The FTC released two guides on the privacy and security issues related to the Internet of Things. The first is a staff report based on discussions in an FTC-hosted workshop on the subject held on November 19, 2013. In addition to summarizing the workshop discussions, the report contains staff’s recommendations in the IoT space. This prompted a FTC Commissioner (Joshua Wright) to dissent from the decision to issue the report. In Commissioner Wright’s view, it is premature to publish staff recommendations in this area without further research, data, and analysis. The dissenting statement can be found here.
The report discusses the benefits of IoT as well as three risks:
- enabling unauthorized access and misuse of personal information;
- facilitating attacks on other systems; and
- creating risks to personal safety
The report also discusses Fair Information Practice Principles including security, data minimization, notice, and choice. Click here to read the full report.
Along with the staff report, the FTC issued a guide called “Careful Connections” that provides recommendations on building security into IoT applications. Download the guide here.
Suppose an email from your company’s in-house attorney instructs you to preserve all documents relating to an ex-employee who is threatening to sue for wrongful termination. In the days before smartphones and cloud storage, this would have been a relatively limited exercise: paper documents would be set aside and files on the company server would be backed up. But work-related data can be stored in many places today, including personal devices of employees. Is a company required to preserve such data?
Costco Wholesale recently faced that issue in an employment discrimination and retaliation lawsuit. See Cotton v. Costco Wholesale Corp., 2013 WL 3819974 (D. Kan. July 24, 2013). The plaintiff asked Costco to produce text messages on the personal cell phones of two of its employees who mentioned the plaintiff or his allegations. Costco objected on the grounds that the discovery request required it to invade the privacy of its employees, and there was no indication that the employees sent inappropriate text messages or used their personal phones for work purposes. The court denied the request, determining that Costco did not have possession, custody, or control of the text messages.
Although the court in the Cotton case ruled that the employer had no duty to produce information stored on the personal devices of the employees in question, the outcome might have been different if the facts had changed even slightly. Courts in other jurisdictions might also have taken a contrary approach.
The law in this area is far from clear, but following the guidelines below will help a company address e-discovery issues in their policy on personal electronic devices. An easy way to remember the guidelines is to think of the acronym “APPS”:
- Access: Reserve the right to access personal devices that store work-related data. Access is crucial if the company is legally required to collect and produce data residing in the personal devices of an employee.
- Permission: Clearly specify what personal devices employees are authorized to use for work-related purposes, if any. Consider keeping a log of authorized personal devices and require employees to update the log whenever they start using a new authorized device or retire an existing one. Your company’s document retention policy should extend to authorized devices.
- Privacy: Notify employees that they should have no expectation of privacy to data stored on a personal device if they use the device for work purposes. This prevents the company from being liable for invasion of privacy should it need to search the contents of a personal device to respond to a discovery request.
- Segregation: If possible, segregate work-related content from personal content on personal devices. Segregation can be implemented with software solutions, but if that is not feasible, at a minimum, instruct and train employees who use a personal device for work on how to keep their personal information separate from work data stored on the device. For example, storage of work-related data in a personal cloud storage account should be prohibited.
Follow the above guidelines to avoid getting caught off-guard by e-discovery requests.
(Photo credit: Wikipedia)
“Smile, you’re on Candid Camera.” Originally coined on the eponymous TV show, that catchphrase is becoming more of common refrain in the workplace. Any employee with a smartphone can easily record an office conversation in secret. But are such covert recordings legal? And what control, if any, does management have over the making of such recordings?
The Law of Recording Face-to-Face Conversations
A majority of states (approximately 37) follow the one-person consent rule for recording face-to-face conversations. This rule authorizes the recording of a conversation so as long as one person in the conversation consents. The consenting party can also be the person recording the conversation. Practically speaking, this means it is legal to record a conversation with another person without his or her knowledge.
Most other states require the consent of all participants in the conversation. Covert recording of face-to-face conversations would not be permitted in states that follow the all-party consent rule.
