Morrison Foerster’s Class Dismissed blog provides insights, recommendations, and timely reports on the latest defense news, developments, and trends in the most current class actions lawsuits and product liability issues that affect consumer-facing companies. Through Class Dismissed, attorneys from our nationally recognized Consumer Class Action and Products Liability practices offer a real-time assessment of the developments in matters that are shaping the industry. This blog examines the full spectrum of consumer-related class action and product liability lawsuits ranging from false advertising, privacy, consumer product safety, ADA, food misbranding, TCPA, environment, retail, and government actions as well as nationwide and multidistrict litigation class actions.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

Editors

park_julie_blog_150x150.png

park_julie_common_640x280.jpg

park_julie_heroretina_2700x1160.jpg

park_julie_mobileretina_750x1040.jpg

park_julie_social_600x600.jpg

Partner

Julie Park protects her clients’ products no matter what kind of product issue they face—whether it is planning for new product development, recalling an existing product, or defending clients against product liability or consumer class actions. Drawing on her deep technical and legal expertise, Julie counsels clients on consumer product safety regulation and pharmaceutical and medical device preemption while also managing complex and multijurisdictional litigation both in state and federal court.

Julie Y. Park

<div class="videoWrapper"><iframe frameborder="0" class="sticky-video" allowfullscreen="1" title="Meet Penny Preovolos, Litigation Partner" src="https://www.youtube-nocookie.com/embed/hv7hYn-Bl7c?rel=0&showinfo=0;vq=hd1080" title="iframe"></iframe></div>Penelope has served as lead counsel in major consumer class actions and antitrust cases for more than 35 years, successfully representing high-profile defendants in antitrust, consumer fraud, and product defect matters. Her clients span a range of industries, including consumer electronics, technology, retail, publishing, food and beverage, cosmetics, and household products. According to Chambers USA, Penelope has a “great reputation for antitrust and product liability work” and is a “superb all-around antitrust lawyer.”Penelope was named the 2019 Antitrust Lawyer of the Year by the Antitrust, UCL, and Privacy Section of the California Lawyers Association. She was co-chair of MoFo’s antitrust practice for 14 years. She has served as chair of the Antitrust and Trade Regulation Section of the State Bar of California and as a member of the Ninth Circuit Advisory Committee on Local Rules and Operations. She is an editor of and frequent contributor to Morrison & Foerster’s <a href="https://classdismissed.mofo.com/">Class Dismissed blog</a>, as well as a frequent speaker about class action and antitrust issues.More About PenelopePenelope clerked for the Honorable Charles M. Merrill, United States Court of Appeals for the Ninth Circuit. She graduated cum laude from Harvard Law School, where she was executive editor of the Harvard Civil Rights – Civil Liberties Law Review. Penelope was a member of Phi Beta Kappa at the University of California, Berkeley. She was awarded the University Medal, the highest undergraduate honor at the university, as well as the English Departmental Citation (awarded to the outstanding graduate in that department).

preovolos_penelope_blog_150x150.png

preovolos_penelope_common_640x280.jpg

preovolos_penelope_heroretina_2700x1160.jpg

preovolos_penelope_mobileretina_750x1040.jpg

preovolos_penelope_social_600x600.jpg

Senior Counsel

Penelope has served as lead counsel in major consumer class actions and antitrust cases for more than 35 years, successfully representing high-profile defendants in antitrust, consumer fraud, and product defect matters. Her clients span a range of industries, including consumer electronics, technology, retail, publishing, food and beverage, cosmetics, and household products.

