Latest / The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store / Class Actions in Privacy with John Yanchunis and Punit Bhatia in the FIT4PRIVACY Podcast E152 S07

Transcript

Class Actions in Privacy with John Yanchunis and Punit Bhatia in the FIT4PRIVACY Podcast E152 S07 · The FIT4Privacy Podcast | Exploring ISO Standards AI Privacy | Grow Skills Store

• 0:00
  Class sections in privacy, have you heard about that?
• 0:03
  Well, yes, Sir, if you're in Europe, you may not have, but if
• 0:07
  you are in US, it's a common thing.
• 0:09
  Of course, class sections are very common in many other
• 0:12
  dimensions or many other cases in the US, but in Europe, it's
• 0:17
  not the case. And we have someone with us
• 0:21
  who's going to guide us on class actions in the US and how these
• 0:25
  help or how he helped people protect their data.
• 0:28
  And we are going to have a fascinating conversation with
• 0:31
  Jean Jeanetunes. I hope I pronounced his name
• 0:34
  well, but the conversation is going to be fascinating.
• 0:37
  And before we go there, take advantage of Close Skills dot
• 0:40
  Store. We offer ISO standard and EU
• 0:43
  regulation courses for everyone. Take advantage.
• 0:46
  And if you are a corporate want training in your company, that's
• 0:49
  also possible. So let's go and listen to John
• 0:52
  in Class Actions in Privacy, another episode of the Fit for
• 0:56
  Privacy podcast. Hello and welcome to the Fit for
• 1:06
  Privacy podcast with Punit Bhatia.
• 1:09
  This is the podcast for those who care about their privacy.
• 1:13
  Here, your host, Punit Bhatia has conversations with industry
• 1:16
  leaders about their perspectives, ideas, and
• 1:18
  opinions relating to privacy, data protection, and related
• 1:22
  matters. Be aware that the views and
• 1:24
  opinions expressed in this podcast are not legal advice.
• 1:28
  Let us get started. Hello and welcome to another
• 1:34
  episode of the Fit for Privacy podcast.
• 1:37
  And today we are going to discuss a conversation on
• 1:40
  privacy focused around class action suits.
• 1:43
  And we have a special person named John with us.
• 1:46
  Welcome, John to Fit for Privacy Podcast.
• 1:48
  Thank you so much, happy to be here.
• 1:50
  So, John, let's start with a very basic question.
• 1:54
  What does data privacy mean for you?
• 1:59
  Data privacy means the control by the individual of their
• 2:03
  personal information, how they choose to share it, how they
• 2:07
  choose not to. It's a question of sometimes
• 2:10
  choice, as well as in connection with the way people interact
• 2:13
  with apps on the Internet or with just companies.
• 2:18
  What's disclosed to them in so far is if information is being
• 2:23
  given, how it's being used or maintained.
• 2:25
  That's very well said. That's what I usually in my
• 2:28
  conversations of speeches also talk about.
• 2:31
  Data privacy is about choice, choice of the individual to
• 2:34
  share their information and what they choose to share with who
• 2:37
  they want to share. But then when this information
• 2:42
  is misused, that creates issues because like bank numbers or
• 2:47
  this bank account numbers or passwords are disclosed, that
• 2:51
  creates issues. So have you seen in some misuses
• 2:55
  of personal data or what kind of misuses have you seen?
• 2:59
  So let me draw a dichotomy, a division between data breach
• 3:04
  litigation and data misuse. That's the way I define or view
• 3:08
  potential claims and litigation in this space.
• 3:12
  So in connection with data misuse, consumers have given
• 3:16
  their information or their information has been harvested
• 3:20
  through some interaction they may have with an app, some other
• 3:24
  site on the Internet. And they were not given
• 3:27
  transparency in so far as how that information was being
• 3:30
  collected, if it was being collected and then how it was
• 3:34
  being used. So consent is not a one way St
• 3:37
  it's not a one proposition fits all.
• 3:40
  So for instance, there's different kind of consents.
