Socially Aware: Newsletter the Social Media Law Update

Morrison & Foerster Social Media Newsletter Vol. 3, Issue 4 August 2012

2011 Best Law Firm Socially Aware: Newsletter The Social Media Law Update

In this issue of Socially Aware, our Burton Award-winning IN THIS ISSUE guide to the law and business of social media, we explore “You Have One New Lawsuit”: whether one can serve legal notice through Facebook and 2 Can You Serve Legal Notice other social media platforms; examine the ongoing dispute Through Social Media? between Twitter and the Manhattan District Attorney over We’ve Come for Your Tweets: the discovery of user tweets; summarize the NLRB’s latest 4 Twitter to Appeal Denial of guidance regarding workplace social media policies; Its Motion to Quash District review a controversial provision from Amazon Web Attorney’s Subpoena Services's customer agreement; take a look at a putative class action lawsuit against the Pittsburgh Penguins 6 The NLRB Weighs In (Again) on hockey team arising out of the team’s text messaging Social Media Policies activities; highlight regulatory challenges to broker-dealers 7 Look Before You Leap: Amazon and investment advisers in using social media; visit a Web Services Customers May recent fair use decision in connection with a South Park Be Subject to an IP Covenant parody of a viral video; and discuss the California Attorney Not to Sue General’s formation of a new Privacy Enforcement and Face Off: Consumer Sues Hockey Protection Unit. All this plus our statistical snapshots 8 Team Over Text Messages showing the growing popularity of mobile devices (and the The Social Media Experiment: corresponding decline of PCs). 8 Challenges for Broker-Dealers and Follow us on Twitter @MoFoSocMedia, and check out our blog. Investment Advisers What, What (in the Court): South Editors Matthew O’Donnell Julie O’Neill 11 Park Studios Shielded by Fair Use John Delaney Anna Ferrari Mridhula Raghupathy for Viral Video Parody Reed Freeman Debbie Rosenbaum Gabriel Meister California Attorney General Aaron Rubin Tim Greene Nathan Salminen 12 Susy Hassan Creates Privacy Enforcement Contributors Erin Herlihy and Protection Unit; Increased Jay Baris J. Alexander Lawrence Enforcement Likely Nicholas Datlowe Daniel Levison Morrison & Foerster Social Media Newsletter Vol. 3, Issue 4 August 2012

bank suggested a novel alternative to Outside of the United States, several “You Have One the court: serving Nicole with notice by courts—including courts in New Zealand, New Lawsuit”: Can sending her a message on Facebook. Australia, Canada and the United Kingdom —have affirmed or even endorsed the You Serve Legal Chase argued that service through use of Facebook and other social media Facebook would meet due process sites as acceptable alternative means of Notice Through requirements because it was “reasonably serving counterparties with notice of the calculated to apprise” Nicole of the claims brought against them. Social Media? claims against her (echoing the words of the U.S. Supreme Court in Mullane v. The Fortunato court’s approach does not Can a litigant be served via social media? Central Hanover Bank & Trust Co.), and necessarily contradict these examples, On June 7, 2012, in Fortunato v. Chase that it should therefore be an acceptable given that the Fortunato court did not Bank, a federal district court ruled that alternative means of service. Although categorically reject service by Facebook defendant Chase Bank could not use the court agreed as an initial matter that or other social networks. Rather, the court Facebook to serve a third-party defendant some form of alternative service would be concluded that service through Facebook with the complaint that Chase had filed appropriate, the court rejected Chase’s would not be appropriate under the against her. argument, ruling that service by Facebook circumstances of the case at issue. Which would not be sufficiently “reasonably begs the question: what might the right In Fortunato, plaintiff Lorri Fortunato sued calculated to apprise” Nicole under the circumstances be? Chase Bank, alleging that the defendant circumstances. Noting that “anyone can had unlawfully garnished her wages to make a Facebook profile using real, fake, As a general matter, the law still favors pay a credit card debt that, according or incomplete information,” the court traditional personal service as its to the plaintiff, was actually incurred by found that “[Chase] ha[d] not set forth preferred and primary method—the her estranged daughter, Nicole (who the any facts that would give . . . a [sufficient] often-depicted “you’ve been served” plaintiff alleged had lied on a credit card degree of certainty that the Facebook moment of physically handing a application in order to open an account profile . . . [was] in fact maintained summons and complaint to a party to in her mother’s name). Chase sought by Nicole[.]” The court then ordered be served. Statutes in U.S. jurisdictions to implead Nicole in the matter, but was Chase to publish notifications in the also typically expressly authorize having a difficult time physically locating local newspapers for all five towns that other traditional means of service, for her; indeed, as the court noted, Nicole its private investigator had identified as example, delivery to a party’s residence apparently had a “history of providing possible residences for Nicole. or agent. When these methods prove fictional or out of date addresses[.]” impractical, statutes typically authorize The Fortunato court prefaced its analysis courts to allow some sort of appropriate Chase hired a private investigator, who by remarking that “[s]ervice by Facebook is alternative means of service. But in a “searched . . . [Department of Motor unorthodox to say the least,” and that the case like Fortunato, assuming that the Vehicles] records, voter registration court was “unaware of any other court that complainant has demonstrated that records, . . . Department of Corrections ha[d] authorized such service.” But, as it alternative service should be permitted, records, publicly available wireless turns out, at least a handful of courts—in what might need to be shown in order to phone provider records, and social media the United States and abroad—appear demonstrate to the court’s satisfaction websites” for a way to contact Nicole. to have done just that. In May 2011, a that service through social media would The private investigator’s search turned local state court in Minnesota permitted be appropriate? up four possible addresses for Nicole in service of a petition for divorce by four different towns, but the defendant Facebook (or, indeed, “[any] other social The Fortunato court expressly identified remained unable to physically locate her networking site”), finding that, compared a first major hurdle, which some have at any of those locations. to the “antiquated . . . and prohibitively termed “authentication.” In order to expensive” traditional means of publishing demonstrate a reasonable likelihood The private investigator did, however, notifications in local newspapers, service that the counterparty is actually going to find what she believed to be Nicole’s through social media would be both receive notice, the complainant needs Facebook profile, which listed a contact cheaper and more likely to actually reach to be able to convince the court that the email address and a location in yet a fifth the party at issue. (And, although not a social media profile in question really town. In view of this discovery, and given ruling on the issue, official form documents does belong to the party to be served, that Chase’s “numerous attempts to effect on the Utah State Court system’s and is not under the control of a different personal service” and “diligen[t] . . . search website can be read to suggest the use person with the same or a similar name for an alternate residence where Nicole of Facebook and Twitter as possible (or even, perhaps, an impersonator). might be served” had not succeeded, the alternative means of service.) This has some parallels to the issues