Penelope A. Preovolos

Claudia focuses her practice on the defense of consumer class actions and on complex commercial litigation, including unfair business competition, false advertising, product liability, and privacy matters. She is currently representing numerous consumer goods manufacturers and retailers in false advertising and mislabeling class action lawsuits. Claudia also regularly counsels clients in the food, cosmetics, retail, and technology industries. She represents companies in false advertising disputes before the National Advertising Division (NAD) of the Council of Better Business Bureaus, Inc.<h5>More about Claudia</h5>Claudia is active in MoFo’s pro bono efforts, and recently traveled to El Paso, Texas, to work with families separated and detained at the border. She is also supervising a pro bono collaboration with Equal Rights Advocates, a nonprofit fighting for gender justice in work places and schools across the country. The initiative will help students who have been victims of sexual assault, attempted assault, or harassment find support and seek justice. Claudia is also a board member of Bay Area Legal Aid and a former board member of Equal Rights Advocates. Claudia is an editor and frequent contributor to MoFo’s <a href="https://classdismissed.mofo.com/">Class Dismissed</a> blog, which provides reports about the latest defense news, developments, and trends in class action lawsuits and product liability issues that affect consumer-facing companies. Her perspectives are also respected in the larger legal community: Claudia has published articles about class action and false advertising issues, and is a co-author of Chapter 7 — “Unfair Competition in California Business Litigation 2016” — of The Recorder. She also regularly speaks at conferences on class action and advertising trends. Claudia is currently serving as a Lawyer Representative for the Northern District of California. She received her J.D. degree in 2004 from Berkeley Law (Boalt Hall School of Law), where she was an associate editor of the Berkeley Technology Law Journal.

vetesi_claudia_blog_150x150.png

vetesi_claudia_common_640x280.jpg

vetesi_claudia_heroretina_2700x1160.jpg

vetesi_claudia_mobileretina_750x1040.jpg

vetesi_claudia_social_600x600.jpg

Claudia focuses her practice on the defense of consumer class actions and on complex commercial litigation, including unfair business competition, false advertising, product liability, and privacy matters. She is currently representing numerous consumer goods manufacturers and retailers in false advertising and mislabeling class actions.

Claudia M. Vetesi

Alexandra Barlow is a partner in the Litigation Department of Morrison Foerster’s San Diego office.Alexandra litigates product liability matters involving medical devices, pharmaceuticals, consumer products, automobiles, and AI. Alexandra's litigation expertise spans the entire case life cycle in both state and federal courts. She handles all phases of discovery, including fact investigation and expert discovery. Alexandra has taken over twenty-five depositions, including experts, plaintiffs, treating physicians, and third-party witnesses. She drafts and argues motions of all types, including motions for summary judgment, motions to quash, and motions for preliminary injunction.Alexandra has significant trial experience. She has first-chaired a one-week jury trial and second-chaired a five‑week jury trial, both involving multiple claims and witnesses. She also has extensive experience in alternative dispute resolution, representing clients at mediations, mandatory settlement conferences, and early neutral evaluations.Alexandra enjoys tracking developments and keeping her clients updated on product liability and personal injury claims, frequently writing or presenting on emerging areas such as autonomous vehicles and smart devices. Alexandra’s experience also extends to professional liability, warranty claims, eminent domain, and construction law.Alexandra earned her J.D. from the University of San Diego School of Law. While in law school, the San Diego Law Review published her comment on the recovery of damages by plaintiffs in a persistent vegetative state, and she also served as a comment editor. She received her B.A. from the University of California, Los Angeles, where she majored in Political Science and minored in Spanish. A San Diego native, she attended a Spanish immersion school through the eighth grade. Alexandra is active in the San Diego community, advising students at a local college. She is also a member of several legal organizations in San Diego, including Lawyer’s Club, the Association of Business Trial Lawyers, and Wallace Inn of Court.

preece_alex_blog_150x150.png

preece_alex_common_640x280.jpg

preece_alex_heroretina_2700x1160.jpg

preece_alex_mobileretina_750x1040.jpg

preece_alex_social_600x600.jpg

Alexandra Barlow is a partner in the Litigation Department of Morrison Foerster’s San Diego office. Alexandra litigates product liability matters involving medical devices, pharmaceuticals, consumer products, automobiles, and AI. Alexandra’s litigation expertise spans the entire case life cycle in both state and federal courts. She handles all phases of discovery, including fact investigation and expert discovery. Alexandra has taken over twenty-five depositions, including experts, plaintiffs, treating physicians, and third-party witnesses. She drafts and argues motions of all types, including motions for summary judgment, motions to quash, and motions for preliminary injunction.

