FAQ: Privacy and Forced Arbitration - Why It Matters

FAQ: Privacy and Forced Arbitration - Why It Matters 
(PDF Version)

How might companies violate your privacy?

Companies have more ways than ever to violate privacy rights.  Explains the Electronic Frontier Foundation, “New technologies are radically advancing our freedoms but they are enabling unparalleled invasions of privacy.”[1]  For example, as one blogger put it, “[B]ecause most modern tech companies provide free services and depend nearly entirely on advertising revenue, their interests in data mining for targeted advertising will always run counter to users’ privacy rights.”[2]  Through social media platforms and other communication tools, technology companies can easily share private messages or search histories, harvest biometric data about users or sell personal information, like geolocation records, to the highest-bidding third party.  Advertisers might use a person’s name and picture to promote online products without permission.

In addition, healthcare providers can release information about a person’s private illness history, treatments and medications without the patient’s consent.  Stores may fail to prevent in-store security breaches, just as banks and lenders can fail to prevent data breaches.  Hotels and employers might even secretly record private conversations without the knowledge or consent of the party whose privacy is being breached, in violation of the law.

What kinds of harms might result from invasions of privacy?

Privacy invasions can have severe consequences for a person’s professional and personal life.  Incorrect, misleading or embarrassing information may hurt someone’s employment potential, making that individual less likely to be hired or more likely to be fired.  Privacy violations can destroy important personal relationships, damage someone’s standing in child custody or other legal proceedings or create a hurtful stigma that follows for a lifetime.  Illegally or illegitimately released personal information can also be used to discriminate.  It might result in increased costs for insurance, products or services.  It can even lead to issues of safety or physical harm if the information is used to stalk or inform criminals of security vulnerabilities.

Identity theft is another possible harm.  Thieves might gain access to someone’s name, address, credit and banking information, social security number, medical insurance or biometric data.[3] With this information criminals can wreak havoc on someone’s life, emptying their bank account,[4] ruining their credit, obtaining medical care under their name and even pretending to be them if ever arrested.[5]  Repairing such damage can take years and cost thousands of dollars, not to mention take a significant psychological and emotional toll on victims and their families.

What kinds of laws protect a person’s privacy?

Many state and federal laws exist to protect the privacy of individuals.  Federal laws that regulate how, when and why a consumer’s data may be intercepted, stored or used include: the Fair Credit Reporting Act[6]; the Driver’s Privacy Protection Act[7]; the Health Insurance Portability and Accountability Act (HIPPA)[8]; the Electronic Communications Privacy Act[9]; the Stored Communications Act[10]; and the Children’s Online Privacy Protection Act.[11]  In addition, some states have laws to protect insurance and library records, student and credit information, tracking technologies and more.  For example, California’s Invasion of Privacy Act[12] bars eavesdropping on private communications and Pennsylvania’s Wiretapping and Electronic Surveillance Control Act[13] prohibits unauthorized access to computer networks, files and systems.

Are these laws enough to ensure that someone’s privacy is protected?

No, laws alone are not enough.  Government agencies are too overworked and under-resourced to effectively monitor and enforce privacy law violations.  For example, as a joint ProPublica/Wired article explained, “The FTC is the lead agency in the government’s effort to ensure that companies do not cross the still-hazy border between acceptable and unacceptable data collection.  But the agency’s ambitions are clipped by a lack of both funding and legal authority,” with the FTC “ill-equipped to find out, on its own, what companies like Google and Facebook are doing behind the scenes.”[14]  In fact, until very recently, the agency only employed a small handful of privacy technologists.[15]

Can private litigation help enforce privacy laws and vindicate rights?

Yes.  Many state and federal privacy laws allow individuals or groups of individuals (classes) to file lawsuits in order to protect their rights.  Through litigation consumers can force a company to stop illegal behavior, obtain compensation for the harms they have suffered and compel public disclosure about privacy violations. 

