The Legal and Regulatory Implications of Internet Privacy

Pillsbury Winthrop Shaw Pittman LLP and Protiviti presented a webinar on the legal implications of social networking. These are my notes.

Rocco Grillo of Protiviti started off the presentation. Social networks have become part of many people’s day-to-day work. They have not replaced email, but are still robust communication tools. The first presenter offered the example of a Fortune 500 Company that wanted to shut down access to several social networking sites and make the use of them during working hours as a terminable offense. They found out that their human resources group used Facebook extensively as part of their recruiting program.

He moved on to social networking risks, pointing out the ability of these sites to include trojans or viruses to computers. (Although he did not offer any examples of how they offer any more of threat than other websites.) Rocco emphasized the importance to create policy and work with your company to craft one that takes into account how people in your organization uses these tools. Use of the sites is not an IT decision. You need to work with a larger group of stakeholders.

He noted the ability of profile spoofing on these sites. How do you know that the person behind that profile is that person? Avoid publishing common verification information like your date of birth or mother’s maiden name. Rocco shared some other scare stories.

Rocco did move on to balancing the risks with the benefits of the tools. Shutting down social networks does not remove the risks. You need a balanced strategy. These are powerful tools, but you need to make people aware of some of the risks.

Ben Duranske took over next. He is part of Pillsbury’s virtual worlds and video games practice. He pointed out that besides Second Life, many of these virtual worlds are pitched towards kids. Sites like Webkins and Club Penguin target a younger audience than Second Life. The roadblocks for virtual worlds are bandwidth, processing power, and ease of access. Since they are proprietary, virtual worlds are walled gardens and there is no standardization. These sites allow users to create things. There are real dollars involved and real money. The Terms of Service of these sites largely concede ownership of your content to the site and allow them to disclose lots of the information. They are very willing to respond to subpoenas requested the revelation of user identities.

Ben laid out some key concerns regarding privacy in mainstream virtual worlds and games:

• Violation of Export Restrictions
• Loss of Trade Secret Protection
• Inadvertent Privacy Policy Violations
• Destruction of Confidentiality Protections

He pointed out that he does not communicate with client in virtual worlds regarding their cases.

Since many of these sites are targeted at kids, you need to make sure you comply with the requirements of Children’s Online Privacy Protection Act (COPPA).

Wayne Matus of Pillsbury moved on to cloud computing. Your information and the things you are doing are not happening on your computer or server, but are actually somewhere else. He pointed out four principal types of cloud computing:

• Internet-based services
• Infrastructure as a service
• platform as a service
• software as a service

Why should lawyers care? The Fourth Amendment. It is not clear if those protections apply to cloud computing. Every man’s house is his castle. But is your piece of the cloud part of your castle? Do you have a reasonable expectation of privacy for this information up in the cloud?

In United States v. Miller, 425 U.S. 435 (1976), the Supreme Court held a government’s demand on a bank did not affect any 4th Amendment interest of its customer. In United States v. Ziegler (2007), the United States Court of Appeals for the Ninth Circuit acknowledged that an employee has a right to privacy in his workplace computer. The court also found that an employer can consent to searches and seizures that would otherwise be illegal.

You need to comply with the Patriot Act. You have some uncertainties as to what jurisdiction applies. You may not know where you information actually exists. There are lots of complex laws that limit the flow information: HIPPA, Tax returns, Attorney-Client privilege, Electronic Communications Privacy Act, Fair Credit Reporting Act, etc. Part of the problem is that many of the contractual agreements with the cloud computing providers do not adequately address many of these issues.

Wayne offered up some things to include in the terms of service:

• Use of data
• Location of data
• Encryption
• No change of terms
• Destruction
• Ownership (assignment)
• Subpoena
• Audit rights