Consumer Law & Policy Blog

The CFO of Target on how to limit data breaches through "smart" credit- and debit-card technology

John J. Mulligan, the Chief Financial Officer of Target, has published Time for smart cards in The Hill. He says that the risks from credit- and debit-card theft can be significantly reduced if the U.S. imbeds "smart card" technology in credit and debit cards. Here's an excerpt (omitting stuff about how swell Target is):

The data breach that struck our company spotlighted the sophistication of criminal hacker networks operating across the globe. We know the attack created significant concerns for millions of customers. We will learn from this incident and we will work to make Target, and the wider business community, more secure in the future. One step American businesses could now take that would dramatically improve the security of all credit and debit cards: adoption of chip-enabled smartcards. The technology is already widely used throughout the world. For many reasons, the United States has been slow to embrace the technology at home. We need to change. ... For consumers, this technology differs in important ways from what is widely used in the United States today. The standard credit and debit cards we use now have a magnetic stripe containing the customer's information. When first introduced, that stripe was an innovation. But in today's world, more is needed. The latest "smart cards" have tiny microprocessor chips that encrypt the personal data shared with the sales terminals used by merchants. Why is such a change important? Even if a thief manages to steal a smart card number, it's useless without the chip. In addition, requiring the use of a four-digit personal identification number (PIN) to complete a sales transaction would provide even greater safety.To be frank, there is no consensus across the business community on the use of PINs in conjunction with chip-enabled cards. ... In the United Kingdom, where smart card technology is widely used, financial losses associated with lost or stolen cards are at their lowest levels since 1999 and have fallen by 67 percent since 2004, according to industry estimates. In Canada, where Target and others have adopted smart cards, losses from card skimming were reduced by 72 percent from 2008 to 2012, according to industry estimates. A reason the United States has been slow to embrace change is that all players in the payments system - merchants, issuers, banks and the networks - have not been able to find common ground on how to share the costs of implementation.

Mulligan's piece coincided with his testimony at a Senate Judiciary Committee hearing yesterday on data breaches. Go here for all the hearing testimony and other hearing materials. Go here to watch the full hearing.

Liability for self-driving car crashes

We've posted several times on self-driving cars (also known as driverless cars or autonomous cars). Go, for instance, here, here, and here.

But none of our posts considered the tort liability scheme when self-driving cars run into pedestrians, other cars, or property? Sophia Duffy and Jamie Patrick Hopkins have figured it out in Sit, Stay, Drive: The Future of Autonomous Car Liability. Here's the abstract:

Driverless cars have made the jump from fantasy to the physical realm. Technology has evolved to the point where autonomous cars will be a common sight in the very near future. The benefits of autonomous cars are plentiful: increased safety for car passengers, who no longer have to fear drunk, reckless, or distracted drivers, increased productivity for passengers who can use the travel time to accomplish tasks, decreased reliance on fuel as the cars often incorporate solar panels and automatically adjust speed to maximize fuel efficiency, and decreased traffic congestion as the cars can identify upcoming trouble spots and take alternate routes to avoid delay. However, this innovative technology brings with it an unaddressed legal issue: how will legal liability be assessed when these cars collide with other cars, pedestrians, or property? Current law surrounding liability for automobile accidents largely bases liability on the actions of the driver. Similarly, looking to the liability law governing computers does not address the issue either, as the laws base liability on the actions of the operator of the computer system, and the scant laws related to autonomous computer systems apply only to commercial transactions. This article proposes that the solution to this legal issue lies in treating autonomous cars like man’s best friend, the dog. Dogs and computers are both treated as chattel under tort law, and are similar in that they can act independently, yet are considered property of another. The laws governing canine ownership show that applying strict liability to autonomous car owners accomplishes the dual purpose of fairly assessing liability without hampering the widespread adoption of this marvelous technology.

Med Express (Medical Specialists) Explanation for Suing Customers Gets Stranger

by Paul Alan Levy

Late last month, we went to trial on a motion for sanctions against Med Express, the company that received widespread condemnation last year for suing two eBay customers who had the temerity to leave truthful but negative or even neutral feedback. You may recall that, after two Ohio lawyers stepped forward and sent in a counterclaim for abusive litigation, Med Express eventually withdrew its lawsuit with an apology from its owner, Richard Radey, who blamed the lawsuit in large part on a lawyer who, allegedly, failed to follow the company’s instructions by filing a lawsuit which Radey had verified as true but, he claimed, “not read.”  As I explained here, the apology lacked credibility.

