Legal Bytes : Advertising & Media Lawyer & Attorney : Reed Smith Law Firm : Marketing & Intellectual Property : Legal Bytes Law Blog

Copyright Infringements on Social Media Services

The question of whether the use of third-party content protected by copyright by a user on a social media site constitutes copyright infringement can be answered in a fairly straightforward way. If there is no consent by the right holder, such use will inevitably constitute an illegal act of making the work available to the public under most modern copyright regimes. Most operators of social media services provide in their terms of use that the user is responsible for making sure that material provided by him on the service does not infringe third-party copyrights. As has been discussed above, the interesting question then becomes whether the operator of the service can be held liable and can be asked to stop the infringement quickly, particularly in situations in which the identity of the infringer (the user) is difficult to establish or the infringer is located in a faraway country.

Conversely, however, one can ask whether content legitimately created by users of social media services enjoys copyright protection itself. If this is indeed the case one may wonder to what extent the operator of the service or other third parties may be allowed to refer to, cite or otherwise make use of such content.

Twitter

With respect to tweets, which by definition can be no longer than 140 characters, one may doubt whether they will be sufficiently creative and original to enjoy copyright protection. In many cases, tweets will only consist of short regular phrases that may not be regarded as an original work of authorship in the U.S. sense,[6] an original work in the UK sense[7], or a personal intellectual creation as required under German copyright law.[8] Consequently, in many cases, none of the three regimes will provide copyright protection to tweets.

To the extent Twitter states in its terms of use:

You retain your rights to any Content you submit, post or display on or through the Services.

this should actually be qualified by indicating that in most cases, tweets will be in the public domain for lack of originality or creativeness. It is not impossible, however, to create short poems or other brief literary works with no more than 140 characters. If originality and creativity can be established, the situation would be different. The analysis would also be different for longer original works broken down into sequences of tweets and made available on Twitter one by one—such as a short story published on Twitter in small bits of no more than 140 characters each, provided the single tweet enjoys protection on its own.

If a tweet or parts of a tweet can be found to be protected by copyright, the use of the respective content by third parties can constitute copyright infringement if fair use (United States), fair dealing (UK), or a similar exception under the respective applicable domestic copyright regime cannot be established. There is no rule, either, under U.S. or European copyright regimes requiring that in order to infringe a literary work, passages of a certain length need to be copied, provided the sequence used enjoys copyright protection as such.

As a consequence, so‑called retweeting, (i.e., repeating somebody else's tweet under one's own user name) may constitute copyright infringement as well, provided the earlier tweet is sufficiently original and creative to be protected. Citation exceptions provided[9] may not help in this context as mere repeating of an entire text without incorporating it into one’s own original work does not constitute citation.

Facebook, MySpace, et al.

The limitations existing with Twitter with regard to the number of characters do not exist on other social media services such as Facebook and MySpace, among others. The further possibility to upload photographs and/or audiovisual content onto such services leaves no doubt as to the possibility of copyright infringement if third parties copy or otherwise make relevant use without permission of materials taken from somebody’s page on Facebook or a similar site.

Terms of Use and Applicable Law for Copyright Law Purposes

Most social media services have terms of use providing for comprehensive non-exclusive copyright licences granted by users to the operator. Typically, such terms of use also provide for U.S. law in the state in which the service is based. Twitter, for example, provides the following in its terms of use:

These terms and any action related thereto will be governed by the laws of the State of California without regard to or application of its conflict of law provisions or your state or country of residence. All claims, legal proceedings, or litigation arising in connection with the service will be brought solely in San Francisco County, California, and you consent to the jurisdiction of and venue in such courts and waive any objection as to inconvenient forum.

While such terms, if they have been validly made the object of the agreement between the user and the operator of the social media service, may apply for general purposes of international law of contracts, the question needs to be asked whether for purposes of copyright law such a choice of law and venue clause will make all foreign copyright regimes inapplicable.

From a European perspective the answer is clearly: no. According to European case law (and the view of leading European scholars), the posting to social media services of works by users in Europe is governed by the copyright laws of the particular European country in which the user resides, regardless of the contractual regime agreed to in the terms of use. This may be surprising, but it needs to be taken into account, particularly in connection with copyright regimes providing for increased protection for copyright owners, such as under German copyright law.

Moral rights, compulsory remuneration rights, legal limitations on the scope of copyright licences and the prohibition of assignments of copyright provided in the German Copyright Act, for example, will all continue to apply for the benefit of a German right holder or with respect to uses in Germany, even if the operator of the social media service provides for California law. Companies are well advised, therefore, not to be misled into believing that simple choice-of-law clauses, even if they have been validly agreed, will enable them to avoid the much stricter and much more pro-author provisions in certain European copyright regimes, compared with what the U.S. Copyright Act provides.

Music Licensing Issues

In dealing with the copyright issues faced by U.S. companies engaging with social media in the U.S. market, we did not mention an issue that looms large for European and multi-national companies operating within Europe. If a company wishes to enliven its web-presence by using music, the rights-clearance arrangements that will be needed are very different if the company is operating in Europe rather than in the United States. A U.S. company can usually clear rights for the U.S. market by means of obtaining two or, at most, three licences, from the music rights societies and from the record company concerned. To reach the whole of the EU market, a multiplicity of licences will be needed, in many cases covering only a single country at a time. Only for a very small number of works is it possible to obtain European-wide clearance by means of two or three licences; choose the wrong work and you could be looking at having to obtain 30 or more licences.

Bottom Line—What You Need to Do

Police your own copyrights and be mindful of copyright protection that may exist for content provided by others. Be aware of the fact that the international nature of global social media services requires that you not only rely on one domestic or one contractually agreed regime, but that you also keep an eye on foreign laws involved with users based abroad.

When clearing rights for using content yourself, be aware of the international scope of the intended use as well, and make sure that you truly obtain sufficient geographic rights for the intended use.

If you operate a site enabling users to upload content, put in place a procedure allowing you to remove, as swiftly as possible, evidently infringing material or material of which you have been told that it is infringing.

Social Media in Action in Data Privacy & Security

Personal data collected by social media companies is at risk from all sides. Thieves want to profile, steal and resell personally identifiable information and data. Employees are tempted to misuse customer data, for monetary gain or to satisfy idle curiosity, perhaps with no malicious purpose at all.[5]  Even standard business processes pose risks to personal data. Not forgetting that social media companies themselves want to gain commercial leverage from the data collected.

Social media enterprises collect, store, use, share, and dispose of personal data every day, including eCommerce-related non-public financial information (for example, credit, banking and payment information). Each of these inflection points is an opportunity for something to go wrong, for a law to be broken or a data subject put at risk. This chapter explains some things social media companies and companies that use social media should know.

Company Obligations Set Forth in the User Agreement

User agreements are private agreements between the publisher and its users, and they define the rights and obligations of each party. Typically, user agreements have at least two components: (1) a privacy policy and (2) a terms of use. While there is no legal distinction between putting them into one document rather than splitting them, social media and web-based services recognise the increased importance privacy and data protection play—not only in law and regulation, but also to consumers. In Europe, regulatory guidance suggests separating terms of use and terms relating to data protection and privacy. Creating a separate document, page or display makes these terms conspicuous, and in a visual and distinctive manner create a better “notice and disclosure” or transparency and consent argument, should a consumer or a regulator challenge the efficacy of notice to consumers.

Privacy policies are statements made by companies about their practices regarding personal information. Companies on the Internet, social media or otherwise, post privacy policies to disclose information practices in accordance with federal and state statutes.[6] Terms of use, on the other hand, describe the terms and conditions governing the relationship between the user and the publisher or operator of the service. Because privacy policies are effectively part of the terms and conditions—the rights and obligations—between the parties, we may simply refer to them as the “agreement” in these materials.

