eMedia Law Insider - Insight & Commentary on Internet Marketing & Online Media

No one likes to be sued.  It may make you mad enough that you want to scream and holler on the Internet.  There is a reason, however, a lot of lawyers recommend not commenting on personnel issues and pending litigation.

Take a lesson from Coyote Ugly that does not involve dancing on the bar.  The lesson is — don’t go to the Internet to rail on your former employees when they file a Fair Labor Standards Act minimum wage case against you.

About a month after a group of employees filed suit against the Coyote Ugly Saloons, the president of the chain of Coyote Ugly Saloons went to her “Lil Spill” blog and wrote:

This particular case will end up pissing me off[,] cause it is coming from someone we terminated for theft. I have to believe in my heart that[,] somewhere down the road, bad people end up facing bad circumstances!

I have been reading the basics of Buddhism[,] and am going to a class on Monday. The Buddhist way would be to find beauty in the situation and release anger knowing that peace will come. Obviously, I am still a very new Buddhist[,] cause my thoughts are “[f***k] that [b**ch.]” Let me do my breathing exercises and see if any of my thoughts change. Lol .

A slightly different take then, say, Warren Buffet may have taken.  The subject of the post had already been reinstated by the time the blog post was published.

To add to the fire, a supervisor allegedly posted on Facebook when drunk about another plaintiff who was still employed but had joined the suit:  ”Dear God, please don’t let me kill the girl that is suing me . . . . that is all . . . .”

The result of these diatribes was a retaliation claim in addition the underlying minimum wage claims.  The federal district court in Tennessee recently allowed both claims to continue.  You can read the opinion here.

I am not an employment lawyer, but I know enough to warn clients you can almost get into more trouble for retaliating against an employee for making an overtime, workers’ compensation, minimum wage, harassment or discrimination complaint than you can for the underlying complaint.  My colleague Michael Kelsheimer has written on retaliation on his Employer’s Handbook blog.

The emedia law lessons seem almost too obvious.  I’ve never thought to add ”don’t let your supervisors post to about your employees while drunk” to my social media policies.  The real lesson is to train your employees and have policies.  Considering the founder was the first to take to the Internet, I’m not sure there was much respect for policies or compliance.  Your business, I am guessing, is probably different.  You should have policies and plans in place regarding who can say what about pending claims and what is and is not appropriate to do on the Internet.

Sometimes, I like to talk basics and this time it’s something as basic as “tell the truth.”  I’ve never had a client come to me and say, “I would like to lie as much as possible in my advertising, can you help me?” It’s never that simple. 

The general rule is advertising cannot be deceptive – which means it should be the whole truth and fair.  You should not have to justify a claim with a lot of explanations. It’s a matter of context and not simply a matter of whether the statement, in a vacuum, is technically true.

According to the FTC’s Deception Policy Statement, an ad is deceptive if it contains a statement – or omits information – that “is likely to mislead consumers acting reasonably under the circumstances; and is ‘material’ – that is, important to a consumer’s decision to buy or use the product.” An ad is unfair if “it causes or is likely to cause substantial consumer injury which a consumer could not reasonably avoid and it is not outweighed by the benefit to consumers.” The FTC looks at advertisements from the reasonable consumer standpoint. If a scientist may understand the half-truth in your claim, but Aunt Myrtle surfing Facebook would be fooled by it, you might find trouble.

The FTC uses the following example to illustrate their contextual, reasonable circumstances approach. If your mouthwash says it kills the germs that cause the cold, that may technically be true. It implies to the average consumer, however, that your mouthwash prevents colds even though you never said that. Therefore, you could be in trouble.

Advertising agencies need to be wary as well. You can’t simply rely upon the client to be truthful because you can also be held liable depending on the extent of the agency’s participation in the preparation of the challenged ad and whether the agency knew or should have known that the ad included false or deceptive claims.

The Online Disclosure

The same rules apply online and off.  Disclosures should be clear and conspicuous so consumers will see and understand them. Disclosures tucked away in a small link not clearly identified or on a completely separate page are not likely to be effective. There is no hard-and-fast rule about the size of font or location of the disclosure or link; the FTC generally asks whether a consumer is likely to find it.

