invasion of privacy – Paul Porvaznik

Facebook Not Subject to Illinois Long-Arm Jurisdiction For Its Photo “Tagging” Feature – IL ND

Surely something as culturally pervasive as Facebook, arguably the Alpha and Omega of social media, is subject to personal jurisdiction in Illinois (or anywhere else for that matter). Wouldn’t it? After all, with over a billion monthly users1 and some 350 million photos uploaded to it daily 2, Facebook’s electronic reach is virtually limitless (pardon the pun).

Wrong – says an Illinois Federal court. In what will be welcome news to on-line merchants the world over, the Northern District of Illinois recently dismissed a privacy lawsuit filed against the social media titan by an Illinois resident for lack of personal jurisdiction.

The plaintiff in Gullen v. Facebook, Inc., 15 C 7681 3 , http://cases.justia.com/federal/district-courts/illinois/ilndce/1:2015cv07681/314962/37/0.pdf?ts=1453468909 sued under the Illinois Biometric Information Privacy Act (“BIPA”), 740 ILCS 14/1 et seq. The plaintiff claimed Facebook’s “tag suggestion” feature which culls uploaded photos for facial identifiers, invaded plaintiff’s BIPA privacy rights.

Granting Facebook’s motion to dismiss, the Court gives a useful primer on what a plaintiff must allege to establish an arguable basis for personal jurisdiction over a nonresident corporate defendant.

– Federal courts sitting in diversity may exercise personal jurisdiction over a nonresident defendant only if the forum-state court could do so. Illinois courts can exercise jurisdiction over a nonresident defendant on any basis sanctioned by the Illinois Constitution or the U.S. Constitution;

– For a court to exercise specific personal jurisdiction over an out-of-state defendant, the court looks to whether the defendant has minimum contacts with the forum State and if those contacts create a substantial connection with the forum State;

– In addition, the contacts with the forum must be initiated by the defendant itself and the mere fact that a defendant’s conduct affected a plaintiff who has a connection to the forum isn’t enough for jurisdiction over the nonresident defendant;

– In an intentional tort case, the court looks at whether the defendant (1) engaged in intentional conduct, (2) expressly aimed at the forum state, and (3) had knowledge that the effects of his conduct would be felt in the forum state;

– With intentional torts, the fact that a plaintiff is injured in Illinois can be relevant on the jurisdiction question but only if the defendant has “reached out and touched” Illinois: if the defendant’s conduct does not connect him with Illinois in a meaningful way, jurisdiction over a non-resident won’t lie in Illinois.

– A website’s interactivity however, is a “poor proxy” for adequate in-state contacts. So just because a website happens to be accessible to anyone with an Internet connection (basically, every person on the planet) doesn’t open the website operator to personal jurisdiction in every point of the globe where its site can be accessed.4

In arguing that Facebook’s electronic ubiquity subjected it to Illinois jurisdiction (A Federal court sitting in diversity looks at whether the forum state (Illinois) would have jurisdiction over the non-resident defendant)), the plaintiff catalogued the social media Goliath’s contacts with Illinois: (1) Facebook was registered to do business here, (2) it had an Illinois sales and advertising office, and (3) Facebook applied its facial recognition technology to millions of photo users who are Illinois residents.

The court rejected each of these three contacts as sufficient to confer Illinois jurisdiction over Facebook for the plaintiff’s privacy-based claims. For contacts (1) and (2), the lawsuit didn’t involve either Facebook’s status as an Illinois-registered entity or its Illinois sales and advertising office. With respect to contact (3) – that Facebook collected biometric information from Illinois residents – the Court found this allegation false.

The Court noted that since Plaintiff alleged that Facebook used the recognition technology in all photos – not just in those uploaded by Illinois users – Facebook’s global use of the technology was not enough to subject Facebook to Illinois court jurisdiction.