In the past few years, corporations such as LinkedIn, Six Continents Hotels and many others have been taken to court by consumers – not regulators – to enforce state and federal privacy laws.[16]  For example, in 2013, students and teachers sued Google for allegedly scanning the contents of student Gmail accounts, gathering information and creating personal student profiles that could be used for targeted advertising in violation of state and federal privacy laws, including the Electronic Communications Privacy Act, California’s Invasion of Privacy Act and Maryland’s Wiretap Act.[17]  Google settled the case.  It also agreed to stop reading and mining students’ email for advertising purposes.[18]

Many privacy cases have been brought as class actions.[19]  In 2010, Countrywide Financial, Countrywide Home Loans and Bank of America settled with a class of customers for stealing thousands, perhaps millions, of customers’ private financial information to sell to third parties.  After learning of the breach, Countrywide waited months to inform customers – exposing them to a high risk of identity theft and ruined credit histories – which made it impossible for plaintiffs to secure legitimate loans and lines of credit.  As part of the settlement, class members were eligible to receive up to $50,000 per incident up to a total of $5 million.[20]

In 2007, Bank of America settled with a class of customers for disclosing personal information to third party marketers without consent or notice in exchange for money.[21]  In 2006, Fidelity Federal Bank settled with a class of 565,000 customers for obtaining driver registration information, which it used for marketing, in alleged violation of the Driver’s Privacy Protection Act.  Fidelity agreed to pay $50 million and destroy any personal information of class members that was illegally obtained from motor vehicle records.[22]

What are forced arbitration clauses and class action waivers, and how do they impact consumers’ ability to seek justice for privacy violations?

Forced arbitration clauses – hidden in the fine print of most consumer contracts today and written in legalese that is incomprehensible to most people – prohibit harmed individuals from suing law-breaking companies in court.  Instead, they must resolve their disputes in secretive, corporate- controlled, rigged arbitration systems.  These clauses also typically prevent consumers from joining together with other victims in class action lawsuits. 

Companies have used forced arbitration clauses and class action bans to avoid accountability for violations of customer privacy.  Take social media providers, who, according to a 2014 study, frequently require customers to submit to arbitration in their “terms of use” agreements as a condition of using their services, essentially constructing a “liability-free zone” where consumers have “rights without remedies” if the companies invade their privacy.[23]  This is especially problematic given that such providers include dating, professional networking, photo sharing, apartment finding and communications websites, who possess an incalculable amount of sensitive consumer data.[24]

What is wrong with forced arbitration?

Consumers are extremely disadvantaged in arbitration controlled by companies.  Arbitrators are often in contract with the businesses against which a claim is brought.  Arbitration companies have a financial incentive to side with corporate repeat players who generate most of the cases they handle.  Arbitrators are also not required to have any legal training and they need not follow the law.  Court rules of evidence and procedure that exist to protect consumers do not apply.  Arbitration proceedings are secretive.  Decisions are enforceable with the full weight of the law even though they may be legally incorrect.  This is extremely disturbing because such decisions are binding.  Sometimes, victims must split the sizeable costs of arbitration with the defense.  But even if the defense handles the costs, this gives them the ability to “freeze” a proceeding in the rare situation where it seems the arbitrator is moving against them.[25]

Why should victims of privacy violations have access to the courts?

With money and politics already dominating the executive and legislative branches of government, America’s court system is one of the only places left in America where everyday people can successfully confront powerful industries and institutions.  Indeed, the right of harmed or violated people to vindicate their rights in court is a fundamental precept of American democracy.  More specifically, class actions, which allow people to band together in a lawsuit, are one of the most important tools of justice for victims of privacy violations.  Where a company may have acquired a large financial windfall by violating the privacy of large numbers of people, class actions are often the only way for victims to hold the company accountable.  Victims then have the option of seeking compensation as well as the ability to ask a court to stop the violations.[26]  They also have the right to appeal an unfair initial decision.[27]  Forced arbitration eliminates these options.

NOTES