Alexandra Barlow is a partner in the Litigation Department of Morrison Foerster’s San Diego office. Alexandra litigates product liability matters involving medical devices, pharmaceuticals, automobiles, AI, and robotics. Alexandra's litigation expertise spans the entire case life cycle in both state and federal courts. She handles all phases of discovery, including fact investigation and expert discovery. Alexandra has taken over twenty-five depositions, including experts, plaintiffs, treating physicians, and third-party witnesses. She drafts and argues motions of all types, including motions for summary judgment, motions to quash, and motions for preliminary injunction.

Alexandra Barlow

Adam J. Hunt is a partner in the Litigation Department of Morrison Foerster’s New York office. His practice focuses on complex litigation, with an emphasis on class action and commercial litigation.Mr. Hunt has extensive experience representing consumer products companies, financial institutions, and technology firms in class action cases and complex commercial disputes before state and federal trial courts, as well as in arbitrations. Clients seek Mr. Hunt’s counsel for his creative, strategic thinking in high-stakes, high-profile matters. He has represented clients facing claims under false advertising, antitrust, and privacy laws throughout the country, securing wins at the pleading stage, summary judgment, and trial, in addition to negotiating favorable settlements, often early in the case. Representative experience includes successfully securing rulings dismissing two putative false advertising class action cases against one of the best-known consumer electronics companies in the world; obtaining a complete win on summary judgment for a major shipping and logistics company in a multimillion-dollar commercial dispute; appearing as counsel at trial for a leading financial institution in a $100 million commercial dispute, winning a bench trial verdict; and prevailing on motions to dismiss false advertising class actions against a leading Greek yogurt company.Mr. Hunt is also an editor of the firm’s <a href="https://classdismissed.mofo.com/" target="_self">Class Dismissed blog</a>, which provides insights, recommendations, and timely reports on the latest defense news, developments, and trends in the most current class action lawsuits that affect consumer-facing companies.Mr. Hunt maintains an active pro bono practice and is the recipient of the New York State Bar Association’s 2017 President’s Pro Bono Service Award for the First Judicial Department, the 2018 Public Service Award from New York University School of Law, and Morrison Foerster’s Kathi Pugh Award for Pro Bono Services.Mr. Hunt received his B.A. with honors from Swarthmore College and his J.D. cum laude from New York University.

hunt_adam_blog_150x150.png

hunt_adam_common_640x280.jpg

hunt_adam_heroretina_2700x1160.jpg

hunt_adam_mobileretina_750x1040.jpg

hunt_adam_social_600x600.jpg

Adam Hunt is a partner in the Litigation Department of Morrison Foerster’s New York office. His practice focuses on complex litigation, with an emphasis on class action and commercial litigation.

Adam Hunt

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Morrison Foerster’s Class Dismissed blog provides insights and reports on the latest news, developments, and trends that affect consumer-facing companies. Subscribe to receive the latest updates by attorneys from our nationally recognized Consumer Class Action and Product Liability practices.

Welcome to Class Dismissed

class-dismissed-welcome-image.jpeg

class-dismissed-welcome-image

Morrison Foerster’s Class Dismissed blog provides insights and reports on the latest news, developments, and trends that affect consumer-facing companies. 

Class Action

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

Stay on top of emerging issues and stay informed of developments related to the law and business of social media.

Socially Aware

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

The latest news and insights from the nationally recognized Consumer Class Action and Product Liability practices of Morrison & Foerster.

