abaip privacy search and email final

8/7/2019 ABAIP Privacy Search and Email Final

http://slidepdf.com/reader/full/abaip-privacy-search-and-email-final 1/36

Privacy of Personal Information

Online, in Email, and on Wireless and

GPS Devices

26th Annual Intellectual Property Law

Conference of the ABA Section of Intellectual Property Law



Privacy of Information in Online Search

and Web Email Services

Michael R. Jones, Esq. Patterson Belknap Webb&Tyler

Jesse Raben, Esq. Associate General Counsel,American Psychological Association

Brady Kriss, Esq., LLM, CIPP,Law Office of Brady Kriss, Esq.



THE NEW GOLDRUSH:DATAFIELDS OR BUST!

3



Investigating Employees’ E-mail Use NPR, June 18, 2008

• INSKEEP: is it true that you can’t delete an email;it’s impossible?

• MS. CHARNOCK: Unless you’re very fortunate, it’simpossible. It can get backed up before you know it,it could’ve been sent to other people, it could bearchived without your realizing it. So really emails

are like the cockroach of the electronic world. It’svery difficult to get rid of.Available at http://www.npr.org/templates/story/story.php?

storyId=91625695&ps=rs 4



Sites Feed Personal Details to New Tracking

Industry Julia Angwin and Tom McGinty The Wall Street Journal, July 30,2010

• The largest U.S. websites are installing new andintrusive consumer-tracking technologies on thecomputers of people visiting their sites -- in somecases, more than 100 tools at a time.

• Two thirds of the tracking tools installed camefrom 131 companies that are in the business of following Internet users to create rich databases of consumer profiles that can be sold.

Part of the WSJ’s series “What They Know” Available at wsj.com/WTK 5



A Look at the Three Big

Search/Email Combos

• Google – Search engine & Gmail

• Yahoo! – Search portal, Yahoo! Mail & Yahoo!Mail Beta

• Bing/Microsoft – Search engine & Windows

Live Hotmail

6



A Look at the Three Big

Search/Email Combos Each can collect three general groups of information about users:

1. Information on search terms entered andresults.

2. Information about sites visited and linksclicked (web-tracking for advertising)

3. Information contained in emails.

7



Search Information Collected

All three companies collect certain standard informationfrom your searches, including:

• Search terms

• IP address

• Unique identifier in a cookie placed on your computer

• Time and date of search

• Browser configuration*

• Location (based on IP address)

8

*Browser configuration can be identifying, depending on your settings, plugins, OS, etc. Brady’s browser, for example,

is unique among the 1,491,192 browsers tested by the EFF. Test yours at panopticlick.eff.org



Who Owns Your Data?Alistair Croll Mashable.com January 12, 2011

“The act of collecting and analyzing massive amounts of public and private data actually generates more data, which isoften as useful as the original information--and belongs to

whomever performed the analysis. Put another way: Big Data makes its own gravy.”

“The important question isn’t who owns the data. Ultimately,we all do. A better question is, who owns the means of

analysis? The digital divide isn’t about who owns data – it’sabout who can put the data to work.”

Available at http://mashable.com/2011/01/12/data-ownership/.

9



Associated Information

But, all three companies may associate your search termswith other information from your use of their services. If you have an account, you may have provided informationabout:

10

• Email address

• Name• Phone number

• Home or work address• Zip code

• Age

• Gender• Preferences

• Interests

• Favorites

• Birth date• Occupation

And if you use Yahoo!’s financial

products and services:

• Your SSN• Information about your assets.

* For the most part, the policies state that identifiable information is stored securely and separately from

search information, and measures are taken to ensure there is no unauthorized association of the data.



Who Owns Your Data?Alistair Croll Mashable.com January 12, 2011

“As we use the Internet for “free,” we have to

remember that if we’re not paying for something,we’re not the customer. We are in fact the product being sold--or, more specifically, our data is.”

So heres the tricky question: Who owns all that data?

11



“Get all the information you can,

we’ll think of a use for it later.”

12



How They Use the Information

• Internal use (improving and developing thesoftware and service.)

• Academic and internal research – only after the

information has been scrubbed of identifying information, such as IP address. This happensanywhere from 9 to 18 months after collection.

• Advertising – First party (Google serves you AdWords on

Google.com)– Third party (Search co. places third party ad on your

results page)

13



Google Only Serves Its Own Ads

14

These visualizations are from the interactive tool at http://blogs.wsj.com/wtk/



Bing Mostly Serves Its Own Ads

15



Yahoo! Has A Lot of Third Party Ads

16



Alas, Hansel and Gretel Had Left A DigitalTrail

17



Email Information

• Nearly all email providers scan your email forSpam, Phishing, Malware, etc.

• Some online email providers also scan youremail for keywords to provide you with more“relevant” advertising

But how does this work?....

18



Email Information

• Same email scanning technology as spam andphishing prevention.

• No humans read your email – only computerprograms scan it.

• If your email contains a keyword that an advertiserhas purchased, an ad will appear next to your email.

– Example: your email contains the words “Paris” and“vacation,” you’d probably get ads for hotels in Paris.

However…

19



Email Information

• Generally, your emails are retained until you delete them. But they areonly scanned for keywords when you view them in the provider’sinterface.