Afterwords:

Gullen’s fact-pattern is one most of the world can relate to. It intersects with and implicates popular culture and national (if not global) privacy concerns in the context of an ever-present and seemingly innocuous photo tagging feature. The case presents a thorough application of “law school” territorial jurisdiction principles to a definitely post-modern factual context. This case and others like it to come, cement the proposition that wide-spread access to a Website isn’t enough to subject the site operator to personal jurisdiction where it doesn’t specifically focus its on-line activity in a particular state.

———————

1 http://www.statista.com/statistics/264810/number-of-monthly-active-facebook-users-worldwide/

2 http://www.businessinsider.com/facebook-350-million-photos-each-day-2013-9

3 http://cases.justia.com/federal/district-courts/illinois/ilndce/1:2015cv07681/314962/37/0.pdf?ts=1453468909

4. See Tamburo v. Dworkin, 601 F.3d 693 (7th Cir. 2010), Walden v. Fiore, 134 S.Ct. 1115 (2014).

‘It Seemed Like a Good Idea At The Time’: Revenge Porn In Illinois – A Crime With Myriad Civil Components

Nation-wide vilification of revenge porn (“RP”) – the unconsented on-line dissemination of sexual photos or images of others (almost always females) – reached an ironic crescendo on Good Friday of 2015 when a California judge sentenced Kevin Bollaert, 28, proprietor of the UGotPosted.com and ChangeMyReputation.com Websites, to an 18-year prison term after a jury convicted him of identity theft and extortion.1

Mr. Bollaert’s sites allowed users (usually jilted paramours) to post intimate photos of third parties without their permission. When the terrified photographed party would contact the site to take the images down, Mr. Bollaert would then extract (extort?) a “settlement” payment from the party.

The near two-decades long jail sentence can be viewed as a culmination of cultural outrage at RP as evidenced by a flurry of civil verdicts across the country and (at current writing) 16 state legislatures criminalizing the practice. Mr. Bollaert’s lengthy punishment, aside from giving him some time to consider “was it worth it?”, may also prove a symbolic harbinger of what’s to come for future RP peddlers.

Hostility toward RP has bled into varied sectors of society. In the international realm, Great Britain recently (April 2015) criminalized the practice by enacting a law that provides for tough penalties against RP defendants and other nations across the globe are likely to follow suit.2

RP has infiltrated the sports arena, too. In December of last year, New York Jets linebacker Jermaine Cunningham was arrested and charged after he posted naked photos of his ex-girlfriend on-line and sent them to her family members (ouch!). Mr.vCunningham pled not guilty in May 2015 to various criminal invasion of privacy charges.3

Most recently, RP hit the news on an astronomical scale as Google, the Web search behemoth, announced it would allow anyone to delete images posted without their permission.4 Social media titans Twitter, Facebook and Reddit followed in Google’s wake and announced similar policies that police the posting of sexually explicit media.5

But while RP’s criminalization garners the most media attention – Illinois’ own statute, which took effect in June 2015, is praised by privacy advocates as particularly robust 6 – RP also gives rise to a plethora of civil causes of action and provides fertile ground for creative lawyering.

This article briefly discusses the various civil claims under Illinois law that are implicated in a case where a defendant – be it an individual or Website owner – posts sexual photos without someone’s consent.

Wikipedia describes RP as “sexually explicit media that is publicly shared online without the consent of the pictured individual.”7 Typically, RP is uploaded by a victim’s ex-partner whose goal is to shame the imaged victim and who sometimes includes the victim’s name, social media links and other identifying information.

Many times, the salacious images are “selfies”, pictures taken by the RP victim. The harmful impact of RP is (or should be) self-evident: sociologists and psychologists have studied RP recipients and heavily documented the toxic psychological, social and financial ramifications they suffer.8

The legal community has also taken notice of RP’s proliferation in this digitally-drenched culture. Witness international mega-firm K&L Gates’ recent launch of a legal clinic dedicated to helping RP plaintiff’s get legal redress

Civil verdicts

Civil suits against RP defendants appear to be gaining traction. For just in the past year or so, juries and judges in several states have hit both individual and corporate RP defendants with substantial money judgments. A California and Ohio court recently socked RP defendants with $450,000 default judgments and civil juries in Florida and Texas awarded RP plaintiffs $600,000 and $500,000, respectively. 10, 11.