Class Dismissed

  Linkedin

MoFo LinkedIN

Class Dismissed Blog - RSS

Stay Connected

By submitting your data to subscribe to this blog, you approved Morrison & Foerster LLP to email you future information about MoFo news and events. You may opt-out at any time by sending a request to <a href="mailto:mofonews@mofo.com">mofonews@mofo.com</a>. To learn more about how Morrison & Foerster LLP uses and protects your personal data, please view our <a href="https://www.mofo.com/about/privacy-policy.html">Privacy Policy</a> at <a href="https://www.mofo.com/">www.mofo.com</a>.

Never miss a post from Class Dismissed. Enter your email below to stay up-to-date.

Subscribe

Class Action and Product Insights for Your Business

Morrison Foerster - Footer

Blogs -  Home Button

Home

Blog - Topics

TCPA

Announcements & Press

Antitrust

Appellate & Supreme Court

Arbitration

Autonomous Vehicles & Robotics

Aviation & Drones

Class Certification

Consumer Products

Coronavirus (COVID-19)

CPSC

Drug & Medical Device

Emergency Use Authorization (EUA)

Environmental Law

False Advertising

FCRA

Food Misbranding

Government Actions

Internet of Things

Mass Torts

Pharmaceutical & Medical Devices

Privacy

Product Liability

Public Readiness and Emergency Preparedness Act (PREP Act)

Retail

Trials

Topics

Blog - Editors

Blog - About

About

Blog - Subscribe

More

Alexandra Preece Barlow

Adam J. Hunt

The Future of Section 230: Protection Against Product Liability Claims?