Because these agreements run between and among publishers and users (and sometimes a company that is using a service or website), a company’s obligation with respect to personal data will change depending upon whether it is the social media service (e.g., Facebook, MySpace or Twitter), a company-sponsored fan site (e.g., a Starbucks sponsored fan site on MySpace) or an unrelated third-party fan site.

Social Media Companies

Social media companies, as authors of these agreements, have the primary responsibility to ensure all personally identifiable information that is collected, used, stored and shared, is used in accordance with the user agreement (and, of course, law and regulation). But, this does not mean that social media companies must be overly conservative in their user agreements. Most social media companies do not charge any recurring user fees for use of their site or service. So, access to and data from users in the community is a social media company’s primary commodity to monetise the site.

This ability to commercially exploit data is tempered by data protection and privacy laws. The need for ‘information monetisation’ can create in an adversarial relationship between the site user and the social media company. As a result, many consumer advocacy organisations are analysing and notifying consumers of updates to social media website user agreements.[7] These consumer watchdog organisations can generate considerable controversy; take for example, Facebook’s Terms of Service update in February 2009. At that time, The Consumerist flagged a series of changes to the Facebook Terms of Service, including deletion of the following text:[8]

You may remove your User Content from the Site at any time. If you choose to remove your User Content, the license granted above will automatically expire, however you acknowledge that the Company may retain archived copies of your User Content.

From this deletion, The Consumerist author, Chris Walters, opined that: “Now, anything you upload to Facebook can be used by Facebook in any way they deem fit, forever, no matter what you do later,” Walters wrote. “Want to close your account? Good for you, but Facebook still has the right to do whatever it wants with your own content.” Ultimately, The Consumerist blog created a firestorm, which caused Facebook to repeal its Terms of Service changes three days after the blog was posted.

The Terms of Service change is not the only example of the tension created over the use of consumer information and consumer disclosures. In the early days of 2007, Facebook launched its Beacon advertisement system that sent data from external websites to Facebook, ostensibly for the purpose of allowing targeted advertisements. Certain activities on partner sites were published to a user’s News Feed. Soon after Beacon’s launch, civic action group, MoveOn.org, created a Facebook group and online petition demanding that Facebook not publish their activity from other websites without explicit permission from the user.[9] In less than ten days, this group gained 50,000 members. Beacon amended its Terms of Service as a result.[10] A class action lawsuit was filed against Facebook as a result of Beacon. The lawsuit was ultimately settled in September 2009[11], and the Beacon advertisement service was shut down.

Facebook has, nonetheless, continued to press on the outside of the envelope with respect to consumer privacy. At the F8 Conference this April, Facebook announced a series of changes to its privacy policies sure to draw considerable attention.[12] The changes include:

Allowing external websites to add a “Like” button. If the user of that external website clicks the “Like” button, that user’s Facebook page will be modified to reflect information about the user’s use of that external site. The user’s Facebook friends will be able to view such information.

Partnering with sites like Pandora and Yelp! to provide for “instant personalization.” This means that when a Facebook user visits those sites, unless she has taken specific elections on her Facebook privacy settings, those sites will download “can pull in information from your Facebook account, which includes your name, profile picture, gender and connections (and any other information that you've made visible to the public). If you visit Pandora, for example, the site could also pull in your favorite music artists, create playlists accordingly, and then notify your Facebook friends.”[13]

In the immediate aftermath of the Facebook changes, members of the United States Congress have already expressed intent to pass laws putting the onus on companies like Facebook to get specific consent from consumers before rolling out new information sharing platforms.[14]

Compared to the United States, Europe has traditionally taken a more stringent approach to data protection. Article 8 of the Charter of Fundamental Rights of the European Union explicitly provides a fundamental right to protection of personal data within the EU. There is also a greater focus on raising awareness. For example, Europe even organised a “European data protection day”, held annually on 28 January.[15] As a result, social networking sites tend to be the subject of far greater public scrutiny than in the United States. Privacy groups and thorough press coverage ensure that any changes to the privacy policies of service providers and any risks or abuses related to these services are comprehensively discussed and brought to the attention of social media users. The Guardian story covering the changes to Facebook’s Privacy Policy in 2009 titled “Facebook privacy change angers campaigners”[16] and a headline from The Sun titled “Teen Weapons Shock On Bebo”,[17] are just two examples of the press coverage social networking sites receive.

Company or Third-Party Sponsored Fan Site or Portal

Many companies, however, do not own or operate a social media website, and thus, do not author the social media user agreement. Instead, these companies are monitoring content regarding their products and services on fan sites/portals run by another company. For example, Starbucks does not operate its own social media website, but operates portals on MySpace, Facebook, Twitter and YouTube. The key for removing information that may be detrimental to Starbucks or any brand is to know where the content lies (on a company or third-party sponsored portal), and the user agreement of the social media website the offending information lies upon.

For portals or fan sites that are sponsored by the marketing company, it is simple for the company to remove offending information. Facebook, MySpace and YouTube offer page administration options for content removal on company-sponsored portals. For these services, the company can directly control content posted to the portal by designating in its administrative options to pre- or post-screen user-generated content. Twitter, however, works differently. On the company-sponsored Twitter profile, the company can control what “Tweets”[18] it sends to its followers, but the company cannot directly control what is “retweeted”[19] by others from the company-sponsored tweets.[20]

For portals or fan sites that are not sponsored, it is more difficult to administer content and remove known privacy violations. Removal of third-party content involving your company or brand is governed by the respective social media site’s user agreement. These will be different depending on the site or service. Take, for example, if one of your employees records a confidential session (a health care visit, tax preparation, loan application meeting, etc.) between the employee and one of your customers. Could the company seek removal of the confidential video? The question of whether a corporation could remove this content on behalf of its customer is different depending upon what social media service is used.

• On YouTube the answer is no. On YouTube, the remedy for removing content is flagging it for removal. Under the YouTube privacy policy, YouTube will not permit privacy flagging on behalf of other people.[21] Alternatively, companies could issue cease-and-desist e-mails directly to the employee posting the content on YouTube.
• On Facebook the answer is possibly. On Facebook, the remedy for removing content is reporting abuse of Facebook’s Statement of Rights and Responsibilities (the “Terms”).[22] In Section 5 of the Terms, Facebook will not permit posting of “anyone’s identification documents or sensitive financial information on Facebook.”[23] Depending on the content of the private information disclosed in the videotaped confidential meeting, a company could report a violation on behalf of its customer.
• On MySpace the answer is yes. On MySpace, the remedy for removing content is submitting a request to delete inappropriate content that violates the website’s Terms of Use Agreement.[24] Under the Terms of Use Agreement in Section 8, any postings that would violate the privacy and/or contractual rights of another party are prohibited.[25] In this scenario, there would be both an individual privacy right on behalf of the customer and a contractual confidentiality right of the company (provided a proper confidentiality provision is in place with the employee).

Notwithstanding the removal of some content by social network providers from the service, it may still surprise some users how their data is stored and used by social networking sites, even in some cases after it has been removed or the user is no longer a member of the site. In addition, social media sites employ technological measures that recognise a user’s computer. For example, according to Twitter’s terms of use, Twitter can collect and use a user’s “automatic” information, such as a user’s IP address or cookies. Whether these provisions will be sufficient to satisfy the upcoming changes in law which will require Twitter to obtain European users’ consent before using their cookies remains to be seen.[26]

Notwithstanding the contractual user agreement rights and obligations on social media, a number of national and international laws also govern this area.