My research has revealed only a single revenge porn case pending in Illinois, but no published decisions yet. 12

“So What’s A Gal (Almost Always)/Guy To Do?” – Common Law and Statutory Civil Claims

Aside from lodging a criminal complaint, an RP plaintiff has an array of common law and statutory remedies at her disposal. A brief summary of the salient causes of action under Illinois law that attach to a revenge porn follows.

(1) Invasion of Privacy – Public Disclosure of Private Facts

Illinois recognizes four common-law invasion of privacy torts, those being (1) an unreasonable intrusion upon the seclusion of another; (2) an appropriation of another’s name or likeness; (3) a public disclosure of private facts; and (4) publicity that reasonably places another in a false light before the public. 13

To state a common law claim for invasion of privacy through public disclosure of private facts, a plaintiff must prove: “(1) publicity was given to the disclosure of private facts; (2) the facts were private, and not public, facts; and (3) the matter made public was such as to be highly offensive to a reasonable person.” 14

Generally, to satisfy the publicity element of the tort, a plaintiff must show that the information was disclosed to the public at large; however, the publicity requirement may be satisfied where a disclosure is made to a small number of people who have a “special relationship” with the plaintiff. 15 An invasion of a plaintiff’s right to privacy is important if it exposes private facts to a public whose knowledge of those facts would be embarrassing to the plaintiff.

This might equate to the “general public” if the person is a public figure, or a particular public such as fellow employees, club members, church members, family, or neighbors, if the person isn’t a public figure. 16

Invasion of privacy damages include actual, nominal, and punitive ones. 17

An intrusion on seclusion invasion of privacy plaintiff must show: (1) an unauthorized intrusion or prying into a plaintiff’s seclusion; (2) the intrusion is highly offensive or objectionable to a reasonable person; (3) the matters upon which the intrusion occurred were private; and (4) the intrusion caused anguish and suffering. 17-a

RP Application: Posting a sexual image on the Internet would qualify as “publicity” and “private” matters under any reasonable interpretation. And nonconsensual posting would signal highly offensive content to a reasonable person. The plaintiff’s biggest hurdle would be quantifying his damages in view of the paucity of published RP cases. But judging from the above default and jury awards, damages ranging from $450,000-$600,000 don’t seem to shock the court’s conscience. In addition, an intrusion on seclusion claim could fail if the RP case involved a selfie – since that would seem to defeat the “private” and “seclusion” elements of the tort.

(2) Illinois Right of Publicity Act (the “IRPA”)

In 1999, IRPA replaced the common law misappropriation of one’s likeness – the second (2) above branch of the four common-law invasion of privacy torts outlined above. Illinois recognizes an individual’s right to “control and to choose whether and how to use an individual’s identity for commercial purposes.” 18 The right of publicity derives from the right to privacy and is “designed to protect a person from having his name or image used for commercial purposes without (her) consent.” 19

“Commercial purpose” under the IRPA means the public use or holding out of an individual’s identity (i) on or in connection with the offering for sale or sale of a product, merchandise, goods, or services; (ii) for purposes of advertising or promoting products, merchandise, goods, or services; or (iii) for the purpose of fundraising. 20 “Identity” means “any attribute” of a plaintiff including a photograph or image of the person. 21

Plaintiff must prove revenue that a defendant generated through the use of Plaintiff’s image. Failing that, plaintiff can recover statutory damages of $1,000. 22. An IRPA plaintiff can also recover punitive damages and attorneys’ fees. 23.

RP Application: RP fits snugly within IRPA’s coverage. It specifically applies to photographs or images. If the RP defendant was making money off the unconsented Web postings, and IRPA claim could prove both a viable and valuable claim that would allow the plaintiff to recover statutory damages and attorneys’ fees.