When using online disclosures, you should place disclosures near, but certainly on the same screen where the claim is. Links are acceptable as long as the link is obvious, appropriately labeled and easy to find. You should track the click-through rates on the disclosure in case you ever have to defend yourself. Make sure the disclosure is made prior to purchase and not hidden on the last page of a multi-step ordering process.

The Comparison – Four out of five clients say my lawyer can beat up your lawyer.*

Comparative advertising is legal — if truthful. You can generally use the competitor’s name and trademarks when making the comparison too. The Lanham Act, however, gives your competitor the right to sue if the comparative advertising is deceptive. If you are going to use comparative advertising and surveys, make sure the sample is large enough to be legitimate. Asking my five best clients and only my five best clients would not be a legitimate survey — nevermind that my fifth best client doesn’t love me as much as I thought they did.

Case Studies

The FDA Doesn’t “Like” Facebook

The Food and Drug Administration issued a Warning Letter on February 26, 2013, because a company “liked” a Facebook post from one of their customers. The customer wrote: “PolyMVA has done wonders for me. I take it intravenously 2x a week and it has helped me tremendously. It enabled me to keep cancer at bay without the use of chemo and radiation…Thank you AMARC.” The FDA said “liking” the post was an endorsement of the message and therefore it was as if the company promoted the drug as a cure or treatment for cancer in violation of the Federal Food, Drug and Cosmetic Act. You can read more here.

Pomegranate Juice makes you healthy, more attractive and just an overall better person.

The makers of POM Wonderful 100% Pomegranate Juice claimed their products could treat, prevent or reduce the risk of heart disease, prostate cancer and erectile dysfunction. While there was some evidence to arguably make such claims, the advertising was still considered deceptive by the FTC and later upheld by a judge. The FTC issued an order prohibiting POM from making any such health-related claims unless it is supported by two randomized, well-controlled, human clinical trials. POM Wonderful spent $35 million in peer-reviewed scientific research and relied upon “centuries of traditional medicine and plain common sense have taught us: antioxidant-rich pomegranate products are good for you.”

Undoubtedly, there are some health benefits to pomegranate juice. Saying the juice helped “cheat death” may have taken things too far. In the ruling, the FTC examined the “net impression” of medical claims (see the mouthwash example above) even if POM did not expressly claim the juice was a cure all. The FTC also did not let POM off the hook for using such qualifiers as “preliminary,” “promising,” “may,” or “can” when it came to health claims.

When is a foot long not 12 inches?

As first publicized by a teenager in Australia through Facebook with the picture to the left, Subway’s “footlongs” do not always measure up. Now, the lawyers have filed several pending state and federal class action cases. Even product names, as opposed to marketing campaigns, can bring on a challenge. If you are going to call something a footlong, it should predominantly be twelve inches long.  The results of this case may depend on the percentage of footlongs not actually twelve inches and whether 11 and ¾” sandwiches are deceptive. On the other hand, Subway put lots of stock in branding the “footlongs,” which is a promise to the consumer they should keep.

So, what can you do?

If you make a claim, have the evidence to back it up which means a “reasonable basis” to make the claim including “competent and reliable scientific evidence” for health and safety claims.

Stay subjective. Saying your drink tastes great or that this is the best column ever is something the consumers can judge for themselves. Opinions are not verifiable facts and rarely can create liability.

Be careful online.  Your “liking,” “re-tweeting,” or other actions can be an endorsement of someone else’s comments and violate regulatory rules that govern your industry.  If you are in those industries, train the people running the official company channels.

The Business Guidance section of FTC’s website provides some good resources to help stay out of trouble.

*comments made in jest and not subject to verification unless you ask my mother.

Our last back to basics was on the use of images on the web.

Your employees want to be able to use their own iPhones or Android devices at work.  Angry Birds on the Blackberry is just not the same.  This trend is being referred to as Bring Your Own Device or BYOD.

While it will make your employees happy, it creates some issues that involve three key stakeholders: legal, IT and HR.  They need to get together to make sure the company does not willy-nilly take on unneeded risk just so the recent college grad can access Instagram photos on his phone while working.