2 Morrison & Foerster Social Media Newsletter Vol. 3, Issue 4 August 2012

Service through social media and other SHIPMENTS OF Internet-based means of communication INTERNET-CONNECTED could become a viable alternative to DEVICES IN 2011 personal service, given that electronic SMARTPHONES service may have 54% TABLETS certain distinct 7% advantages over the traditional means of alternative service used where no physical address is available. PCS 39% raised when trying to use social media evidence in the context of a trial.

A second hurdle, somewhat less explicit in the Fortunato court’s ruling, is whether— even if the social media profiledoes Source: http://www.idc.com/getdoc.jsp?containerId=prUS23398412 belong to the party to be served—the profile’s owner regularly (or ever) logs in • That recent photos of the party to be information may be readily accessible to to or checks that profile. Being able to served have been posted to the profile; the general public. (Yes, people do still demonstrate this fact could help support leave their social media profiles wide an argument that “the person to be served • That the profile’s “friend” or contact open.) Of course, practitioners should would be likely to receive the summons list corresponds with the party keep in mind ethical rules when using and complaint” through his or her social to be served’s known real-world social media to obtain information. media profile, which, as theFortunato acquaintances; court noted, was important in cases where • That updates, posts and other In the long run, service through social service by email has been accepted. interactions on the profile’s “wall” media and other Internet-based means identify the user as the party to of communication could become a Cases from various countries, coupled be served; viable alternative to personal service, with some creative thinking, provide helpful given that electronic service may have guidance for how a party that wants to • That the profile’s user has responded certain distinct advantages over the serve notice through social media could to recent friend requests, wall posts or traditional means of alternative service surmount the hurdles above. For example, private messages; and used where no physical address is a party could try to demonstrate: available (i.e., publication in local • That third-party testimony corroborates newspapers and posting of public • That the personal biographical details the assertion that the profile belongs notices). First, as noted in the Minnesota listed in the profile match the party to to the party being served. case described above, electronic notice be served’s basic personal information can be far quicker, cheaper and easier. (e.g., date of birth, educational history Depending on the applicable social media Second, as the Minnesota court also and/or work history); profile’s privacy settings, much of this noted, notice may actually be more