New Wave of PFAS Legislation Aimed at Consumer Products

CPSC Releases Annual Report on Deaths and Injuries Involving Nursery Products

CPSC Proposes New Safety Rules for Infant Rockers

CPSC Commissioners Abstain from Retracting Infant Sleep Product Statements

LinkedIN

In a recent ruling, California’s Court of Appeal unanimously affirmed the dismissal of California’s complaint against Delta Air Lines, Inc. (“Delta”), which alleged that the company’s Fly Delta mobile application violated California’s privacy laws.<a href="#_ftn1" name="_ftnref1">[1]</a> The Court of Appeal held that the lawsuit was expressly preempted by the Airline Deregulation Act of 1978 (ADA). The holding is in line with other cases broadly applying the ADA’s preemption provision and limits the extent to which airlines may be required to comply with state privacy laws.California’s LawsuitThe California Attorney General (AG) brought the lawsuit against Delta to enforce California’s Online Privacy Protection Act of 2003 (CalOPPA), Cal. Bus. & Prof. Code §§ 22575-22579. In pertinent part, CalOPPA requires an operator of a commercial website or online service to draft and post online a privacy policy informing consumers in California “of the Web site’s or online service’s information practices with regard to the consumers’ personally identifiable information[.]” CalOPPA also places certain other requirements on operators of websites or online services.The AG argued that Delta violated CalOPPA in connection with the Fly Delta mobile app, which can be downloaded from the Internet and used on smart phones and other mobile devices (and therefore arguably makes Delta “an operator of online services” subject to CalOPPA). Users can do a variety of things on the app, including checking in for flights, viewing reservations for air travel, pricing and buying tickets, paying for and tracking checked baggage, and accessing their frequent flyer accounts. The app also purportedly allows users to send and receive information over the Internet, and collects certain personally identifiable information (PII) about individuals residing in California.The AG alleged that Delta did not conspicuously post a privacy policy as required by CalOPPA.  According to the complaint, app users allegedly were not informed that their PII was collected, how Delta used such information, or with whom that information was shared, disclosed, or sold. The AG first notified Delta that the app did not comply with CalOPPA in an October 2012 letter.  Less than two months later, the AG filed its complaint alleging that the app “does not have a privacy policy conspicuously posted, i.e., reasonably accessible to consumers within the [mobile application.]” The AG’s complaint contained a single cause of action under California’s Business and Professions Code section 17200 (the “unfair competition law” or UCL), claiming that Delta’s CalOPPA violations were “unlawful, unfair, or fraudulent business acts and practices” under the UCL.Delta responded with a demurrer in which it argued that the ADA expressly preempted the AG’s lawsuit. The ADA is a 1978 federal law intended to remove government control over fares, routes, and new carriers entering the market in the commercial aviation field. The ADA contains an express preemption provision that prohibits the states from enacting or enforcing any law, regulation, or provision “related to a price, route, or service of an air carrier[.]” 49 U.S.C. § 41713(b)(1). The trial court agreed with Delta, sustaining the demurrer without leave to amend and dismissing the complaint with prejudice. The AG appealed.The Court of Appeal’s OpinionThe Court of Appeal affirmed, holding that the ADA preempted California’s UCL claim against Delta. The court began by reiterating the “‘two cornerstones’ of federal preemption analysis”: First, that congressional intent is the focus of the analysis, and second, that there is a presumption against preemption.            Supreme Court PrecedentApplying those cornerstone principles here, the court was guided by three cases in which the U.S. Supreme Court addressed the reach of the ADA’s preemption provision: Morales v. Trans World Airlines, Inc., 504 U.S. 374 (1992), American Airlines, Inc. v. Wolens, 513 U.S. 219 (1995), and Northwest, Inc. v. Ginsberg, 134 S.Ct. 1422 (2014).In Morales, the Supreme Court held that the ADA preempted Travel Industry Enforcement Guidelines composed by the National Association of Attorneys General (NAAG). The NAAG guidelines purported to govern the content and format of airline fare advertising and were designed to stop allegedly deceptive airline advertisements. The Supreme Court interpreted the “relating to” language in the ADA preemption clause broadly, and held that the ADA preempted the NAAG guidelines because they were “related to” a price, route, or service of an air carrier.  Morales, 504 U.S. at 383-384.The Court similarly found that the ADA preempted the plaintiffs’ claims in Wolens. In Wolens, the plaintiffs alleged American Airlines’ retroactive modification of its frequent flyer program violated Illinois’ Consumer Fraud and Deceptive Business Practices Act. The Supreme Court held that the claims related to American Airlines’ “‘[prices],’ i.e. American’s charges in the form of mileage credits for free tickets and upgrades, and . . . ‘services,’ i.e. access to flights and class‑of-service upgrades unlimited by retrospectively applied capacity controls and blackout dates.” Wolens, 513 U.S. at 226.  Because they related to prices and services, the claims were preempted by the ADA.In Ginsberg, the Supreme Court reaffirmed its broad interpretation of the ADA’s preemption provision. The Court concluded that the ADA preempted the plaintiffs’ claims for breach of the implied covenant of good faith and fair dealing stemming from allegations that the airline terminated their memberships to its frequent flyer program. The Court found that airline’s frequent flyer program was “related to” the airline’s prices and services, and thus that the claims were preempted by the ADA.            ADA Preemption, CalOPPA, and the Fly Delta AppTurning to California’s claim here, the court began by addressing a few issues that had been resolved by Morales and Wolens.First, the court noted that, in assessing whether the ADA preempts the AG’s UCL action, the court would examine the underlying state law predicate—i.e., CalOPPA.Second, the court explained that, in analyzing the preemption issue, it was not required to apply the presumption against preemption because the field governed by the ADA—air transportation—has long been regulated at the federal level.Third, the court rejected the AG’s argument that the complaint did not “relate to” Delta’s service. The app was designed to facilitate access to the airline’s services, and the AG was trying to compel Delta to maintain the app in compliance with CalOPPA.  Thus, the lawsuit “related to” Delta’s services. Notably, the court did not decide whether the app itself was a “service” within the meaning of the ADA.The court then concluded that the ADA preempts California’s UCL/CalOPPA claim as applied to Fly Delta. The court explained that CalOPPA is not a mere “disclosure regimen” within which operators of online services may act with broad discretion. Rather, CalOPPA is similar to the consumer protection legislation at issue in Morales and Wolens, and has the potential to intrusively regulate airlines.  Moreover, as in Morales, the obligations imposed by CalOPPA would significantly affect the airline’s ability to market its product through the app, and would therefore have a meaningful impact on the fares Delta charges. As the court explained, quoting Morales: “If each AG were to require Delta to comply with its own version of CalOPPA, it would force Delta to design different mobile applications to meet the requirements of each state. And, indeed, enforcement of the CalOPPA’s privacy policy requirements might well make it impossible for an airline to use a mobile application as a marketing mechanism at all.”Finally, the court rejected the AG’s argument that CalOPPA would have only “a peripheral effect on ticket prices, routes, or airline services.” CalOPPA would instead “require Delta to meet state standards regarding privacy policy requirements in place of the market forces currently dictating Delta’s selection and design of” Fly Delta.Because the ADA preempted California’s UCL claim for violation of CalOPPA, the court upheld the dismissal of the complaint. And it did so without leave to amend, finding that there was no reasonable possibility that the AG could amend to avoid ADA preemption.What This MeansDelta reinforces the broad scope of the ADA’s preemption provision. As the case makes clear, airlines have a strong argument that state laws like CalOPPA, which apply across industries and seem to have only a remote effect on the airline’s prices, routes, or services, simply cannot be applied to them. But this does not mean that the airlines may operate unchecked in areas governed by CalOPPA and other preempted laws. As the Delta court noted, quoting Wolens, Morales, and Ginsberg: “[T]he DOT retains authority to investigate unfair and deceptive practices and unfair methods of competition by airlines, and may order an airline to cease and desist from such practices or methods of competition.” The court further stated that DOT appears to have “taken action” related to the collection of PII by air carriers, and privacy policies for the sharing and storage of that PII. To date, however, the DOT has issued no regulations governing the form and placement of privacy policies related to an airline’s mobile app. And until the DOT does, state privacy laws cannot fill the gap. <a href="#_ftnref1" name="_ftn1">[1]</a> People ex rel. Harris v. Delta Air Lines, Inc., Case No. A139238, 2016 LEXIS 419 (Cal. Ct. App. May 25, 2016).