Workplace Bans on Covert Recordings
Even if covert recordings are legal, management may regulate the practice if done so consistently with the right of employees to engage in concerted activity, which is protected under Section 7 of the National Labor Relations Act (NLRA). A recent National Labor Relations Board decision illustrates this. Whole Foods Market, Inc., Case No. 01-CA-096965 (Oct. 30, 2013). The case involved a challenge to a company policy that banned employees from recording conversations without prior management approval. The company’s stated purpose for the policy was “to eliminate a chilling effect to the expression of views that may exist when one person is concerned that his or her conversation with another is being secretly recorded.”
The administrative law judge (ALJ) in the case upheld the policy. The ALJ noted that there is no protected right to record conversations in the workplace, but even if there were such a right, management may regulate the exercise of that right. It was not adopted in response to union activity, and it was clearly tied to the company’s core value of fostering open and honest dialogue about company matters. The ALJ disagreed that the policy could reasonably be interpreted as a restriction on using social media to communicate and share information about work conditions through video recordings made at the workplace. The policy regulated a means of communication as opposed to the protected activity itself. It also did not prohibit employees from making recordings during non-work time. The policy therefore did not violate Section 7 rights.
The Whole Foods Market decision suggests questions that management should consider when drafting a work rule against covert recordings to ensure that the rule does not violate the NLRA:
- Is the rule clearly linked to a purpose besides preventing employees from engaging in Section 7 activity?
- Does the rule leave open alternative channels for employees to communicate about Section 7 activity?
- Does the rule allow employees to make recordings during non-work hours?
A ban on covert recordings is more likely to withstand a legal challenge if management can answer “yes” to each of these questions.
Supervisor snoops into former employee’s personal Gmail account after she returns company-issued Blackberry — Lazette v. Kulmatycki, 2013 WL 2455937 (N.D. Ohio June 5, 2013)
The line between personal and business use of electronic devices is increasingly getting blurry, especially as more and more workers carry dual-use devices (devices designed for both work and personal use) like smartphones and tablets. Businesses can benefit from the increases in productivity and morale resulting from this trend, but they also face new privacy concerns. The recent case of Lazette v. Kulmatycki (N.D. Ohio June 5, 2013), highlights this risk.
Verizon issued a Blackberry smartphone to its employee, Sandi Lazette. Lazette set up a personal Gmail account on the phone with Verizon’s permission. Lazette returned the Blackberry to her supervisor when she stopped working for Verizon, understanding that the phone would be “recycled” for use by another Verizon employee. Lazette thought she had deleted her personal Gmail account before returning the phone, but she had not. Over the next eighteen months, Lazette’s supervisor read 48,000 emails in her Gmail account without her knowledge or authorization, and shared the contents of certain emails with others.
Lazette sued Verizon and her supervisor for claims including violation of the Stored Communications Act (SCA) and invasion of privacy. A federal court ruled that Lazette’s supervisor was potentially liable under the SCA for reading personal emails that Lazette had not previously opened, and that Verizon could be vicariously liable for the supervisor’s actions. The court also allowed Lazette’s privacy claim to move forward.
LegalTXTS Lesson: Lazette teaches important lessons about protecting the privacy of personal employee data on work devices, including dual-use devices.
1. Don’t read your employees’ personal messages—even if they are readily accessible. Management should treat an employee’s personal account as private, even if restrictions to accessing the count are minimal or non-existent. A person does not need to hack into an account or otherwise circumvent access restrictions to electronic communications to be liable under the SCA. Lazette’s Gmail account was accessible to her supervisor for no reason other than the fact that Lazette failed to delete her account from her Blackberry. Yet, the court ruled that Lazette’s negligence did not give her former employer implied consent to read her private emails. The simple act of opening an unread message in an employee’s personal email account was enough to create liability under the SCA.
2. Construe grants of access narrowly. If an employee allows a supervisor access to his or her personal email account for work purposes, that is not a grant of access to everything in the account. In Cheng v. Romo (D. Mass. Nov. 28, 2012), an employee of a medical imaging company gave his supervisor the password to his Yahoo! email account. Although the employee did not attach conditions to sharing the password, his unstated objective was to share radiologic images that were emailed directly to him. Years later, the supervisor logged into the account to read emails about the status of the company. In the lawsuit that followed, the court allowed the employee’s SCA and invasion of privacy claims to go to trial. Cheng teaches that management should err on the side of preserving privacy if given access to an employee’s private online account for a specific work purpose or no stated reason at all.