To ensure that the Ohio lawyers got paid to their work for the customers, I entered an appearance in the case to pursue sanctions (Ohio does not have an anti-SLAPP statute).  We finally went to trial on the sanctions motion, and Med Express was represented by a new lawyer, not the lawyer whom its owner had thrown under the bus. The new lawyer adduced testimony from Radey to the effect that what he really wanted to sue about was not the language of the feedback but, rather, the individual “detailed seller ratings” (“DSR’s”) that the two customers had left for him. These DSR’s, Radey testified, identify specific aspects of his conduct such as whether the item he had sent was as described, whether he communicated well, and whether the shipping time and shipping charges were proper.  He claimed that he was able to tell what ratings the customers had left for him by seeing the changes in rating from just before to just after they left feedback, and that each customer had left ratings of “1,” the lowest on a one-to-five scale, for each of the four categories. These ratings, he testified, were false factual statements.

It was an interesting argument, but what Radey might not have taken into account, in presenting this testimony, was that although eBay does not allow buyers (or sellers) to see the individual ratings that buyers leave for them, eBay does keep electronic track of each individual DSR.  And, when our clients checked with eBay customer service to determine what individual DSR’s they had left, they were told that eBay’s records contradicted Radey’s testimony – one customer left a range of ratings from 1 to 5 for different categories, while the other had left only a 5 rating for the one category he entered.

The judge has set a schedule for post-trial briefs, which will be due after the transcript is ready.  We have sought leave to reopen the record to obtain evidence directly from eBay on this issue; I’ll report on further developments here.

One more update: in the wake of last year’s bad publicity, Med Express changed the name under which it trades on eBay from med_express_sales to medical_specialists_inc.  eBay customers beware – the seller that sues its critics for truthful feedback has a new name.

What does "privacy" mean to Facebook?

Facebook is now ten years old. In this thought-provoking piece in the Washington Post, Michael Zimmer, who is an assistant professor at the School of Information Studies at the University of Wisconsin at Milwaukee and is the director of the Center for Information Policy Research, reviews Facebook founder Mark Zuckerberg's views over the past ten years on the subject of privacy, along with the policy changes at Facebook that have implemented those views.

Based on those views and policy changes, Zimmer concludes that, to Zuckerberg, "Control is the new privacy." Zimmer quotes Zuckerberg:

In an interview with Time magazine in 2010 Zuckerberg declares: “What people want isn’t complete privacy. It isn’t that they want secrecy. It’s that they want control over what they share and what they don’t.”

In response, Zimmer offers this critique, and warning:

The problem with Zuckerberg’s philosophy of privacy, of course, is that over Facebook’s 10-year history, users’ ability to control their information has largely decreased. Default settings lean toward making information public, and new advertising and third-party platforms are increasingly spreading users’ information beyond their direct control.

So is "control" just a Facebook talking point rather than an actual aspiration? There is some support for position in that Zimmer's account, which explains how Zuckerberg and Facebook see the sharing of information as an inherent good and privacy as an obstacle to be overcome.

Farm bill cuts food stamps, could have been much worse

After protracted negotiations, the Post reports, the House and Senate have agreed on a farm bill that appears headed for passage and the President's signature. One of the key sticking points was how much to cut from the Supplement Nutrition Assistance Program (SNAP), also known as food stamps. The House sought $40 billion in cuts and the Senate got the cuts down to $8 billion. Not as bad as it could have been, but reducing the food stamp benefits of 850,000 households is not a good start toward reducing income inequality.

The massive safety effects of vehicle regulations -- and seat belt regulation in particular

by Brian Wolfman

We've told you before about the huge reductions in on-the-road deaths caused by various forms of vehicle safety regulations. And we heard just yesterday about the latest vehicle safety rule-in-the-making--not many years away--being pushed by the National Highway Traffic Safety Administration (NHSTA): cars talking to each other to avoid crashes.

But seat belts are the single most effective traffic safety device for preventing death and injury, according to NHTSA. Wearing a seat belt can reduce the risk of crash injuries by 50 percent. Seat belts saved more than 75,000 lives from 2004 to 2008. Forty-two percent of passenger vehicle occupants killed in 2007 were unbelted. A 2009 NHTSA study estimates that more than 1,600 lives could be saved and 22,000 injuries prevented if seat belt use was 90 percent in every state.

