| Lane et al. v. Facebook et al. | |
|---|---|
| File:California-northern.gif | |
| Court | Northern District of California |
| Full case name | Sean Lane, et al., v. Facebook, Inc, Blockbuster Inc, Fandango Inc, Hotwire, Inc, STA Travel Inc, Overstock.com, Inc, Zappos.com, GameFly, Inc |
| Argued | September 14 2007 |
| Decided | March 17 2010 |
| Holding | |
| Facebook was held accountable for breaching security policy and releasing user personal information onto the Facebook page. | |
| Court membership | |
| Judge sitting | Richard Seeborg |
On March 17, 2010, Judge Richard Seeborg issued an order approving the class settlement in Lane v. Facebook, the class action lawsuit arising out of Facebook's Beacon program. In this class action in the Northern District of California, the defendant, Facebook was charged with failing to obtain informed consent from the consumers. Without getting this consent, Facebook placed private information on consumers on the pages which were posted to the public. This case comes down to the fact that Facebook and the other Beacon affiliated companies traded information about the consumers and failed to tell them about it. The Beacon affiliated companies are Blockbuster Inc, Fandango Inc, Hotwire Inc, STA Travel Inc, Overstock.com Inc, Zappos.com Inc, and GameFly Inc. The plaintiffs claimed that this was a huge breach of the privacy on many federal and state levels. The parties met multiple times between December 9th, 2008 and July 28, 2009. The parties reached an internal agreement during a private mediation. Facebook ended up terminating the Beacon program, and created a $9.5 million dollar fund for privacy and security. There was no money handed out to Facebook users that were affected negatively by the Beacon program.
In this case, Facebook users are seeking recovery based on the allegation that Facebook failed to get informed consent from the consumers before posting their personal information on the Facebook page. The plaintiffs claim that through the Beacon program, Facebook obtained information about their specific transactions. The Facebook users claim that this is against many federal and state privacy laws, and it is because of this that they are suing Facebook and the other companies that are involved in the Beacon program.
Initially this motion was brought individually on behalf of all Facebook users that had been affected by this service, and used it without their knowledge between November and December of 2007. [1]The Plaintiffs claimed that Beacon had breached many of their privacy rights and violated the Electronic Communications Privacy Act (“ECPA”), the Video Privacy Protection Act (“VPPA”), the Computer Fraud and Abuse Act (“CFAA”), the California Consumer Legal Remedies Act (“CLRA”), and the California Computer Crime Law (“CCCL”). Because Facebook had not made it clear that they were starting this service, this act was considered a privacy breach. After hearing the complaints, Facebook filed the dismiss the case on October 10, 2008. However, the parties ended up agreeing to a settlement after having private talks. It took almost 8 months for the two parties to reach an agreement.
Facebook established a cash settlement fund of nine million five hundred thousand dollars. [2] The money was used to establish and operate a privacy foundation which was devoted to funding and sponsoring programs designed to educate users. The privacy foundation has sole responsibility of the management and distribution of its funds. In addition to the 9.5 million dollars, Facebook also had to provide the following relief:
Throughout this entire process, Facebook denied any wrongdoing whatsoever on their part or on the part of any of the companies involved with them. Facebook and the remaining companies claim that they have complied with all laws and therefore deny that the plaintiffs are entitled to any form of damages based on the conduct that has been described. Also, the Defendants claim that they have defenses to all claims that have been alleged, and that they are ready to defend against these claims.
There are a number of requirements that the court needs to make sure that the case satisfies for settlement purposes. Once these prerequisites are shown to be satisfied the law says that there can be a class action where the questions of fact do not need to be limited merely to that on the individual level, but they can pertain to members of the entire class.
Numerosity is one of the prerequisites that needs to be met in order for the settlement class to be certified. Numerosity means that the class is large in size and that it is not possible or not practical for everyone in the class to convene at the same time. Fed. R. Civ. P. 23(a)(1). There isn't really a specific number of people that the class needs to meet to satisfy this requirement. Usually if there are more than 40 member in the class the requirement is easily satisfied. In the case of Facebook the number of people affected by the Beacon program is is estimated to be in the millions of individuals. This is easily enough to satisfy the numerosity requirement. [4]
Commonality is the second prerequisite that needs to be met in order for the settlement class to be certified. Commonality means that there are questions of law or fact which are common amongst all the members of the class. ed. R. Civ. P. 23(a)(2). The class can show commonality by either showing shared legal issues with different facts or that they all share a core set of facts but the claims for relief are on different legal theories. This can be seen in the Dukes v. Walmart case. [5] All you need is just one common and significant issue and this will be enough to get certification. In regards to this case, all the Facebook users had the common issue that Facebook released their private information about their purchases and rentals onto the internet. The Beacon program release information that was personally identifying and there was no adequate notice or consent, and also no way to opt out of the program.
This common issue among class members results in many common factual and legal questions which the motion describes:
In addition, such common questions for the settlement include whether the settlement is fair, and what is the proper form of notice. Because of these reasons the court saw it that the commonality requirement was satisfied.
Typicality is the third prerequisite that needs to be in order for the settlement class to be certified. Typicality looks at the relationship of the facts and issues between the class and its representatives. Dukes, 509 F.3d at 1184 fn.12. The general definition of typicality is "under the rule’s permissive standards, representative claims are ‘typical’ if they are reasonably coextensive with those of absent class members; they need not be substantially identical; some degree of individuality is to be expected in all cases, but that specificity does not necessarily defeat typicality” In this case, the Facebook users claimed that Facebook had caused unauthorized disclosure of personal information on the website. The Plaintiffs resulted in having their privacy rights violated in breach of the state and federal law. Since all the Plaintiffs were subject to identical actions from Facebook, these claims were seen as typical, and the courts requirement of the claims being typical was met. [4]
Adequate Representation is the fourth and final prerequisite that needed to be met. This means that even though not everyone from the class is present, the people that are present will "fairly and adequately protect the interests of the class.” Fed. R. Civ. P. 23(a)(4). The class needs to be represented by people that qualified and also people that don't have any conflict of interest with the proposed class. With respect to this case, since all the people in the class and the people that are representing them have been affected by the same problems from Facebook, we can assume that there is no conflict of interest. Also, the class counsel were all well respected members of the legal community, have engaged in complex litigation in the past, and have had consumer class action lawsuit experience in the past. Because of these things, the Plaintiffs and the class Counsel will both be adequate representation for the rest of the class. [4]
The Electronic Communications Privacy Act of 1986 was passed to put restrictions on the United States government from putting wiretaps on telephone calls. It would basically be possible to get any information about a person without their knowledge.
Although not as extreme, in Facebook's case, they were getting information about the users from third parties and Facebook users claimed that this was without the direct permission of the user. The act only mentions phones but people feel that it can be generalized to other forms of media such as rental records.
The Video Privacy Protection Act of 1988 was passed when Supreme Court nominee Robert Bork's video rental records were placed into the newspaper. This act shows the protection that consumers get from organizations that are trying to collect their data. If the information that they are going to collect will make it possible to identify the individual and the items that they purchased, this act will prevent it.
Although this act only talks about video rentals, you can assume that they also include other rental records such as DVDs and Video games which are also rented often. Since you can apply the language of this act broadly to anything that is rent or bought, this becomes a very applicable privacy law with respect to the Lane v. Facebook case. Facebook user purchase information was being collected from various different companies that were participating in this program. Facebook would then take this information and post it on the Facebook site for other users to see. This was an infringement of a users privacy as we can derive from this Act.