3. Thoroughly purge personal data from company-issued electronic devices before reusing them. Companies commonly reuse electronic devices (e.g., desktop and laptop computers, cell phones, PDAs, tablets) for work purposes after it has been returned or repaired. Employees can leave behind personal data on devices such as saved passwords, emails, web history, internet cookies, and the like. Set and enforce policies requiring the purging of all such data from electronic devices before the devices are issued to another employee.
4. Clarify employee expectations of privacy upfront if implementing mobile device management (MDM) tools. One measure for mitigating the risk of security breaches relating to dual-use mobile devices is the use of MDM tools controls such as the ability to “remotely wipe” a device should it get lost or compromised. MDM measures could raise privacy concerns if they result in alteration or destruction of personal data on a dual-use device. To mitigate such concerns, a company should devise policies clarifying upfront the expectations to privacy that employees should to have if they choose to use a dual-use device at work.
Creative Commons image courtesy of Daigo Oliva on Flickr
The Hawaii anti-paparazzi bill eponymously named after its chief supporter is back after getting an extreme makeover, and it just took another step toward becoming law in Hawaii. The Senate Judiciary Committee has recommended passage of a revised version of the Steven Tyler Act (SB426, S.D. 1). The revised bill is a big improvement from the original version. It goes a long way toward remedying the problems discussed in my previous post on the Act, and now it looks much more like the California statute after which it was patterned. But despite the revisions, the Act remains quirky in some ways, and it still doesn’t answer the question of why we need a brand-new privacy law.
Here are the highlights of the revised bill. The revised bill:
- creates an actual tort for constructive invasion of privacy, not just one in the name. The original bill tried to create a constructive invasion of privacy tort, but the parameters of the tort were not well-defined.
- defines certain concepts that are key to liability under the Act, like “personal and familial activity.”
- makes it very difficult to impose liability on those publicizing or selling images or sound recordings that were captured in violation of the Act.
- carves out exceptions to liability, including one for law enforcement activities.
- creates a fairly novel process for raising a defense against invasion of privacy claims in court based on the First Amendment or its counterpart in the Hawaii State Constitution.
Now, let’s look at some of the features of the revised bill in greater detail.
Constructive Right of Privacy
The revised bill creates two types of invasion of privacy, one physical in nature and the other constructive. Both require an intrusion into land owned or leased by the plaintiff. This is an important revision because it gets rid of the “taking pictures at the beach” scenario (i.e., why should a celebrity complain about invasion of privacy if her picture is taken on a public beach?)
An intrusion, however, does not necessarily require a physical trespass onto the plaintiff’s property. Spying and eavesdropping could constitute intrusion, but does not necessarily involve a physical trespass. The tort of constructive invasion of privacy accounts for this distinction, stating that non-physical intrusions will be treated as invasions of privacy. The use of “visual or auditory enhancing devices” to probe into the plaintiff’s private affairs, regardless of whether it involves a physical trespass, counts as an invasion of privacy. That’s how constructive invasion of privacy works.
The original bill bungled the concept of constructive invasion of privacy by not tying liability to the use of visual or auditory enhancing devices. The revised bill fixes that problem.
“Personal and Familial Activity”
The original bill left out definitions of key concepts. A notable one was “personal and familial activity,” which is what the plaintiff must have been engaged in when the defendant captured images or recordings of him or her. The original bill did not define the term. The revised bill adopts the definition used in the California anti-paparazzi law.
Having a definition rather than none is a step in the right definition, but the definition is still too vague. The revised bill defines “personal and familial activity” as “intimate details of the plaintiff’s personal life, interactions with the plaintiff’s family or significant others, or other aspects of the plaintiff’s private affairs or concerns.” What range of activities does “the plaintiff’s private affairs or concerns” include? The revised bill doesn’t say.
Liability of Sellers of Images and Recordings
One criticism of the Act was that it punishes sellers of images or recordings of celebrities. The Act imposes liability on those who sold images or recordings that were captured in violation of the Act if they had “actual knowledge” of the violation and received compensation for the rights to the images or recordings. One problem of the original bill is that “actual knowledge” was not defined, so the level of intent needed to trigger liability wasn’t clear. The revised bill remedies that problem by defining “actual knowledge.” The definition requires “actual awareness, understanding, and recognition” that the image or recording was taken or captured in violation of the Act. That’s difficult to prove.
