-Choice paradigm and are moving away from it. Recently, in the Madrid International Conference of Data Protection and Privacy Commissioners highlighted some of the issues with Notice-Choice and the need to move towards an Accountability standard. In fact, the regulators signed a document to that effect during the conference. Two weeks later, the Department of Commerce Conference on Cross Border Data Flows, Data Protection and Privacy reiterated the same message—primarily because the attendees were the same people. Finally, just last Monday, several attendees to the FTC Privacy Roundtable highlighted the issues with self-regulation in the US and the need to move to an Accountability standard. In fact, the FTC hinted at the need to refine the current Notice-Choice paradigm with the Sears enforcement action. Given the regulatory momentum, we will likely see the FTC providing more guidance for websites on privacy issues soon after the Privacy Roundtables, at the very least in the behavioral advertising realm.

The case is Sedersten v. Taylor, No. 09-3031-CV-S-GAF, 2009 U.S. Dist LEXIS 114525 (W.D. Mo. Dec. 9, 2009).

See also Venkat Balasubramani’s comments via Eric Goldman’s Blog.

Read More...

Supreme Court to Review Electronic Communications Case

by Mehmet Munur

The Supreme Court will review a 9th Circuit Court case finding that the unauthorized search of employee text messages on an employer provided text messaging pager may have violated the employee’s privacy rights despite a written policy stating that the employees should have no expectation of privacy.

Once again, the Supreme Court’s review of the case highlights the complexity of employee electronic communications in the workplace. With the extensive use of blogging and social media in the workplace, it is becoming more and more important to put in place explicit electronic communication policies and to implement those policies uniformly. You can find our previous blog post on the 9th Circuit Opinion here.

Read More...

Regulators Issue Final Model Privacy Notice

By Mehmet Munur

On November 17, eight federal regulators issued final rules and model privacy notice forms as required under the Gramm-Leach-Bliley Act. While the use of the notice forms are not required, the two-page forms create a safe-harbor for disclosures required under the GLBA.

The notice forms replace the Sample Clauses previously issued by the regulators. The regulators stated that their studies “confirm[ed] that a notice composed solely of the Sample Clauses promotes ease of scanning to perform simple tasks – because the notice is short and not because it is understandable – but the Sample Clauses do not do well on comprehension measures. Moreover, the testing showed that current notices – in which the Sample Clauses are typically embedded – do poorly on all measures.” Therefore, the regulators appear to want to increase the use of the model clauses as much as possible.

The FTC has been pushing for alternate means of providing notice to individuals for some time. The FTC noted in its February 2009 Behavioral Advertising Staff Report that “privacy policies have become long and difficult to understand, and may not be an effective way to communicate information to consumers. Staff therefore encourages companies to design innovative ways – outside of the privacy policy – to provide behavioral advertising disclosures and choice options to consumers.” Then in its recent Sears Enforcement, FTC stated that Sears failed to “disclose adequately that the software application, when installed, would: monitor nearly all of the Internet behavior that occurs on consumers’ computers.” Sears had mentioned the broad nature of data collection only in the 75^th line of a legal agreement. Then in August, FTC once again mentioned the Sears enforcement and the need to provide better notice in the Health Breach Notification Rule; stating “[b]uried disclosures in lengthy privacy policies do not satisfy the standard of ‘meaningful choice.’” FTC will be conducting Privacy Roundtables in the near future. We expect the highlights notices, model privacy notices, and Carnegie Mellon’s Nutrition Label Approach to privacy statements to take center stage in these roundtables.

Read More...