Data Privacy Archives - Page 21 of 35

Data Privacy

Are Your Robocalls Legal? Following Federal Law May Not Be Enough

by McDermott Will & Emery | Dec 5, 2013 | Advertising & Marketing, Consumer Protection, Data Privacy

Last week’s Seventh Circuit ruling in Patriotic Veterans v. State of Indiana confirms that businesses should check both federal and state laws before using automatic dialing systems (ATDS) to deliver prerecorded or synthetic voice messages known as “robocalls”.

The Telephone Consumer Protection Act (TCPA) is a federal law that generally prohibits robocalls to residential telephone lines without the prior express consent of the party receiving the call. However, calls that are not made for a commercial purpose, including calls made for political purposes, are exempt from the TCPA.

The TCPA contains a preemption clause that states “nothing in this section . . . shall preempt any State law that imposes more restrictive intrastate requirements or regulations on, or which prohibits:

the use of automatic telephone dialing systems;
the of artificial or prerecorded or prerecorded voice messages;” (emphasis added)

Notably, the State of Indiana’s Automated Dialing Machine Statute imposes “more restrictive” requirements, because while it does have some limited exemptions, it does not contain the TCPA’s exemption for political calls.

In Patriotic Veterans, an Illinois based non-profit sought to make robocalls for political purposes across state lines to Indiana residents. Not wanting to pay for the live callers that would be required under the Indiana law, Patriotic Veterans filed a complaint in federal court against the State of Indiana and the Indiana Attorney General, seeking a declaration that the Indiana law was, among other things, pre-empted by the TCPA.

The District Court agreed with Patriotic Veterans, holding that the TCPA preempted the Indiana statute and granting Patriotic Veteran’s request for an injunction against enforcement of Indiana’s law with respect to political messages, but stayed the injunction pending the appeal.

The Seventh Circuit Court of Appeals reversed. The Court concluded that there was no express preemption in the statutory language because “the TCPA says nothing about preempting laws that regulate the interstate use of automatic dialing systems. Therefore, we must conclude that they are not preempted. The plain language of the text reinforced by the presumption against preemption prevents this court from looking any further[.]” The Court further concluded that there was no implied preemption for two reasons: (1) the federal regulatory scheme is not so pervasive or dominant as to make clear that Congress intended to occupy the entire legislative field, and (2) it is possible to comply with both laws (even if inconvenient or expensive for Patriotic Veterans).

What Does This Mean for Businesses?

The ruling in Patriotic Veterans further confirms that mere compliance with the TCPA is not enough. Courts are unlikely to strike down state laws that are more restrictive than the TCPA, so it is important for businesses that are developing a robocalling strategy to check the laws of the states where they plan to contact residents. Any such strategy should include a plan to comply with both the TCPA and the applicable state law requirements.

Safe Harbor: Still Alive, Well and Producing Corporate-Wide Privacy Management Programs

by McDermott Will & Emery | Nov 26, 2013 | Data Privacy, Data Transfers/Safe Harbor/Privacy Shield

More than 4,000 U.S.-based multinational companies have selected the U.S. – E.U. Safe Harbor Program as the preferred compliance mechanism for international data transfers from the E.U. to the U.S. Recent transatlantic surveillance politics between the European Union and the United States have, however, focused a controversial spotlight on the Safe Harbor Program. In the world of international personal data transfer regulation, the Safe Harbor Program has become a cause célèbre in the E.U.-U.S. trade discussions and in political commentary by E.U. data protection regulators. Despite the political wrangling, European data protection officials are unlikely to eliminate the benefits of the Safe Harbor Program without offering an alternative program that recognizes the work of companies in implementing E.U.-compliant data protection programs.

For more information on this subject, see “EU Privacy Safe Harbor Still Alive and Well, With Implications for Enterprise Risk Management,” written by Ann Killilea and published by Thomson Reuters Practical International Corporate Finance Strategies, November 15, 2013.

Consumer Data Privacy Update for Marketers, Part 2: New Telemarketing/Text Message Marketing Rules Effective October 16, 2013

by McDermott Will & Emery | Nov 21, 2013 | Advertising & Marketing, Consumer Protection, Data Privacy, Ecommerce, Mobile Apps, Promotions, Sweepstakes & Contests, Text Messaging

The Federal Communications Commission (FCC)’s Report and Order 12-21 (Order 12-21), issued in February 2012, describes revised telemarketing rules that became effective during the past 12 months.