California Court of Appeal Finds AG’s Privacy Suit Over Fly Delta Mobile App Is Preempted

In a recent ruling, California’s Court of Appeal unanimously affirmed the dismissal of California’s complaint against Delta Air Lines, Inc. (“Delta”), which all

California Court of Appeal Finds AG’s Privacy Suit Over Fly Delta Mobile App Is Preempted

On April 14, 2016, the Seventh Circuit again weighed in on Article III standing requirements in a putative class action involving an alleged data breach.  In Lewert v. P.F. Chang’s China Bistro, Inc., Case No. 14-3700 (7th Cir.), the two named plaintiffs each allegedly dined at a P.F. Chang’s location in Illinois during a period that was affected by a data breach.  One plaintiff alleged that fraudulent charges appeared on his debit card and that he canceled his card and purchased a credit monitoring service.  The other plaintiff alleged no fraudulent charges on his card, but alleged that he spent time and effort monitoring his card statements and credit report.  The plaintiffs sought to represent a class of all customers whose payment data may have been compromised during the breach.  The district court dismissed the claims for lack of standing, concluding that the plaintiffs had not suffered the requisite personal injury.  The Seventh Circuit reversed.The court focused its standing analysis on the requirement of a concrete and particularized injury.  The court relied on its recent decision in Remijas v. Neiman Marcus Grp., LLC, in which it concluded that plaintiffs in a data breach case had sufficiently alleged Article III standing based on their increased risk of fraudulent credit- or debit-card charges and the increased risk of identity theft.The Lewert court reasoned that the named plaintiffs adequately alleged these same injuries.  Regarding plaintiffs’ other alleged injuries, the Seventh Circuit did not reach a conclusion but expressed skepticism that plaintiffs’ other claimed injuries based on the cost of their meals or based on a property right to personally identifiable data would be sufficient injuries for Article III standing.  The Seventh Circuit thus concluded that the plaintiffs had plausibly alleged at least some injuries that were sufficiently immediate and concrete as to satisfy the standing requirement.  It reasoned that the defendant’s arguments regarding whether the plaintiffs’ data was in fact exposed and whether defendant actually caused any of the claimed injuries were matters going to the merits of the case rather than the sufficiency of the pleading.

