epic.org

WhatsApp previously threatened sanctions against users who would not accept the company’s new terms of use with weaker privacy protections, but backed down late Friday after a coalition of groups from around the world protested. Burcu Kilic, digital rights program director for Public Citizen, released the following statement in response: “Thank you for stopping what you never should have started. Now please also undo what you coerced millions of people into accepting.” In 2014, EPIC and the Center for Digital Democracy warned the FTC that Facebook routinelyincorporates user data from companies it acquires and that WhatsApp users objected to the acquisition. The FTC approved the merger but told EPIC and CDD that "if the acquisition is completed and WhatsApp fails to honor these promises, both companies could be in violation of Section 5 of the FTC Act and potentially the FTC's order against Facebook."

Lina Khan was confirmed to the Federal Trade Commission by the U.S. Senate and named chair of the Commission by President Biden today. Khan received bipartisan support, with senators voting 69-28 in support of her confirmation. Khan is an expert on antitrust enforcement and served as counsel to House Antitrust Subcommittee Chairman David Cicilline during the Subcommittee's groundbreaking investigation last year. She has written extensively on the problems of concentrated power in the context of digital markets and said during her confirmation hearing that "I worry that some of these companies may think it's just worth the cost of business to actually violate privacy law." EPIC has long argued that the FTC is not doing its job to protect privacy and that the U.S. needs a Data Protection Agency. "Commissioner Khan has a tremendous opportunity as Chair to transform the FTC at a moment where anticompetitive and invasive business practices have proliferated," said Alan Butler, Executive Director of the Electronic Privacy Information Center (EPIC). "Large tech companies have increasingly infiltrated our lives to the most minute level, and it will take a keen and aggressive regulator to ensure that these powerful entities don't monopolize our markets and our data."

The U.S. Supreme Court issued a decision today in TransUnion LLC v. Ramirez, an important case about the ability of individuals to bring privacy cases in federal court. The Court, in a controversial 5-4 decision authored by Justice Kavanaugh, held that proof of "concrete harm" is required to establish standing to sue under Article III of the U.S. Constitution. The jury in this case found that TransUnion had willfully violated the Fair Credit Reporting Act (FCRA) when it falsely flagged the credit reports of thousands of individuals for being "Specially Designated Nationals" under the Office of Foreign Asset Controls list that includes terrorists, drug trafficers, and other sanctioned individuals. The Supreme Court held that the group of individuals who could prove that these false credit reports had been disclosed to third parties had standing to sue, but the group who did not provide evidence that their reports had been disclosed did not meet the burden under Article III.

This decision will have significant implications for individuals seeking redress in federal court for privacy violations that do not involve the improper disclosure of personal information. EPIC filed an amicus brief in TransUnion, urging the Court to hold that people can sue when their privacy rights are violated, regardless of whether they allege that the violation led to other harms. Justice Thomas, joined by three other members of the Court, agreed and would have ruled that standing exists in any case brought by an individual to vindicate a violation of their private rights. EPIC's Executive Director, Alan Butler, said that "the Supreme Court's decision in TransUnion does not close the door on all privacy claims, but it certainly makes it more difficult for individuals to seek redress in privacy cases that don't involve improper disclosure of information." EPIC previously filed an amicus briefs on this issue with the Supreme Court in Spokeo v. Robbins and frequently files amicus briefs in cases interpreting standing under a variety of privacy laws.