Uber Lawsuit Highlights Data Breach Disclosure Requirements

The Washington attorney general’s lawsuit against Uber highlights an organization’s disclosure obligations in Washington State in the event of a data breach.

The Nov. 28 suit, filed in King County Superior Court, is thought to be the first time Washington’s data disclosure statute has been pressed in court. It alleges that Uber Technologies, Inc., violated RCW 19.255 by keeping the fact of its data breach by a hacker secret for about a year. The suit alleges the breach affected more than 10,000 Washington residents.

RCW 19.255.010, enacted in 2015, applies to any person or business that conducts business in Washington that owns or licenses data that includes “personal information.” The statute defines “personal information” as a person’s first and last name, in conjunction with his or her social security number, driver’s license number, or account or credit card number, and security code or password that would permit access to the person’s account. 

It requires the notification of affected persons and the attorney general within 45 days of the discovery that personal information “was, or is reasonably believed to have been, acquired by an unauthorized person and the personal information was not secured.” 

The statute defines “secured” in this context as being “encrypted in a manner that meets or exceeds the national institute of standards and technology (NIST) standard or is otherwise modified so that the personal information is rendered unreadable, unusable, or undecipherable by an unauthorized person.”

Required notifications must be made in writing, and include: (a) the name and contact information of the person or business making the report; (b) a list of the types of personal information that were or are reasonably believed to have been disclosed; and (c) the addresses and toll-free telephone numbers of the major credit reporting agencies.

Violators of this RCW 19.255 are subject to suit by both the affected persons and the attorney general.

The takeaways from ths lawsuit are obvious but important: (1) if your organization stores personal information, make sure it doesn’t get out; (2) encrypt all stored information in accordance with NIST standards; and (3) immediately fess up to any data breach in the form the statute requires so you don’t get into more trouble than you’re already in.

Washington State Trademarks Are Now Searchable

The Washington Secretary of State’s database of trademark filings is now searchable (accessible here, at the bottom of the page).

This is a big improvement. Before, searching state records was a hit-and-miss (and mostly miss) affair with the Washington State Digital Archives. Or it meant spending time on the phone. Or paying to access third-party databases, which was a bit galling, since trademark filings are public.

Be galled no more. Users can now search Washington trademark filings by trademark number, owner name, trademark word elements, or Uniform Business Identifier (UBI) number. Once a filing is found, you can click a hyperlink and see PDFs of the as-filed documents. The interface is publicly-available, and it’s free.

That’s not to say it’s perfect. Those are the only searches available. You can’t search by attorney, or goods and services, or use Boolean operators. Those features would be nice, but they’re icing on the cake. It would also help to know the currency of the database, i.e., the date through which the information is accurate. However, this is such a great leap forward, I’m not complaining.

What’s important is the database is meaningfully populated with relevant data. It’s a useful tool that trademark owners should search before making their own filings in Washington.

Amazon Gives Additional Benefits to Trademark Registrants

Amazon gives trademark owners a new reason to register their brands: it’s a ticket to enrolling in the Amazon Brand Registry program.

Enrollment gives trademark owners access to enforcement tools within the Amazon marketplace, including what Amazon describes as “proprietary text and image search, predictive automation based on your reports of suspected intellectual property rights violations, and increased authority over product listings with your brand name.”

This is becoming increasingly popular with clients.

To qualify, brand owners first need to register their marks with a government trademark office in the U.S., Canada, Mexico, India, Japan, France, Germany, Italy, Spain, the United Kingdom, and the European Union. Only standard character marks (word marks) qualify — design marks (logos) are not included. The subject trademark also “must match the brand name printed on products and/or packaging.”

Enrollees in Amazon’s previous program must re-enroll to get the benefits of the new program. However, any brand owner (enrolled or not) can still lodge an intellectual property infringement complaint with Amazon through its public interface (though that tool has mixed reviews at best).

It remains to be seen whether Amazon’s new program will live up to its promise. However, I’m all in favor of the stated goal: to help trademark owners and Amazon “work together to reduce potential intellectual property rights violations and promote an accurate representation of [trademark owners’ brands] on Amazon.”

Floodgates on "Offensive" Trademarks Not Open Yet

Section 2(a) of the Lanham Act bars registration of trademarks that may “disparage” persons, institutions, beliefs, or national symbols, or bring them into “contempt, or disrepute” (the “disparagement” clause); or that include “immoral” or “scandalous” matter (the “scandalousness” clause).