Company Obligations Set Forth in National and International Law

U.S. position

Today, businesses operate globally with technology that knows no national boundaries. Nothing comes more naturally than sharing and sending information halfway around the world. Social media epitomises that modern, global ethos.

Every jurisdiction in the world can claim the right to protect its citizens–and information about them. The United States has a very different concept of “personal information” and adequate protection of it than the European Union; the European laws are not necessarily across all of its Member States. And so it goes, in every part of the world. A social media company can be completely compliant with United States law and still run afoul of legal mores elsewhere. By way of example, Facebook experienced a culture clash with Canada’s privacy commissioner with respect to the disposal of personal information. Facebook had been retaining data on subscribers who quit, so that they could more easily rejoin should they choose to do so later. Canada’s privacy commissioner determined that Facebook’s retention of data was a violation of Canada’s Personal Information Protection and Electronic Documents Act, and negotiated a settlement that provides that, “Collected personal information can be kept only for a specified time and must be deleted or destroyed when no longer needed.”[27]

Europe position

Social media services accessible in Europe will also have to comply with the relevant legislation, the implementation of which may differ between Member States. They may also be subject to any additional national measures.

The EU’s Article 29 Data Protection Working Party has set forth an opinion on online social networking.[28] This Opinion, adopted June 12, 2009, opines that “social networking services” or “SNS” are generally data controllers, and SNS subscribers are generally data subjects. In the view of these authors, even those SNS located outside the EU are bound to respect EU strictures on data processing and onward transfer as to residents of EU member countries. Where a subscriber’s information is only available to a self-selected circle of friends, the Opinion posits that the exception allowing sharing of personal information within households applies. However, when access to the subscriber’s information is shared more broadly, with or without that subscriber’s consent, “the same legal regime will then apply as when any person uses other technology platforms to publish personal data on the web.”[29] The Working Paper goes on to state a number of other positions regarding marketing by SNS, complaint procedures, and (advocating) the availability of pseudonyms.

United Kingdom position

The UK has its own domestic data protection law in place which implements the EU Data Protection Directive.[30] The Data Protection Act 1998 (‘Act’) requires organisations processing personal data to comply with eight distinct data protection principles. The UK also has in place domestic legislation implementing the EU e-Privacy Directive.[31]

The UK Government is currently at odds with the European Commission for failing to properly implement the Data Protection Directive and e-Privacy Directive at national level. The European Commission commenced infringement proceedings against the UK for its failure to guarantee the confidentiality of electronic communications (such as emails and internet browsing) which protection is otherwise enshrined in European legislation. This action was triggered by secret trials conducted in 2006-2007 by the UK telecommunications provider, British Telecom, of a behavioural advertising technology being developed by the company Phorm. This technology enabled the monitoring of an individual’s Internet use without the user’s consent or knowledge, the results of which enabled companies to more effectively target advertising to users. In a failed attempt to bypass data protection laws, Phorm matched a user’s IP address with a unique identifier which was then provided to advertisers, together with profiling information about browsing history. If the UK fails to change its domestic legislation to ensure the privacy of online communications, this action may result in a hearing before the European Court of Justice.[32]

Privacy Policies/Notices: Guidance and General Principles

On both sides of the Atlantic surveys have been carried out to assess whether privacy policies sufficiently and clearly inform users of how their personal data will be used and for what purposes. Although in the UK privacy policies are not a legal requirement under the Act, a privacy policy is a simple way to satisfy the fair processing requirement, which is one of the data protection principles under the Act. Regulatory guidance supports the use of clear and simple privacy policies which adapt a “layered” approach, with the most important information highlighted in a clear manner.

Nonetheless, the surveys have highlighted a need for existing privacy notices to be clearer and more user-friendly. As a means to an end, organisations should make sure that their privacy policies focus primarily on informing the consumer and not on protecting the entity.[33]

Privacy policies should be reviewed regularly to make sure that they continue to comply with any changes in the data processing activities of an organisation and the relevant data protection and privacy laws applicable.

There are obvious benefits to ensuring privacy policies are transparent. Not only will consumers be less likely to complain, it may also provide a competitive advantage from consumers having more confidence in the organisation and how their personal data is being processed. This may lead to consumers entrusting the organisation with further personal data it would not otherwise have received. This seems to be one of the most important trends in social media today – do users trust the site operator?

The Next Direction in Privacy Law [34]

The main challenge for social media companies is that the regulatory privacy obligations seem to be developing on-the-fly in this area. There was no US law clearly forbidding Facebook from partnering with several dozen other sites to share information regarding subscriber usage of affiliate sites. There was no law clearly forbidding Facebook from making such activity logs visible to the subscribers’ friends. Facebook even provided a pop-up, opt-out mechanism to help respect subscriber privacy choices. Yet following a class action lawsuit, discussed above, Facebook shut down its Beacon program and donated $9.5 million to a non-profit foundation to promote online safety and security.[35] Clearly, as important as existing laws are the developing sensibilities of both consumers and privacy officials. The predominant theme appears to be a profound antipathy toward the aggregation and use of information of consumer behavior, however well disclosed. Social media companies need to proceed very carefully in capitalising on the wealth of information that they are assembling, developing subscriber and policymaker support for programs in the works, and adequately disclosing program information to consumers, at a minimum, in the user agreement. Moreover, companies need to realise that even where the law has been slow to catch up, consumer reaction and the threat of regulatory or legal action has often shaped privacy practices in social media. Keeping on top of those trends is critical.

Take, for example, the 2009 global industry initiative to address concerns over behavioral advertising. In 2009, the American Association of Advertising Agencies, Association of National Advertisers, Interactive Advertising Bureau, Direct Marketing Association and the Better Business Bureau, completed a joint business initiative and released the “Self-Regulatory Principles for Online Behavioral Advertising”.[36] The trade groups worked closely with the Council of Better Business Bureaus in crafting the principles. The initiative was in response to urging by the FTC that unless the industry adopted polices, government regulators would step in.

The industry effort covers the categories the FTC identified as the key areas of concern: education, transparency, consumer control, data security, material changes, sensitive data and accountability. The Council of Better Business Bureaus, along with the Direct Marketing Association, are now developing additional policies to implement accountability programs to give some teeth to the self-regulatory rules and to foster widespread adoption of the principles.

This initiative appears to have now crossed over to Europe and there is discussion of a special “behavioural” advertising logo that will be displayed in all behavioural advertising. Looking forward, privacy and data protection law will continually be outpaced by technological developments. To take a recent example, the Google Buzz social networking service that was launched in February 2010 has been at the centre of a torrent of criticism by users and privacy groups who claim that the new service has violated rights to privacy. Google Buzz was an attempt by the search giant to convert its Gmail service into a social network. A particularly controversial feature was that Gmail users were automatically signed up to Buzz and a ‘ready-made’ social network of ‘friends’ for them to follow was created using information from Gmail accounts of the contacts with whom they most frequently email and chat.

Following the ferocity of public reaction, Google has been forced to adapt many of the features of Buzz, including removing the automatic links between Buzz and content posted by users on other Google services (e.g., Picasa photo albums), making the option to opt-out of Buzz altogether more prominent in the email facility and adopting an ‘auto suggest’ rather than an ‘auto-follow model’. In April 2010, the Privacy Commissioner of Canada, Jennifer Stoddart, and the heads of the data protection authorities in France, Germany, Israel, Italy, Ireland, Netherlands, New Zealand, Spain and the United Kingdom sent a strongly-worded letter to the chief executive officer of Google Inc. to express their concerns about privacy issues related to Google Buzz.[37]. The authorities noted that:

“While your company addressed the most privacy-intrusive aspects of Google Buzz in the wake of this public protest and most recently (April 5, 2010) you asked all users to reconfirm their privacy settings, we remain extremely concerned about how a product with such significant privacy issues was launched in the first place.” And, in a statement seemingly directed at every company looking to launch innovative products in this space, the regulators warned, “It is unacceptable to roll out a product that unilaterally renders personal information public, with the intention of repairing problems later as they arise. Privacy cannot be sidelined in the rush to introduce new technologies to online audiences around the world.”

