 |
CCPA: WEEK TWO
Law firms vie to offer guidance on CCPA; one appears to challenge Facebook interpretation of data ‘sale’
Multiple U.S. law firms are following and contributing to emerging interpretations of the California Consumer Privacy Act as U.S. publishers, data-users and other companies struggle to figure out their obligations and how quickly they need to comply. A half-dozen or more firms post their advice publicly and one of the best emerged this week — a post by the D.C.-based law firm of Kelley Drye — with 11 key questions answered.
“We provide some insights on common questions we are hearing about how to comply with the CCPA in the absence of clear guidance or precedent,” says the Jan. 7 post co-bylined by attorneys Alysa Zelter Hutnik, Aaron Burstein and Alex Schneider.
One of the most important insights of the week comes from two lawyers at another firm, Hopkins & Carley, in Palo Alto — the definition of data “sale” under the CCPA. Attorneys Celine Guillou and Chiara Portner argue sale “is to be interpreted broadly.” (see: Quote of the Week, below), a point of view apparently not shared, for example, by Facebook.
“Another observation is that the much reviled “Do Not Sell My Information” button – for which the Attorney General has yet to provide more information as promised in the proposed regulations – is notably absent from the homepages of many companies that do in fact sell personal information,” Guillou and Portner write.
RELATED LINKS:
-
In CCPA, data ‘sale’ not just about money | Celine Guillou & Chiara Portner, Hopkins & Carley
-
ROUNDUP: 2020 predicted as another groundbreaking privacy year | Robert Bowman et al., Husch Blackwell LLP
-
ALERT: New data-privacy laws in Illinois, Texas, Oregon, New Hampshire, Washington, N.H., N.Y., and Maine | Victoria Beckman & Eric Cook, Frost Brown Todd LLC
-
Learning? Reporter spends six hours filling out CCPA requests | Thorn Klosowski, NYTimes
-
Virginia legislature seen as likely to take up “Virginia Privacy Act” | Chris Nolen, McGuireWoods LLP
|
|
|
Does your organization need customized privacy compliance solutions? ITEGA can help.
|
|
|
We bring together support you need to approach compliance with CCPA, GDPR if needed, and future privacy legislation as it emerges.
|
|
 |
Apple declares privacy focus in rare CES 2020 appearance by executive; but FB says we are just as good
The annual CES tech showcase wrapped up in Las Vegas. Facebook and Apple, who have been absent from the event in the past, came this year to discuss privacy. It was the first appearance by Apple since 1992. Some 170,000 people convene for CES annually.
Facebook unveiled a new version of its privacy checkup tool at CES’ media-preview event on Monday. On Tuesday, Apple’s senior global privacy director, Jane Horvath, and Facebook’s chief privacy officer, Erin Egan participated in a Chief Privacy Officer roundtable — during which Apple was questioned about their bold statement of privacy during last year’s event (through a huge billboard by the conference center), while still being found to share data with third-party apps over the last year. (video)
“At Apple, the way we define privacy is to put the consumers in the driver’s seat,” Horvath declared. “They should have control of their data, they should have choices over their data.”
Another privacy-centric panel discussion, featuring speakers from the Consumer Technology Association, Facebook, Office of Senator Schatz, law firm Baker Botts, and the National Telecommunications and Information Administration focused on the need for privacy legislation to come from the federal level. (video)
The event also included fireside chats with FTC Chairman, Joseph Simons and FCC Chairman, Ajit Pai. (video)
READ MORE:
At CES, Facebook argues it’s just as good on privacy as Apple | Alfred Ng, cNet
|
|
 |
What are the consequences of sharing health data with Big Tech?
Facebook’s new preventative health tool says that it doesn’t share your health data with third parties and they won’t share ads based on that data. But the tool also says if you click on any of the resource links provided, you may see ads related to those web visits. The behemoth is part of the growing list of tech companies gathering health information outside of HIPAA regulations.
