E-Commerce Law Week, Issue 561

CDA Immunity Survives Another Test

A federal court in Texas recently ruled that MySpace may retain immunity under the Communications Decency Act (CDA) for information that users were prompted -- but not required -- to provide when creating a new MySpace profile.  In Jane Doe IX v. MySpace, Inc., a mother sued on behalf of her 15-year-old daughter, who was allegedly "lured from her home and sexually assaulted by a sexual predator ... who communicated with her and ultimately orchestrated his sexual assault of her through the MySpace.com website.”  The plaintiffs sued MySpace for "negligence ... and ... failing to implement reasonable safety measures to protect minors."  MySpace moved to dismiss under section 230(c)(1) of the CDA, which states that "[n]o provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider."

Breach Notification Laws to Take Effect in Alaska and South Carolina on July 1

Two more states will soon begin enforcing data breach notification requirements.  As we previously reported, Alaska governor Sarah Palin signed a bill in June 2008 that will require any person or business that owns or licenses the personal information of a state resident to notify the resident if this information is breached, subject to a risk of harm threshold.   And South Carolina governor Mark Sanford signed a bill in April 2008 that will require any person that does business in the state, "own[s] or licens[es]" data that includes "personal identifying information," and discovers a breach of this information to notify any affected state residents "whose personal identifying information ... was not rendered unusable through encryption, redaction, or other methods."  The South Carolina law requires notification only if the personal information "was, or is reasonably believed to have been, acquired by an unauthorized person," and "illegal use of the information has occurred or is reasonably likely to occur or use of the information creates a material risk of harm to the resident."  Both states' laws take effect on July 1, 2009.

FTC Action Requires Prominent Notice and Express Consent Before Use of Tracking Software

Sears Holdings Management Corporation (SHMC) has agreed to settle Federal Trade Commission charges stemming from its alleged failure to "disclose adequately" that software it offered to visitors to sears.com and kmart.com would monitor their Internet use and send this information to SHMC's servers.  As part of the settlement, SHMC agreed to: obtain customers' express consent to the download or installation of any tracking software; make a prominent post to the SHMC website to inform existing users of the software that it was tracking their Internet use; assist consumers in uninstalling the tracking software; cease collecting data transmitted by any software installed before the agreement; and destroy any information collected by the software.  SHMC also agreed to "[c]learly and prominently" notify consumers of the tracking functions in any future SHMC software prior to its installation and outside of any license agreement -- including by disclosing the types of data collected, "how the data may be used," and "whether the data may be used by a third party."

United States Freezes Online Poker Players' Funds, While Europe Condemns U.S. Restrictions On Internet Gambling

The U.S. crackdown on Internet gambling has continued despite the change in Administration.  Now, in a new twist, prosecutors have taken action that directly affects individual gamblers rather than just gambling sites or their service providers.  Moreover, the action targets poker, whereas most previous actions have targeted sports-related betting.  Federal prosecutors for the Southern District of New York have reportedly requested that at least four banks -- Citibank, N.A., Wells Fargo, Goldwater Bank, and Alliance Bank of Arizona -- freeze accounts containing over $30 million in deposits and winnings of individuals who play poker on offshore websites.  The accounts reportedly belong to payment processors Allied Systems and Account Services, which broker transactions between these players and the poker websites.  Meanwhile, the European Commission has released a staff report that concludes that the U.S. restrictions on Internet gambling violate the General Agreement on Trade in Services (GATS).  And the state of Minnesota has backed off its demand that communications providers prevent computers in the state from connecting to gambling websites.

Questions and comments about E-Commerce Law Week are always welcome.  Please send your feedback to Sally Albertazzie.