data reg test 1

privacy

the right to be left alone

UDAP

unfair or deceptive acts or practices

3 parts of deception

a representation or omission, material to the consumer, likely to mislead

what makes a practice unfair?

injury must be: substantial, without offsetting benefits, one consumers cannot reasonably avoid

what makes a practice deceptive?

a material statement or omission likely to mislead consumers

injunctive relief

stop behavior

civil penalties

money paid to the government

false light

misrepresenting someone publicly in a highly offensive way

five types of privacy rights

information, access, data portability, correction, to be forgotten

data breach

the unlawful and unauthorized acquisition of personal information that compromises the security, confidentiality, or integrity of that information (legal governance, and business strategy problem)

personal information

defined by state law, but typically includes name, SSN, driver's license number, account number, credit or debit card number, etc.

reasonable security standard

basis for governing statutes of data privacy, judged after the fact in litigation or enforcement

administrative controls (before a breach)

governance, hiring/access/termination policies, ongoing training

physical controls (before a breach)

facility/device security, disposal, BYOD risks (mixing personal and corporate data onto a single device)

technical controls (before a breach)

authentication, encryption, Intrusion Detection Systems, firewalls, patching

third-party risk management (before a breach)

vendor contracts, access review, breach notification clauses

steps after a breach

containment, fix vulnerabilities, notification

five FTC model letter of notification complaints

what happened, what information was involved, what the company is doing in response, what steps individuals should take to protect themselves, credit monitoring offer

mandatory arbitration clause

requires disputes to go through private arbitration instead of court, used in Equifax breach

data brokers

companies that collect, aggregate, analyze, and sell personal info about people with whom they have no direct relationship

what do data brokers use to collect data?

census records, motor vehicle records, court filings, property records, voter registration, purchase histories, etc.

what do profiles of data brokers include or look like?

age, height, race, gender, etc.; people with HIV, people with dementia, etc.

GDPR effect

the benefits Americans reap due to stricter regulation in the EU (downstream benefits)

strict liability

do not need to have intent to cause harm to be held liable

torts

harms/injury

four components of prosser's theory of privacy torts

1. intrusion upon seclusion

2. public disclosure of embarrassing private facts

3. publicity which places the plaintiff in a false light in the public eye

4. appropriation of the plaintiff's name or likeness for the defendant's advantage

how has the use of torts in privacy law changed?

historically was the strongest legal tool, but is now limited because brokers rely on "public" data, we consent disclosure or sharing, no more physical space to intrude, and data is normally "true"

what is now the best way to protect privacy?

regulation reform

what are the three key actors in class action lawsuits?

lead plaintiff, class members, defendant

what are the four necessary elements of class action lawsuits?

numerosity, commonality, typicality, adequacy

numerosity

so many victims, it would be inefficient or impossible for courts to handle separate trials

commonality

all victims must share the exact same legal issue; the court must be able to solve everyone's problem with one answer

typicality

the lead plaintiff's story must be like everyone else's

adequacy

the lead plaintiff and their lawyers must be capable of protecting the interests of the whole group fairly

FTC

federal trade commission

what is the FTC's mission

protect the public from unfair/deceptive practices and unfair competition

what is the FTC

a regulatory agency that brings public law actions regarding antitrust, consumer protection, and UDAP

what is the makeup of the FTC?

five commissioners, appointed by the president, confirmed by the senate; one selected by president to serve as chair, bipartisan representation required

what tools can the FTC utilize?

law enforcement, advocacy, research, education

how does the FTC enforce the law?

1. learns of a practice via a filed claim or public domain

2. investigates (may include subpoenas for testimony/evidence)

3. administrative law trail (with ALJ)

4. decision may be appealed to the commissioners, then to Fed District Court

penalties the FTC can use

civil penalty, consent decree

civil penalty

monetary for each violation and each day of noncompliance

consent decree

company doesn't admit fault but agrees to change practices

five types of data problems

1. confusion of people with similar names

2. biased or one-sided info

3. malicious gossip and hearsay

4. computer errors

5. incomplete info

purpose as defined by FCRA

reasonable procedures meeting the needs of commerce fairly and equitably to consumers, regarding confidentiality, accuracy, relevancy, and proper utilization

consumer report as defined by FCRA

any communication bearing on credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living

alternative credit scoring

incorporates cash flow signals such as income inconsistency, bill, and rent payments, and spending patterns; is pitched as a social justice reform but is really not

issue of CFPB withdrawal of guidance docs

based on opposition to sub-regulatory guidance, not substantive disagreement, no replacements; withdrawn because of arguments of federal agency overreach

CFPB

Consumer Financial Protection Bureau

individual right of action FCRA vs. GLBA

right to sue

FCRA: yes, for both negligent and willful violations

GLBA: no, enforcement left to federal regulators, state insurance authorities, state AGs, and FTC

preemption FCRA vs. GLBA

can states pass more privacy protective laws

FCRA: no, since FACTA blocks states passing more protective laws

GBLA: yes, acts as floor

15 USC Section 45

unfair methods of competition in or affecting commerce, and unfair or deception acts or practices in or affecting commerce, are hereby declared unlawful

state-led privacy torts

1. intrusion upon seclusion

2. public disclosure of private facts

3. false light

4. appropriation of name or likeness

ACRO rights

access, rectification, cancellation, opposition (Latin America)

state level data breach reporting requirements

notice to AG, time-sensitive notification, risk of harm analysis, encrypted safe harbor, paper or electronic