Whilst legal action by users who feel their rights have been infringed is inevitable (for example, a woman in Florida has already instructed lawyers regarding the misuse of her personal data), the problem for Google may spread far wider. In trying to make the “getting started experience as quick and easy as possible”[38] to compete with other social networking services, they have potentially alienated users and may now have a harder task convincing the millions of users on Facebook and Twitter to migrate to Buzz instead.

Another social media phenomenon is the exploitation of geo-location technology. Four Square is a location-based game which can be downloaded onto a user’s phone and which turns city maps into a game board. Users can “check-in” via their phones and this information is fed to Twitter, where the user’s location is made public. By “checking in,” the application is able to recommend places to go, things to do nearby and tips from other users for that location. Whilst this application clearly has its benefits, users appear undeterred by the implications of revealing their whereabouts, or, indeed, where they are not; this could pave the way for a new wave of privacy concerns.

Company Engagement in (or Avoidance of) Third-party Legal Disputes

Increasingly, information gathered by social media sites is at the center of legal controversies to which social media companies themselves are strangers.

• Social media sites are routinely used for sting operations seeking out sexual predators.[39]
• On the other hand, one criminal defendant in a forcible rape case tried to enter into evidence the victim’s Facebook status page. He claimed that this social media showed that the victim’s complained-of bruising resulted from heavy drinking on other occasions.[40]
• A Canadian court allowed discovery of a Facebook profile in a motor vehicle accident suit, despite the document being subscriber-designated as limited access.[41]
• If an employer terminates an employee for cause, recommendations that the employers had made regarding that employee on a site like LinkedIn may be evidence of pretext.[42]
• Subscribers’ posts may violate their own company’s privacy policies, or even reveal their own company’s trade secrets.[43]
• Subscribers may later regret their social media postings, but the evidence that those posts were made can be crucial and published if there is a public interest justification.[44] One MySpace subscriber posted an article heavily critical of her hometown. Six days later she removed it. But, in the meantime, it had been republished in her hometown newspaper, arousing the ire of her community to the extent her family had to close its business and move. The subscriber sued the paper who republished the article. The court held that the initial MySpace publication made any subsequent republication fair game, and non-actionable.[45]
• Presenting perhaps even additional complications, courts in some countries, like New Zealand and Australia, have allowed official court process to be served over social medial sites.[46] The UK Courts are following New Zealand and Australia having recently allowed an injunction to be served on a defendant through Twitter for the first time.[47]

Both the social media enterprise and individual companies on social media can protect themselves. As stated above, each social media enterprise already has (or should have) a detailed suite of policies, reflected in the user agreement, to determine how the company fits in to the substance and process of third-party legal actions. Likewise, all companies should put policies in place governing employees’ actions on social media to avoid company vicarious liability.

Ultimately, subscribers should also take steps to protect themselves because regulators can do only so much to protect subscribers’ personal data and privacy.

Children

The popularity of social networking with young people makes the issue of data protection and privacy more acute. A central concern is that young people lack the awareness of the associated risks of these services and the potential for abuse when revealing personal data. Online risks for young users include illegal and age-inappropriate content, improper contact and conduct, including victimisation or grooming and potentially risky behaviors. Whilst the United States has laws and regulations to protect the privacy of children online, the FTC has announced plans to accelerate review of its regulations with an eye towards imposing more stringent standards.[48]

The impact of digital media on privacy issues for young people has been a key focus in both the UK and throughout Europe. In the UK, for example, the Information Commissioner has published numerous good practice notes for website operators whose sites are directed at children. The Home Office Task Force on Child Protection on the Internet has also published in 2008 good practice guidance for providers of social networking and other interactive services[49].

Whilst a focus of legislators has been to raise awareness amongst users of the risks associated with social networking (for example, through the annual EU “Safer Internet Day”), more recently there has been a focus on the contribution that service providers can make to security in the online environment. Following almost a year of discussions, in February 2009 the European Commission and major social networking companies, including Facebook, Bebo, and MySpace, agreed the “Safer Social Networking Principles for the EU”[50]. These principles were aimed at giving young people extra protection from violations of their privacy and the potential abuse of their personal information. Key principles include: ensuring services are age-appropriate for the intended audience[51]; empowering users through tools and technology to manage the service[52]; providing easy-to-use mechanisms for users to report conduct or content that violates the Terms of Service of the provider; encouraging users to employ a safe approach to personal information and privacy; and assessing the means for reviewing illegal or prohibited content.

However, a year on, the review of the implementation of the principles published by the European Commission on 9 February 2010 suggests that whilst the principles have been a step forward in tackling online risks for young people, more still needs to be done. According to the Commission less than half of social networking companies make profiles of users aged under 18 visible only to friends by default, and only one-third replied to user reports requesting assistance.[53] Whilst currently the Commission is in favor of a multi-stakeholder collaboration with providers and adopting a ‘best practice approach’ to manage potential risks, if providers do not toe the line, the consequence may be regulatory intervention.

Protections To Deter Criminal Activity

Data security class action litigation usually focuses not on the (often judgment-proof) criminal wrongdoers themselves, but on the companies those wrongdoers happened to work for, with, or through. Moreover, governments around the world have drafted businesses into the war against identity theft. Hefty fines can result from a lack of due diligence.

The penalties for breaches of the Data Protection Act 1998 in the UK are currently under review.[54] The UK Government has proposed to put in place tougher sanctions to act as deterrents, for example, up to two years imprisonment and maximum fines of £500,000, the latter of which is expected to take effect in April 2010.[55] The UK, as well as other European countries, is taking data protection law seriously, and service providers should bear this in mind.

In social media enterprises, an even greater risk than identity theft or financial fraud exists. Users of social media have been exposed to emotional abuse[56] and have been sexually assaulted,[57] among other crimes. Attempts have been made to hold the social media enterprises themselves liable for not doing more to stop these abuses. Whilst legal actions have generally not resulted in recovery against social media enterprises, the attendant bad publicity and subscriber concern carry a cost of their own.

Where there is a pre-existing protective order in place, even the simple act of making a friend request via a social media service can rise to the level of criminal contempt.[58] And, especially where the social media environment involves the creation or accumulation of some artificial currency, subscribers can also abuse the system to achieve property crimes or tax evasion.[59]

Precautions to detect likely criminal activity, to the extent practicable, and having social media employment agreements to establish company expectations, are essential for any business’s self-preservation. Typically, companies can take actions such as routine audits and establishing human resources notification policies for crimes involving employees in the workplace. Social media employment agreements are now essential for individuals doing work for your business. We recommend evaluating all of the types of individuals employed by your company and developing a social media agreement that will fit for: employees, contractors, hired talent (representing the company in an endorsement/marketing context), and outsourcing contracts, where applicable. (See Chapter 6 – Employment.)