The Wall Street Journal reported back in February that Facebook has already been receiving sensitive information from wellness tracking apps, such as data on when users may be ovulating from the period-tracking app Flo.
Xcertia, an independent nonprofit founded by the American Medical Association and other major health and technology organizations, has published privacy guidelines for app developers. The guidelines are meant to create a roadmap in adhering to strict privacy standards and creating a consistent privacy policy format; allowing consumers to better understand how their data is being used. A 2019 study found that a third of smoking cessation and depression apps didn’t even have a privacy policy.
While health and wellness apps have a lot of promise to help people, it remains unclear how most of these companies are ensuring that no harm is done by intentionally or unintentionally allowing data to be used to support discrimination and/or exploiting a person’s weaknesses. Sixty percent of respondents to a survey by marketing research firm Kantar cited privacy concerns, such as data breaches as a deterrent to their adoption of personal medical devices.
A University of Toronto study found that 19 out of 24 apps tested were sharing data with multiple 3rd parties. In 2018, ProPublica and NPR found that insurance companies were working with data brokers to accumulate data on the habits of millions of Americans. Meanwhile, the employee background screening industry is increasingly using big data and AI.
Because of a Vermont law enacted last year, Fast Company was able to assemble a list of 121 organizations buying and selling data. Many are recognizable names, while others are lesser-known — including companies that work with landlords to screen potential tenants or provide marketing leads to insurance companies.
LEARN MORE:
Colleges want freshmen to use mental health apps, but are they risking students’ privacy? | Deanna Paul, My San Antonio
|
|
DC WATCH
Surprise: GOP Senate leader backs giving publishers four-year window to collude in negotiating with FB and Google; will there be committee action?
In an unexpected development, U.S. Senate Majority Leader Mitchell McConnell on Jan. 6 added his official support to a languishing bill that would give the publishing industry a four-year limited exemption from antitrust laws — so that it could negotiate with Facebook and Google over content sales and use.
The oldest lobby group for the industry, the News Media Alliance (NMA), embraced a House version (H.R. 2054) of the idea when it was introduced in the House April 3, 2019, by Rep. David Ciccillini, D-R.I. There has been no action on the bill. In the meantime, Ciccillini has gained a high profile in efforts to consider what to do about perceived “platform monopoly” as chair of a House antitrust subcommittee.
“There is bipartisan concern about the future of local news,” David Chavern, president and CEO of the NMA, was quoted by Bloomberg as saying. He added: “Local news in particular needs to find its way to a new economic model and that economical model runs through Google and Facebook.” Chavern’s group counts the New York Times, the Washington Post and News Corp. as members. (READ CHAVERN’S STATEMENT)
Chavern’s organization released a study in June which estimated Google garnered $4.7 billion in advertising revenue in 2018 tied to the work of news publishers. The figure and methodology were disputed by Google, but it failed to provide its own documentation. Among critics of the methodology were Columbia Journalism School professors. The j-school has benefited from grant funding from Google.
The prime sponsor of the Senate version (S. 1700) of what is called the “Journalism Competition and Preservation Act of 2019” is Sen. John Kennedy, R-La. He introduced it June 3 and it is sitting in the Senate Judiciary Committee, where he is a member. Other GOP co-sponsors, besides McConnell are Sens. Rand Paul and Bill Cassidy. Democratic co-sponsors — all on the judiciary committee — are Sens. Amy Klobuchar, Richard Durbin and Cory Booker. Klobuchar’s father was a newspaper reporter.
Meanwhile, Nieman Lab editor Josh Benton wrote that the measure, if it became law “is unlikely to have a substantial impact on the dysfunctional relationship between publishers and platforms.” His reporting also explains in some detail the bills’ language and effect. Nieman has reported in the past on Google’s efforts to fund journalism innovation. Google has funded at least one Nieman reporter.
