{"id":3183,"date":"2020-09-03T10:04:51","date_gmt":"2020-09-03T15:04:51","guid":{"rendered":"http:\/\/blogs.luc.edu\/compliance\/?p=3183"},"modified":"2020-09-03T10:04:51","modified_gmt":"2020-09-03T15:04:51","slug":"privacy-lessons-learned-from-litigation-the-unfair-and-deceptive-practices-lawsuit-against-zoom","status":"publish","type":"post","link":"https:\/\/blogs.luc.edu\/compliance\/?p=3183","title":{"rendered":"Privacy Lessons Learned from Litigation: The unfair and deceptive practices lawsuit against Zoom"},"content":{"rendered":"

Richard Horton<\/em><\/span>
\nAssociate Editor<\/em><\/span>
\nLoyola University Chicago School of Law, LLM 2021<\/em><\/span><\/p>\n

Yet another privacy and data security-related lawsuit has been filed<\/a> against Zoom Video Communications, Inc. (\u201cZoom Inc.\u201d). Zoom Inc. has been the subject of several<\/a> complaints related to its video-conferencing service since its meteoric and spectacular rise in popularity due to the Coronavirus<\/a> pandemic and related quarantine measures beginning in March 2020. In this particular case, there are compliance lessons to be learned from the unfair and deceptive practices claims alleged against Zoom Inc. in the plaintiff\u2019s D.C. Superior Court filing.<\/span><\/p>\n

What\u2019s the issue?<\/strong><\/span><\/p>\n

Zoom Inc. is the company that owns and operates<\/a> the eponymously named Zoom internet video-conferencing service. Zoom is a public company that was founded in 2011<\/a> and had its IPO last year. The plaintiff in the lawsuit alleges that at its IPO, Zoom Inc. was worth $16 billion, and now, during the global pandemic, currently enjoys a valuation of over $70 billion. Zoom Inc. has not only been sued specifically for its privacy and data security failings<\/a>, but also has been the subject of a shareholder derivative suit<\/a> that alleges that those shortcomings have caused the stock price to drop resulting in a loss to investors.<\/span><\/p>\n

This time, Zoom Inc. is being hauled into court, not by one of its users, business subscribers, or shareholders, but by a consumer protection non-profit organization, Consumer Watchdog<\/a>, suing on behalf of the general public and consumers in the District of Columbia. Consumer Watchdog is a consumer protection advocacy group that has advocated for several wide-ranging reforms, including energy, healthcare, insurance, and privacy<\/a>. The public interest group, established in 1985, has its roots in California and nuclear power proliferation reform. In its August 10th<\/sup> filing, Consumer Watchdog has alleged<\/a> that the increase in Zoom users and the resulting increase in the stock market valuation of Zoom Inc. were, at least in material part, due to Zoom Inc.\u2019s misrepresentations about the privacy and security of the service.<\/span><\/p>\n

What are unfair, deceptive, or abusive acts or practices (UDAAP)?<\/strong><\/span><\/p>\n

Generally, consumer protection laws at the state and federal levels prohibit unfair, deceptive, and abusive acts and practices, including the Fair Trade Commission Act, the Dodd-Frank Wall Street Reform and Consumer Protection Act (Dodd-Frank Act), and the applicable law in this case, the DC Consumer Protection and Procedures Act<\/a> (CPPA). Laws with similar language have been adopted across the country in all 50 states<\/a>. Courts have consistently interpreted a company\u2019s misrepresentations to be an unfair and deceptive act<\/a>.<\/span><\/p>\n

Consumer Watchdog has alleged that Zoom Inc. made false representations that communications on the platform were protected by \u201cend-to-end encryption.\u201d<\/a> While Consumer Watchdog appears to acknowledge that a type<\/em> of encryption was<\/em> used<\/a>, the dispute hinges on Zoom Inc.\u2019s ability to intercept and access<\/a> all communications on its platform, notwithstanding the encryption measures in place. Consumer Watchdog argues<\/a> that because Zoom Inc. retained this ability, the encryption mechanism that it put in place did not meet the high standard of \u201cend-to-end encryption.\u201d The advocacy group has not<\/em> alleged that Zoom Inc. actually made any efforts to access communications, but rather, merely that it could have<\/em><\/a>.<\/span><\/p>\n