So, where do I start?

While there are IT and HR issues to consider, the primary legal risk centers on the company’s need to access the employee’s personal phone and possibility to wipe it clean if the phone is lost or the employee is terminated. 

If you want to address the issues cheaply (the Yugo), then adjust your existing Computer Use or Technology Resources (whatever you have already called it) policy.  Make sure the restrictions and rules also apply to the employee-owned devices (don’t forget the tablets) that access the company’s computer networks and resources.   You also probably need to add a line that although the company will try not to erase or access personal items on personal devices, the company reserves the right to access the phone, its data and possibly wipe it clean if it needs to protect company assets or conduct necessary investigations.  Employees should also be warned that they run the risk of losing personal data on their devices if they use them for work.

If you don’t already have some type of Computer Use policy, then you can create a brief agreement with employees before you allow them to use their personal devices to access the company’s networks to cover these basics.

This is a minimal approach to covering BYOD that covers the privacy and right to search/erase issues. In one of the few applicable cases involving the company inspection of a personal laptop, the court in Sitton v. Print Direction, Inc., 718 S.E.2d 532 (Ga. Ct. App. 2011) noted the employee gave the company permission to look at the contents on the laptop when it expressed the necessity for the company “to be able to respond to proper requests resulting from legal proceedings that call for electronically-stored evidence” and provided that for this reason, its employees should not regard “electronic mail left on or transmitted over these systems” as “private or confidential.” The company’s policy also stated the company “will . . . inspect the contents of computers, voice mail or electronic mail in the course of an investigation triggered by indications of unacceptable behavior.” The policy was expressly included personal devices used at work and not just company-issued computers.

We want more . . .

If you like, or want more rules, the pundits suggest there you should have a whole policy separate and apart from your computer use policy to cover things not necessarily addressed above such as:

- Required security measures the company will take (such as requiring passcodes to unlock the iPhone or company-provided apps with more complex, rotating passwords or automatic locks after a set number of failed attempts)

- The ability to clean a device remotely if stolen or lost including employee notification protocols with warning that personal items may be lost in the process

- Notice that using your own device is a privilege and not a right

- Only employees can access company resources with devices

- Reserving the right to disconnect from the company resources without notice

- Departing employee procedures

- Coordination with the data retention policies

- Identify which devices and operating systems the company will support

- Eligibility and Reimbursement procedures and restrictions

- Any required applications that the company will require to be installed

- Require IT approval before use

- Require IT approval before transfer or disposal of the device to clean

- Reserve the right to wipe clean in case of an emergency

- Disclaim any liability for increased charges

- Add that the company does not condone typing or reading while driving

- Disclaim any liability for data loss to the device as a result of the company data or applications

- What support is available for BYOD

- Restrictions against jailbreaking or otherwise modifying the operating system of the phone

The gold-plated plan would require the employee to sign off on this policy separate and apart from the rest of the employee manual. 

For more . . .

Here is a website with a sample policy.  It needs to be tailored to fit your specific needs and requirements.  If you are just getting started, this may be a helpful place to start.  SAP BYOD Policy Guidebook

Texas State Representative Jeff Leach R-Plano (full disclosure – he is a lawyer in our Dallas office) proposed a bill (HB  1989) that would allow service via social media if the more traditional methods did not work first.

Normally, to serve someone with a lawsuit you have to have the petition and citation delivered to them in person or through certified mail so the courts are certain the defendant knows they have been sued. 

There is already a process in place to allow for substituted service if there is reason to believe a defendant is purposefully “ducking” or avoiding service.  Usually, it means dropping the papers off at the person’s residence with anyone over the age of 16 or publication. 

The current rules also allow a judge to authorize service “in any other manner that the . . . evidence . . . shows will be reasonably effective to give the defendant notice of the suit.”  This proposal would expressly add “social media” as an additional substituted method. 

Because the proposal comes from a lawyer in our firm, I will defer on providing my opinion here on the blog, but tell me what you think of the proposal in the comments. 