Addressing Traditional Data Security Concerns

Every social media enterprise needs a comprehensive written information security program. The very open architecture that allows social media enterprises to thrive also allows information security threats to multiply. For example, the Twitter worm, “StalkDailey,” “can gain access to unsuspecting Twitter users by masquerading as the family, friends, and co-workers of the user.”[60] In fact, 19 percent of all hacking attacks were directed at social media enterprises in the first half of 2009, “ranging from simple defacement of sites, placing malware on them or using them to spread smear campaigns.”[61] Social media enterprises need to enlist not just their employees, but also their subscribers, in rapid response to developing privacy threats based on well-understood policies and procedures. Failing to do so may result in dilution of a brand’s value as regulators and consumers react to lapses in security.

A written policy is necessary, but not sufficient to ensure compliance. A written policy without implementation and adherence is a dead letter. Plain language review, easy-to-follow training materials, employee testing, vendor auditing, security breach drills, and the like are indispensible to making sure policy is part of day-to-day procedure.

At the same time, outreach to subscribers to let them know what to expect (and not expect) from the company will help subscribers defend themselves from spoofers, phishers, and similar would-be attackers.

Also, like every company, social media companies should have plans for: the protection and secure disposal of personal data (including in hard copy); the implementation of major litigation holds; and response to the loss or theft of personal data (including, where required or appropriate, through notice to data subjects).

Is the Company Properly Insured against Data Privacy Incidents?

The last risk you need to plan for is the risk that all other mitigation will, ultimately, not be sufficient. As noted above, no system is perfect. Data privacy and security lawsuits can cost millions or tens of millions of dollars to resolve. The right level of coverage, either under general policies or specific endorsements, is something that every company needs to determine on an ongoing basis.

Bottom Line—What You Need to Do

Understand the sensitive nature of information that flows through social media. Recognise the serious compliance and litigation risks that the collection and distribution of such information entails. Consider contractual tools to mitigate these risks, including properly drafted privacy policies and terms of use. Know your obligations under all applicable data privacy and security laws, and have a nuts-and-bolts plan to meet those obligations. Stay ahead of developments in data and privacy security law, so that, to the extent possible, the compliance program put in motion today will be deemed adequate even under the standards of tomorrow. Lastly, know your coverage position with respect to data privacy and security incidents, and properly adjust that coverage in light of known and suspected risks.

Social Media in Action in Trademarks

Trademark, Service Mark and Trade Name Infringement

Twitter, Facebook, and virtual worlds such as Second Life, to name a few, allow their members to adopt user names, personalised sub-domain names, virtual products, and avatars, which all create confusion as to source. There is little resolve to prevent an individual or entity from adopting a user name or sub-domain name that incorporates another’s trademark or personal name. Nor has the law caught up with issues involving the “sale” of virtual products that bear trademarks owned by another or the creation of avatars that resemble celebrities.

Twitter

Twitter, a social networking service that allows users to send and read posts of up to 140 characters in length (“tweets”) has experienced meteoric growth since its launch in July 2006, with almost 75 million visitors in January 2010 alone.[1] Think about the marketing opportunities; now, think about how many people could be deceived by trademark infringers and impersonators. Upon joining Twitter, members create a username which is the “identity” through which their tweets are sent and received. A recurring issue is a member registering a username that is the trademark of another or a name belonging to a celebrity.

In September 2009, ONEOK, Inc. sued Twitter for trademark ifnfringement, alleging that the company wrongfully allowed a third party to adopt the username “ONEOK,” its company trademark, from which the unnamed third party tweeted information about the natural gas distributor.[2] The complaint alleged that the messages were misleading in that they were made to appear like official statements from ONEOK when, in fact, the company had no involvement in sending them. Over the course of a month, ONEOK unsuccessfully asked that Twitter terminate or transfer the unauthorised account. After the complaint was filed, however, the parties resolved the dispute and the account has since been transferred to the company.

A more complex situation arose for Vodafone, whose UK Twitter account was hijacked internally (with a tweet we cannot reproduce here for reasons of taste) by a (presumably now ex) employee[3].

If the Vodafone case proves that companies must have robust internal policies on consumer-facing social network activity, third-party “Twitterjacking” is less easily dealt with. Twitter does have a trademark policy in place that provides the following:

Using a company or business name, logo, or other trademark-protected materials in a manner that may mislead or confuse others or be used for financial gain may be considered trademark infringement. Accounts with clear INTENT to mislead others will be immediately suspended; even if there is no trademark infringement, attempts to mislead others are tantamount to business impersonation.[4]

And while Twitter provides such a policy, it is unclear how well-developed a plan it has for dealing with trademark infringement or how well it is enforced. As a result, it remains the trademark owner’s obligation to be hands-on about protecting its rights. Strategy in doing do so may include developing a standard as to what you may deem to be objectionable use of your trademark, using the privacy protection put in place by the social network to the best of your advantage, and, if feasible, proactively adopting any username variants of the mark you are seeking to protect, a tactic proffered by Facebook as discussed below:

Facebook

Facebook has more than 400 million active users, allowing its members to connect with others, upload photos, and share Internet links and videos. A recent Compete.com study ranked Facebook as the most-used social network by worldwide monthly active users.[5]

Like Twitter, it too, has found itself defending claims of trademark infringement. Facebook, likewise, has an intellectual property infringement policy; however, Facebook’s enforcement of this policy has been called into question.[6] The policy provides that:

Facebook is committed to protecting the intellectual property of third parties. On this page, rights holders will find information regarding how to report copyright and other intellectual property infringements by users posting content on our website, and answers to some frequently asked questions regarding our policies.[7]

Facebook also reserves its right to remove or reclaim a username upon complaint by a trademark owner.[8]

With respect to trademark infringement, it is unclear whether pending trademark applications and/or common law rights will be sufficient to bring a claim, or if the challenger must own a registered trademark. The question of jurisdiction is also unclear. If a Community Trade Mark (CTM) is registered in Europe, to what extent will a claim citing infringement by a U.S. user hold water? How will Facebook handle claims by multiple parties claiming rights in the same mark? Only time will tell.[9]

In its own effort to combat trademark infringement and name-squatting, Facebook, in conjunction with its new policy of allowing users to create personalised URLs, has implemented the following procedures:

• Trademark owners were provided with a three-day window to record their registered trademarks with Facebook, rendering those names unavailable to third-party users, and allowing the trademark owners the opportunity to register for and use those names themselves at a later date.
• Usernames cannot be changed and are non-transferable. As a result, a username cannot be sold, and, should a user terminate his/her account, the username will become permanently unavailable.
• Only a single username may be chosen for each profile and for each of the pages that a user administers.
• In an effort to prevent a user from monopolising a commercially desirable term, generic words may not be registered as a username.

Though these efforts can help provide some comfort to trademark owners, it is unfeasible to protect any and all variations in the spelling of a mark or use of a mark with a generic term (e.g., “cartierwatches”). Furthermore, it remains uncertain whether Facebook, under its current trademark infringement policy, will only stop uses of exact marks. Moreover, will use of the mark as only a username be enough to enact the policy, or must there be infringing content on the Facebook page, or even commercial content on the page?

Another limitation is that common law and other unregistered rights to names under domestic laws (whether in the United States, the UK or continental Europe) are not part of this policy. In other words: If a trademark is not registered, a brand owner cannot automatically prohibit its use as a Facebook URL.

Perhaps Facebook should adopt a model similar to that of the Uniform Domain-Name Resolution Policy (“UDRP”) used to help resolve cybersquatting and other domain name disputes. The UDRP offers trademark owners the ability to acquire or cancel a domain name registration if they can prove that: (1) the domain name at issue is confusingly similar to the owner’s trademark; (2) the current owner of the domain name has no right or legitimate interest in the domain name; and (3) the current owner has registered and is using the domain name in bad faith. The decision as to whether the current domain name holder gets to maintain his/her registration or whether the domain name is to be transferred or cancelled, is rendered by a neutral panel. Certainly providing a uniform set of rules could only serve to help trademark owners in protecting their marks. Not only may such policy help to avoid costly litigation, but decisions can also be rendered fairly quickly.