The FCC’s telemarketing rules are issued under the Telephone Consumer Protection Act (TCPA) and apply to a telephone call to a residential landline or wireless number or a text message that is initiated for advertising or telemarketing purposes and uses an “automatic telephone dialer system” (ATDS) or an “artificial or prerecorded” voice message.

The three major changes implemented during the past year are:

(i) Abandoned calls rule effective November 16, 2012: Telemarketers must ensure that no more than three percent of calls answered by a person are “abandoned” (i.e., not answered by the telemarketer within two (2) seconds after the called person answers) during a 30-day calling campaign period;

(ii) Opt-out mechanism effective January 14, 2013: Artificial or prerecorded telemarketing messages must include an automated, interactive mechanism that enables the called person to opt out of receiving future prerecorded messages; and

(iii) Prior express written consent rule effective October 16, 2013: “Prior express written consent” (as described below) of the called person is required[i] for:

telemarketing calls to a wireless telephone number when an artificial or prerecorded message or ATDS is used;
telemarketing text messages sent using an ATDS; or
telemarketing calls to a residential landline telephone number using an artificial or prerecorded message.

“Prior express written consent” means a written agreement signed by the called person that clearly authorizes delivery of advertising or telemarketing messages using an ATDS or an artificial or prerecorded voice message and clearly states that agreeing is not a condition of buying any product or service. A written agreement may be “signed” electronically using any method recognized under the federal Electronic Signatures in Global and National Commerce Act (E-SIGN Act) or applicable state contract law. The E-SIGN Act recognizes a signature as an “electronic sound, symbol or process” that is “attached or logically associated with” an agreement and “adopted by a person with the intent to sign.”

Although industry standards have required express opt-in consent for recurring text messaging programs prior to implementation of the FCC’s prior express written consent rule, consent obtained under the old regulatory framework is not sufficient under the new FCC consent rule because (among other requirements) the “agreement” to which the consumer consents (i) must include reference to use of automated technology and (ii) “must be obtained without requiring, directly or indirectly, that the agreement be executed as a condition of purchasing any good or service.”

Action Step for Marketers: Obtain New Opt-in Consent for Telemarketing and Mobile Marketing

Obtaining new opt-in consent consistent with the requirements of the new FCC consent rule is best practice because the sender bears the burden of proving that it has obtained prior express written consent that meets the FCC standards. Relatedly, implementation of a record-keeping system through which evidence of compliant consent is retained for at least three years (i.e., the statute [...]

Continue Reading

Welcome to McDermott’s Of Digital Interest Blog

by McDermott Will & Emery | Nov 19, 2013 | Advertising & Marketing, Big Data, Consumer Protection, Data Privacy, Social Media

Welcome to McDermott’s Of Digital Interest blog!

The global digital economy continues to rapidly expand and we can only imagine where technological innovation will take us next. Every day companies are developing new and exciting ways to leverage the Internet and digital connectivity to make businesses more efficient, improve individual outcomes, facilitate customer engagement and maximize the power and value of data.

At the same time, privacy, data security, digital advertising and online consumer protection continue to be among the fastest growing areas of the law around the globe. In the digital realm, jurisdictional lines can be crossed in nanoseconds, and this compounds compliance challenges. With more than 50 attorneys in our group around the world, McDermott’s international, multi-disciplinary team of lawyers work hard to keep abreast of important developments and trends so we can help our clients meet those challenges.

This blog is the natural extension of those efforts and it is designed to provide legal professionals and risk managers with practical insights into regulatory developments, industry trends and current issues impacting the digital environment. From major developments in privacy and data security, to new strategies for legitimizing cross-border data transfers, to coverage of hot topics like user tracking and geolocation, and the latest trends in the specialized field of online advertising, internet promotions and beyond, we expect that this blog will serve as a trusted resource for professionals who are responsible for managing data and compliance in the digital age.

We hope you find Of Digital Interest to be both interesting and helpful and we welcome your feedback. If you have questions or topic suggestions, please let us know via the “Contact Us” form or feel free to reach out to one of the editors directly.

Heather Egan Sussman and Rohan Massey
Co-chairs, McDermott’s Privacy and Data Protection Practice

Consumer Data Privacy Update for Marketers, Part 1: Children’s Online Privacy Protection Act Amendments

by McDermott Will & Emery | Nov 19, 2013 | Advertising & Marketing, Big Data, Consumer Protection, Data Privacy, Email/Spam, Mobile Apps, Social Media

New technologies enable marketers to collect and analyze more — and more specific— data than ever before. Marketers can track consumers across the internet and mobile applications, and can deliver advertising based on consumers’ interests inferred from the collected data. In theory, consumer tracking enables marketers to present advertising to consumers who are predisposed to a specific product or service, producing a higher purchase rate and transaction price, and a greater return on investment in marketing activities.