It has been done before but there are some concerns about authentication according to Bradley Shear of Shear on Social Media.  Legal Language Services, a commercial enterprise that helps effectuate service, mirrors Bradley’s concerns and provides some additional background on service via email and social media.

Here is the actual text of pertinent parts of the bill:

Sec. 17.031. SUBSTITUTED SERVICE THROUGH SOCIAL MEDIA WEBSITE.

(a) If substituted service of citation is authorized under the Texas Rules of Civil Procedure, the court may prescribe as a method of service under those rules an electronic communication sent to the defendant through a social media website if the court finds that:

(1) the defendant maintains a social media page on that website;

(2) the profile on the social media page is the profile of the defendant;

(3) the defendant regularly accesses the social media page account; and

(4) the defendant could reasonably be expected to receive actual notice if the electronic communication were sent to the defendant’s account.

 Check out our prior Texas Leg Watch 2013 on the proposal prohibiting employers from asking for social media passwords.

If you are the CEO of Google, Facebook, Verizon, Comcast, Exxon or Boeing, don’t read this.  You have a team of lawyers working for you who have already spent hours analyzing President Obama’s Cybersecurity executive order and the numerous articles about it.  If you own a one-location cupcake shop, auto repair facility or truly a “mom and pop” business, you can go back to looking at Harlem Shake videos online.   This post is for the rest of us.

Even if you are not into defense, a major international conglomerate or think no foreign entities, hacktivists or cyber-terrorists are coming after your company, you may need to take steps now to respond to the executive order.

The Basics

The focus of the order is on “critical infrastructure“ which largely means energy, health care, transportation, financial services, heavy manufacturing, food and drugs.  If you are wondering whether you are “critical infrastructure,” you probably aren’t.  In fact, the Secretary of Homeland Security is tagged with identifying “critical infrastructure at the greatest risk.”  Those identified will be confidentially notified of the designation and encouraged to adopt the cybersecurity framework.  But, you probably work with someone who is considered “critical.”

If you contract in any way with the government, or even contract with those who contract with the federal government, you should probably pay attention.  If you work with those in likely to be identified as “critical infrastructure,” you should pay attention. Right now, many of the directives are voluntary, but it is likely preferences will be given to contractors who tighten their sybersecurity.  You can expect cybersecurity to become part of the RFP process, so you need to be ready. 

Have a data breach plan in place.  If you store any individual’s personally identifiable information, including credit cards, or other sensitive information, you should already have a plan in place that complies with many state laws so you can report any breaches to the appropriate authorities.  Now, you should have a plan in place in case you lose trade secrets or get hacked for other reasons.  This plan should include the technological response to mitigate the harm and reporting requirements to the appropriate agencies.  

The Government is promoting more transparency and a private-public partnership to address these national security concerns.  If you do business with any federal agencies, or companies that do, start asking them what they think is appropriate for your situation.  If you are in a heavy-regulated industry or would be considered “critical infrastructure,” your requirements are likely to be dicated by the National Institute of Standards and Technology (NIST) or your specifc industry regulators.  

Think about your vendors and contractors.   We have already written a two-part series about some state laws requiring you and your contractors to have Written Information Security Plans or WISPs.   Now, think about whether you are doing business with or for anyone who may be considered “critical infrastructure.”  Here’s looking at you internet marketing and web development firms.  You need to be prepared to provide notices and information about data breaches.  What are you prepared to disclose?  How much will you have to disclose while still not disclosing too much personal privacy?  You need to make sure you and your contractors have plans in place.  

Go Hack Youself.  Yes, I mean this literally.  Your plan should include some type of periodic risk audits.  Have someone try to hack into your system so you know and can address your vulnerabilities.  Although not required at this point, it may become law before year’s end.  If your IT guy can get through, imagine in the full weight of a foreign power or legions of hacktivists coming after you.  Think about whether your business partners are also up to snuff and do periodic testing. 

But wait, there’s more . . .

Just when you thought that was enough, if you are doing business in Europe, you might want to check out the EU’s Cybersecurity Directives.

Finally, Homeland Security may not be the only one interested in your cybersecurity.  The SEC requires disclosures of your cyber-risks and protections.