Can a plaintiff bring a privacy lawsuit under a federal law?
Not necessarily. Even if the federal law has a private right of action, plaintiffs cannot pursue lawsuits without demonstrating harm that qualifies for Article III Standing.
Why have many courts rejected breach of contract when companies violate their privacy policies? (2)
- privacy policies are notices, not contracts.
2. plaintiffs failed to establish damages.
What are the three ways to define PII?
- Tautological Approach, and PII that identifies a person. (used in VPPA)
- The Non-public approach (used in GLBA and Cable Act)
- The Specific-Types Approach (used in COPPA and many state breach laws)
Apple Inc. Superior Court 2013
Apple didn’t violate provision of Song-Beverly Credit Card Act that prohibits merchants for requesting or recording PII.
Pineda vs. Williams Sonoma 2011
Song-Beverly meant to include not only the complete address, but also its components.
What 3 things are needed for Standing?
- ‘injury in fact’
- the injury is fairly traceable
- it is likely that the injury will be redressed by a favorable decision.
TransUnion LLC cs Ramizez 2021
- Standing leading case
- plaintiffs were labelled terrorists
- Plaintiffss were reports were not released, failed to meet standing
Spokeo Inc. v. Robins 2016
- Standing leading case because not all FCRA violations lead to standing.
- This case could not establish injury in fact because no concrete harm.
Clapper vs. Amnesty 2013
- this was a challenge to FISA Court and its relevance to consumer privacy.
- Court decided plaintiff were speculating on possible future injury and that was not sufficient to establish injury.
In re Google Inc. vs Cookie Placement Consumer Privacy Ligit.
- lacked standing because plaintiff couldn’t prove a harm in google’s placement of cookies in Safari.
- Plaintiff couldn’t prove harm that Google interfered with their ability to monetize their personal data.
Resnick v. AvMed, inc. 2012
- Standing established because injury in fact.
2. ability to prove sufficient nexus between data breach and identity theft.
What are the 3 things to prove breach of contract?
- the existence of a contract
- Breach of the contract
- Damages that flow from that breach
Are Privacy Policies Contracts?
Yes, when they make explicit commitments. That is used to support a breach of contract claim.
What are the five Statutes granting enforcement authority to the FTC?
- FTC Act
- GLBA
- COPPA
- TCFAPA
- FCRA