• 3:42
  I may give my information to a particular company for a
• 3:46
  particular purpose, but that doesn't mean I'm consenting for
• 3:49
  its use for all purposes. And the type of misuse
• 3:53
  litigation that I've had experience in is against some of
• 3:57
  the big tech companies. X formally Twitter for instance,
• 4:03
  a case involving the harvesting of information, despite the fact
• 4:08
  that X represented to consumers that that information would not
• 4:13
  be used or certain information would not be collected and used
• 4:18
  by that platform. Google is another company that
• 4:22
  I've had misuse litigation, both the Incognito on Chrome browser
• 4:27
  as well as the Firebase component.
• 4:31
  Again, people were given the impression or the belief that
• 4:35
  they had made decisions that that information would not be
• 4:39
  harvested by Google, and in fact it was.
• 4:44
  The Incognito case was settled a couple years ago.
• 4:48
  It's now on appeal. The other case going to trial
• 4:51
  against Google involves Firebase, the app, and that's
• 4:55
  going to trial in August of this year.
• 4:58
  OK. So that's interesting that you
• 5:01
  specify that when we talk about misuse, there is the misuse of
• 5:06
  data on intention or by purpose or lack of transparency by a
• 5:11
  company and that can be challenged.
• 5:13
  But you also mentioned that data breach is another type of
• 5:17
  misuse, though that's by other actors reaching into the system.
• 5:22
  How do you see that part? Well, there's certainly been an
• 5:24
  explosion of of that. I think in terms of the just
• 5:29
  overall cost to companies and consumers, it's projected to be
• 5:33
  $11.6 trillion burden on companies and consumers.
• 5:39
  So in connection with data breaches, companies have been
• 5:44
  collecting information for some time.
• 5:46
  It's perceived and thought of as the new oil, the currency of the
• 5:51
  21st century. And information has great value.
• 5:54
  We've seen some of the biggest companies now on the face of the
• 5:57
  earth in terms of cap value. It's not really creating
• 6:01
  anything. They gather information and they
• 6:04
  use that information to generate revenue.
• 6:07
  I mentioned Google, certainly X, formerly Twitter, and Meta,
• 6:12
  formerly Facebook, are all companies that take information
• 6:18
  and they monetize it. There was a, a very famous bank
• 6:22
  robber back in the United States in the 30s and 40s by the name
• 6:25
  of Willie Sutton. And Willie was arrested.
• 6:29
  And while he was incarcerated, it's alleged that a reporter
• 6:34
  asked him, Willie, why do you rob banks?
• 6:36
  And he said, well, that's where the money is.
• 6:39
  So think about that in terms of data breach litigation.
• 6:44
  The money information or personal information is being
• 6:49
  held by various companies in connection with the operation of
• 6:53
  their enterprises and that is where criminals go to get their
• 7:00
  money. That the information that they
• 7:01
  can then turn into money whether it be through bulk sales or
• 7:08
  using it for engaging in identity theft.
• 7:12
  Sure, but that does make sense that people are interested in
• 7:17
  the data and data is the new gold as we call it, or that's
• 7:20
  where the info money is. But then if someone's has that
• 7:26
  suspicion or someone has that evidence that the information
• 7:29
  has been misused. Now in US, because compared to
• 7:33
  EUEUU have the recourse through the GDPR and other privacy laws.
• 7:38
  But in US, there's this culture of class action suits even in
• 7:42
  other domains, but also in privacy.
• 7:44
  So how does that work in a class section suite?
• 7:46
  When can somebody consider it? Maybe let's start with the ven
• 7:50
  part. When is it an appropriate moment
• 7:53
  for somebody to say my data is misused and I should consider a
• 7:57
  class section? I think when they found out,
• 7:59
  when, When a consumer finds out that their information has been
• 8:02
  taken, usually through an e-mail or letter from a company that's
• 8:07
  been subjected to a data breach, depending upon the nature of the
• 8:12
  information, it's my contention that injury has occurred.
• 8:16
  They're both at a present and increased risk of identity theft
• 8:20
  and they should take action. Companies in the wake of a data
• 8:23
  breach tell consumers you need to protect yourself.
• 8:26
  You need to monitor your accounts.
• 8:29
  You should consider signing up for an identity theft product.