(3), (4) Intentional and Negligent Infliction of Emotional Distress

“To prove a cause of action f0r intentional infliction of emotional distress, the plaintiff must establish three elements: (1) extreme and outrageous conduct; (2) intent or knowledge by the actor that there is at least a high probability that his or her conduct would inflict severe emotional distress and reckless disregard of that probability; and (3) severe emotional distress.” 24

A negligent infliction of emotional distress plaintiff must plead and prove the basic elements of a negligence claim: a duty owed by the defendant to the plaintiff, a breach of that duty, and an injury proximately caused by that breach. 25 A bystander negligent infliction plaintiff must prove a physical injury or illness resulting from the conduct. 26

Since literally millions consume social media on a daily basis (27), perhaps it’s not a stretch to see a bystander make out a negligent infliction claim based on RP aimed at a bystander’s close relative for example.

RP Application Under prevailing social mores, posting sexually explicit media designed to shame someone or to extract money from them would likely meet the objectively extreme and outrageous test. The intent or reckless disregard element would likely be imputed to a defendant by virtue of him publicizing the offending material. The unanswered questions would be damages. Putting it rhetorically, how would you (judge or jury) compensate the RP where there is no precise numerical formula?

(5) Copyright Infringement

Copyright infringement as applied to the RP setting represents a creative – and some way the best – way to attack RP. 28 The Federal copyright scheme particularly fits a RP situation involving “selfies” – which, by some accounts, make up nearly 80% of RP claims. 29

Copyright law gives an owner the exclusive rights – among others – to duplicate and exhibit a work. Copyright protection exists for any work fixed in a tangible medium and includes photographs and videos. 30 The copyright infringement plaintiff must establish (1) she owns the copyright in the work; and (2) the defendant copied the work without the plaintiff’s authorization.18 Inputting a copyrighted work onto a computer qualifies as “making a copy” under the Copyright Act. 31

The catch here is that formally registering the work is a precondition to filing suit for infringement. 32

Being able to sue a defendant for copyright infringement is obviously an important right since that is copyright law’s “teeth”: a winning copyright plaintiff can recover statutory damages, actual damages plus attorneys’ fees. 33

But it begs the question – is it realistic that an RP plaintiff is going to draw more attention to a salacious photo by registering it with a Federal government agency? Not likely. Nevertheless, a copyright claim could lie for RP conduct involving a plaintiff’s selfies if she registered them with the US Copyright office.

What about the CDA (Communications Decency Act)?

Another important consideration in the RP calculus involves Section 230 of the Communications Decency Act (“CDA”) – a statute on which much electronic “ink” has spilled and that is beyond the scope of this article. 34 Basically, as I understand it, the CDA immunizes Web service providers (Comcast, AOL, etc.) from a third-party’s publication of offensive content but not Web content providers. 35 So the CDA inquiry distills to whether a Website defendant is a service provider (in which there would be immunity) or content provider (in which case there wouldn’t be).36.

(6) Negligence

A common law negligence action against an RP spreader constitutes another creative adaptation of a tried-and-true cause of action to a decidedly post-modern tort (and crime). An Illinois, a negligence plaintiff must plead and prove (1) the defendant[s] owed a duty of care; (2) the defendant[s] breached that duty; and (3) the plaintiff’s resulting injury was proximately caused by the breach. 37

The plaintiff would have to prove that the RP defendant owed a duty of care not to post and distribute intimate images of the plaintiff, that the defendant breached the duty by indiscriminately posting the image, and that plaintiff suffered injury as a proximate cause.

Like the privacy torts encapsulated above, the key questions seem to be causation and damages. That is – what numerical damages can the RP plaintiff establish that are traceable to the illicit (electronic) is is publication? Conceivably, she could request lost wages, medical and psychological treatment costs, pain and suffering, loss of a normal life, etc. – the entire gamut of damages a personal injury plaintiff can seek.