While privacy protection policies provided by social media sites may help to alleviate some concerns, trademark owners can pursue other legal avenues should these policies fall short. As evidenced by the ONEOK case discussed above, filing an action for trademark infringement or unfair competition are options to protect a valuable trademark.

What Constitutes Infringement?

In the United States, the Lanham Act provides that one is liable for trademark infringement if he or she “use[s] in commerce any reproduction, counterfeit, copy, or colorable imitation of a registered mark in connection with the sale, offering for sale, distribution, or advertising of any goods or services on or in connection with which such use is likely to cause confusion, or to cause mistake, or to deceive…”[10] Similar “use in commerce” requirements exist for claims of unfair competition[11] and dilution.[12] However, the success of any such claims depends on the definition of “use in commerce.” Does a defendant have to use the social media site to sell goods or services in order to avail the trademark owner a claim for relief under the Lanham Act? Unfortunately, this question has yet to be answered definitively, though application of the Lanham Act will certainly depend on the level of commercialisation.

Under English law, as generally under trademark laws in the member states of the European Union that are harmonised under the EU Trademark Directive,[13] trademark infringement occurs where a registered trademark is used without the owner’s consent, and:

• The sign used by the infringer is identical to the registered trademark and is used in relation to identical goods or services
• The sign is identical to the registered trademark and is used in relation to similar goods and services
• The sign is similar to the registered trademark and is used in relation to identical or similar goods or services, and there is a likelihood of confusion by the public, or
• The sign is identical or similar to the registered trademark, the trademark has a reputation domestically, and the use of the sign takes unfair advantage of, or is detrimental to the distinctive character of, the trademark[14]

Under European Community trademark law, the CTM Regulation[15] provides the proprietor of a CTM with the right to prevent third parties from using:

• A sign that is identical to the CTM in relation to identical goods or services, or
• A sign identical or similar to the CTM in relation to identical or similar goods or services if there exists a likelihood of confusion by the public.

The European Court of Justice (ECJ) has held[16] that mere adoption of a company name does not constitute trademark infringement. The test used by the ECJ was that the use of the sign must affect the mark’s essential function of guaranteeing source. It is likely that the adoption by a third party of a name in a social media context will pass this test, though each case will depend on its facts. If use of the company name in a social media context is made in a way that clearly indicates that the use does not originate from the company itself (e.g., a username such as “BMWcritic), infringement will likely not be found.

The English courts have also addressed the question of jurisdiction.[17] In the 1-800 Flowers case, it was held that for trademark law purposes, website-use did not constitute use everywhere in the world merely because the site is globally accessible. Key factors to determining infringement were held to be the intention of the website operator and what local users understand upon accessing the site. Applying this test to Facebook, Bebo or MySpace could result in different decisions depending on geographical coverage and demographic reach. Decisions in other European countries, such as Germany,[18] have used the same approach and asked whether the website-use is directed at the respective domestic customers or audience.

Unfair Competition/Passing Off

In English law, companies can use the tort of passing off to protect their brands. A company looking to protect its name, mark or get-up must establish goodwill, misrepresentation and damage to successfully argue passing off.

While an action for trademark infringement can only be brought in relation to a registered trademark, the cause of action in passing off is wider and protects all elements by which a claimant’s business can be identified. That said, passing off is narrower in scope and harder to prove than the law of “unfair competition” in the United States. While the tort of passing off has not yet been tested in a social media context, there is no reason for it not to apply, albeit that it might be difficult to prove damage in this context. If this is the case, a claimant can instead rely on an argument based around erosion of goodwill, which has previously been successful in the English courts, if the claimant’s brand exclusivity has been reduced, blurred or diminished.[19]

While unfair competition law is not harmonised within the European Union to the same degree as trademark law, other countries offer similar (albeit not identical) remedies to passing off. In Germany, for example, the imitation of goods or services of a company leading to an avoidable confusion among consumers as to commercial origin, or unjustly exploiting or impairing the goodwill connected to the imitated goods or services, constitutes unfair competition.[20] The one case decided by German Courts in this context did not concern an individual use within a social media context, but rather an alleged imitation of the look and feel of Facebook by the German site StudiVZ.[21]

Impersonation

Social media websites such as Twitter and Facebook have also encountered problems with impersonation, an issue particularly prevalent with respect to celebrities. Twitter has even adopted an impersonation policy that states:

Impersonation is pretending to be another person or business as entertainment or in order to deceive.

Non-parody impersonation is a violation of the Twitter Rules.

The standard for defining parody is “would a reasonable person be aware that it’s a joke?” An account may be guilty of impersonation if it confuses or misleads others—accounts with the clear INTENT to confuse or mislead will be permanently suspended.[22]

Twitter will allow a parody impersonation to exist if the following criteria are met:

The profile information on a parody account is subject to removal from Twitter.com if it’s not evident from viewing the profile that it is a joke, it is considered non-parody impersonation. Non-parody impersonation accounts may be permanently suspended.[23]

Nevertheless, countless celebrities have fallen victim to imposters who have acquired usernames of well-known personalities, including Britney Spears, Peyton Manning, William Shatner, the Dalai Lama and even the Queen.[24]The landmark case that brought this issue to light involved St. Louis Cardinals Manager Tony La Russa, who sued Twitter for trademark infringement for allowing an impersonator to send unauthorised and offensive messages under his name.[25] Specifically, he claimed that the unauthorised user made light of the deaths of two Cardinals pitchers, and the public was duped into believing that these statements were made by La Russa. The case settled in June 2009.

Cases like this beg the question as to how well trademark owners can rely on social media websites to shut down imposters, even in light of such matters being brought to their direct attention. In the UK, the advent of personalised URLs may allow trademark owners to rely on English case law, which has held that use of a domain name can infringe a registered trade mark. In Germany, the courts are at least as generous, and have not only viewed the use of a domain as infringing trademark rights, but also as infringing rights to personal and company names.[26]

In an effort to address such concerns, Twitter has created verified accounts, a currently experimental feature, which is a tool developed to help establish the authenticity of those individuals who encounter impersonation or who identity confusion on a regular basis. An account that is verified indicates that Twitter has been in contact with the person or entity the account is representing, and has verified that it is approved. However, the drafter of the tweets sent from the account is not necessarily confirmed. They note that only a handful of accounts have been verified to date (and this feature is not being tested with businesses), so accounts that do not bear the “Verified Account” badge are not necessarily fake. According to Twitter’s website:

We’re starting with well-known accounts that have had problems with impersonation or identity confusion. (For example, well-known artists, athletes, actors, public officials, and public agencies). We may verify more accounts in the future, but because of the cost and time required, we’re only testing this feature with a small set of folks for the time being. As the test progresses we may be able to expand this test to more accounts over the next several months.[27]

While acknowledging that it will not be verifying all accounts, Twitter claims that it will try to assist you if your account is constantly competing with parody or impersonation accounts. Despite these efforts, it is clear that there is quite a long way to go before impersonation and identity confusion can be dealt with effectively. Ironically, many famous celebrities delegate the use of their Twitter account to their publicist or manager.

Virtual Worlds

Virtual worlds are another emerging area of unease. Developed through the application of user-generated content, members create avatars that exist in an online world. Second Life, one such 3-D virtual world where users can socialise, connect and create using voice and text chat, also allows users to create virtual products for sale online, using online currency to complete the transaction that is purchased with real world currency. Habbo is another example, only with a broader reach and targeted to a teen and pre-teen audience.