• 8:34
  The problem with some of those products offered by consumers is
• 8:37
  there for a short period of time, 1-2 or three years at
• 8:40
  tops, when in fact the injury continues for the lifetime of
• 8:44
  the consumer because their information can be used and
• 8:47
  misused to engage in identity theft for the rest of their
• 8:51
  lives. So a product necessary to
• 8:56
  protect them is identity theft product for their lifetime, so
• 9:00
  that there is a third party now monitoring potential misuse so
• 9:05
  that consumers can protect themselves.
• 9:08
  So I don't a spouse that a consumer needs to wait until
• 9:13
  they actually have had identity theft occur and a monetary loss
• 9:18
  occur before they've been damaged.
• 9:22
  And I think when they receive that, then they should consult a
• 9:27
  law firm, certainly our law firm, myself included, in
• 9:32
  connection with the potential for filing a class action.
• 9:35
  But there's also another component of the class
• 9:38
  litigation that we pursue other than simply for damages, and
• 9:41
  that is for injunctive relief. Because when this information
• 9:44
  has been taken, it's merely been electronically imaged and, and,
• 9:49
  and taken information still resides with the company.
• 9:53
  And the question is, well, what are they doing to protect that
• 9:56
  information from further breaches?
• 10:00
  I have litigation against companies that have suffered 2
• 10:03
  and 3 breaches in the course of several years.
• 10:07
  So the purpose of injunctive relief is to ensure that there
• 10:10
  is a hardening of the information system and there's
• 10:13
  third party oversight along with judicial oversight to ensure
• 10:19
  that that information is protected.
• 10:22
  There's a saying in in the South of the United States that when a
• 10:26
  fox gets in a chicken coop, you don't ask the fox how many
• 10:30
  chickens that ate. And that's the same thing with
• 10:32
  respect to our perspective as we focus on defendants.
• 10:37
  We shouldn't rely upon a defendant to tell us, oh, we've
• 10:40
  had a breach, but trust us, this information is now secure.
• 10:45
  No, no, no. We need judicial oversight and
• 10:48
  3rd party intervention and review to make certain that the
• 10:53
  company has not only hardened its system but is continuing
• 10:57
  forward with adopting the technology or the
• 11:00
  state-of-the-art as it develops. Now that does make sense.
• 11:04
  You, you answer in two parts, the injury and the injunction.
• 11:08
  And injunction is I think in the GDPR enabled through the right
• 11:13
  to object processing in the meantime.
• 11:15
  But I'd like to go back to the injury part.
• 11:18
  How would you define the concept of injury or loss in context of
• 11:24
  data privacy? Because it's not like an
• 11:26
  accident in which there's a physical bodily injury, it is
• 11:30
  something else. So how would you define that
• 11:32
  injury for a normal layman? Well, I think injury in part
• 11:37
  relates to a loss of control. That information that you had
• 11:42
  control of as a consumer or you entrusted A defendant to control
• 11:47
  it has now been taken by a third party and in a data breach
• 11:52
  context for only one purpose, to engage in identity theft.
• 11:56
  That information isn't taken because somebody's interested in
• 11:59
  finding out whether or not you've got a house for sale or
• 12:02
  you're single and you're looking for a romantic relationship.
• 12:07
  Now it's it's taken to engage in an injury.
• 12:10
  So it's my position that as soon as that loss of control occurs,
• 12:14
  that information is now in the hands of a criminal, that
• 12:18
  consumers face a present and increased risk of identity theft
• 12:22
  Injury has occurred. Certainly the manifestation of
• 12:25
  that injury can be a loss of money, but that's merely A
• 12:29
  manifestation that is not necessarily the focus of the
• 12:33
  injury. And I relate back to the product
• 12:36
  that I think is a necessary one to protect consumers in that
• 12:39
  instance is I an identity theft product?
• 12:45
  And that's a obligation that the defendant needs to fulfil.
• 12:49
  And that's what a major focus of our litigation seeks is that
• 12:53
  amount of money that would be given to the consumer and in the
• 12:57
  consumer's hands that consumer can go out and I purchase an
• 13:01
  identity theft product for the remainder of their life.
• 13:05
  And is it a common practise in the US to do class actions in
• 13:10
  context of privacy? Yes, it there.
• 13:14
  I would say that's probably the the biggest area of class
• 13:19
  litigation presently in the United States and I think it's
• 13:22
  also growing in the EU and the UK and we've seen some data
• 13:27
  privacy litigation both in data misuse and data breaches.
