Private Versus Public Data: New Lawsuits Question What Should be Protected

Wed, Dec 7th, 2022 | by Miles Mediation and Arbitration | Article | Social Share

By Leigh Wilco

Today, the cell phone has become ubiquitous. It likely goes where you go — to the office, to the grocery store, to the gym. Your favorite restaurant. Your doctor’s appointment. Your house of worship. While it’s almost always on you, it’s easy to forget that it’s likely also tracking your movements. That geolocation data, and how it may be used, is at the heart of two new lawsuits filed in the U.S. District Court for the District of Idaho.

The first was brought by Kochava, Inc., an Idaho-based mobile analytics firm that brokers data, against the Federal Trade Commission (FTC). The lawsuit, which was filed after the company received notice that the FTC was preparing to file for an injunction against it, asks the court to protect its data brokering business from FTC interference. Less than three weeks later, the FTC filed its own lawsuit against Kochava, seeking to prevent the company from sharing data containing “sensitive locations” (like medical facilities and houses of worship) with its customers.

In addition, in September a proposed class action lawsuit was filed against Kochava in California alleging that it illegally collected and stored California consumers’ precise location data and sold the information to its clients.

Wherever You Go, Someone Knows

Geolocation data is highly valuable to businesses seeking to target potential and current customers. Mobile devices and apps track data, including physical locations and how much time is spent there. (Yes, people can “opt out” of location tracking, but most fail to do so.) Kochava purchases geolocation data from from millions of mobile devices, and creates data feeds that connect specific timestamped locations with specific mobile advertising identifiers, or MAIDs. It then sells access to this data to companies to purportedly help them identify consumers’ shopping habits and better target potential customers.

Kochava filed its lawsuit against the FTC in federal court on August 12, 2022, seeking a declaratory judgement and protection from a potential injunction by the FTC. The suit asks the court to find that its “practice of data collection specifically or latitude and longitude, IP address and MAID information associated with a consumer’s device is not an ‘unfair … act or practice’ as defined by Section 5 of 15 U.S.C. §45(a),” the Federal Trade Commission Act.

The lawsuit claims that the data the company sells does not allow someone to track a specific person to a specific location and points out that people can opt out of location data collection practices. It also stated that the company had begun using a privacy block that removes health services location data from the information it supplies.

The FTC has filed its own lawsuit, formally asking for injunctive relief against Kochava to force the company to stop selling sensitive geolocation data and to delete all sensitive geolocation data that has already been collected.

Protecting the Right to Privacy

The issue, according to the FTC’s suit, is one of privacy. This geolocation data can be used to trace people’s movements from “sensitive locations” like houses of worship, domestic violence centers, addiction recovery clinics, and reproductive health clinics, says the lawsuit. The sale of such data can allow third parties to identify people and expose them to “stigma, discrimination, emotional distress, and even physical violence.”

“Where consumers seek out health care, receive counseling, or celebrate their faith is private information that shouldn’t be sold to the highest bidder,” said Samuel Levine, Director of the FTC’s Bureau of Consumer Protection. “The FTC is taking Kochava to court to protect people’s privacy and halt the sale of their sensitive geolocation information.”

Kochava maintains that the FTC lacks standing, noting that there is no federal privacy law that the FTC would be responsible for enforcing. Instead, Kochava claims the commission is attempting not to enforce law, but to create it — which is beyond the commission’s scope.

Drawing the Line Between Private and Public

This isn’t the FTC’s first foray into this area of law. In June 2021, the FTC settled with Flo Health. The FTC had alleged that the company had shared users’ sensitive health information with marketing and analytic firms, including Google and Facebook, after promising to keep that information private. Per the settlement, the company had to notify users that it had disclosed health info and direct third parties that had received the information to destroy it. Flo Health must now receive affirmative consent from users before sharing personal health information, and cannot mispresent how it uses, collects, or discloses such information.

Regardless of whether it has standing to do so, the FTC has declared that protecting sensitive consumer data is one of its top priorities. It is currently exploring rules to combat commercial surveillance practices that profit from personal information. It has also declared that it will enforce laws that prohibit illegally using and sharing highly sensitive or private consumer data.

But what type of data is considered private, and should be protected? What kinds of limitations can be placed on data which is readily available to companies with the ability to gather, analyze, and sell it? And how much authority does the FTC have —  or should it have — over privacy matters like the ones involved in these two related suits?

While the cases have not been consolidated, they have been assigned to the same judge. As they play out, companies that harvest, supply, and use this geolocation data and consumer privacy watchdog groups will be paying close attention to the federal court’s rulings in this relatively new area of law.

ABOUT LEIGH WILCO

Leigh Wilco has been practicing law in Atlanta for over 35 years, representing plaintiffs and defendants in a variety of matters. For the past 20+ years, he has overseen the litigation practice group at Weissman PC (formerly Weissman, Nowack, Curry & Wilco) dealing with a wide range of real-estate-related matters, in addition to his previous areas of practice. Leigh has served as a neutral for more than 10 years in real estate disputes, premises liability claims, contractual disputes, small business and partnership dissolutions, professional liability, wrongful death, and personal injury cases. He has also been appointed by the courts as a special master and as a receiver.