3 Morrison & Foerster Social Media Newsletter Vol. 3, Issue 4 August 2012

likely to reach the intended recipient and tweets associated with the account if delivered through social media than @destructuremal—the Twitter account if communicated through those more allegedly used by Harris. Harris filed a With regard to any traditional means. And third, some motion to quash, and Twitter refused to expectation of means of Internet communication enable comply with the subpoena pending the privacy, the court senders to confirm electronically that results of Harris’s motion. likened posting a their messages have been opened or tweet to screaming received by the intended recipients. The court found that Harris lacked standing to quash the third-party subpoena out of an open Given the likelihood that attempted service on Twitter, because Harris had neither a window. through social media will be around for proprietary interest nor a privacy interest in a while, we look forward to keeping you the user information or tweets associated posted on future developments. with the @destructuremal account. The No Physical Intrusion court observed that no search warrant was required to obtain Harris’s tweets, as With regard to physical intrusion, the We’ve Come for no Fourth Amendment privacy rights are court stated simply that there had Your Tweets: implicated when information is sought from been no physical intrusion into Harris’s a third party, such as Twitter. Rather, in a Twitter account. Unlike the contents of Twitter to Appeal criminal case, the Stored Communications someone’s home or car, the contents Act (SCA) permits the government of Harris’s Twitter account had been Denial of Its to subpoena subscriber and session “purposely broadcast to the entire world information directly from a social media [and] into a server 3,000 miles away.” Motion to Quash site. The court ordered Twitter to comply District Attorney’s with the subpoena. No Reasonable Expectation of Privacy With regard to any expectation of Twitter then filedits own motion to quash Subpoena privacy, the court likened posting a tweet the subpoena. Twitter argued that, under to screaming out of an open window. its Terms of Service, Harris in fact retained As the Occupy Wall Street protests fade According to the court, “If you post a tweet, his rights to any content that he submitted, from memory, a related discovery battle just like if you scream it out the window, posted or displayed on or through the between Twitter and the New York County there is no reasonable expectation of Twitter service; and that denying Harris’s District Attorney rages on. privacy. There is no proprietary interest in standing to oppose the subpoena placed your tweets, which you have now gifted to an undue burden on Twitter. In a decision Earlier this year, we discussed the the world.” The court distinguished a tweet, handed down on June 30, 2012, the District Attorney’s efforts to subpoena however, from a “private” Internet dialogue, court disagreed. The court noted that the user information and tweets of criminal such as one conducted via private email, general rule in New York is that “only the defendant Malcolm Harris, an Occupy private direct message, or private chat. recipient of a subpoena in a criminal case Wall Street protester charged with Accessing relevant information from such has standing to quash it,” and reiterated disorderly conduct for allegedly occupying private Internet dialogues “would require that Harris had no Fourth Amendment the roadway of the Brooklyn Bridge. a warrant based on probable cause.” A privacy right in his tweets. Twitter has In a setback for Twitter, the Criminal tweet, however, is not like an email sent objected to the court’s decision, and, as Court of the City of New York recently to a single party, and “[t]here can be no noted, will be filing an appeal; a review of denied Twitter’s motion to quash the reasonable expectation of privacy in a the court’s decision highlights key issues to District Attorney’s subpoena; Twitter has tweet sent around the world.” be addressed on appeal. announced its decision to appeal the court’s decision. In this article, we take A Tweet Is a “Public Posting” a look at the court’s decision rejecting No Privacy Violation The court based its decision on its finding Twitter’s motion, and discuss key issues Proving a violation of the Fourth that a tweet is a “public posting.” In the to be addressed on appeal. Amendment requires a showing of either court’s view, “It is the act of tweeting or (1) a physical intrusion onto personal disseminating communications to the As noted, the dispute emerges from the property or (2) a violation of a reasonable public that controls.” The court supported District Attorney’s criminal prosecution expectation of privacy. The court found its finding by citing Twitter’s Privacy of Harris. Believing that Harris had that, due to Harris’s publication of his Policy, which states that “[o]ur Services tweeted information inconsistent with his tweets to third parties, neither showing are primarily designed to help you share anticipated defense, the District Attorney could be made here. information with the world. Most of the sought from Twitter the user information

4 Morrison & Foerster Social Media Newsletter Vol. 3, Issue 4 August 2012

information you provide us is information you are asking us to make public.” As further evidence of the public nature of a GOING MOBILE: THE RISE OF tweet, the court also cited Twitter’s 2010 agreement with the Library of Congress, MOBILE DEVICES AND APPS under which every public tweet since Twitter’s inception is to be archived; several Internet sites through which U.S. Internet users spend Of the world's deleted tweets remain accessible; and 94 MINUTES PER DAY 4 BILLION a National Geographic Channel project using mobile apps, compared MOBILE that has collected tweets and intends to to only 72 minutes browsing PHONES, broadcast them into space this August. the web. 1.08 billion are smartphones; 3.05 billion are NEARLY 8% The court likened the third-party recipient Mobile Internet usage is on pace to SMS-enabled. OF ALL U.S. of a tweet to a witness on the street SURPASS DESKTOP INTERNET WEB TRAFFIC who overhears something screamed out USAGE BY 2014. IS MOBILE of an open window. As the court put it, trafﬁc; in Asia, “today, the street is an online, information Americans spend on average that number has reached nearly 18%. superhighway, and the witness can be 2.7 HOURS PER DAY the third party providers like Twitter, SOCIALIZING Facebook, Instagram, Pinterest, or the on their mobile devices. 91% OF MOBILE next hot social media application.” A INTERNET ACCESS tweet, like a scream out the window, IS FOR SOCIAL has been made public, and “[t]here is 39% of instances where a consumer leaves ACTIVITIES; no reasonable expectation of privacy for a store without purchasing anything were for desktops, this tweets that the user has made public.” INFLUENCED BY SMARTPHONES. number drops to 79%.

No Undue Burden on Twitter 70% OF Twitter argued that denying standing ALL MOBILE to Harris placed an undue burden on SEARCHES Twitter, who was thereby forced to either result in action comply with, or move to quash, each within an hour. such subpoena seeking information of a Twitter user that it receives. The court flatly disagreed, noting that “that burden is placed on every third-party respondent to a subpoena and cannot be used to create standing for a defendant where none exists.”

No Undue Burden Under the Stored Communications Act A court issuing an order under Section Sources: http://blog.flurry.com, http://blog.hubspot.com, http://tag.microsoft.com. 2703(d) of the SCA, “on a motion made promptly by the service provider,” may with the @destructuremal Twitter quash or modify the order if it finds that Warrant Required for Tweets account, including all tweets posted from the information or records sought are in Electronic Storage for Less it between September 15, 2011, and “unusually voluminous” or if compliance Than 180 Days December 31, 2011. The court declined with the order “otherwise would cause an The only data associated with the to find that this order placed an undue undue burden” on the service provider. @destructuremal account that the court burden on Twitter under the SCA, stating In this case, the order requires Twitter to did not order Twitter to produce were instead that “it does not take much to provide all user information associated those tweets sent out from the account search and provide the data to the court.”

