After nine months of intense negotiations and uncertainty, and despite ongoing criticisms from powerful data protection regulators, the new EU-U.S. Privacy Shield program went into effect this week as the U.S. Department of Commerce began accepting applications online. Some companies that are self-certifying their compliance have already submitted their documentation and many more are expected to do so in the coming days and weeks as they seek shelter under the replacement for the long-standing EU-U.S. Safe Harbor arrangement that was invalidated by the European Court of Justice last year.

Companies can now “sign up” for the Privacy Shield list, but they should not expect a rubber stamp from the Commerce Department just because they have self-certified. To ensure that their applications are approved, companies should take the following steps:

  • Confirm that they are eligible to participate—not all organizations are. Only companies subject to the jurisdiction of the FTC or the DOT may participate at this time
  • Develop a Privacy Shield-compliant privacy policy statement
  • Identify their independent recourse mechanism—under the new framework, self-certifying organizations must provide an independent recourse mechanism available to investigate unresolved complaints at no cost to the individual
  • Ensure that they have compliance verification mechanisms in place
  • Designate contacts within their organizations to serve as liaisons regarding the Privacy Shield
  • Review the information required to self-certify
  • Go online to to self-certify

Continue Reading Time to Raise Your Shield: The New EU-U.S. Framework Is Here

Last week, the European Commission unveiled the latest documentation related to the EU-U.S. Privacy Shield intended to restore trust in transatlantic data transfer and establish a mechanism for U.S. companies to once again transfer data from the EU with confidence. We wrote last month about the initial announcement of the Privacy Shield but expressed caution about whether the European Union and the United States would be able to iron out the details of the complicated agreement before the February 29, 2016 deadline set by the Article 29 Working Party (“WP29”).  But it appears that the two sides were able to make significant progress in the month of February, and the European Commission released more than 120 pages of documentation setting forth the new Privacy Shield requirements.

There are many details in the documentation released last week, but following are the key points:

  • Participating organizations will be required to follow rules related to consent, relevance, proportionality, access and correction.
  • Arbitration will be available for disputes.
  • Participating organizations will be required to provide additional information to data subjects at the point of consent.
  • Participating organizations must implement stronger controls on data transfers to third-party data processors and controllers.
  • Participating organizations must commit to address EU member complaints “expeditiously” through the FTC.
  • The FTC will verify self-certification.

It remains to be seen whether this will be enough to satisfy key stakeholders in the EU.  WP39 has announced that it will provide its opinion on the level of protection afforded by the Privacy Shield on April 13, 2016.  We will continue to monitor these developments and keep you apprised.

Politicians in both the European Union and United States touted Tuesday’s agreement on a new “Privacy Shield” for EU-U.S. data transfers as a resolution to the data transfer quagmire that has faced companies since the EU-U.S. Safe Harbor was invalidated in October. While this new deal is a promising step in the right direction for companies that transfer data from the EU to the United States, there are still many questions about exactly what the requirements of the new Privacy Shield will be, how an American company can ensure compliance with those requirements and (perhaps most importantly) whether the European Court of Justice will validate the new rules.

Indeed, the deal heralded by politicians on both sides of the Atlantic appears to be only a high-level agreement—they expect to document the actual terms over the next few weeks (the Article 29 Working Party (WP29), the body made up of representatives of individual European Member States’ data protection authorities, has called for it to be fully documented by the end of February). Thus, we anticipate quite a bit more negotiation on the precise scope and language of the requirements. Meanwhile, WP29, which had been assessing data transfer mechanisms like standard contractual clauses and model contracts for possible flaws that would lead to enforcement actions, announced that it will not take enforcement actions based on its concerns about these mechanisms while it awaits the details of the new transfer deal. Continue Reading Privacy Shield Offers Hope on EU-U.S. Data Transfer—For Now

In a well-reasoned and encouraging decision to Internet businesses, the Northern District of Illinois recently found that even operating one of the largest, most popular websites in the world is not enough to create personal jurisdiction everywhere the site can be accessed. See Gullen v. Facebook, Inc., Case No. 15-cv-07681 (Jan. 21, 2016 N.D. Ill.). The court relied heavily on the Supreme Court’s decision in Walden v. Fiore, 134 S. Ct. 1115 (2014), and the Seventh Circuit’s decision in Advanced Tactical Ordnance Sys. LLC v. Real Action Paintball, LLC, 751 F.3d 796 (7th Cir. 2014), to hold that the Northern District of Illinois lacked specific personal jurisdiction over defendant Facebook.