• 13:31
  In the UK. The High Court came very close
• 13:35
  to allowing the class action, the opt out mode of class
• 13:42
  litigation a couple of years ago.
• 13:45
  Certainly the opt out mode class litigation has been accepted in
• 13:53
  the Netherlands. And I think over the course of
• 13:56
  time you're going to see other company, other countries in the
• 14:00
  EU embrace the opt out method of approaching data misuse and data
• 14:06
  breaches. It is a worldwide problem, just
• 14:10
  doesn't occur in the United States.
• 14:11
  It occurs all over the world and as I mentioned, you know, it's
• 14:14
  projected to be a point $6 trillion expense to consumers
• 14:19
  and companies in order to protect their information and
• 14:22
  also the cost of repercussions when that's taken.
• 14:26
  And when you say this point, 6 trillion, is that in context of
• 14:30
  the data privacy class suits or overall class suits?
• 14:33
  So the 11.6 trillion is projected to be the cost of
• 14:39
  companies, both in terms of reacting to data breaches and
• 14:44
  data, as well as the cost to consumers.
• 14:48
  That's not my figure, that's one that I've seen published in this
• 14:52
  industry. No problem, just clarifying if
• 14:54
  it's specific to data privacy and when these class sections
• 14:58
  are taken up. So is it a cost to the consumer
• 15:02
  or is it a cost that's covered if the last section results in
• 15:07
  payments and then the payment is deducted?
• 15:09
  How does it work? Because I've heard the that in
• 15:11
  the United States, especially when you have an accident or an
• 15:15
  injury, you get your costs are covered through the compensation
• 15:20
  you will receive and you don't have to pay if you don't get the
• 15:22
  compensation in the same model in privacy also.
• 15:25
  So if if I understand your question in connection with data
• 15:29
  privacy litigation, we lawyers like me who advocate on behalf
• 15:35
  of consumers in class actual litigation do so on a contention
• 15:39
  basis. That is the cost of the consumer
• 15:42
  is not the payment of any hourly rate nor out of pocket expense.
• 15:49
  Lawyers work on a contingent basis looking for success before
• 15:54
  we're able to recover any fee. And of course we advance the
• 15:57
  costs and expenses that we hope to get from the litigation
• 16:02
  itself. And you know, that is the way in
• 16:05
  which lawyers in class litigation advocating for
• 16:09
  consumers are compensated. And of course in class action
• 16:13
  litigation when there are settlements or the result in
• 16:16
  final judgement, judicial oversight, in other words,
• 16:20
  courts scrutinise the fee applications and enter orders
• 16:26
  accordingly. So it is do not think that
• 16:31
  merely because an application is sought for a certain percentage
• 16:35
  that it's always granted at that percentage level.
• 16:38
  OK, so that's in fact, I think a win win because the legal
• 16:44
  counsel would also do his or her due diligence to make sure that
• 16:48
  the case that is being put forward is solid and the user is
• 16:53
  also assured that they will not incur unnecessary cost while
• 16:57
  they have already suffered the damage due to the privacy breach
• 17:01
  or privacy misuse. So it's, it's a win win.
• 17:04
  And then if it comes through, then both are being compensated
• 17:09
  the, the legal counsel as well as the individual.
• 17:12
  But then if we have a class action, one of the concerns in
• 17:16
  some geographies is it takes a long time.
• 17:19
  So what's an average time span span that it takes in the United
• 17:22
  States in your experience? So it could run anywhere from a
• 17:28
  year and a half to three years. Most cases now because the Class
• 17:35
  Action Fairness Act when filed or filed in federal court or if
• 17:40
  filed in the state court that they're removed under Catholic
• 17:43
  jurisdiction to federal court and federal judges are the
• 17:49
  progress of litigation before then is monitored.
• 17:52
  Most federal judges want to complete any case within two
• 17:57
  years time. So at the outset of a case,
• 18:01
  they'll set a schedule for not only the filing of a motion for
• 18:05
  class certification, which is very important stepping stone in
• 18:10
  connection with class litigation, but also the trial
• 18:12
  of that case. There are cases that go a little
• 18:14
  bit longer than two years, but in my experience it's been about
• 18:18
  a year and a half, two tops three years.