5 Morrison & Foerster Social Media Newsletter Vol. 3, Issue 4 August 2012

on December 31, 2011. This is because, aid or protection.” This right applies • Discouragements of the “friending” under the SCA, the court may compel regardless of whether the employees are of one’s co-workers. According either an Electronic Communications members of a labor union. The NLRB’s to the third memorandum, a policy Service (ECS) or a Remote Computing guidance on this subject suggests that statement advising employees to Service (RCS) to disclose non-content employee social media policies that “think carefully about ‘friending’ other information, and may compel an RCS to discourage the exercise of these rights co-workers” could be construed as disclose its contents; but the court may may run afoul of the NLRA. unlawfully discouraging employees only compel an ECS to disclose content from communicating regarding the that has been in electronic storage for The NLRB’s third memorandum, issued terms of their employment. more than 180 days. At the time that the by Acting General Counsel Lafe Solomon, June 30, 2012 order was issued, the court analyzes in detail seven different social • Requirements that employee did not have the proper authority under media policies at issue in recent cases grievances be addressed through the SCA to order disclosure of tweets before the NLRB. Six of these policies internal procedures, rather than made on December 31, 2011. The court, were found by the NLRB to contain aired online. A social media policy accordingly, modified its previous order provisions that are contrary to the NLRA, providing the employer “believes that with respect to the ECS content that while the seventh “revised” policy was individuals are more likely to resolve was less than 180 days old—removing upheld in its entirety as lawful. The NLRB concerns about work by speaking that portion of the order that would have specifically questioned the breadth of directly with co-workers, supervisors required Twitter to produce tweets placed the following types of provisions, many or other management-level personnel from the @destructuremal account on of which are commonly found in social than by posting complaints on the December 31, 2011. media policies: Internet” was found to be unlawful, according to the NLRB, because it • Prohibitions on the disclosure might inhibit employees from “seeking What Next? of confidential or “non-public” redress through alternative forums.” The Criminal Court of the City of New information, or of matters The NLRB noted, however, that York ordered Twitter to disclose all non- concerning individual privacy employers may “reasonably suggest” content information, as well as all content rights, via social media. Instructions availing of internal dispute resolution information from September 15, 2011, to not to reveal non-public information procedures. December 30, 2011. As noted, Twitter has may be unenforceable as applied announced its intention to appeal, rather to discussions about, or criticism • Prohibitions on the sending of than to comply with, the decision. Twitter of, the employer’s labor policies unsolicited communications to will not have to turn over the December and its treatment of employees. other employees. The NLRB found 31, 2011 tweets unless the government The NLRB noted such a tension in a policy requiring employees to report obtains a search warrant. Will Twitter have policy requiring social media users receiving “unsolicited or inappropriate to turn over the other @destructuremal not to “reveal non-public company electronic communications” to be tweets? We’ll keep you posted. information on any public site,” where an impermissible restraint on the explanation of non-public company employees’ right to discuss their information did not include appropriate employment conditions. The NLRB Weighs carve-outs for activities protected under Section 7. • Restrictions on public discussions In (Again) on Social of personal opinions regarding • Prohibitions on the disclosure work. One policy discussed in the Media Policies of an individual’s personal memorandum expressly permitted information via social media. The employees to discuss online their With the issuance of its third guidance NLRB took issue with a social media personal opinions about work-related document on workplace social media policy instructing employees: “[D] issues, but only to other employees policies in the past year, the National on’t disclose [personal information and not to the general public. The Labor Relations Board (NLRB) continues regarding employees and other third NLRB found this overbroad because to refine its position on how to craft parties] in any way via social media the right to discuss employment workplace social media policies that are or other online activities.” As the conditions extends to discussions with consistent with the terms of the National NLRB explained, “[I]n the absence non-employees. Labor Relations Act (NLRA). of clarification, employees would • Prohibitions on comments Section 7 of the NLRA provides reasonably construe it to include regarding pending legal matters. A employees with the right to engage in information about employee wages policy providing, “Don’t comment on “concerted activities for the purpose of and their working conditions.” any legal matters, including pending collective bargaining or other mutual