CCPA and Data Breach Class Action for Leading Software Company

BIPA Class Action Against Gaming and Hospitality Company

TCPA and Other Class Actions for Major Technology Company

Data Breach Class Action for Technology Company

Wiretap Act action against a Major Consumer Electronics Manufacturer

TCPA Class Action Against National Chain

In re Pharmaceutical Industry Average Wholesale Price Litigation

In re Verizon Wireless Data Charges Litigation

cheung_tiffany_blog_150x150.png

cheung_tiffany_common_640x280.jpg

cheung_tiffany_heroretina_2700x1160.jpg

cheung_tiffany_mobileretina_750x1040.jpg

cheung_tiffany_social_600x600.jpg

Clients seek out Tiffany for her successful track record in defending class action claims on behalf of clients in a broad range of industries, including technology, healthcare, and consumer product companies. She represents numerous Fortune 500 companies in high-stakes litigation involving privacy and marketing claims in courts throughout the United States.

Tiffany Cheung

Clients seek out Tiffany for her successful track record in defending class action claims on behalf of clients in a broad range of industries, including technology, healthcare, and consumer product companies. She represents numerous Fortune 500 companies in high-stakes litigation involving privacy and marketing claims in courts throughout the United States.

Seventh Circuit’s Latest Word on Standing Requirements for Data Breach Claims

On April 14, 2016, the Seventh Circuit again weighed in on Article III standing requirements in a putative class action involving an alleged data breach. In Lew

Seventh Circuit’s Latest Word on Standing Requirements for Data Breach Claims

Health care apps are one of the most important and growing segments in the ecosystem known as the Internet of Things (IoT). After the recent amendments to the Health Insurance Portability and Accountability Act (HIPAA) that, among other things, broadened the definition of a “Business Associate,” many technology companies found themselves wondering whether they were, or were not, subject to HIPAA. Health and Human Services (HHS) recently issued some guidance, Health App Use Scenarios & HIPAA, that attempts to provide some clarity on these issues for app developers.

Fertility Center Litigation

Fitbit

MicroPort

Leading Healthcare, Pharmaceutical, and Medical Device Company

Lethal Injection Matters – Major Pharmaceutical Company

Pain Pump Matters – Large Pharmaceutical Company

Major Technology Company

Leading Chemical Company

Security Device Company

In re Air Crash Near Peixoto de Azevedo, Brazil

bosman_erin_blog_150x150.png

bosman_erin_common_640x280.jpg

bosman_erin_heroretina_2700x1160.jpg

bosman_erin_mobileretina_750x1040.jpg

bosman_erin_social_600x600.jpg

Erin Bosman is chair of MoFo’s Class Actions and Mass Torts Practice Group and is a founder and co-head of the Artificial Intelligence Group. Clients value her business strategy, seeking her comprehensive counsel throughout the product life cycle, especially in high-stakes litigation and product recalls.

Erin M. Bosman

Erin Bosman is chair of MoFo’s Class Actions and Mass Torts Practice Group and is a founder and co-head of the Artificial Intelligence Group. Clients value her business strategy, seeking her comprehensive counsel throughout the product life cycle, especially in high-stakes litigation and product recalls.

Erin Bosman

Julie Park provides analytic and strategic counsel for issues in product life cycle, product liability and defective products, consumer class actions, and more.

