A Canadian company has recently found itself in a bit of hot water regarding an App that it markets for use with its smartphone-enabled massage device. The “We-Connect” App is designed to be used with the aptly named We-Vibe device and to collect highly personal data in real time and transmit it back to the company. Plaintiffs in a consumer class action suit allege that they were not aware of, and never consented to, the company intercepting and collecting this data, which includes highly sensitive, personally identifiable customer information related to use of the device. Standard Innovation Corp. now faces a wiretap claim, as well as claims that it violated Illinois state laws prohibiting eavesdropping, intrusion upon seclusion, and deceptive business practices.
While the “We-Connect” case highlights a particularly egregious example of questionable privacy practices, it is likely to be just the tip of the iceberg. As of next year, almost 2.6 billion of us will own smartphones. And “phone” is becoming a bit of a misnomer as we use them more frequently for functions other than phone calls, including — but not limited to — texting, emailing, and internet browsing. We are on them habitually. And we have become accustomed to getting exactly what we want—wherever and whenever we want it — whether it be directions, an Uber, or to stream the most recent episode of Scandal. Companies have, in turn, learned that providing an App is an extremely effective way to engage consumers. As Standard Innovation Corp. has learned, though, an App is also an easy way to (allegedly) run afoul of privacy laws.
App developers must be mindful of both federal and state regulations governing consumer privacy and data security. They should ensure, for example, that consumers are aware of their rights and liabilities, and are informed about how their data is collected, used and shared. Consumer dissatisfaction over how their data is used has been the impetus for more than one previous class action suit, often against a social media provider. Turns out that people do not like Facebook using their names or photos for targeted advertising. Nor do they appreciate all of their LinkedIn contacts being spammed. Data aggregators have also been the target of suits by irate consumers, with the Supreme Court remanding the Spokeo case to the Ninth Circuit earlier this year for a determination on whether the plaintiff actually had standing to be in federal court in the first place. This requires a “concrete and particularized” injury that is “actual or imminent,” and not conjectural or hypothetical. In other words, was there an “injury in fact” at the root of the lawsuit? Query whether “psychological or emotional” harm may qualify as an “injury in fact.” This could well be something that Standard Innovation Corp. learns the hard way.
Follow me on Twitter: @sroberg_perez