6 Morrison & Foerster Social Media Newsletter Vol. 3, Issue 4 August 2012

litigation or disputes,” was found to be third memorandum provides one example for AWS corporate users, especially users unlawful on the basis that it “restricts of a social media policy that it considered in the technology industry. employees from discussing the lawful. Although this exemplar, which protected subject of potential claims” is attached to the NLRB memorandum In Section 8.5 of the AWS Customer against their employer. in full, will not meet the needs of all Agreement, AWS obtains from its employers, it may serve useful as a customers a covenant not to sue for • Prohibitions on responding to resource against which to compare patent infringement or other intellectual government inquiries. The NLRB your company’s social media policy. property infringement in connection found that one employer’s direction As the NLRB’s position on this subject with AWS-related services. Here’s the to employees not to respond to evolves, we suggest consulting counsel relevant language: communications from government to address whether specific provisions of “During and after the Term, agencies was overbroad “to the extent your company’s social media policy are you will not assert, nor will you that it restricts employees from their consistent with the NLRB’s guidance. authorize, assist, or encourage protected right to converse with [NLRB] any third party to assert, against agents or otherwise concertedly seek us or any of our affiliates, the help of government agencies Look Before You customers, vendors, business regarding working conditions, or partners, or licensors, any patent respond to inquiries from government Leap: Amazon infringement or other intellectual agencies regarding the same.” Web Services property infringement claim • Requirements that employees check Customers May regarding any Service Offerings with the legal department or human you have used.” resources (HR) department prior to Be Subject to an posting or communicating with the Read literally, this language would appear media. Requiring employees to secure IP Covenant Not to impose a covenant on AWS customers permission from their employer before not to sue AWS—or its affiliates, engaging in activities protected under to Sue customers, vendors, business partners Section 7, the memorandum noted, is or licensors—for patent, copyright or prohibited by the NLRA. The growth of cloud computing has been other intellectual property infringement phenomenal, as companies ranging from in connection with web services made Analyzing employer social media early stage start-ups to conservative, available not only by AWS but also by policies under the NLRA continues to blue-chip corporations have sought its affiliates. Immunized services purport be a major enforcement priority of the to take advantage of the cost savings to include not only AWS’s data hosting NLRB, although the NLRB’s position on offered by cloud-based solutions. And services but also associated application social media policies remains, for the at the head of this revolution has been programming interfaces and content most part, untested by the courts. The Amazon Web Services (AWS), one of the (although content made available by third memorandum underscores how the earliest and most popular of the cloud third parties on the AWS platform would precise wording of the policy is critical service providers. Indeed, AWS’s cloud appear to be excluded). to whether it is considered overbroad platform has proven to be particularly by the NLRB. Social media policies appealing to bloggers, website operators, Moreover, if enforceable, the covenant that distinguish between the prohibited social media providers and companies language would prohibit AWS customers behavior and concerted activities seeking to quickly and cost-effectively from authorizing, assisting or encouraging excluded by the policy, and that provide expand their presence on the Internet. any third party to pursue intellectual examples of each, would be more likely to property-related claims against AWS, its withstand NLRB scrutiny. By contrast, the We have summarized elsewhere the affiliates, customers, vendors, business third memorandum cautions employers privacy and data security concerns partners or licensors, a broad prohibition against relying on a so-called “savings associated with cloud solutions, particularly that could—if read in the broadest clause” (such as a general statement those based on “public cloud” models. fashion—potentially impact law firms and that the policy will not be interpreted in However, in recently reviewing the other entities that provide assistance to a manner inconsistent with the NLRA) if click-wrap “AWS Customer Agreement” patent, copyright and other intellectual “employees would not understand from governing access to and use of AWS, property owners. this disclaimer that protected activities among the many standard pro-vendor are in fact permitted.” provisions typically found in any online And the kicker? The provision purports Terms of Use these days, we were struck to survive the expiration or termination Alongside its long list of examples of by one provision that stood out as being of the AWS Customer Agreement. So potentially unlawful policy language, the highly unusual and particularly worrisome a company’s decision to terminate its

7 Morrison & Foerster Social Media Newsletter Vol. 3, Issue 4 August 2012

relationship with AWS may not relieve (i.e., three per week) was without his As the ongoing Penguins litigation such company of its obligations under the express consent, and, for each of those highlights, however, making the “do not assert” provision. violating messages, he says that he— disclosures is not enough: the marketer and his fellow class members—should must also take care to abide by its For a number of legal reasons, therefore receive the prescribed statutory own promises. A failure to do so may companies should always proceed with damages of at least $500. Statutory give rise not only to a private cause caution whenever considering the use of damages per violating message could go of action under the TCPA—a very hot a cloud platform. Conducting thorough up to as much as $1,500 if the Penguins area for plaintiffs’ attorneys over the due diligence is essential, and, of course, are found to have willfully or knowingly past couple of years—but could also such due diligence requires careful violated the law. lead to an enforcement action by the review of all agreements or policies FTC or a state regulator, charging that governing one’s access to or use of the the marketer’s failure to follow its own platform under consideration. And, as the promises was deceptive. The bottom AWS Customer Agreement illustrates, Companies sending line is that companies sending text companies that have patents or other text messages to messages to consumers need to ensure intellectual property rights covering consumers need to that they are in compliance with their Internet or cloud-related technologies or ensure that they are in own representations regarding such works need to be particularly vigilant that, messages, or they may find themselves in their drive to reduce storage costs, compliance with their in the penalty box. they are not inadvertently restricting their own representations ability to fully exploit their intellectual regarding such The Social Media property rights. messages. Experiment: Face Off: Challenges for Consumer Sues Some may wonder why the Penguins would have made a message frequency Broker-Dealers Hockey Team Over promise in the first place. Widely followed industry guidelines issued by the Mobile and Investment Text Messages Marketing Association (MMA) state that a marketer should provide certain Advisers Earlier this year, Fred Weiss, a information to consumers when seeking Pittsburgh Penguins hockey team fan, their consent to receive recurring text The news that a Wall Street firm plans to responded to an offer to receive text messages—including the fact that the give its financial advisers limited access messages alerting him to team news consumer’s mobile carrier’s message and to social media websites has been viewed and special offers. Although the terms data rates apply, as well as how many by many as inevitable. Morgan Stanley’s pertaining to the call-to-action apparently messages the consumer can expect foray into the fast-changing world of social promised Weiss that he would receive no to receive. These disclosures give the media highlights the difficulties faced by more than three messages per week, he consumer the information that he or she broker-dealers and investment advisers alleges that he received five messages needs to make an informed decision and the regulators who oversee them. As the first week and four the following regarding whether to sign up. The MMA more financial firms follow suit, regulators week. Instead of simply following the guidelines do not have the force of law, will struggle to enforce securities laws that alerts’ unsubscribe instructions, Weiss but they are intended to help ensure that were written when the telephone and the filed a putative class action lawsuit marketers comply with mobile carrier telegraph were the prevailing social media. against the hockey team, alleging that requirements. Moreover, while a message its delivery of more messages than frequency disclosure is not expressly Federal securities laws require broker- promised violated the federal Telephone prescribed by law, the Federal Trade dealers and investment advisers to Consumer Protection Act (TCPA). Commission (FTC) or a state regulator comply with a panoply of detailed rules could take the position that a failure to tell designed to ensure that customers a consumer, before he or she subscribes, The TCPA generally prohibits the delivery and clients are not misled. The rules how many messages to expect is an of a text message without the recipient’s require them to keep records of every omission of material information and express consent. In his complaint, Weiss paragraph, sentence, and word—and therefore deceptive. Marketers are has alleged that the delivery of messages now, every tweet. therefore advised to make the disclosures in excess of those to which he had agreed imposed by the MMA guidelines.