The plaintiff in Gullen alleged that Facebook had unlawfully obtained and stored his biometric information without authorization. Id. At 2. To support personal jurisdiction, the plaintiff argued that Facebook was registered to do business in Illinois, had a sales and advertising office in Illinois, and “target[s] its facial recognition technology to millions of users who are residents of Illinois.” Id. at 3-4. The court found these alleged contacts insufficient to confer specific personal jurisdiction because the plaintiff had not connected the allegedly wrongful conduct to the Illinois business registration or office and had tacitly admitted that Facebook’s alleged collection of biometric information was not targeted at Illinois residents but instead applied to Facebook users generally. Id. “[T]he Seventh Circuit has rejected the notion that an online merchant’s operation of an interactive site is sufficient to confer specific jurisdiction on it in every state from which the site can be accessed. . . . Because plaintiff does not allege that Facebook targets its alleged biometric collection activities at Illinois residents, the fact that its site is accessible to Illinois residents does not confer specific jurisdiction over Facebook.” Id. at 4-5.

Facebook is, of course, a global social media presence with substantial connections to Illinois. Nevertheless, the court emphasized that the contacts must be contacts that the defendant (not the plaintiff or a third party) created. Id. at 3 (“We have consistently rejected attempts to satisfy the defendant-focused ‘minimum contacts’ inquiry by demonstrating contacts between the plaintiff (or third parties) and the forum State.”). The court found there was no personal jurisdiction because “plaintiff does not, and could not plausibly, allege that Facebook knew an Illinois resident would upload a photo of him and tag his name to it, thereby (allegedly) giving Facebook access to plaintiff’s biometric information.” Id. at 5.

In light of Walden, Advanced Tactical and Gullen, defendants in cases arising from alleged online conduct should carefully consider challenging personal jurisdiction. If a site like Facebook with “millions” of in-state contacts is not subject to personal jurisdiction, many other Internet companies should be able to successfully challenge personal jurisdiction based on the rationale laid out in these decisions.

By now, most attorneys who handle class action litigation are familiar with the defense strategy commonly known as “mooting.”(This terminology is, frankly, imprecise, but we will save the semantics discussion for another day.) The cautious plaintiffs’ attorney will file a cursory motion for class certification with the complaint to minimize the likelihood of mooting.The defense attorney will serve an offer of judgment for full relief as soon as possible and immediately move to dismiss. But in light of conflicting circuit court decisions, the legal landscape is unclear on the ultimate effect of these maneuvers. Luckily, we’re here to help. Continue Reading Four Approaches and Counting: The Circuit Split on “Mooting”

In a decision subject to surprisingly little commentary by TCPA pundits, the Illinois Court of Appeals handed a significant victory to TCPA defense lawyers in November 2014 on the issue of “mooting” a putative class representative’s individual claim. See Ballard RN Ctr., Inc. v. Kohll’s Pharm. & Homecare, Inc., 2014 IL App. (1st) 131543 (2014). Despite the fact that the plaintiff had filed a motion for class certification before an offer of full and complete individual relief by the defendant, the court found that the plaintiff’s individual TCPA claim was still “mooted” because the motion for class certification that the plaintiff had filed was cursory and devoid of facts.  Id. at P59.

According to the court, “[I]f a putative class action plaintiff could circumvent the holding of Barber merely by filing a contentless ‘shell’ motion for class certification contemporaneously with its complaint, then it would effectively eviscerate the Barber decision.” Id. (referring to Barber v. American Airlines, Inc., 241 Ill. 2d 450, 455 (2011) (holding that class representative’s claim is moot when defendant offers full and complete relief before filing of motion for class certification)). Continue Reading Cursory Class Certification Motion Not Enough in Illinois?