But the revised bill goes one step further in limiting publisher and seller liability. The plaintiff has the burden of establishing actual knowledge by “clear and convincing evidence.” This is the highest standard of proof in a civil matter (just below the “beyond a reasonable doubt” standard in criminal cases).
The plaintiff’s burden to prove the liability of publishers and sellers is reminiscent of the “actual malice” standard applicable in libel cases brought by a public official or public figure. In other words, the revised bill makes it very, very difficult to prove publisher and seller liability.
The revised bill also makes clear that there is no derivative liability for publicizing or selling an image or recording if it had been previously publicized or sold before without violating the Act.
Exceptions to Liability
The revised bill creates exceptions to liability, most notably for activities relating to law enforcement and investigation into illegal conduct. The revised bill also clarifies that the Act does not preclude suits for other legal or equitable relief under other theories, including the Hawai‘i anti-SLAPP law or a claim for publication of private facts.
First Amendment Defense
Perhaps the most interesting feature of the revised bill is an expedited process for handling defenses based on the First Amendment or its Hawaii counterpart, i.e., Hawaii Constitution, Article I, Section 4 (the revised bill does not cite specifically to Section 4, which is the section that parallels the First Amendment, so the expedited process apparently applies to a defense based on any portion of Article I is raised). The basic idea is to give first priority to resolving questions of the constitutionality of enforcing the Act in a particular situation.
Here’s how the expedited process works. If the defendant files a motion to dismiss a claim for violation of the Act based on First Amendment/Article I grounds, the case basically comes to a halt until the motion is decided. The court cannot look outside the allegations in the pleadings to decide the motion, and all discovery is suspended until the motion is decided. The court must hold a hearing and rule on the motion on an expedited basis. If the court denies the motion, the defendant may immediately appeal the denial.
The revised bill also flips the burden of proof. When the defendant files a motion to dismiss based on a First Amendment/Article I defense, the plaintiff has the burden to prove that, more likely than not, the plaintiff’s “claim is [not] barred by a defense based on the First Amendment of the United States Constitution or article I of the Hawaii State Constitution” (note that the quoted language in the revised bill omits the word “not”; that’s probably a typo). If the defendant wins the motion, it can recover damages, attorneys’ fees, costs, punitive damages, and other sanctions against the plaintiff and even the attorneys and law firm representing the plaintiff.
Thoughts on the Revised Bill
The revised bill is much better than the original version. I’m still not convinced, though, that the solution to the problem of overzealous paparazzi is a new law. Hawaii already recognizes the privacy tort of inclusion into seclusion, and that seems to cover the type of intrusion addressed in the concept of “constructive invasion of privacy.” The tort of intrusion into seclusion does not require a physical invasion into the plaintiff’s personal space. The use of visual or auditory enhancing equipment to remotely gain access to the plaintiff’s private affairs would seem already covered under existing law. Creating a new law to deal with the issue would add little new benefits while potentially creating more problems.
Take the expedited process for dealing with First Amendment issues, for example. According to a Standing Committee Report, the expedited process was created in response to constitutional concerns about the Act. As a lawyer who represents media defendants, I welcome extra procedural protections for airing out First Amendment issues. But I do think the expedited process is somewhat sloppy. The process gives too much incentive to a defendant to respond initially to a Tyler Act claim with First Amendment defenses, even unmeritorious ones. The defendant has nothing to lose and everything to gain by using such a tactic. By filing a motion to dismiss on First Amendment grounds, the defendant can freeze discovery in the case, shift the burden of proof to the plaintiff, and potentially reap the benefit of recovering fees, costs, and damages from the plaintiff, his or her attorney, and even the attorneys’ law firm! There are few circumstances in which a defendant should not raise a First Amendment defense. And on the flip side, true victims of constructive invasion of privacy might think twice before suing under Tyler Act due to the risks involved. Which again begs the question: Do we really need the Tyler Act?