8 Morrison & Foerster Social Media Newsletter Vol. 3, Issue 4 August 2012

The challenge: how can financial firms similar, but very different, sets of rules. The SEC defines “advertisement” very comply with these strict rules while Social media use by investment advisers broadly. “Advertisements” include, in satisfying the market’s growing passion that are dually registered with the SEC relevant part, any notice, circular, letter, or for communicating by texts and tweets? and with FINRA is subject to both sets of other written communication addressed And how can regulators enforce two- rules and interpretations. to more than one person, or any notice dimensional securities laws in the new or announcement in any publication or by three-dimensional world? Investment advisers. The SEC radio or television, that (1) offers analysis, has recognized that social media is report, or publication concerning securities, “landscape-shifting” and that its use or that is to be used in making any determination as to when to buy or sell any The exponential jump by the financial services industry is rapidly accelerating. security, or (2) any graph, chart, formula, in social media usage or other device to be used in making any has attracted the The SEC staff has stated its view that determination as to when to buy or sell attention of federal use of social media to communicate any security, or (3) any other investment securities regulators, with clients and prospective clients advisory service with regard to securities. may implicate Rule 206(4)-1 under the who have responded Investment Advisers Act of 1940, as While this regulatory definition reflects with additional amended (Advisers Act), which governs technological advancements through and guidance and advertisements by investment advisers. including the cathode ray tube television enforcement actions. set, we can reasonably conclude that This rule, in relevant part, provides that it applies to all kinds of social media an investment adviser will violate the communications, including blogs, wikis, Advisers Act’s anti-fraud provisions if it photo and video sharing, podcasts, social The exponential jump in social media publishes, circulates, or distributes “any networking, and virtual worlds. usage has attracted the attention of advertisement” that: federal securities regulators, who have OCIE’s regulatory concerns can be responded with additional guidance and • Refers, directly or indirectly, to categorized into three broad categories: enforcement actions. “testimonials of any kind concerning compliance policies and procedures, the investment adviser” or the third-party content, and record keeping. The Financial Industry Regulatory investment advice it provides; Authority (FINRA), which regulates Compliance programs. First, the SEC • Refers, directly or indirectly, to broker-dealers, published guidance on staff is concerned that investment past specific recommendations it blogs and social networking websites adviser compliance programs may provided (e.g., “cherry picking”), in January 2010. This was followed by include overlapping procedures unless the adviser discloses a list guidance on social networking websites that apply to advertisements and of all recommendations, subject to and business communications, posted in communications but do not specifically certain requirements; August 2011. include social media. The staff urges • Represents that a graph, chart, or investment advisers to evaluate the In January 2012, the U.S. Securities and formula, by itself, can be used to effectiveness of their compliance Exchange Commission’s (SEC) Office of determine which securities to buy, programs with respect to the use of Compliance Inspections and Examinations without prescribed disclosures; social media by the firms themselves, (OCIE) published a National Examination their representatives, or solicitors, Risk Alert called Investment Adviser Use • Contains a statement to the effect including the following hot buttons: of Social Media, which outlines in stark that a report, analysis, or other terms the SEC staff’s compliance concerns service will be furnished free of • Usage guidelines. Compliance on the use of social media by registered charge, unless it is actually provided procedures should address investment advisers. entirely free of charge without appropriate usage and restrictions condition; or on use of social media, based on potential risks. While investors typically do not distinguish • Contains any untrue statement of a between broker-dealers, on one hand, material fact, or that is otherwise false • Content standards. Content may and registered investment advisers, or misleading. implicate fiduciary duties or other on the other hand, these two types of regulatory issues, which compliance financial institutions are regulated under procedures should address.