Trademark Infringement

Too often the virtual products offered for sale on virtual worlds bear the trademarks of third parties without permission to do so. By way of example, in the United States, Taser International, Inc. filed a trademark infringement claim against Second Life over the sale of unauthorised virtual versions of its electronic stun guns.[28] The lawsuit was later dropped, but the liability of Linden Lab, creator of Second Life, was debated in the media.[29] One question raised was why Linden Lab could not have been protected under the safe harbor provisions of the DMCA (See Chapter 1 – Advertising) or the CDA (See Chapter 2 – Commercial Litigation). After all, Linden Lab does not manufacture or sell stun guns, but merely provides the platform through which these “products” are offered for sale. The reason is because trademark infringement claims, unlike copyright claims, for example, are not covered by the DMCA or the CDA. Still, if one were to follow the logic of these statutes, it would seem that the creator of the product bearing the unauthorised trademark should be held liable, not the party who merely provided the platform. In Europe, the E-Commerce Directive makes no such distinction. Thus, virtual world operators might seek to rely on the argument that they are mere conduits, expeditiously removing infringing content when put on notice. Equally, brands that are struggling to find recourse in the United States may find solace in Europe.

A further question is whether such use of another’s trademark, in fact, amounts to trademark infringement. After all, these unauthorised products are not actually offered for sale in the real world, only online. However, several trademark owners have actively promoted the use of their products on Second Life, including International Business Machines Corp. and Xerox Inc.[30] Therefore, there is reason to believe that a stun gun bearing the Taser trademark, was, in fact, endorsed by Taser International Inc. As such, it would seem that it is in the trademark owner’s best interest to police its mark to the best of its ability in order to avoid any possible confusion with respect to source or association. Further, you want to avoid a slippery slope, wherein allowing wrongful use of one’s intellectual property in the virtual world leads to even greater harm in the real world.

In the European Union, the ECJ found that use of a trademark protected for toys on a toy replica of a car will constitute trademark infringement only if that use affects or is liable to affect the functions of the trademark, or if, without due cause, use of that sign takes unfair advantage of, or is detrimental to, the distinctive character or the repute of the trademark.[31] In the Adam Opel case, which followed a preliminary ruling from a German court, the German courts ultimately found no such harm to the trademark, and therefore no infringement.[32]

As intellectual property lawyers know, infringement arises when there is a likelihood of consumer confusion among the relevant purchasing public. On this basis, a plaintiff suing for trademark infringement may claim damages based on lost or diverted sales, which, on its face, may not seem to clearly apply to the unauthorised use of trademarks in the virtual world. However, real profits are, in fact, generated on such sites. Moreover, as noted by the Intangible Asset Finance Society:

it is undeniable that the virtual world population and the “real” life population overlap, and behavior in one medium can surely have an effect, adverse perhaps in this case, on the other. This type of activity may further prevent one from being able to fully exploit IP rights and build IP equity, in particular brand equity, by weakening, diluting and tarnishing trade mark rights or serving as a barrier to potential licensing opportunities and avenues.[33]

Other examples of virtual world trademark infringement include two cases involving the company Eros LLC. In one instance, Eros sued Leatherwood for the making and selling of unauthorised copies of its virtual adult-themed animated bed, using Eros’ “SexGen” mark.[34] Eros sought an injunction and Leatherwood defaulted. In another case, Eros, along with other Second Life merchants, sued a party for duplication of its products and selling them at virtual yard sales, using its marks to identify the products.[35] Eros had owned a pending application with the U.S. Patent and Trademark Office for the mark “SexGen” (which has since matured to registration)[36], and a second plaintiff, DE Designs, owned a federal registration for the mark “DE Designs.”[37] The plaintiffs were granted a judgment by consent, wherein it was ordered that the defendant:

• Pay plaintiffs $524 as restitution for profits derived from the unauthorised copying and distribution of the plaintiffs’ products
• Represent to the court under penalty of perjury that any remaining unauthorised copies were destroyed
• Permanently cease copying, displaying, distributing or selling any of the plaintiffs’ merchandise
• Disclose the names of any alternative accounts or future accounts to plaintiffs
• Allow plaintiffs, through their attorneys, access to copy and inspect the complete transactional records maintained by PayPal, Inc. that were owned or operated by the defendant

As is evidenced by the above, businesses that operate entirely within a virtual world nevertheless receive recognition of their marks, at least in the United States (though maybe not in Europe, depending on the facts at issue), implying that the mark is “used in commerce” within the definition of the Lanham Act. In fact, Alyssa LaRoche sought and was granted registration of a design mark of an avatar by the U.S. Patent and Trademark Office in connection with virtual content creation services.[38] This can certainly be seen as a step ahead for trademark rights within virtual media. Why do companies bother with these lawsuits? Because the virtual economy is growing at a massive rate (witness Zynga, for example), and younger generations are learning their first hand experiences online.

In an EU law analysis, it is difficult to see how a sale of virtual goods will constitute a sale of goods for legislative purposes. As discussed, harmonised trademark law in the European Union turns on whether the goods and services related to the alleged infringer are identical or similar to the trademark owner’s goods and services (unless, under some domestic laws, use in commerce is made of a famous brand). To what extent will the courts decide that virtual Louis Vuitton wallpaper is similar to the real thing? This issue has not been decided (yet) in the English courts.

In the UK, brand owners might opt to rely on passing off, which, as discussed, does not turn on similarity but instead requires goodwill, misrepresentation and damage to be established. In other EU countries, similar remedies under unfair competition law may be available.

So, how do brand owners protect themselves? One option concerns registration for different classifications, such as for online interactive games (Class 41). EU member states adopt different approaches in this regard. Under UK law, an applicant must honestly intend to make goods and services available in the classes for which it registers a mark. This differs from the Office of Harmonization for the Internal Market (“OHIM”) practice, which permits broad registrations, and regulates undue scope through the provisions on revocation for non-use. This seems like a simple change to make in return for extending the protection of your brand. Some EU member states adopt a similar approach. In Germany, for example, applications need to be made in good faith in the sense that bad faith applications can be challenged. However, in practice the application is regarded as neutral so long as there is no actual indication of bad faith on the part of the applicant (which would have to be demonstrated by the party challenging the application). EU member states (along with the CTM regime) also employ a revocation procedure for non-use once five consecutive years of non-use after registration have passed. Furthermore, the hurdles set by the ECJ will still apply even if trademark protection exists for relevant services in Class 41.

Perhaps to prove it is a good copyright citizen, Second Life, like Twitter and Facebook, has a policy in place to help avoid infringement and impersonation.[39] Your account name cannot be the name of another individual to the extent that it could cause deception or confusion; a name that violates any trademark right, copyright, or other proprietary right; a name that may mislead other users to believe you to be an employee of Linden Lab; or a name that Linden Lab deems in its discretion to be vulgar or otherwise offensive.[41]

The policy adds that Linden Lab reserves the right to delete or change any account name for any reason or no reason. In addition, an account cannot be transferred without the prior written consent of Linden Lab (however, it will not unreasonably withhold its consent to the transfer of an account in good standing by operation of a valid written will to a single natural person, as long as proper notice and documentation are provided as requested by Linden Lab).

