1. CHAPTER Cybertorts, Privacy, and Government Regulation Cybertorts, Privacy, and Government Regulation 11

2. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-2 Cybertorts Because of the ability of the Internet to amplify two torts are particularly important Defamation More people witness defamatory remarks because of the Internet Invasions of Privacy Internet facilitates lost cost acquisition, aggregation, and distribution of personal information Because of the ability of the Internet to amplify two torts are particularly important Defamation More people witness defamatory remarks because of the Internet Invasions of Privacy Internet facilitates lost cost acquisition, aggregation, and distribution of personal information

3. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-3 Defamation Pl. in defamation cases must show Def. made untrue statements about him The statements were published or reproduced in some way Pl.’s reputation was harmed as a result If the def. is the media and the pl. is a public figure, then the pl. must also show the def. –Knew the statements were true or –had a reckless disregard for the truth Pl. in defamation cases must show Def. made untrue statements about him The statements were published or reproduced in some way Pl.’s reputation was harmed as a result If the def. is the media and the pl. is a public figure, then the pl. must also show the def. –Knew the statements were true or –had a reckless disregard for the truth

4. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-4 Defamation Publisher liability Publishers are as liable as the author of defamatory material Distributors (newsstands and libraries) are not liable for libelous material unless they –Know or should know that material they are distributing is libelous –The first Internet libel cases treated ISPs as distributors and thus exonerated them from liability if they did not supervise the content of what was posted on their server Publisher liability Publishers are as liable as the author of defamatory material Distributors (newsstands and libraries) are not liable for libelous material unless they –Know or should know that material they are distributing is libelous –The first Internet libel cases treated ISPs as distributors and thus exonerated them from liability if they did not supervise the content of what was posted on their server

5. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-5 Defamation In the Stratton case a court held an ISP liable because the ISP claimed it supervised content to eliminate “adult” material –the consequence was that ISPs who tried to weed out porn incurred greater liability for defamation –Congress came to the rescue with the Communications Decency Act (CDA) of 1996 The CDA requires the courts to treat ISPs as distributors rather than publishers The CDA also preempts state defamation laws Qualifying as an ISP yields benefits--reprinting erroneous stock tips does not make the ISP liable In the Stratton case a court held an ISP liable because the ISP claimed it supervised content to eliminate “adult” material –the consequence was that ISPs who tried to weed out porn incurred greater liability for defamation –Congress came to the rescue with the Communications Decency Act (CDA) of 1996 The CDA requires the courts to treat ISPs as distributors rather than publishers The CDA also preempts state defamation laws Qualifying as an ISP yields benefits--reprinting erroneous stock tips does not make the ISP liable

6. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-6 Defamation The CDA protection of ISPs also extends to reproductions of online reporters Some foreigners have sued U.S. businesses for material posted on their web sites Whether there is jurisdiction for such suits is questionable An additional question is whether exemptions under U.S. law shield U.S. firms from defamation suits launched in foreign countries The CDA protection of ISPs also extends to reproductions of online reporters Some foreigners have sued U.S. businesses for material posted on their web sites Whether there is jurisdiction for such suits is questionable An additional question is whether exemptions under U.S. law shield U.S. firms from defamation suits launched in foreign countries

7. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-7 Invasions of Privacy Common law invasions of privacy are based on –Intrusion into the plaintiff’s solitude –Public disclosure of embarrassing private facts –Publicity that places the pl. in a false light –Wrongful appropriation of the pl.’s name or likeness for commercial purposes The common law protects a person’s reasonable expectation of privacy –In order for the govt. to search a person or his property, the govt. has to show probable cause to believe that a crime has taken place Common law invasions of privacy are based on –Intrusion into the plaintiff’s solitude –Public disclosure of embarrassing private facts –Publicity that places the pl. in a false light –Wrongful appropriation of the pl.’s name or likeness for commercial purposes The common law protects a person’s reasonable expectation of privacy –In order for the govt. to search a person or his property, the govt. has to show probable cause to believe that a crime has taken place

8. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-8 Electronic Communications Privacy Act (ECPA) 1986 The ECPA extended the protections of the Omnibus Crime Control and Safe Streets Act of 1968 –ECPA made it illegal to wiretap phone calls Most people have a reasonable expectation of privacy for their private phone calls ECPA added protection for email, cellular phones, radio pagers and computer transmissions Protects both storage and transmission of digitized textual information, voice mail and customer records of ISPs –ECPA made it illegal for the govt. to obtain or intercept such communications except with a court order The ECPA extended the protections of the Omnibus Crime Control and Safe Streets Act of 1968 –ECPA made it illegal to wiretap phone calls Most people have a reasonable expectation of privacy for their private phone calls ECPA added protection for email, cellular phones, radio pagers and computer transmissions Protects both storage and transmission of digitized textual information, voice mail and customer records of ISPs –ECPA made it illegal for the govt. to obtain or intercept such communications except with a court order

9. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-9 Govt. Intrusions More recently there have been a lessening of protection of electronic communications from govt. intrusions USA Patriots Act has made it easier for the govt. to get records for ISPs or to intercept email Carnivore is an FBI software tool that investigates every email transmission from an ISP for such words as “bomb” or “biological agents” Since 911, there has been an increase in all kinds of govt. surveillance More recently there have been a lessening of protection of electronic communications from govt. intrusions USA Patriots Act has made it easier for the govt. to get records for ISPs or to intercept email Carnivore is an FBI software tool that investigates every email transmission from an ISP for such words as “bomb” or “biological agents” Since 911, there has been an increase in all kinds of govt. surveillance

10. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-10 Private Intrusions Courts use the reasonable expectation of privacy concept to find that Hidden cameras in bathrooms or bedrooms are an invasion of privacy –Same applies to conversations with doctors, psychiatrists, or financial advisors –In general it is not reasonable to expect privacy about things that are revealed online –To date, use of cookies and other surreptitious software that reports data to web sites and advertisers without first obtaining permission of users is not illegal –It is an actionable breach of contract for a web site to not adhere to the statements made in its privacy policy Courts use the reasonable expectation of privacy concept to find that Hidden cameras in bathrooms or bedrooms are an invasion of privacy –Same applies to conversations with doctors, psychiatrists, or financial advisors –In general it is not reasonable to expect privacy about things that are revealed online –To date, use of cookies and other surreptitious software that reports data to web sites and advertisers without first obtaining permission of users is not illegal –It is an actionable breach of contract for a web site to not adhere to the statements made in its privacy policy

11. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-11 Government Actions to Protect Privacy FTC has led govt. action to protect consumer privacy FTC thinks that web sites should adhere to the Five Fair Information Principles: –Notice/Awareness—right to be notified if someone is collecting information about you –Choice/Consent—right to opt out of having information about you collected –Access/Participation—right to see files collected about you and right to offer corrections –Integrity/Security—right to have personal files collected about you be secure –Enforcement/Redress—right to sue if any of the first four FIPs are violated FTC has led govt. action to protect consumer privacy FTC thinks that web sites should adhere to the Five Fair Information Principles: –Notice/Awareness—right to be notified if someone is collecting information about you –Choice/Consent—right to opt out of having information about you collected –Access/Participation—right to see files collected about you and right to offer corrections –Integrity/Security—right to have personal files collected about you be secure –Enforcement/Redress—right to sue if any of the first four FIPs are violated

12. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-12 Government Actions to Protect Privacy FTC has prosecuted firms that make false claims in their privacy policies Note that various branches of govt. have not been careful or efficient in their control of personal information Privacy Act of 1974 basically prohibits nonconsensual use of personal information collected by branches of the fed. govt. –There are many exceptions to the Privacy Act of 1974 –Confidentiality of student records are protected by the Buckley- Pell Amendment FTC has prosecuted firms that make false claims in their privacy policies Note that various branches of govt. have not been careful or efficient in their control of personal information Privacy Act of 1974 basically prohibits nonconsensual use of personal information collected by branches of the fed. govt. –There are many exceptions to the Privacy Act of 1974 –Confidentiality of student records are protected by the Buckley- Pell Amendment

13. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-13 Government Actions to Protect Privacy State privacy laws are a crazy quilt that are Difficult to comply with and are not coordinated or uniform Recognizing that states cannot regulate the Internet, Congress passed the Identity Theft and Assumption Deterrence Act of 1998 –It is a felony to steal someone’s identity with penalties up to 15 years in jail –Identity theft occurs when someone appropriates your personal information without your knowledge to commit fraud Identity thieves often make use of a person’s SS# and credit card numbers State privacy laws are a crazy quilt that are Difficult to comply with and are not coordinated or uniform Recognizing that states cannot regulate the Internet, Congress passed the Identity Theft and Assumption Deterrence Act of 1998 –It is a felony to steal someone’s identity with penalties up to 15 years in jail –Identity theft occurs when someone appropriates your personal information without your knowledge to commit fraud Identity thieves often make use of a person’s SS# and credit card numbers

14. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-14 Government Actions to Protect Privacy Children’s Online Privacy Protection Act, 1998 Makes it illegal to obtain online information from children (under 13) without consent of parents Consent from parents must be verifiable Applies to web sites that directed at children Web sites must establish protections for data collected from children so that it is not distributed in ways that are illegal Children’s Online Privacy Protection Act, 1998 Makes it illegal to obtain online information from children (under 13) without consent of parents Consent from parents must be verifiable Applies to web sites that directed at children Web sites must establish protections for data collected from children so that it is not distributed in ways that are illegal

15. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-15 Gramm-Leach Bliley Act, 1999 Title V of the Act Protects nonpublic financial information –Financial institutions must insure security and confidentiality of customer records –Must provide protection against hackers by anticipating threats or hazards –Prohibits disclosure of personal financial information unless the customer is notified Customers must have an opportunity to opt out of disclosure of their information to third parties Prohibits disclosure of such information to telemarketers Title V of the Act Protects nonpublic financial information –Financial institutions must insure security and confidentiality of customer records –Must provide protection against hackers by anticipating threats or hazards –Prohibits disclosure of personal financial information unless the customer is notified Customers must have an opportunity to opt out of disclosure of their information to third parties Prohibits disclosure of such information to telemarketers

16. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-16 Health Insurance Portability and Accountability Act (HIPAA) Part of the act deals with preexisting medical conditions and health insurance Other part deals with protection of the privacy of medical records HIPAA regulations become enforceable April 2003 –These regulations make nonconsensual secondary disclosure of personally identifying medical records illegal, but there are a number of exceptions –Between healthcare providers, HMOs, and insurance companies there are no prohibitions on sharing records except for psychiatric records Part of the act deals with preexisting medical conditions and health insurance Other part deals with protection of the privacy of medical records HIPAA regulations become enforceable April 2003 –These regulations make nonconsensual secondary disclosure of personally identifying medical records illegal, but there are a number of exceptions –Between healthcare providers, HMOs, and insurance companies there are no prohibitions on sharing records except for psychiatric records

17. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-17 Health Insurance Portability and Accountability Act (HIPAA) Among the exceptions allowed by HIPAA are for –Public health officials who are tracking various diseases and epidemics –Medical researchers –Law enforcement –Officials who are investigating fraud in medicare –There are a number of other exceptions HIPAA is a federal program that should make privacy laws more uniform that the current set of state laws Among the exceptions allowed by HIPAA are for –Public health officials who are tracking various diseases and epidemics –Medical researchers –Law enforcement –Officials who are investigating fraud in medicare –There are a number of other exceptions HIPAA is a federal program that should make privacy laws more uniform that the current set of state laws

18. McGraw-Hill/Irwin Legal Environment of Business in the Information Age © 2004 The McGraw-Hill Companies, Inc., All Rights Reserved. 1-18 European Union The EU has perhaps more protection for privacy than in the U.S. The Data Protection Directive of 1995 prohibits sharing of information with any nation that does provide adequate protection for personal data In 1999 the U.S. Dept. of Commerce worked out a safe harbor regulation that has so far satisfied the EU –If a U.S. firm complies with the safe harbor regulation, EU firms can share data with the firm The EU has perhaps more protection for privacy than in the U.S. The Data Protection Directive of 1995 prohibits sharing of information with any nation that does provide adequate protection for personal data In 1999 the U.S. Dept. of Commerce worked out a safe harbor regulation that has so far satisfied the EU –If a U.S. firm complies with the safe harbor regulation, EU firms can share data with the firm