On May 12, 2008 the Federal Trade Commission issued its long awaited final set of rules under the CAN-SPAM Act of 2003 (the "Act"). The rule:

• Modifies the term "sender" with respect to multi-advertiser e-mails;
• Clarifies the opt-out request process;
• Defines the term "person"; and
• Clarifies the meaning of "valid physical postal address" of the sender.

The accompanying report:

• Explains the FTC's interpretation of the Act's application to affiliate marketing programs and tell-a-friend campaigns.

The rule will take effect on July 7, 2008.

Continue Reading...

• Print
• Comments
• Trackbacks

The June 18, 2008 Ninth Circuit panel decision in Quon et al. v. Arch Wireless et al., No. 07-55282 (9th Cir. June 18, 2008) has sparked a flurry of news reports and speculation regarding employers’ ability to monitor employees’ e-mails and text messages. In fact, the decision appears to change very little for private employers who wish to review employee communications stored on, or sent through, their own servers and computers. However, Quon does limit employers’ ability to request from third-party providers the contents of employees’ electronic communications.

Continue Reading...

• Print
• Comments
• Trackbacks

New amendments to the Fair and Accurate Transactions Act (“FACTA”) (itself an amendment to the Fair Credit Reporting Act (“FCRA”)) bar consumers from alleging willful violation and seeking statutory damages based on the printing of credit card expiration dates on receipts where the account number is otherwise properly truncated in accordance with FACTA. This development means the end is near for scores of class action lawsuits filed last year.

FACTA prohibits the printing of more than five digits of a credit or debit card number or the expiration date on receipts provided to a customer. Since December 4, 2006, consumers have filed hundreds of suits against merchants who allegedly printed a truncated account number and the expiration dates on receipts, arguing that those merchants “willfully” violated FACTA, and seeking $100 to $1,000 for each violation. At least one court has interpreted FACTA to apply to electronic receipts as well as printed ones.

Continue Reading...

• Print
• Comments
• Trackbacks

Many B2C companies are beginning to explore marketing to consumers’ wireless devices using text messaging (“SMS,” or “short message service”) and MMS messaging (“Multi-media Messaging Service”). They may even target their promotions based on where the recipient is physically located using the wireless device’s GPS technology. They also may target their promotions to teens and tweens. What legal issues should companies be aware of as they navigate through this relatively new area?

Continue Reading...

• Print
• Comments
• Trackbacks

In December 2007, Texas became the first state to file COPPA enforcement actions, by separately suing the entities behind Gamesradar.com and TheDollPalace.com in the United States District Court for the Western District of Texas. The complaints are available as an attachment to the press release on the Texas Attorney General’s website. The defendants in those cases are California and New York – and not Texas – entities.

With little fanfare, Texas apparently settled its suit involving TheDollPalace.com ("where cartoon dolls live") in March 2008, and in doing so has imposed restrictions on content with no precedent in the COPPA consent decrees entered into by the Federal Trade Commission.

Continue Reading...

• Print
• Comments
• Trackbacks

A new Act of Parliament gives the United Kingdom’s Information Commissioner’s Office (ICO) the authority to impose monetary penalties for misuse of personal data in violation of section 55 of the Data Protection Act of 1998 (DPA).

Continue Reading...

• Print
• Comments
• Trackbacks

On May 22, 2008, the California Court of Appeal narrowed the scope of claims available under California’s Song-Beverly Credit Card Act of 1971, California Civil Code § 1747.08, ruling that the statute is subject to the one-year statute of limitations of Code of Civil Procedure section 340 and does not apply to merchandise returns.

Continue Reading...

• Print
• Comments
• Trackbacks

The European Data Protection Supervisor (EDPS) has come out in favor of the EU enacting data security breach notification laws.

The EDPS is an independent supervisory authority devoted to protecting personal data and privacy and promoting good data protection practices within the EU, both by monitoring the EU administration’s own data processing, as well as by commenting on pending legislation.

Continue Reading...

• Print
• Comments
• Trackbacks

On May 9, 2008, Iowa Governor Chester Culver signed legislation (SF 2308) requiring any person who owns or licenses computerized data that includes a consumer's personal information to give notice of a breach of security. The law does not require notification if, after an appropriate investigation or after consultation with the relevant federal, state, or local agencies responsible for law enforcement, the person determined that no reasonable likelihood of financial harm to the consumers whose personal information has been acquired has resulted or will result from the breach.  Following is an updated list of the 43 state security breach notification laws (plus District of Columbia and Puerto Rico).

Continue Reading...

• Print
• Comments
• Trackbacks