HIPAA breach notification rule

health data containing personal identifying information released by covered entities

FTC health breach notification rule

health-related data by other entities (health apps, wearables, etc)

computer-security incident notification rule

issued jointly by OEC, Fed Reserve, and FDIC; NCUA has parallel rule for credit unions

GLBA safeguard rule

enforced by FTC, non-banking financial institutions

SEC item 1.05 (Form 8-K)

publicly traded companies

Article III standing doctrine

determines whether a person can legally bring a lawsuit

3-step test for standing

1. injury in fact

2. causation

3. redressability

injury-in-fact

you actually got hurt, must be particularized (not to the general public), must be concrete

causation

direct line connecting injury to the actions of the defendant

redressability

a court has the power to fix the problem or make up for it

FTC Act (1914)

prohibits unfair or deceptive acts or practices

FTC Section 5(1)

issue a complaint, hold admin proceedings, issue cease-and-desist orders, civil penalties for continued violations

FTC Section 13(b)

preliminary and permanent injunctions in fed district court to stop violations or imminent violations of laws enforced by the agency

Magnum-Moss Warranty-FTC Improvement Act (1975)

gave the FTC industry-wide rulemaking authority

what was the Congressional response to the Magnum-Moss Warranty Act

added extra procedural steps, to check on the FTC's broad and unpopular rulemaking power

what is the effect of the changes to the Magnum-Moss Warranty Act?

discourages broad rulemaking, favors targeted enforcement

process of rulemaking for FTC post-Magnum

1. publish an advance notice of proposed rulemaking for public feedback

2. submit proposal to Congressional oversight committees

3. proposed rule must show the practice is prevalent, unfair/deceptive, and detail economic impact

4. hearing held if any interest party requests one

5. FTC issues a final rule consistent with rulemaking record

FCRA

Fair Credit Reporting Act; America's first federal regulations on consumer reporting agencies, furnishers, and users of consumer reports

furnishers ex

Chase Bank, Capital One, etc.

users ex

landlords, employers, etc.

what is the legislative history of the FCRA?

Sen. William Proxmire was worried about risk of anonymous character assassination (bias and error) as previously credit reporting was a mix of retailers, public record court files, news, interviews with friends and neighbors

what was the compromise bill reached for the FCRA?

CRAs open files to consumers in exchange for immunity from state tort liability

three components of the FCRA

1. CRAs may furnish reports only for a "permissible purpose"

2. consumer consent required for reports sent to employers or containing medical info

3. non-permissible pull: may still be a consumer report but the user violates the law

accuracy obligations in the FCRA for CRAs

reasonable procedures to ensure maximum possible accuracy

accuracy obligations in the FCRA for furnishers

may not furnish info they know or have reasonable cause to believe is inaccurate

accuracy obligations in the FCRA for users

when taking adverse action, must give notice and info about the CRA

ex of adverse action by a user

rescinding a job offer, rejecting a tenant

what are the five consumer rights in the FCRA?

1. access

2. dispute

3. identity theft

4. time limits on negative info

5. limits on affiliate sharing (weak)

what does the access right look like for the FCRA?

free annual report from each nation-wide CRA

what happens when a dispute is filed?

triggers mandatory FCRA investigation within 30 days, inaccurate or unverifiable info must be deleted

1996 Consumer Credit Report Reform Act

amendment to FCRA, motivated by inaccuracies and difficulty fixing them, blamed computerization; added first obligations on furnishers, 30-day dispute deadline, and protection against reinsertion

FACTA

Fair and Accurate Credit Transactions Act

2003 FACTA

addressed identity theft, free annual reports, fraud alert and blocking mechanisms; permanently extended preemption, blocking stricter state laws via federal uniformity; lobbied for by industry

2010 Dodd-Frank Act

created CFPB and transferred most FCRA rulemaking and enforcement authority to it

what is the data broker problem?

FCRA was built for bureaus collecting from retailers and interviewing neighbors, not algorithmic scoring or broker dossiers

GLBA

Gramm-Leach-Bliley Act

GLBA (1999)

allowed for consolidation of financial service providers/big bank mergers, allowing the same institutions to offer savings and investment services

criticism of the GLBA

would make the institutions "too big to fail" super banks that would eventually require taxpayer bailouts

GLBA Financial Privacy Rule

1. requires annual privacy notice, where institution must disclose the info collected, where it is shared, how it is used, and how it is protected

2. requires the right to opt out of personal info being shared with unaffiliated parties

what did the GAO find out about opting out?

found consumer opt-out rate is generally low and model form may be out of date and not reflect how institutions share info

what are the regulatory exceptions to opt out requirements?

financial institutions are exempt from offering an opt-out choice for sharing with essential service providers, joint marketing partners, and credit reporting agencies

GLBA Safeguards Rule

implements data security requirements; requires institutions to create a written security plan

Financial Services Regulatory Relief Act (2006)

required a model privacy notice that complies with GLBA and lets consumers compare practices

Melvin v. Reid (1931)

movie was made about a sex worker and created without consent; contributed to debate of public disclosure of private fact tort

Sidis v. FR Publishing (1940)

newspaper printed a story about a child prodigy as an adult; contributed to debate of public disclosure of private fact tort