While these new technologies make advertising and marketing more targeted and efficient, they also present new challenges for marketers. Although a majority of consumers understand the “pay with data” model through which websites, mobile applications and other digital services are made available at no cost, they do not want advertisers to track them or to aggregate the tracking data into so-called “big data” databases. Consequently, consumer digital privacy has been the subject of many recent news articles – from lawsuits filed by consumers against email service providers and social media platforms for undisclosed data mining to senatorial requests to data brokers for transparency.

In this four-part series, we will highlight of some recent developments in consumer data privacy law and suggested steps for marketers on how to address them.

Children’s Online Privacy Protection Act Amendments

The Children’s Online Privacy Protection Act (COPPA) is a federal statute enacted in 1998 that requires operators of commercial digital services to provide parental notification and obtain verifiable parental consent prior to collecting personal information from children under 13. To implement COPPA, the Federal Trade Commission (FTC) issued a set of regulations known as the Children’s Online Privacy Protection Rule (COPPA Rule). On December 19, 2012, the FTC released amendments to the COPPA Rule which became effective July 1, 2013.

The amended COPPA Rule enhances online privacy protection for children and makes digital services’ operators more accountable for data collection activities involving children under age 13. Notable for marketers is a new liability standard for third-party service providers. Specifically, effective July 1, 2013:

The operator of “children-directed” (i.e., intended for children under age 13) online or mobile websites and services is strictly liable for actions of independent third parties – including social media plug-ins – on/through its website and mobile services if the third party is acting as its agent or service provider or if the operator benefits by allowing the third party information collection; and
A software plug-in, ad network or similar party that collects information on or through a third-party’s online or mobile website or service now is liable under COPPA if that party has actual knowledge it is collecting personal information on a children-directed platform.

The amended COPPA Rule makes several other key changes to the original COPPA Rule, including:

An expanded definition of personal information to include geo-location information, a child’s photo or audio or video file, screen or user names, and persistent identifiers, such as information held in a cookie, an IP address, a mobile device [...]

Continue Reading

Italian Data Protection Authority Releases New Guidelines and Requirements for Customer Call Centres Based Outside the European Union

by McDermott Will & Emery | Nov 14, 2013 | Data Privacy, Data Transfers/Safe Harbor/Privacy Shield

New legal requirements have been introduced as part of the Italian Data Protection Authority (IDPA) guidelines on the processing of personal data by call centers based outside the European Union.

One of the most significant changes is that companies wishing to operate their customer care services via call centres based outside the European Union will now be required to notify the IDPA in advance.

The new guidelines have been put in place in order to establish specific rules to manage the use of call centers, which have become increasingly popular with companies in the past few years, primarily because of their perceived efficiency and cost-savings advantages.

Many companies have adopted the call center approach for their customer service operations, which necessitates the transfer, processing and storage of personal data. When the call centre is based, and its operations are carried out, outside the European Union, there is an increased risk to the security of this data.

For this reason, the guidelines require that the Data Controller, i.e., the company based in Italy that is operating its customer services through a call centre outside Italy,

Adopts at least one of the mandatory approaches to legally transferring personal data outside the European Union, e.g., Safe Harbor, Standard EU Commission Clauses or binding corporate rules
Implements specific security measures to prevent the risk of loss, theft or unlawful processing of personal data.

The guidelines outline specific structures and features for customer services management systems and provide detailed precautions to be applied to communications equipment used by call centre personnel.

Once the guidelines have been published in the Italian Official Gazette, any company wishing to locate its customer care or call centre services outside Italy will be required to file a notification with the IDPA. The IDPA might prescribe specific requirements with which the company will have to comply in order to obtain permission, or give recommendations aimed at ensuring ongoing compliance. There will be a specific procedure and paperwork for applying for permission and complying with the IDPA’s requirements.

Companies that already operate customer services through call centres based outside the European Union will be required to notify the IDPA within 30 days of the publication of the guidelines in the Italian Official Gazette.

To Track or Not to Track

by McDermott Will & Emery | Nov 13, 2013 | Advertising & Marketing, Consumer Protection, Data Privacy, Mobile Apps, Social Media

October 21, 2013 Digital advertising based on tracking users’ interests and related privacy concerns have been the subject of many recent news articles. What does this mean for businesses? Evolving industry practices and new legislation relating to online privacy and user tracking likely require changes to online privacy practices and policies.

To read the full article, click here.