• 18:22
  We litigated the Capital One data breach case which involved
• 18:26
  almost 98,000,000 consumers in the Eastern District, Virginia,
• 18:31
  known in the United States as the Rocket docket.
• 18:33
  We did that during COVID. That case took a little bit more
• 18:38
  than a year and a half. But the fact of it is, is that
• 18:41
  even with COVID and the inability of being in person, we
• 18:45
  were able to utilise a zoom efficiently to conduct almost
• 18:51
  two dozen earrings as well as over 50 depositions.
• 18:56
  So as plaintiff lawyers, we're incentivized because we don't
• 19:00
  get paid by the hour efficiency is required.
• 19:05
  We don't spend money needlessly because we're advancing those
• 19:08
  cost. So there's no reason to expect
• 19:13
  that there's going to be a delay from the plaintiff's
• 19:16
  perspective. The defendants however certainly
• 19:19
  have every incentive to try to slow the case down and not
• 19:24
  everyone engage in in that type of behaviour.
• 19:27
  But I've seen it enough to to know it's not an exception when
• 19:33
  it occurs. So there is this struggle.
• 19:35
  Plaintiffs want to get the litigation moved as quick as
• 19:38
  possible. Defendants want to slow it down
• 19:41
  and that's an over generalisation but but again
• 19:44
  I've seen it enough times to know what happens.
• 19:46
  It definitely happens and I think one of the concerns would
• 19:50
  be if it's going to last anywhere between 1 1/2 to three
• 19:54
  years. Is there a risk of the data
• 19:58
  subject, what we call in EU, being pressurised or being,
• 20:06
  let's keep it simple, say pressurised by the company in
• 20:10
  one way or the other way or to fair and unfair means?
• 20:14
  Is that happening? Is that a concern?
• 20:17
  How? How does the data subject feel
• 20:19
  secure? So if I understand your
• 20:22
  question, are, are are you asking are there external forces
• 20:27
  or even internal forces that may affect how a company approaches
• 20:32
  class action litigation involving data privacy?
• 20:36
  Is that the question? You can answer that part also,
• 20:42
  but my question is more around the fact say I'm the victim and
• 20:47
  I ask come to you and say let's do a class action litigation and
• 20:50
  it's against your company X. So not the X that we normally
• 20:53
  know, just an X and that X company hires some mean some
• 20:59
  people to pressurise me to withdraw the case.
• 21:02
  Does those kind of tactics happen?
• 21:05
  I don't see that happening. You know, consumers that we that
• 21:10
  and who eventually agree to be class representatives, you know,
• 21:16
  go through a certain amount of scrutiny and, and understand
• 21:18
  that, you know, the litigation is going to take time.
• 21:21
  There's certain commitments from them in terms of their time and
• 21:25
  and they may have to sit for a deposition, they may have to
• 21:28
  gather information. But I, I don't see that type of
• 21:32
  tactic as it gone on perhaps, but not in the litigation that I
• 21:38
  handle. OK, that's good to know.
• 21:41
  And do these, you mentioned these people are kind of
• 21:46
  prepared for the kind of timeline they have to go through
• 21:50
  and the stress or challenges they have to go through.
• 21:54
  What kind of preparation goes in, in telling a plaintiff
• 21:57
  saying it's going to be two years, you're going to go
• 22:00
  through this? And what kind of preparation do
• 22:02
  they have to do to see through the phase of two years, three
• 22:06
  years in a stress freeway, if I can call it like that?
• 22:11
  So aside from continuing to consult with us during the
• 22:16
  litigation and help, you know, make decisions about the
• 22:20
  litigation, of course, relying upon us because we're lawyers.
• 22:23
  But the commitment from consumers, other than just
• 22:26
  monitoring litigation would be potentially gathering
• 22:30
  information that a defendant might ask and be legitimately
• 22:35
  entitled to seek, answer some questions in the form of
• 22:39
  something called interrogatories and to sit for a deposition and
• 22:43
  perhaps attendance at hearings if so required.
• 22:49
  So, you know, in, in terms of the amount of time, it's
• 22:52
  certainly well worth their, their time.
• 22:56
  And it's, I, I don't want to minimise it too much, but, but,
• 23:02
  but it is a minimal investment of time in connection with the
• 23:07
  endeavour and the importance of the endeavour that they would
• 23:10
  undertake as class representatives.