In June, the Supreme Court held that the disparagement clause violates the First Amendment. See Matal v. Tam, 582 U.S. ___ (2017). In that case, the Court found that the disparabement clause-based denial of an application to register THE SLANTS by the Asian-American lead singer of the Portland-based band of that name infringed the applicant’s free speech rights (and, indeed, his effort to claim a racial slur as a badge of honor). For this reason, the disparagement clause is no longer a ground on which the U.S. Patent and Trademark Office will deny an application for federal trademark registration.

Importantly, however, this decision doesn’t extend to the scandalousness clause. While the constitutionality of that provision is separately being challenged, the case hasn’t yet been decided. See In re Brunetti, No. 15-1109 (Federal Circuit) (considering the registrability of the trademark FUCT for apparel). For now, therefore, any trademark the USPTO deems to be “immoral” or “scandalous” will be placed into suspension (i.e., frozen) until the Bruenetti case directs how those trademarks should be examined.

While trademark law is moving in the right direction, the floodgates have not yet opened on profanity or other trademark elements that some may consider offensive. That time probably will come, but pending the Federal Circuit’s decision in Bruenetti, it’s not here quite yet.

Best IP Practices for the Small Business Owner

I often get trademark and copyright questions from startups or small business owners. Though one size doesn’t fit all, there are some common things to think about when getting your IP house in order.

1. Consider registering your trademarks. You can expand the automatic common law rights that arise through using your trademarks if you register them with the U.S. Patent and Trademark Office (yielding national rights) or secretary of state’s office (yielding statewide rights). Your top priority is probaby your business name, followed by your logo, followed by your tag-line. Getting a registration confirms you are the owner and gives you the legal presumption of being the exclusive owner throughout the U.S. (if you get a federal registration) or state (if you get a state registration) for the goods and services you sell under the brand. These expanded rights give you a powerful tool to keep imitators of your brand(s) at bay. Registration isn’t required, so weigh the expected benefits against the cost.

2. Consider registering your copyrights. Copyright law protects against copying. Registration with the U.S. Copyright Office isn’t technically required, but you can’t enforce your rights without at least having an application for registration in the pipeline (if you’re on the West Coast/in the Ninth Circuit). Moreover, if the copying occurrs after your registration issues, you can elect statutory damages and seek attorney’s fees in a copyright infringement lawsuit, which you can’t do if copying occurs before registration. Even if you don’t foresee going to court, having these remedies available gives added heft to a cease-and-desist letter you might send which, by itself, can deter and stop copying. As with trademarks, you should critically consider whether you would get enough bang for your buck before deciding to file.

3. Assignments from vendors. A related copyright consideration is making sure that any vendor or independent contractor that has done creative work for you has assigned their rights to you. This goes for website development and any other writing, audio, or visual work you may have commissioned. Since the “work for hire” doctrine only applies to employees, everyone else who does creative work needs to assign their copyright interest to you in a signed writing. Otherwise, they will continue to own rights in their work and may throw your ability to use, adapt, and sell the work into question.

4. Keep your secrets secret. If your employees or contractors need access to your competitive intelligence to do their jobs, you should consider making sure it doesn’t walk out the door when your relationship ends. You should protect your formulas, customer lists, product ideas, pricing strategies, and other commercially-sensitive information by limiting access to such information to those with a genuine need to know. You can also protect such information with nondisclosure agreements, noncompetition agreements and nonsolicitation agreements. There are limitations to such agreements, but you can minimize the chance of losing exclusive rights in your trade secrets by learning the universe of tools available to protect them.

5. Talk with a patent lawyer. Your invention, method, and design may be patentable. Similarly, they could be covered by someone else’s patent. A patent lawyer can tell you what you need to know to understand your rights, including maximizing your protection and minimizing the risk of receiving a claim against you.

6. Understand the limits of IP law. Lastly, you should realize that intellectual property law doesn’t cover everything — not by a longshot. Trademark law only protects against similar brands in the context of similar goods or services. Copyright law only protects against the copying of original forms of expression (text, photos, videos, code, and the like). It doesn’t cover ideas, functional aspects, or common means of expression. Trade secret law only protects against the misuse of information that is valuable because it is secret, and that you have taken reasonable steps to keep secret. Reverse-engineering can be ok, and in some cases, intentional copying can be ok. Many other limitations exist. The sooner you learn your rights, the sooner you can plan accordingly.

Page | 1 | 2 | 3 | 4 | 5 | Next 5 Entries