• Even though your online email provider does not store or analyzeinformation about your emails while they are sitting in web-storage, if you click on an ad, the advertiser may receive information about how you got to their site, including the fact that you had certain keywords inyour email.

• If you combine this with other information, including your IP addressand identifying cookies that Yahoo! or Google share with advertisers, adetailed picture of you and your conversations and interests could bedeveloped.

20



Email Information

• To avoid these contextual advertisements, youcan not view your emails in the online email

provider’s interface.

• Forward your emails to a desktop client – Eudora, Outlook, Thunderbird – and the email

keyword analysis won’t take place.

21



Search Engines and Web Email Conclusion

Information in Search Engines vs. Free Web Email

– Both services cash in on information gleaned from

users

– Free services are often not really free – you pay them

in information.

– There are easy ways to help protect the privacy of

your information when using search engines or webemail.

22



23

Legal Protections

These statutes can apply to information collected through theuse of search engines and online email:

• Federal Statutes

– Electronic Communications Protection Act (ECPA)

– Stored Communications Act (SCA)

– Wiretap Act

– Other federal privacy laws• Gramm-Leach-Bliley Act (GLBA)

• Health Insurance Portability and Accountability Act (HIPAA)

• Drivers Privacy Protection Act

• Federal Records Act

– Fair Credit Reporting Act (FCRA)

– FTC Act

23



24

Legal Protections

These protections may also apply:

• State Statutes– Consumer protection laws

– MA data protection laws

– CA information law

• Common Law

– Property rights (e.g., trespass to chattel, conversion)

– Torts

– Contract (i.e., privacy policy)• Breach of contract

• Enforcement by FTC

• Enforcement by state Attorneys General

24

Most common

mechanism is FTCenforcement of Privacy

Policies via unfair and

deceptive businesspractices actions.



Google Buzz Settlement

• FTC/ Google settlement on March 30, 2011

• Google launched Buzz, a social network, in Feb.2010. Buzz was automatically turned on for all of

Google’s Gmail users, and all frequently emailedcontacts were made “friends” on Buzz, and a user’slist of “friends” was public.

• Two outcomes:1. Gmail users’ full real names were revealed to some

contacts; and2. Frequently emailed Gmail contacts were made public

on Buzz.

25



• FTC found that Google used “deceptive tactics andviolated it sown privacy promises to consumers.”

• The settlement consent decree requires Google:– to obtain express opt-in consent from users to publicly

display information, and to develop a “comprehensiveprivacy program,” including Privacy by Designprinciples, to ensure that such a breach of users’ privacy

doesn’t happen with future feature launches.

– To submit to a biennial independent privacy audit.

Google Buzz Settlement

Consent decree available at http://www.ftc.gov/os/caselist/1023136/index.shtm 26



27

Other Cases Involving Disclosure of Search

Engine or Web Email Data

• “Expectation of privacy” cases

• In re DoubleClick Inc. Privacy Litigation , 154 F. Supp.2d 497 (S.D.N.Y 2001)

• 2006 AOL disclosure and resulting litigation Doe

v. AOL LLC , 06-5866 (N.D. Cal.)



Issues on the Horizon

What counts as email?

On March 28, 2011 the US District Court for the

Northern District of CA held that Facebook messages and wall posts were “email” under CAN-SPAM.

Available at http://www.hldataprotection.com/2011/04/articles/consumer-privacy/canspam-held-to-apply-to-social-media-messaging/

28



Issues on the Horizon

Legislation & Federal Rules

• FTC’s Do Not Track List

• FTC’s stepped up privacy initiative

• Commerce Dept.’s proposed Privacy Czar andPrivacy Framework

• McCain’s and Kerry’s “Online Privacy Bill of

Rights”• EU’s new cookie law (goes into effect in May)

• Possible changes to EU data retention directive

29



Steps to Take to Increase Your Privacy

• Forward your email to a desktop app or otheronline app – Eudora, Outlook, MobileMe,

Thunderbird, etc.• Clear your cookies and your web history!

• Use anonymous browsers

• Use private browsing mode in your regularbrowser (IE9, Chrome, Safari and Firefox can

do this, if you enable it.)

30



Where to Find Information About the Privacy

Policies in this Presentation

• Bing – http://privacy.microsoft.com/en-us/bing.mspx

– http://privacy.microsoft.com/en-us/fullnotice.mspx#collection – Microsoft Live Hotmail – No specific policy found, information here is from the

general Microsoft policy above.

• Google– http://www.google.com/intl/en/privacy/

– http://www.youtube.com/watch?v=kLgJYBRzUXY – FAQ on Gmail ads:

http://mail.google.com/support/bin/answer.py?answer=6603

• Yahoo!– http://info.yahoo.com/privacy/us/yahoo/details.html

– Yahoo! Mail (classic) http://info.yahoo.com/privacy/us/yahoo/mail/details.html – Yahoo! Mail Beta

http://info.yahoo.com/privacy/us/yahoo/mail/betafaq/details.html

31



“We have some facts about that you don’t

remember, some that you thought were really secret, and some that never happened.”

32



“I’ve Decided to Contract Out the All Seeing, AllKnowing Function to Google”

33



“We have to be forthright with the public. We have

to have their confidence. We have to convincethem we’re working for the common good. Then

we can invade their privacy.”

34



“Take these and keep the location APP on – The

boss said he might need to know where we are.”

35



Thanks!

36

abaip privacy search and email final

Documents