• 23:12
  For instance, litigation of this type is extremely expensive.
• 23:16
  And to do this litigation individually without the class
• 23:20
  action device, it simply wouldn't occur.
• 23:23
  You know, sometimes we've incurred millions of dollars in
• 23:27
  expert cost, certainly in the hundreds of thousands is rather
• 23:32
  routine. No individual is going to expend
• 23:35
  that kind of money nor lawyer undertake it on an individual
• 23:38
  basis without really substantial losses and and certainly none
• 23:43
  that I've ever seen that would justify that kind of expense.
• 23:46
  So, you know, the class action device is the perfect method for
• 23:51
  advancing these claims and spreading, you know, the risk
• 23:58
  over the class. Although it, as I mentioned, if
• 24:02
  the case does not result in success, it is the lawyer who
• 24:07
  undertook the endeavour who comes out with the loss because
• 24:12
  our time will not have been kind of compensated on contingent
• 24:15
  basis. So there's a lot of efficiencies
• 24:19
  built into the process on our side, but also there's a need,
• 24:22
  you know, to move the cases along expeditiously.
• 24:27
  Now that does make sense, but on the other hand, is there
• 24:32
  protection or privacy protection, identity protection
• 24:36
  for the plaintiff while class section is initiated or that's
• 24:40
  not required? So to the extent they provide
• 24:44
  any information and discovery, that information is going to be
• 24:46
  subject to a protective order. So that information is not going
• 24:49
  to be made publicly available. And you know, when they're
• 24:53
  deposed, you know that deposition typically is
• 24:58
  protected as confidential because in the questioning by a
• 25:03
  defendant's lawyer, they're going to be answered questions.
• 25:05
  And you know, their, their answers are not something that
• 25:08
  we want exposed to the public in general.
• 25:10
  So privacy litigation is afforded a certain amount of
• 25:15
  cover or protection for consumers to the extent they
• 25:19
  provide information. And the same thing with respect
• 25:21
  to defendants giving us information both in terms of
• 25:25
  what other consumers are in the class, but they may have lost,
• 25:29
  but also the information architecture that the company
• 25:35
  might employ in the various methods by which a hacker was
• 25:41
  able to exploit the vulnerabilities to engage in
• 25:45
  taking the information. And whatever hardening the
• 25:47
  company has done since then, that information is maintained
• 25:52
  outside the public view because again, we don't want to expose
• 25:55
  that company to another loss. So we have you know that
• 26:01
  interest because again companies continue to contain have
• 26:05
  possession of the information of our class.
• 26:08
  And what's the end outcome of a class action usually?
• 26:12
  I mean either positively. Let's look at the positive side
• 26:15
  of it. Let's say there's a class action
• 26:17
  and then it so happens, it results in an outcome.
• 26:21
  Now the injury or the impact has happened, there is a
• 26:25
  compensation which is monetary, but what else does the plaintiff
• 26:30
  get in terms of or what? What's the end outcome?
• 26:35
  So typically, not always because there are some cases that fail.
• 26:42
  The monetary relief is designed to address the typical
• 26:46
  repercussions that consumers sustained in the wake of a data
• 26:49
  breach. There's a bucket or Ave for
• 26:54
  getting out of pocket losses compensated typically lost time,
• 26:59
  the time spent by a consumer to address repercussions of a data
• 27:03
  breach are compensated at an hourly rate.
• 27:07
  And then there are cases in which all the consumer has to do
• 27:11
  is just fill out a claim form and they will receive a check
• 27:15
  for a certain amount. You know, it all depends upon
• 27:19
  how the monetary component is addressed.
• 27:23
  There's also the ability of getting another credit
• 27:28
  monitoring or identity theft product for a period of years
• 27:32
  that can be a benefit. And then of course, we seek
• 27:36
  business practises and forms of injunctive relief to ensure that
• 27:41
  the system of the defendant is hardened so that it's further
• 27:45
  protected from any future data breaches.
• 27:50
  That does make sense. So it's a good thing that you're
• 27:55
  doing by helping people with class actions in, especially
• 27:58
  when they're impacted. But I like to ask a question
• 28:01
  which maybe is not appropriate for your business, but still as
• 28:08
  an individual, it's better to protect misuse of data rather
• 28:12
  than have a misuse and then go for class action.