Afterwords:

RP is a subject whose contours seem to be in perpetual flux as the law is fluid and still developing. In fact, by the time this article is published, it’s possible that there will be a flurry of legislative, political and even case law developments that make some of the contents dated.

That said, as on-line privacy issues and social media use continue to pervade our culture and expand on a global level, and as publishers of private, salacious photographs aren’t learning their collective lesson, RP will likely secure its foothold in cyberlaw’s criminal and civil landscapes.

The above is not an exclusive list of potential revenge porn causes of action. As states (and countries) continue to enact laws punishing RP, it’s likely that civil damage claims attacking the practice will mushroom in lockstep with RP’s rampant criminalization.

References:

1. http://www.nbcsandiego.com/news/local/Kevin-Bollaert-Revenge-Porn-Sentencing-San-Diego-298603981.html

2. http://www.independent.co.uk/news/uk/home-news/revenge-porn-illegal-in-england-and-wales-under-new-law-bringing-in-twoyear-prison-terms-10173524.html

3. http://www.msn.com/en-us/sports/nfl/nfl-linebackers-case-highlights-rise-of-revenge-porn-laws/ar-BBj8sP9

4. http://bigstory.ap.org/article/ff3b7f7b697b4af295935ed6a482ca1e/google-cracks-down-revenge-porn-under-new-nudity-policy

5. http://www.huffingtonpost.com/mary-anne-franks/how-to-defeat-revenge-porn_b_7624900.html

6. http://www.ilga.gov/legislation/publicacts/fulltext.asp?Name=098-1138 (text of Illinois’ revenge porn law, eff. 6.1.15)

7. https://en.wikipedia.org/wiki/Revenge_porn

8. http://www.huffingtonpost.com/mary-anne-franks/how-to-defeat-revenge-porn_b_7624900.html

9. http://dealbook.nytimes.com/2015/01/29/law-firm-founds-project-to-fight-revenge-porn/?_r=0

10. http://arstechnica.com/tech-policy/2015/03/revenge-porn-creepsters-ordered-to-pay-900000-in-default-judgment

11. http://www.brownanddoherty.com/florida-jury-delivers-record-setting-600000-00-verdict-in-revenge-porn-case.php; http://www.houstonchronicle.com/news/houston-texas/houston/article/Jury-awards-500-000-in-revenge-porn-lawsuit-5257436.php6.

12. http://articles.redeyechicago.com/2014-03-11/news/48127548_1_hunter-moore-mary-anne-franks-legislators

13. Ainsworth v. Century Supply Co., 295 Ill.App.3d 644, 648, 230 Ill.Dec. 381, 693 N.E.2d 510 (1998).

14-16. Miller v. Motorola Inc., 202 Ill.App.3d 976, 978, 148 Ill.Dec. 303, 560 N.E.2d 900, 902 (1990), citing W. Keeton, Prosser & Keeton on Torts § 117, at 856–57 (5th ed.1984)

17. Lawlor v. North American Corporation, 2012 IL 112 530, ¶¶ 58-65

17-a. Huon v. Breaking Media, LLC, 2014 WL 6845866 (N.D.Ill. 2014)

18-19. Trannel v. Prairie Ridge Media, Inc., 2013 IL App (2d) 120725, ¶¶ 15-16

20. 765 ILCS 1075/1.

21. 765 ILCS 1075/5

22. 765 ILCS 1075/40(a)(2)

23. 765 ILCS 1075/40(b)

24. Doe v. Calumet City, 161 Ill.2d 374 (1994)

25-26. Rickey v. CTA, 98 Ill.2d 546 (1983)

27. http://www.statista.com/statistics/264810/number-of-monthly-active-facebook-users-worldwide/ (Facebook has 1.44B users; Twitter has 236M; Instagram – 300M)

28-29. http://www.washingtonpost.com/news/the-intersect/wp/2014/09/08/how-copyright-became-the-best-defense-against-revenge-porn/

32. 17 U.S.C. § 1104

33. http://copyright.gov/circs/circ01.pdf

34. https://www.law.cornell.edu/uscode/text/47/230

35. http://www.defamationremovallaw.com/what-is-section-230-of-the-communication-decency-act-cda/

36. Zak Franklin, Justice for Revenge Porn Victims: Legal Theories to Overcome Claims of Civil Immunity by Operators of Revenge Porn Websites, 102 Cal. L. Rev. 1303 (Oct. 2014).