9 Morrison & Foerster Social Media Newsletter Vol. 3, Issue 4 August 2012

• Monitoring. Advisers should consider • Enterprise-wide sites. Advisers that form. OCIE urges investment advisers how to monitor use of social media are part of a larger financial services to ensure that their recordkeeping by employees, representatives, or corporate enterprise may consider policies and procedures allow advisers and solicitors, and should take into creation of usage guidelines designed that use social media to comply with the consideration the lack of ability to to prevent the advertising practices recordkeeping requirements. monitor third-party sites. of a firmwide social media site from violating the Advisers Act. In January 2012, the SEC published • Frequency of monitoring. The staff an Investor Alert, Social Media and suggests a risk-based approach for Third-party content. Second, the staff has Investing: Avoiding Fraud, designed frequency of monitoring of social indicated that third-party content on social to make investors aware of fraudulent media communications. media sites presents special compliance investment schemes that use social • Approval of content. Advisers challenges. These issues arise when media. It also provides tips for checking should consider pre-approval of third parties post messages, forward the backgrounds of investment advisers communications, rather than links, or post articles to an adviser’s and brokers. An Investor Bulletin, Social after-the-fact reviews. website or in social media sites. Adviser Media and Investing, Understanding Your representatives and solicitors generally Accounts provides tips for investors who • Firm resources. Advisers should do not interact with these third parties or use social media about privacy settings, evaluate their resources to ensure respond to their postings. security, and password selection. that they are sufficient to adequately monitor personnel and archive The staff noted its concern about direct Also in January 2012, the Enforcement communications. or indirect testimonials “of any kind.” Division announced that the SEC charged The SEC’s rules do not define the an Illinois-based investment adviser with • Criteria for approving participation. term “testimonial,” but the SEC’s staff offering to sell fictitious securities on Compliance procedures should broadly interprets the term to include LinkedIn. Among other things, the Division assess risks to the adviser, including a statement of a client’s experience alleged that the adviser used LinkedIn operational, reputational, privacy, and with, or endorsement of, an investment discussions to promote fictitious “bank other regulatory issues. adviser. Therefore, the use of “social guarantees” and “medium term notes,” plug-ins,” even when a third party hits the which generated interest from potential • Training. Advisers should consider “Like” button on an adviser’s Facebook investors. The adviser failed to comply implementing a training program page could be a “testimonial” under the with recordkeeping requirements or related to social media, with a view Advisers Act if the “Like” represents an maintain a required Code of Ethics. toward promoting compliance. explicit or implicit statement of a client’s • Certification. Consider procedures that experience with an investment adviser or The SEC’s Enforcement Division noted require personnel to certify that they its representative. that fraudsters are quick to adapt to new understand and will comply with social technologies to exploit them for unlawful media policies. The staff’s concerns underscore the purposes. This case suggests that the challenges that investment advisers face federal regulators are determined to adapt • Functionality. Advisers should consider when the use of freewheeling, interactive to new technologies to follow the fraud. the functionality of social media social media collides with requirements to sites approved for use, including the comply with pre-Internet regulations that Broker-dealers. As long ago as continuing obligation to address any were designed to regulate newspaper and 1999, FINRA recognized the potential upgrades or modifications. magazine advertisements. compliance issues posed by use of social • Personal/professional sites. Advisers media when it stated that a registered should consider whether to adopt Recordkeeping. The SEC’s third representative’s participation in an policies to address business area of concern is recordkeeping Internet chat room is subject to the same conducted on personal or third-party obligations of advisers. OCIE noted requirements as a presentation in person media sites. that the recordkeeping rules do not before a group of investors. FINRA differentiate between traditional paper codified this guidance in 2003, when it • Information security. Advisers communications, like snail mail, and defined the term “public appearance” should consider whether permitting electronic communications, such as to include participation in an interactive representatives to have access to emails, instant messages, and other electronic forum. social media sites poses information ways that investment advisers provide security risks, and how to protect advisory services. In other words, the FINRA published its Guide to the Internet information. federal regulators focus on the content for Registered Representatives, and in of the communication, rather than its

10 Morrison & Foerster Social Media Newsletter Vol. 3, Issue 4 August 2012

September 2011, it released a three- in this area. Financial services firms part series of podcasts on these issues are well advised to assess how their to educate broker-dealers and their We note that customers and employees use social representatives. regulated entities media, to evaluate the potential risks, also need to pay and to ensure that their policies and FINRA is not so much concerned about attention to the procedures adequately address the the form of a communication from increasingly complex compliance and a registered representative; rather, growing tension operational issues arising from the it is concerned about the content of between guidance soaring popularity of social media. the communication and whether the on social media use registered representative obtained prior issued by regulators What, What (in the supervisory approval for sending the and new laws and communication. FINRA penalized a Court): South Park registered representative who posted 32 National Labor tweets touting a particular security without Relations Board Studios Shielded prior principal approval, among other pronouncements by Fair Use for alleged violations. imposing restrictions Viral Video Parody For a summary of recent FINRA on employers’ ability concerns about social networking, see to monitor or curtail our August 3, 2011 News Bulletin, FINRA their employees’ The Seventh Circuit held recently in to Issue More Guidance on Social Media. Brownmark Films, LLC v. Comedy social media use. Partners that, under certain circumstances, a trial court may dismiss The Morgan Stanley initiative. The a copyright infringement case based on a New York Times DealB%k reported on fair use defense prior to discovery. June 25, 2012 that, after a yearlong trial communications technology, firms must program, Morgan Stanley planned to give still comply with pre-Internet federal about 17,000 financial advisers “partial securities laws covering anti-fraud, Over the years, the satiric Comedy access” to Twitter and LinkedIn. But don’t advertising, and recordkeeping. Central cartoon program South Park and expect their registered representatives its creators have developed a reputation for biting social commentary. Past targets to get carried away with a flurry of on- An additional challenge. We note include World of Warcraft players, Occupy the-fly stock picks. The representatives that regulated entities also should Wall Street, and the History Channel’s draw posts “from a prewritten library” of understand the growing tension between, recent obsession with swamp creatures Twitter messages and submit all LinkedIn on one hand, the typically conservative and World War II. In the show’s 12th postings for approval, using advanced guidance on social media use issued by season, in an episode entitled “Canada software designed for this purpose. Other regulators and, on the other hand, new on Strike,” South Park took on the world firms likely will follow suit and devote more laws and National Labor Relations Board of viral videos. The episode included a resources to developing this latest frontier pronouncements restricting employers’ parody of a real-world viral video called of communications with customers. ability to monitor or curtail their “What What (In the Butt)” (“WWITB”) employees’ social media use. There are (Authors’ Note: possibly NSFW). South Not only did Morgan Stanley give the no easy solutions to this emerging issue; Park’s version visually approximates green light to its financial advisers to rather, a company’s chief compliance the original, but plays on the naïveté of post limited tweets, but, on the firm’s officer and its employment law advisors the starring nine-year-old South Park official Twitter account, senior Morgan should coordinate polices in an effort character, Butters, by using more childish Stanley economists recently tweeted to alleviate the tension between these elements; for example, by portraying their analysis of the U.S. jobs report and conflicting regulatory approaches. Butters dressed up as a teddy bear and the European Central Bank’s decision to a daisy. lower interest rates. Conclusion. The exponential growth of the use of social media presents Brownmark, the copyright holder for This initiative signals a trajectory and compliance and operational challenges the original WWITB video, filed suit for confirms that the financial services for investment advisers and broker- copyright infringement against South Park industry’s use of social media is here dealers. Regulators are devoting more Digital Studios and others (“South Park to stay. And it is a somber reminder and more resources as they scramble to Studios”). South Park Studios responded that, notwithstanding advances in stay current with technological advances with a motion to dismiss based on an