• 28:15
  So in that context, how can an individual or subject protect
• 28:21
  his or her information from misuse without having to end up
• 28:24
  in this situation? I think it's important for
• 28:27
  consumers to understand and and to read whatever information is
• 28:33
  provided to by any company in so a relationship where the
• 28:38
  consumer is being asked to provide information.
• 28:42
  So for instance, a patient goes into a doctor or hospital in the
• 28:46
  hospital or doctor wants a Social Security number.
• 28:50
  As a patient perspective patient, I would ask why?
• 28:53
  Why is Social Security number? Certainly they need to know
• 28:56
  dates of birth, sex, medical history, my medical insurance
• 29:02
  information, but why is Social Security number?
• 29:04
  So I think all too often as consumers, they give their
• 29:07
  information freely without an appreciation for why is it
• 29:10
  needed? Why do you why does that company
• 29:13
  need it? And also what's being done to
• 29:16
  protect it and how long is a company going to maintain it?
• 29:19
  So for instance, going back to a physician or hospital after I
• 29:25
  received medical treatment, why is the hospital or doctor need
• 29:29
  to retain every bit of information that I gave them
• 29:32
  that they may need, you know, diagnosis, treatment protocols,
• 29:37
  type of medication that might be on.
• 29:39
  But if I have had to give them my Social Security number, why
• 29:42
  do they need to keep that going forward?
• 29:45
  So I think, you know, there that there needs to be more of
• 29:49
  consumers asking questions than simply providing the
• 29:53
  information. And the same thing with, you
• 29:55
  know, downloading apps or engaging in activities on the
• 29:58
  Internet. People need to be cautious
• 30:01
  merely because something is free.
• 30:04
  It's the illusion that it's free, but it's not really free.
• 30:09
  If you download an app, understand what that app is
• 30:12
  taking from you when you use it. It may be harvesting your
• 30:15
  information that you're giving to it when you use the app, but
• 30:20
  it also may be accessing information on whatever platform
• 30:25
  you're using to communicate with that web-based app.
• 30:30
  It may be taking geolocation data as you move about your your
• 30:36
  business. All too often come consumers
• 30:39
  don't ask those questions. I as a consumer very leery
• 30:44
  about, you know, what I take for free there there there's nothing
• 30:49
  free here companies are, you know, taking your information.
• 30:52
  So I think seeking transparency, utilising caution and having an
• 30:59
  understanding of what that information might be taken and
• 31:04
  and and used for. And I think, you know, a lot of
• 31:06
  consumers sometimes have the perception, well, it's all out
• 31:10
  there. Why should I care?
• 31:12
  Well, they, they should care because it's going to cost them
• 31:16
  money in so far as exposing their identity to cyber
• 31:21
  criminals. And also it's affecting our
• 31:25
  ability to engage in critical thinking, all too often rely
• 31:29
  upon social media to keep in touch with the world, our
• 31:33
  friends, without realising that what these companies are doing
• 31:38
  is are taking away our choice, our freedom.
• 31:41
  They're actually engaged in helping us formulate thought
• 31:46
  and, and, and think, you know, back in the 50s, companies began
• 31:51
  to recognise that the way you should influence voter behaviour
• 31:57
  is targeting certain demographics and influencing
• 32:02
  that demographic to vote one way or another.
• 32:05
  Now with technology, we've come so far in advance that we've
• 32:09
  been able to model behaviour. And I think a lot of division
• 32:14
  you see in the United States and in the world as a result of
• 32:17
  that, people have forgotten. Well, let me think, take a step
• 32:20
  back and, and think of what's being fed to me on some news
• 32:23
  feed. So data privacy means more than
• 32:28
  I think the subject of, you know, data misuse and losing
• 32:33
  information through, through data breaches it, it it really
• 32:37
  does affect choice and freedom. Yeah, I completely agree with
• 32:47
  you. I think it's been interesting to
• 32:51
  understand this concept of class actions.