37. Corgan v. Muehling, 143 Ill.2d 296, 306 (1991)

Planting GPS Device On Car Not Enough for Invasion of Privacy Claim – IL Fed Court

Troeckler v. Zeiser, 2015 WL 1042187, a recent Southern District of Illinois case, examines this question adapted to a plaintiff’s intrusion on seclusion claim filed against her ex-husband – the defendant who, with some help, secretly affixed a GPS device (a “black box”) to the plaintiff’s car.

The defendant’s two principal acts giving rise to plaintiff’s suit were (1) installing the GPS device; and (2) repeatedly trying to log-in to the plaintiff’s personal email, computer and cell phone accounts. Plaintiff sued for invasion of privacy/intrusion on seclusion (the “Intrusion Claim”) and conspiracy against the ex-husband and the people he hired to install the device and log in to plaintiff’s e-mail.

The defendant moved to dismiss all claims and the Court dismissed some claims and sustained others.

On the Intrusion Claim, the court noted that in Illinois, intrusion on seclusion is a species of the invasion of privacy tort. To make out a valid invasion of privacy claim in Illinois, a plaintiff must demonstrate (1) an unauthorized intrusion or prying into the plaintiff’s seclusion; (2) an intrusion that is offensive or objectionable to a reasonable person, (3) the matter upon which the intrusion occurs is private; and (4) the intrusion causes anguish and suffering.

Element (3) – the intrusion involves something that is private – generates the most litigation. Case examples of private matters include poking holes in a bathroom ceiling and installing hidden cameras in a doctor’s examination room. Conversely, private facts contained in public records (name, address, SS #, e.g.) do not satisfy the privacy element.

The court looked to a New Jersey case for guidance as to whether installing a GPS device was actionable intrusion on seclusion. The New Jersey court in Villanova v. Innovative Investigations, Inc., 21 A.3d 650 (N.J.App.Ct 2001) held that a defendant who surreptitiously placed a GPS monitor on her ex-husband’s car (to see if he was cheating on her) was not an invasion of privacy where there was no evidence the defendant drove his car into a private or secluded location.

Following the reasoning of the NJ case, the Troeckler court dismissed the plaintiff’s Intrusion Claim since the plaintiff failed to allege that she drove her car somewhere in which she had a reasonable expectation of privacy.

The plaintiff fared better on the Intrusion Claim as it pertained to the defendant hacking into her private email accounts. The court found that for purposes of a motion to dismiss, the plaintiff did sufficiently allege a claim for invasion of privacy based solely on the e-mail allegations.

The plaintiff won and lost parts of her conspiracy claim against her ex and the various people he enlisted to help him install the GPS device and breach the plaintiff’s emails accounts. Civil conspiracy requires concerted action and an underlying wrongful act. Since the plaintiff failed to establish invasion of privacy on her Intrusion Claim, there was no predicate tort for the conspiracy.

The result was different with respect to the e-mail hacking though. Since logging in to the plaintiff’s private accounts was a possible invasion of privacy (at least at the early pleading stage), the conspiracy claim survived as it related to the e-mail claims.

Afterwords:

1/A defendant’s unauthorized hacking into a plaintiff’s private email accounts can underlie an intrusion on seclusion/invasion of privacy claim;

2/ In the context of installing a monitoring device on someone’s car, the privacy tort is applied literally: if the plaintiff doesn’t show that she drove somewhere private or “secluded,” invasion of privacy isn’t the proper cause of action to assert. With the benefit hindsight, the plaintiff probably should have pled a violation of the civil stalking statute based on the defendant’s GPS installation.

Share this:

Share this:

Share this: