Weekly Updates

Personal liability for CISOs

From Reuters:

“SolarWinds executives receive Wells notice from US SEC

June 23 (Reuters) - SolarWinds (SWI.N) said on Friday some of its former and current executives had been issued a Wells notice by the U.S. Securities and Exchange Commission over a massive 2020 data breach tied to the software firm.

A Wells notice does not necessarily mean that recipients have violated any law. The SEC issues Wells notices to firms when it is planning to bring enforcement action against them.”

The case on debate here is part of the SEC’s current investigation into the SolarWinds hack of 2020, which was used to infiltrate multiple high-profile companies and government entities. One of the receivers of this Wells notice was SolarWinds’ CISO, which has worried the security industry about possible implications to other CISOs.

One of those voicing concerns was Jamil Farshchi, current Equifax CISO, who took over a few months after the massive Equifax 2017 data breach that affected around 160 million people:

Many worries are associated with the current state of security in multiple companies, with CISOs and teams operating with small budgets and little space in boards or long-term company decisions. And these worries are reasonable in the short term. But the way we see the future impacts of actions like this from the SEC, we believe that the environment should improve substantially for security inside companies.

In 2018, the Brazilian Central Bank published the first Cyber Security regulation for financial companies in Brazil. This new regulation required companies to have a Cyber Security policy, among other things. For financial companies in Brazil, a policy is a big deal because the director who approves that policy can be personally liable for failing to implement it or for its shortcomings, depending on how much damage was caused.

The consequences across the industry were that financial companies started hiring more security personnel and increased security budgets substantially. CISOs also increased their bargaining power within their organizations. After all, if they leave now, another director would need to immediately take over the responsibility. With stakes this high, no director would mindlessly take on that responsibility.

Follow up on Meta fine issue

It's time for a quick follow-up on the policy issue underlying Meta's billionaire fine over EU-US personal data transfers. As discussed in a previous issue, the record-breaking fine resulted from a sovereignty dispute between the US and EU over protecting European personal data against US national security surveillance.

The European Commission said this week that they expect to have a new deal in the next few weeks. If confirmed, the new deal will end a three-year window when it was effectively illegal to send personal data from Europe to the US. The real question is whether the EC can sign a deal that would satisfy the European judiciary or if institutional misalignment will undo yet another international treaty.

Privacy gag order in Ireland

From NOYB:

“In a surprising last-minute amendment to the otherwise innocuous "Courts and Civil Law (Miscellaneous Provisions) Bill 2022" from September 2022 the Irish Government added a provision that would allow the Irish DPC to declare almost all its procedures "confidential". Section 26A would make most reporting about procedures or decisions by the DPC a crime. Speaking about outlandish claims by "big tech" or unfair procedures that often concern millions of users would equally become a crime. Various civil rights groups have called to stop Section 26A”.

Most of the concerns expressed around this provision were that big tech would benefit from gag orders concerning data protection investigations. Amnesty International accused the government of "attempt[ing] to […] shield Big Tech from scrutiny”. Our first reaction to this news was quite different, though.

Publicity and transparency are two cornerstones of democracy as we know it. Therefore, sealing legal procedures should be considered only in extreme scenarios. That general rule is especially crucial in disputes between fundamental rights, as data protection cases often are. In many instances, data protection cases are not just opposed to big tech commercial interests. Data privacy is often in conflict with the fundamental rights of other individuals. The right to be forgotten limits freedom of expression and information, international personal data transfer bans limit individual autonomy, etc..

These cases require a delicate balance of interpretation — which is why, in law theory, they are formally called hard cases. Removing hard cases from the public debate is extremely dangerous.

The Irish parliament approved the provision this Wednesday. We hope it's reviewed or declared unconstitutional soon, or else Europeans could suddenly wake up with more and more error messages like this:

Setting clear lines: when Section 230 does not apply

This week, Prof. Eric Goldman analyzed a decision from the US Court of Appeals for the Ninth Circuit (California). The background issue was whether Facebook was liable for a violation of California housing legislation that prohibits discrimination in housing advertising according to a few protected classifications. From the Civil Rights Department of the State of California's website:

"[California] state fair housing laws […] [makes] it illegal to discriminate against or harass someone because of a protected characteristic, such as their gender, race, national origin, sexual orientation, gender identity, or religion. […] The law also requires reasonable accommodations for disabilities and prohibits retaliation against someone for exercising their rights. The law applies to landlords, tenant screening companies, property management companies, real estate agents, home sellers, builders, mortgage lenders, housing authorities, and others. The law applies to all aspects of housing and housing-related services, such as renting, leasing, sales, new construction, mortgage lending, insurance, municipal services, shelters, advertising, and restrictive covenants. Additionally, it is unlawful for cities, counties, or any local government agency to make zoning, land-use decisions, or policies that discriminate based on a protected characteristic”.

The issue at hand is whether Facebook's practice of extracting information from users’ profiles, including the protected classifications, and allowing advertisers, including in the housing market, to filter out certain user segments is protected by CDA Section 230.

As mentioned in our article Section 230 and the future of the internet:

"Section 230 states the defendant is immune from liability if it is sued for information provided by another information content provider, that is, by anyone who is responsible, “in whole or in part”, for the “creation or development” of the contested material. The challenge faced by the courts was to define what “creation or development” means and what its extension is.”

In this case, therefore, the issue was to define whether extracting information from users’ profiles and allowing advertisers to filter out audiences based on protected classifications is considered "creation or development” of information.

From Prof. Eric Goldman's blog:

“The court summarizes the plaintiffs’ allegations:

The operative complaint alleges that Facebook's “targeting methods provide tools to exclude women of color, single parents, persons with disabilities and other protected attributes,” so that Plaintiffs were “prevented from having the same opportunity to view ads for housing” that Facebook users who are not in a protected class received. (…)

Based on these allegations, the court concluded Section 230 did not apply because "Plaintiffs’ claims challenge Facebook's conduct as a co-developer of content and not merely as a publisher of information provided by another information content provider.” (…) Thus,

Facebook was “much more than a passive transmitter of information provided by others; it [was] the developer, at least in part, of that information.” Indeed, Facebook is more of a developer than the website in Roommates.com in one respect because, even if a user did not intend to reveal a particular characteristic, Facebook's algorithms nevertheless ascertained that information from the user's online activities and allowed advertisers to target ads depending on the characteristic.

(…) I believe Facebook no longer permits the targeting at issue in this case, so this case may be a battle over legacy practices”.

Prof. Goldman goes on to argue that "[w]hen the Ninth Circuit riffs on what constitutes a ‘co-developer,’ it opens up Pandora's box of potential Section 230 exclusions” and that "[u]nfortunately, the court did not fully engage with many other cases holding that Section 230 applies to anti-discrimination claims”. Finally, he concludes that the decision could mean that "a website can lose Section 230 protection merely by asking the wrong questions, regardless of how the third party answers the questions”.

We disagree.

The Ninth Circuit pointed out that Facebook acted as a speaker, not just an editor/publisher. That fact is sufficient to forego Section 230 protection, regardless of whether anti-discrimination rules are exempted from Section 230's safe haven.

In this case, the court interpreted that Facebook not only asked the wrong question but also answered it with the (sensitive) information it created, segmenting the users. Then, Facebook allowed advertisers to filter out audiences based on that sensitive data, which is illegal in the California housing market. If a real estate agency were to investigate its potential buyers to classify them based on protected characteristics and then allowed homeowners to decide to which segments they want to advertise their homes, the violation of state law would have been clear. Facebook was doing the same but in an automated flow. It was not the mere conduit of third-party content but the creator of a crucial part of the information used to violate state law.

The court's decision is not a new challenge to Section 230. It's applying the same rule to the automated action of creating content and using it in an illegal fashion online. Case in point, discriminate users based on protected characteristics in housing advertising.

SolarWinds investigation, privacy gag orders, and limits of Section 230