# Presentation: 665774

## <date/time>

## Session 55

***Internet Privacy Laws***

- Session 55-

## Background

- There really aren’t any per se privacy laws.
- Instead, there is a patchwork of federal and state laws that are potentially applicable.
- We will cover these areas and see if we can identify some useful constructs.

- Session 55-

***Should You Have a Privacy Policy ***
***and What Should it Say?***
*This is the question that always comes up.*
*Perhaps the answer is that you need privacy practices and in some cases privacy policies.**** ***

- Session 55-

## Privacy Issues

- A college or university that deals with student records, financial aid information or health care information online may have to deal with a number of privacy issues.
- The irony is that, with certain limited exceptions, there is no legal requirement for a web site operator to have a privacy policy.

- Session 55-

## Privacy -- the Legal Framework

- There are no comprehensive federal privacy laws -- instead, specific federal laws were enacted to deal with particular types of privacy abuses.
- Privacy law is largely based on state law.
- The FTC has jurisdiction to challenge "unfair or deceptive practices," which can include failure to comply with privacy promises.

- Session 55-

## State Privacy Laws

- Generally based on four common law causes of action.
- 1) Intrusion into another’s solitude or seclusion;
- 2) Public disclosure of sensitive private facts;
- 3) Misappropriation of name/likeness;
- 4) Presentation of another in a “false light”.
- May have claims for misappropriation of personal information

- Session 55-

## Federal Privacy Laws

- Generally these only deal with specific types of situations.
- They are not always consistent with one another.
- Furthermore, some of them leave unanswered important questions on how to comply.

- Session 55-

## Federal Privacy Laws

*Children’s Online Privacy and Protection Act* (COPPA).  Applies to web sites or online services “directed” to children under 13 **or** general audience web sites that have *actual knowledge* of collecting personal information from children.
- Requires a posted privacy notice, but probably not applicable to most college/ university web sites.

- Session 55-

## Federal Privacy Laws (cont.)

*Family Educational Rights and Privacy Act *(FERPA). Generally requires educational institutions that receive federal funds to keep students’ personally identifiable education information (such as grades or application information) private.
- Does not require a privacy policy, but if a school maintains student information on a web site, must be careful to keep it private.

- Session 55-

## Federal Privacy Laws (cont.)

- FERPA appears to be strict liability - good faith effort **may not be** **enough**.
- No exception for security breaches?
- Recent example at University of Montana (accidental posting of psychological records of 62 children and teenagers).

- Session 55-

## Federal Privacy Laws (cont.)

*Gramm-Leach-Bliley Act* (GLB Act).  Requires that “financial institutions” (broadly defined) issue privacy notices to their customers and, in certain circumstances, provide them with the opportunity to opt out of disclosures.
- If a school deals with students’ financial information online, a privacy notice may be required.

- Session 55-

## Federal Privacy Laws (cont.)

- Compliance with FERPA with respect to student financial data will be deemed compliance with the GLB Act.
- Creates a loophole for financial aid? But does not necessarily cover all financial data gathered and disseminated online.
- Also, affiliates may not be entitled to GLB Act exemptions.

- Session 55-

## Federal Privacy Laws (cont.)

*Office of Health and Human Services Rule* (HHS Rule). Establishes that consumers have the right to receive written notice of information practices of health care providers that conduct certain transactions electronically.
- If a school has a health care provider (i.e., a student health clinic), may need “written notice” of electronic information practices.

- Session 55-

## Federal Privacy Laws (cont.)

*Electronic Communications Privacy Act* (ECPA).  Generally forbids the interception, use, and disclosure of private e-mail.
- Does not require a posted privacy policy, but recent cases have found no liability under the ECPA where privacy policies existed. (Similarly, a privacy policy could serve to dispel the “reasonable expectation of privacy” under the Fourth Amendment.)

- Session 55-

## Additional Federal Law Considerations

- FTC has enunciated five core privacy principles --  notice, choice, access, security, and enforcement -- and encourages companies to follow them.  Voluntary industry self policing thus far has convinced regulators not to act.
- Nevertheless, nearly 50 privacy bills await consideration by Congress.

- Session 55-

## So Why Adopt a Privacy Policy?

- One of the federal laws may require it.
- Federal government may adopt one for you if you don’t.
- Consumers may expect it -- it can be used as a marketing tool (with disclaimers).
- More important, lessons from the case law illustrate that an effective privacy policy may reduce exposure to privacy lawsuits.

- Session 55-

## Lessons from the Case Law #1

- Lesson #1:  ***If you have a privacy policy, you must follow it.***  The FTC has brought a number of unfair or deceptive practices lawsuits where the defendant companies failed to collect or use the personal information in accordance with their own privacy policy.

- Session 55-

## Lessons from the Case Law #2

- Lesson #2:  ***Privacy policies that truthfully disclose information collection practices can be helpful in defending lawsuits.***  Courts have dismissed complaints relating to certain information practices where the consumer has consented to the practice.  (Of course need to consider how to evidence agreement.)

- Session 55-

## Drafting Privacy Policies

- Should follow the FTC’s core principles and fully disclose information practices.
- Policy should reflect various information practices taking into account changes -- should be accompanied by an internal assessment of all information practices.

- Session 55-

## Drafting Privacy Policies

- Avoid being overly legalistic and remember the audience.
- May need more than one privacy policy - for example, rules change when a prospective student becomes a student (GLB Act and FERPA).

- Session 55-

## Sample Privacy Policies

- Session 55-

## Sample Privacy Policies (cont.)

- Session 55-

## Sample Privacy Policies (cont.)

- Session 55-

## Additional Complexities

- International considerations, such as the EU privacy directive and safe harbor.
- Use and combination of information collected online with information collected offline.
- What rules apply to personal information about a person other than the person who submits it?

- Session 55-

## SFA Tech Slide

- We appreciate your feedback and comments.  We can be reached:
- Peter Cassat
- Dow, Lohnes & Albertson
- (202) 776-2724
- pcassat@dlalaw.com

- Session 55-