What\u2019s the compliance risk?<\/strong><\/span><\/p>\n

While it has been alleged<\/a> that Zoom Inc. made the false representations to \u201cestablish itself as a safe, secure, and reliable video conferencing platform,\u201d tech companies can take affirmative measures to prevent marketing teams from issuing similarly false claims<\/a>, knowingly, negligently, recklessly, or otherwise.<\/span><\/p>\n

Ostensibly, product marketers for Zoom Inc. made representations in marketing materials<\/a> that used security-related technical terms that have exacting and precise definitions (i.e.<\/em> end-to-end encryption<\/a>). Definitions, which those same marketers, may<\/em> not have been able to fully appreciate. Moreover, a typical<\/a> legal review of the same marketing materials, performed by general counsel or marketing-focused attorneys, will not likely uncover these types of oversights, for the very same reason\u2014lack of deep subject matter expertise.<\/span><\/p>\n

The compliance risk, illustrated by this case, is that a product marketing team may elect to use technical terms related to the privacy and data security of its product platform when those terms do not adequately or precisely reflect the actual capabilities<\/a> of the platform. This problem will arise relatively more often in product marketing-driven organizations, where the use of the technical term originates from the product marketing team (e.g.<\/em> defining market position<\/a>), rather than the teams with technical competence, particularly the engineering team. This lawsuit is evidence that even relatively slight<\/em> inconsistencies between product promises and technical standards can form the basis for costly litigation.<\/span><\/p>\n

How do you control it?<\/strong><\/span><\/p>\n

Tech companies must begin to recognize the increasing importance of privacy and data security features. Consumer Watchdog explained in its complaint<\/a> that \u201cconsumers are making data security a crucial consideration when choosing which companies to do business with and which products to buy.\u201d Because UDAAP laws typically require that a representation must be material<\/em><\/a> to be considered deceptive, tech companies should understand that privacy and data security statements are now<\/em> actionable.<\/span><\/p>\n

Tech companies must respond with a risk mitigation approach, by developing a formal review and approval process for marketing materials that includes consultation with privacy and data security engineers, particularly when technical terms and security-related claims are employed. The formal review process should be mandatory, when triggered, and risk & compliance personnel should adopt a written policy and related procedures<\/a> to ensure that it is followed. The policy and its enforcement should be owned and maintained by risk & compliance teams. For ideas on what these types of controls generally look like, review this sample policy template<\/a> published by the Health Care Compliance Association (HCCA).<\/span><\/p>\n

As a part of the recommended review process, the privacy and data security engineer should verify, on behalf of risk & compliance, that all privacy and data security claims in the marketing materials are true, correct, and accurate, and not misleading or deceptive when compared against the technical specifications of the system currently in production. This may require technical standards-related research and even consultation with legal counsel that specializes in privacy and data security matters.<\/span><\/p>\n

Alternatively, it may be argued that an approval process with too many stakeholders is a hindrance to the speed and agility of the organization. However, that effect can be minimized by soliciting engineering\u2019s input earlier in the process of developing the marketing team\u2019s materials. Marketing will typically begin its efforts by developing a messaging framework<\/a>, that can then be used to guide subsequent development of specific marketing assets. Consultation of engineering during the review and approval of the messaging framework is less cumbersome and time-consuming than conducting the same process for each individual marketing asset.<\/span><\/p>\n

Further, technical specifications are collaboration and communication tools<\/a>. Engineering teams should seriously consider developing technical specification documents, that detail the architectural and design solutions that they<\/em> have chosen (guided by product requirements), so that marketing can reference it when developing its marketing materials and formulating related claims. Any privacy and security-related update to the marketing materials that is not reasonably based on content expressly stated in the messaging framework or technical specification should trigger an additional review for approval.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Yet another privacy and data security-related lawsuit has been filed against Zoom Video Communications, Inc. (\u201cZoom Inc.\u201d). Zoom Inc. has been the subject of several complaints related to its video-conferencing service since its meteoric and spectacular rise in popularity due to the Coronavirus pandemic and related quarantine measures beginning in March 2020. In this particular case, there are compliance lessons to be learned from the unfair and deceptive practices claims alleged against Zoom Inc. in the plaintiff\u2019s D.C. Superior Court filing.<\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[473,534,571,1205,1623],"class_list":["post-3183","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-compliance-program","tag-covid-19","tag-data-privacy","tag-journal-of-regulatory-compliance","tag-cybersecurity"],"_links":{"self":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts\/3183","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3183"}],"version-history":[{"count":0,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=\/wp\/v2\/posts\/3183\/revisions"}],"wp:attachment":[{"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.luc.edu\/compliance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}