The policy further provides that a user shall not:

(i) take any action or upload, post, e-mail or otherwise transmit Content that infringes or violates any third party rights; (ii) impersonate any person or entity without their consent, including, but not limited to, a Linden Lab employee, or falsely state or otherwise misrepresent your affiliation with a person or entity…[41]

Linden Lab is generally known to remove any content from its site that incorporates another’s trademark without the trademark owner’s authorisation, or features the unauthorised use of celebrity material, as evidenced by the case wherein the Trump organisation put Linden Lab on notice that a user was incorporating its “Miss Universe” trademark in its “Miss SL Universe” pageant. Linden Lab put the infringers on notice of the complaint by the Trump organisation and proceeded to remove all references to Miss Universe and Miss SL Universe from Second Life. While this is certainly encouraging, the trademark owner or celebrity would be wise to proceed with caution in leaving the determination of what amounts to infringing or unauthorised use to Linden Lab.

The creators of Second Life have also established a Second Life Patent and Trademark Office (“SLPTO”) that offers dated evidence of any Second Life creation to help protect the users’ intellectual property.[42] While not a legal authority, the SLPTO serves as a neutral third party created to help creators protect their intellectual property, educate them on their rights, and add value to their products. The SLPTO also offers automated DMCA notices, copyright applications, limited edition numbers and individual item registration. As in other areas, this is the beginning of the development of “virtual laws,” where virtual worlds seek to operate under their own distinct and unique legal framework, often based on real legal principles.

Celebrity Name and Likeness

As noted above, virtual world users create avatars. Many users will fashion an avatar bearing a celebrity’s name or likeness. This action results in a separate category of trademark infringement and, in the United States at least, generates rights of publicity issues; but the results may surprise you. The lead singer of the band Deee-Lite sued Sega of America, Inc. for common law infringement of her right to publicity, misappropriation of her likeness, and false endorsement under the Lanham Act (among others), based on the alleged use of her likeness as the basis for a character in one of its video games. Despite the fact that the character bore similar facial features, hairstyle and clothing style, and recited the singer’s catchphrase, the court held that there was “sufficient expressive content to constitute a ‘transformative work,’” protected under the First Amendment.[43] In a separate avatar-related case, Marvel sued NCSoft for copyright and trademark infringement on the basis that the avatars created in its “City of Heroes” game were “identical in name, appearance and characteristics belonging to Marvel.”[44] The case settled.

As these cases evidence, trademark owners and providers of virtual world platforms remain ever vigilant of the growing concern regarding the unauthorised use of trademarks and likenesses. It is in the best interests of both parties to work together in protecting the trademark owners’ rights in order to avoid costly and preventable litigation.

Bottom Line—What You Need To Do

It is of the utmost importance to have a strategy in place in order to best protect your ownership of intellectual property. By aggressively policing your trademarks, service marks, trade names and copyrights, intellectual property owners will be in the best position to prevent claims that they have waived their ability to enforce their ownership rights, while at the same time discouraging others from any unauthorised use of such marks and works of authorship.

What Brand Owners Need to Know

The online form created by Facebook for submissions by registered trademark owners allows submission of only one trademark registration at a time, and it is not clear whether your notification will protect only the exact registered mark or variations (subtle, phonetic or otherwise). While URLs are not case-sensitive, trademark owners are painfully aware that "case" is not the most frequent problem encountered when protecting one's brand names and intellectual property rights.

Facebook is limiting the "initial" URL registration period, beginning June 13, (a) to individual users who already had a user profile page prior to the June 9 announcement and (b) to administrators of Facebook Pages (i.e., Facebook pages owned by businesses, public figures, brands and artists) that were live prior to May 31, 2009 and that had at least 1,000 fans at that time. If your Facebook account does not meet these requirements, you have to wait until June 28 to register a personalized URL.

The submission form appears to apply only to registered trademarks, and the owner (or the owner’s authorized representative) is asked to include the registration number on the submission form. While state and foreign registrations are not addressed (either on the form or in the FAQs provided by Facebook), presumably any bona fide registration number in the field could suffice—but that is neither clear nor certain.

Facebook has given trademark owners a very short window of opportunity to provide advance notification to Facebook of their IP rights. If a trademark owner has not done so by end of the day Friday, June 12, presumably any qualified user can register a personalized Facebook URL using a brand owner's mark. Facebook also has indicated that personalized user/page URLs will not be transferable and can be removed or reclaimed by Facebook at any time—further measures Facebook can take to prevent abuse. These mechanisms, procedures and buzz aside, owners give up no legal rights by not submitting forms to Facebook in advance, and Facebook already has a form to use to report infringements after an alleged violation occurs, even if one hasn’t provided advance notification. FYI, allegations of copyright infringement can be dealt with by submitting another form provided by Facebook that applies to "take down" notices under the Digital Millennium Copyright Act (DMCA).

The $64,000 Question

If you are a trademark owner, should you submit forms and notify Facebook of your rights, or wait to assert claims if and when infringements occur? This is not an easy question to answer.

First, you are under no obligation to do anything, nor does this feature mean that if you do nothing, you are somehow giving up your legal rights. By failing to notify Facebook, a trademark owner does not waive any rights to its intellectual property otherwise provided by law. It simply means that a trademark owner may have to do what intellectual property rights-owners do all the time—enforce its intellectual property rights after an infringement has occurred.

Second, while the notification form doesn’t indicate that the submitter is agreeing to any terms and conditions, nor does it require being a registered user to submit a  notification form—either before or after—one might conjure up a legal argument that by voluntarily submitting a form (where one has no legal obligation to do so), one is agreeing to use the procedures and accept the terms and conditions that apply—at least insofar as one’s dealing with Facebook in connection with handling these matters and enforcing one’s rights (e.g., if the owner has an issue with Facebook in dealing with brand name and trademark issues).

Take one example: What if Facebook simply does nothing with your notification? After all, there is no legal obligation imposed on Facebook to police your marks. What if one year from now, Facebook opts to impose a charge for maintaining or registering personalized URLs? Facebook's terms of use (referred to by Facebook as the "Statement of Rights and Responsibilities") provide exclusive venue for claims or disputes against Facebook in the courts in Santa Clara County, Calif. Could an argument be made that you may now have consent to that jurisdiction exclusively? If you don't have to face such an argument, a trademark owner is clearly free to proceed in virtually any competent jurisdiction in the United States, including the trademark owner’s home state. Whether that is an advantage or not is debatable, but it—like many other issues that arise from such voluntary submissions—is an unresolved issue. Bottom line, you have no duty to act, nor does failing to act deprive you of any of your legal rights. But if you do act, some lawyers may be able to claim that your actions have implications and consequences. 

On the other hand, if a brand owner or its authorized licensee currently has a Facebook Page, it is already subject to Facebook’s terms and conditions. Under such circumstances, notifying Facebook of your rights using the form may be the easiest way to avoiding a needless intellectual property battle that will most certainly cost more than the time spent completing a form.

The Evolution of Brands into Social Networks and Media

Facebook is adding another dimension to social networking—allowing personalization of pages while seeking to develop mechanisms to deal with brands and brand owners. Facebook users interact with brands as well as people. The personalized URL launch is another example of the convergence of interactive advertising, social networks and intellectual property protection. While Facebook’s latest offering may be the next evolutionary step forward, it may also be a passing fad. Time will tell. But one thing is certain:

If you are a brand owner with trademark registrations, you need to consider all of the issues before blindly jumping on anything that appears simple and easy, but that may have unforeseen consequences (and costs).

If you need to know more or if you have any questions, contact me through my website page, by email, or by following me on Twitter, or contact Keri Bruce at kbruce@reedsmith.com, Douglas Wood at dwood@reedsmith.com, Carl Pierce at cpierce@reedsmith.com, Adam Snukal at asnukal@reedsmith.com, Greg Shatan at gshatan@reedsmith.com or Tracy Zurzolo Quinn at tquinn@reedsmith.com. Of course, if they aren't among the names above, you can always contact your favorite Reed Smith attorney who will be more than happy to help you.