RELATED LINKS:
|
|
DCN’s TRUSTX unit’s report promotes switching digital ads from auction-based to premium markets; says agency execs and buyers are not in alignment
In a new report, the TRUSTX unit of Digital Content Next, which represents premium legacy and digital-only publishers, concludes there is a need to convince marketing officers and ad agency executives and buyers “to spend only in premium programmatic environments that are based on value-driven economics rather than auction-based systems predicated on cheap CPMs and cost.”
The quote comes from the last paragraph of a blog post summarizing the strategic-advertising report, “TRUSTX Programmatic Market Insights Report.” TRUSTX is DCN’s co-operative and private programmatic ad marketplace launched in 2016 and focused on aggregating available supply of advertising spots with premium publishers. The summary was written by Randy Price, DCN’s research director.
The report is based on interviews with seven DCN publisher members: CBS Interactive, the E.W. Scripps Co., the ESPN unit of Disney, Fox News, Meredith Publishing, NBC Universal and WarnerMedia. It summarizes what those publishers have learned through involvement in the TRUSTX marketplace. One observation: “There appears to be a disconnect between senior executives at agencies, who may support buying directly from publishers, and the actual buyers who are incented to manage campaign costs through buying lesser viewable impressions which are less expensive.”
The language in the report itself says the rise of the $129-billion U.S. digital ad marketplace has been accompanied by industry consolidation, waste from non-viewable inventory, fraudulent traffic, and lack of transparency and accountability in the buying process. These factors, it states, “have significantly undermined the trust and value exchange between publishers, marketers and consumers.”
|
|
MORE NEWS / AD TECH
EU TRACKING
PRIVACY BUSINESS
-
AT CES, Horvath says Apple focused on putting consumers in control of their data | John Eggerton, BroadcastingCable.com
-
OPINION: Don’t believe Apple, Facebook, Amazon hype about privacy | Geoffrey A. Fowler, WashingtonPost.com
-
Privacy big topic at Consumer Electronics Show | E.J. Schultz & Jack Neff, AdAge
-
Your TV is watching you: Will Samsung, LG, Vizio do privacy? | Rob Pegoraro, USA Today
-
DeCloak claims it can anonymize behavioral data for brands | Ray Schultz, DigitalNewsDaily
-
Data aggregator Infutor seeks to help enterprises monitor CCPA compliance | Laurie Sullivan, DigitalNewsDaily
TRUTH AND TRUST
|
|
|
QUOTE OF THE WEEK
Is “said social media company’ ‘selling’ private data under CCPA?
“Under the CCPA, ‘sale’ or ‘selling’ is to be interpreted broadly. It is NOT limited to what we think of colloquially as a real purchase for money. In fact, a CCPA “sale” includes releasing, disclosing, disseminating, making available, transferring, selling, renting, or otherwise communicating (in any manner or allowing them to collect through cookies) personal information by the business to another business or a third party for monetary or other valuable consideration (including a promise or commitment). In other words, if a business discloses personal information to any other person or entity that may use it for its own commercial gain or purposes (e.g., internal analytics, or disclosure to other parties for commercial gain) and thus not solely in order to fulfill a business purpose as a true service provider, this would likely be considered a sale. There are only limited exceptions, and the proposed regulations have made this even clearer. The definition is key when evaluating a business’s vendor relationships – in particular adtech services. As such, unless the California Attorney General adjusts the definition in its final regulations, if said social media company uses personal information collected, in particular from certain of its adtech products, for its own purposes and other than to provide ads on behalf of its customers, it cannot be considered a service provider and would be deemed to sell personal information. It will be interesting to see how this position will be justified.”
– Attorneys Celine Guillou and Chiara Portner, of the Palo Alto law firm of Hopkins & Carley, writing in their law firm’s blog newsletter about implementation of the CCPA, Jan. 6, 2019.
|
|
| ABOUT PRIVACY BEAT
Privacy Beat is a weekly email update from the Information Trust Exchange Governing Association in service to its mission. Links and brief reports are compiled, summarized or analyzed by Bill Densmore and Eva Tucker. Submit links and ideas for coverage to newsletter@itega.org.
|
|
|
|
|
|