11 Morrison & Foerster Social Media Newsletter Vol. 3, Issue 4 August 2012 affirmative fair use defense. Although viewed South Park’s parody as something August 2011, and will centralize a number Circuit Judge Cudahy noted that courts more than mere drudgery avoidance. of existing California Justice Department should generally refrain from dismissing programs intended to enforce privacy cases based on affirmative defenses, he Going forward, Brownmark changes little, if laws, combat identity theft, educate wrote that the reason for this reticence is anything, with respect to the substance of consumers, and create partnerships with that defenses typically turn on facts that the fair use analysis. But Brownmark does private industry under one umbrella. emerge during discovery and trial. In this show that courts may—in at least some The new unit’s mission is broad: it will case, though, the district court ruled that fair use cases and at least in the Seventh enforce federal and state laws regulating only two pieces of evidence were needed Circuit—grant a motion to dismiss prior the collection, retention, disclosure, to decide the question of fair use: the to discovery. While Brownmark involved and destruction of private or sensitive original WWITB video and South Park a seemingly easy fair use case in the information by individuals, organizations, Studios’ parody. defendants’ favor, it will be interesting and the government. In addition to to see whether future courts will grant traditional online privacy, the unit’s The district court granted South Park motions to dismiss where the fair use mandate covers health privacy, financial Studios’ motion and dismissed the case. analysis is less obvious. In any event, privacy, identity theft, government The Seventh Circuit affirmed, noting that copyright infringement plaintiffs should be records, and data breach laws. The unit “[o]ne only needs to take a fleeting glance aware that the road to discovery where a will be staffed by California Department at the South Park episode” to determine defendant raises a fair use defense may of Justice employees, including six that its use of the WWITB video is not be quite as smooth as it used to be. dedicated prosecutors. meant “to lampoon the recent craze in our society of watching video clips Harris has made online privacy protection on the internet . . . of rather low artistic California a major focus of her administration, sophistication and quality.” Thus, fair use. Attorney General and the creation of the new Privacy Enforcement and Protection and eCrime Other commentators support the decision, Creates Privacy Units are just two of her initiatives aimed noting that the focus of the parody is not at fighting online crime and protecting the specific viral video, but rather that Enforcement consumer privacy. In February of this the parody is a commentary on society’s year, Harris also secured an agreement consumption of such Internet videos and Protection between her office and the six major generally. It is worth noting that such Unit; Increased platforms for distributing and selling arguments have not always found favor in mobile applications. The agreement is the courts. For example, in the well-known Enforcement designed to ensure that mobile and social Cat Not in the Hat! case, a district court apps comply with the California Online found—and the Ninth Circuit affirmed— Likely Privacy Protection Act, which requires that a book entitled The Cat Not in the Hat! operators of commercial websites and A Parody by Dr. Juice was not shielded On July 19th, California Attorney General online services that collect personally as fair use. The book “mimic[ked] the Kamala D. Harris announced the identifiable information about Californians distinctive style” of a Dr. Seuss book, using formation of a new Privacy Enforcement to conspicuously post a privacy policy. repetitive, simple rhymes to tell the story and Protection Unit within the state’s Facebook signed onto the agreement, of the O.J. Simpson double-murder trial. Department of Justice. The move is called a “Joint Statement of Principles,” in The general idea is that a use is not fair widely seen as a means of stepping June 2012, adding the primary platform if, in the words of the U.S. Supreme Court up the state’s enforcement activities for social applications to the agreement. in Campbell v. Acuff-Rose, the alleged involving privacy issues. infringer uses the original work solely “to get attention or to avoid the drudgery The Privacy Enforcement and Protection in working up something fresh.” In Unit will be organized under the state’s Brownmark, it seems, the Seventh Circuit new eCrime Unit, which was formed in

We are Morrison & Foerster—a global firm of exceptional credentials in many areas. Our clients include some of the largest financial institutions,Fortune 100 companies, investment banks and technology and life science companies. Our clients count on us for innovative and business-minded solutions. Our commitment to serving client needs has resulted in enduring relationships and a record of high achievement. For the last eight years, we’ve been included on The American Lawyer’s A-List. Fortune named us one of the “100 Best Companies to Work For.” Our lawyers share a commitment to achieving results for our clients, while preserving the differences that make us stronger. Because of the generality of this newsletter, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations. The views expressed herein shall not be attributed to Morrison & Foerster, its attorneys or its clients.