Privacy Lawyer: Policy Transparency Helps Reduce Lawsuits
To avoid lawsuits under the California Invasion of Privacy Act (CIPA), companies should adopt a defense-first posture that emphasizes transparency, making themselves more difficult targets for litigation, said Matthew Pearson, a Womble Bond privacy lawyer.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
Pearson called it the “don't be the slowest gazelle in the pack” approach, during a webinar that privacy vendor Privado sponsored Thursday.
The first step is to make sure website disclosures are “painfully” transparent, Pearson said. “This is not a situation in which you want” or “need to hide the ball.”
A cookie banner that says "we use cookies to enhance your experience" doesn't explain much, he argued. Instead, disclosures should focus on what's happening, not technology.
“If I go to court and say, ‘Your Honor, plaintiff consented to what we were doing because we told them that we were using cookies to enhance their experience,’ there's no world in which the court's going to say that's consent to do what we did, because the judge is not going to understand what that means.”
Linking one's privacy policy with the cookie banner is a good idea that may provide a deeper explanation of one's policy, but businesses should remember that it's not “sufficient consent.” Also, he said that “if you're banking on an individual clicking on your privacy policy, scrolling through [it], reading it all, understanding it, and then thinking, ‘Well, I consented to do this,’” that's not the case.
Pearson recommended linking Terms of Use, but also specifically listing relevant provisions for easy access, such as an arbitration clause or class-action waiver. “Take steps to put people on notice of the terms you want to enforce."
Additionally, a business should update its website's architecture so that an explanation of what tracking technologies are doing occurs early, he said. If the cookie banners pop up immediately every time the site is visited, one can argue that website visitors "knew what was going on," Pearson said. “They knew early” and “they knew often.”
Pearson cautioned that his approach isn't "a silver bullet,” and companies “likely will still get demand letters” or lawsuits. Still, "what you're doing is better positioning yourself" should litigation occur, he said.