• 32:53
  And at the same time, I'm also curious to ask you one final
• 32:58
  question. In US, the privacy specific laws
• 33:03
  are sector based or state based. So when you go for a class
• 33:07
  action is do you lean back on the privacy laws or do you lean
• 33:12
  back on class action laws? So in large measure because of
• 33:18
  the absence of federal regulation and regulation or
• 33:23
  statutes within the 50 states, we rely upon common law at least
• 33:29
  in the 49 states. Louisiana has civil law and in
• 33:33
  some of the very early data breach, data misuse litigation,
• 33:40
  I relied upon common law concept.
• 33:43
  So let me look, Let me take you back to 1999 when I along some
• 33:49
  other lawyers sued a double click, which now is a part of
• 33:55
  Google double click would place cookies on your hard drive
• 34:00
  whenever you went onto the Internet and visited various
• 34:02
  sites. Well, based upon the performance
• 34:05
  level of computers back in 1999, those cookies being aggregated
• 34:11
  on your hard drive would affect the operation of the computer
• 34:16
  itself. People simply, I think even
• 34:18
  today don't understand cookies, although the cookie has now been
• 34:23
  advanced, but those cookies being placed on your hard drive
• 34:31
  not only affected your machinery, but the concept we
• 34:35
  use in the absence of any litigate or statutes of the time
• 34:39
  was the concept of trespass, the property.
• 34:43
  That is the common law concept that if somebody put a foot on
• 34:47
  your land and they did not have permission to do so, that was a
• 34:52
  trespass. The cookie was being placed on
• 34:55
  your hard drive and that was the claim that helped that
• 35:00
  litigation succeed. Over the course of time, we've
• 35:04
  continued to use, you know, basic privacy torts as well as
• 35:11
  some states or most states have Deceptive Trade Practises Act,
• 35:15
  Section 5 of the FTC Act as looked at data privacy or data
• 35:22
  security and found violations of Section 5.
• 35:28
  We, we've, I think one of the first cases that I litigated in
• 35:33
  a data breach context, use the Ford's Deceptive Unfair Trade
• 35:37
  Practises Act. And the court found that the
• 35:41
  failure to maintain proper data security was a deception and it
• 35:47
  was unfair to the three prongs of most deceptive Trade
• 35:52
  Practises Act adopted by the states.
• 35:55
  We now have other states who have adopted, you know, privacy
• 36:00
  statutes. One of the foremost is
• 36:02
  California, but we've also had, you know, statutes in New York,
• 36:09
  Virginia or in Illinois that provide consumers the ability of
• 36:16
  seeking redress. Sure.
• 36:19
  So that's been quite useful and insightful conversation.
• 36:24
  Now, if based on this conversation, somebody's
• 36:27
  interested in pursuing a class action or getting to know about
• 36:32
  more about it, what would be the best way to get in touch with
• 36:35
  you, John? So I'm certainly all over the
• 36:39
  Internet. My e-mail address is
• 36:43
  jyanchounis@forthepeople.com. Or go to Morgan and Morgan.
• 36:48
  We're pretty ubiquitous around this country and even in the
• 36:53
  world, so you can go to our website, forthepeople.com.
• 36:59
  OK. So with that, I would say thank
• 37:03
  you so much, John for sharing these insights with us.
• 37:06
  It's a very unique topic and you're one of the specialist in
• 37:08
  this area. So thank you so much for your
• 37:11
  time and have a wonderful day. Thank you so much.
• 37:15
  Bye bye. Thanks for listening, If you
• 37:18
  liked the show, feel free to share it with a friend and write
• 37:21
  a review if you have already done so.
• 37:23
  Thank you so much and if you did not like the show, don't bother
• 37:27
  and forget about it. Take Care and Stay Safe Fit for
• 37:31
  Privacy helps you to create a culture of privacy and manage
• 37:35
  risks by creating, defining and implementing a privacy strategy
• 37:39
  that includes delivering scenario based training for your
• 37:42
  staff. We also help those who are
• 37:45
  looking to get certified in CIPPECIPM and CIPT through on
• 37:51
  demand courses that help you prepare and practise for
• 37:54
  certification exam. Want to know more?
• 37:57
  Visit www.fitforprivacy.com. That's www.fitthe#4privacy.com.
• 38:08
  If you have questions or suggestions, drop an e-mail at
• 38:12
  Hello at FIT for privacy.com. Until next time, goodbye.