Seat belt use didn't happen by chance. it took regulation and a large publicity campaign (largely taxpayer funded) to get where we are. It wasn't until 1968 that federal law required all new vehicles (except buses) to be equipped with seat belts. And it wasn't until 1984 that a single state (New York) required their use. Now, all but one state (New Hampshire) requires their use. One key determinant of seat belt use is whether a state is a "primary law state" (where a vehicle occupant can be pulled over solely for not using a seat belt) or a "secondary law state" (where a vehicle occupant can be ticketed for not using a seat beat, but only if the car is pulled over for some other infraction). NHTSA just issued its 2013 seat belt use survey, which shows that in "primary" states seat-belt use is at 91%, while in "secondary" states use is only at 80%. And since states began enacting "primary" laws, seat belt use has increased dramatically. Between 1995 and 2013 alone, use has gone from 60% to 87%.

There are many statistical studies on the effects of seat belt use on traffic-related deaths and driving behavior. This one from about 10 years ago by economists Alma Cohen and Liran Einav may be interesting to our more mathametically inclined readers.

FDA ad campaign seeks to reduce teen smoking

Most smokers start as kids. The FDA wanted the tobacco companies to put gruesome pictures illustrating the health hazards of smoking on all tobacco packages, but the First Amendment got in the way. So, now, according to this AP story, the FDA is running its own ad campaign to warn teens against smoking. Here's an excerpt:

The Food and Drug Administration is using ads that depict yellow teeth and wrinkled skin to show the nation’s at-risk youth the costs associated with cigarette smoking. The federal agency said Tuesday it is launching a $115 million multimedia education campaign called “The Real Cost” that’s aimed at stopping teenagers from smoking and encouraging them to quit. The Food and Drug Administration is using ads that depict yellow teeth and wrinkled skin to show the nation’s at-risk youth the costs associated with cigarette smoking. Advertisements will run in more than 200 markets throughout the U.S. for at least one year beginning Feb. 11. The campaign will include ads on TV stations such as MTV and print spots in magazines like Teen Vogue. It also will use social media.

Go here to view "The Real Cost" home page on the FDA's website.

Below is one of the FDA's gruesome labels in wanted the tobacco companies to display. For all the others go here.

How the Obama Administration Can Unilaterally Strike a Blow Against Arbitration Clauses

by Jeff Sovern

A theme of the President's state of the union address was that if he cannot achieve his goals by working with Congress, he will pursue those goals unilaterally, to the extent he can, through executive action.  One tool presidents have is the purchasing power of the United States.  The US buys about $500 billion worth of goods and services annually, more than anyone else.  As this Sunday Times Review essay by Ian Urbina notes, presidents, including President Obama, have used this tool to effect social change.  Urbina explained:

In 1941, for example, President Franklin D. Roosevelt issued an executive order prohibiting racial discrimination by defense contractors after it became clear that federal legislation would be impossible because of the stranglehold that Southern Democrats had on Congress.

Since then, the government has used its purchasing power to promote an array of other social goals, including ending forced child labor, promoting recycled paper, incentivizing the hiring of disabled people and opposing apartheid.

President Obama has made one major foray into this realm. In September 2012, he issued an executive order strengthening rules preventing federal agencies from using factories that relied on forced labor or trafficked workers. * * *

Suppose the president ordered that federal agencies not do business with companies that use predispute arbitration clauses.  Businesses like Citibank  that both do business with the government (see here and here) and use arbitration clauses would have to choose which one was more valuable to them.  The result might be fewer consumer contracts subject to arbitration clauses. And the president wouldn't have to wait for Congress to pass the Arbitration Fairness Act to get there.

What's the downside?  Urbina reports that some critics charge that using government purchasing power to accomplish substantive goals helps contractors who are better at gaming the system.  Yet those who use arbitration clauses have already demonstrated skill at gaming the system, and so presumably no company using arbitration clauses would be disadvantaged in that way. Other critics claim that such strategies might increase costs to the government.  But some major businesses, including JPMorgan Chase with its credit cards, are already eschewing the use of binding arbitration clauses, and there's no evidence that their prices are not competitive. 

This president has already done a lot for consumers by signing the Dodd-Frank Act and creating the Consumer Financial Protection Bureau.  He can add to that legacy by using the government's purchasing power to do still more.

Farmed and Dangerous: Chipotle's satirical four-part series on corporate farming

On February 17, Farmed and Dangerous -- Chipotle's four-part comedic, but serious series on corporate farming -- begins airing on Hulu. Watch the hilarious trailer here or by clicking on the embedded video below.

 

We posted earlier on Chipotle's unusual and evocative video about the treatment of animals in large-scale farming.

Ever feel that you are being asked to pay too much for in-flight Internet access?

Well, so do some consumers, whose federal antitrust suit against the dominant provider of Internet service on commercial airlines -- Gogo, Inc. -- has survived a motion to dismiss. Go here for a description of the case and the court's decision denying Gogo's motion to dismiss. The case is pending before federal district judge Edward Chen of the Northern District of California.