Julie Park

Julie Park | Product Liability Lawyer

health-care-apps_thumbnail.jpg

HIPAA and Health Care Apps: Is Your App Covered?

HIPAA and Health Care Apps: Is Your App Covered?

health-care-apps_image.jpg

Health care apps are one of the most important and growing segments in the ecosystem known as the Internet of Things (IoT). After the recent amendments to the H

The Internet of Things (IoT) is booming. Smart cars, wearable health trackers, connected medical devices, drones—entrepreneurs and evolving industry are connecting to the world in ways only science fiction writers imagined. In 2008, the number of connected devices surpassed the number of people on earth. By 2020, conservative estimates predict the IoT market will grow to $7.1 trillion (up from $1.9 trillion in 2013). Its massive scale and expected future growth belies the simple truth that IoT is still in its infancy. In fact, you were probably born before IoT was; the market didn’t even have a name until 1999.As with any profitable and developing market, legal questions abound. IoT is no different, especially for designers and manufacturers of novel devices. What happens if your product injures a customer? What kind of data should your product collect? Do you have a duty to review and understand all the information your product provides? What happens when your connected device gets hacked? How much control should customers have over connected devices? Is a recall necessary when a product’s connection to the Internet fails but the product still works? These questions all share a common thread: there is not yet a developed body of case law with the answers.Because of companies’ abilities to capture, analyze, and capitalize on information gathered from connected devices, one of the most important questions for IoT companies concerns data ownership and governance. Who “owns” all of the data that’s being collected by these billions of devices? Again, the courts have not weighed in on this yet. But we have some ideas that may help companies stay out of trouble in courtrooms.Figure It Out Early. Where ownership of data hasn’t been properly appropriated, we expect significant disputes between all interested parties. This means companies may be unwittingly signing up for prolonged litigation down the road when they haven’t made clear (1) what data it plans to collect; (2) what it plans to do with that data; and (3) how much say the consumer has in limiting the amount or kind of data collected. Much of what a company can, or should, do with information collected depends on (1) the type and source of the data; (2) the specific ways in which the data will be used; (3) the scope of disclosure or consent given by the data subject; (4) contractual restrictions on data usage; and (5) regulatory authority over the use of data. These complicated and often intertwined factors require serious analysis and foresight when bringing novel products to market.Take for example, a “smart” thermostat. This cool device provides the manufacturer with advanced metrics about consumer usage and preferences. In turn, the company can use this information to implement firmware updates designed to reduce overall energy use or to provide personalized settings for individual users. The company could also analyze aggregate data and use patterns from all of its customers to tailor its marketing and design for future models. The company may further capitalize on this data by selling it to third parties for research or analysis purposes. But what if a customer objects (or sues!) saying it didn’t agree to the company using or selling data collected from his or her home? Or more concerning, what if a third party breaks into the company’s database and can ascertain when a customer has turned off his or her smart thermostat and is, therefore, not home? When the hacker then robs the customer’s house and the customer sues the manufacturer for failing to keep his or her information safe, who’s to blame? Although they may not provide an answer to every disagreement down the road, clearly delineated user agreements and disclaimers can go a long way in providing customers’ expectations of what their data will or will not be used for.With great data comes great possibilities. We are here to remind you that these possibilities can also lead to great risks. Check back for more tips and insights on IoT!

internet-of-things_thumbnail.jpg

Internet of Things: Whose Data Is It Anyway?

Digital Single Market Update: Technology Standardization in the EU

internet-of-things_image.jpg

The Internet of Things (IoT) is booming. Smart cars, wearable health trackers, connected medical devices, drones—entrepreneurs and evolving industry are connect

Internet of Things: Whose Data Is It Anyway?

The FDA’s recently issued draft guidance on “<a href="http://www.fda.gov/downloads/medicaldevices/deviceregulationandguidance/guidancedocuments/ucm482022.pdf" target="_blank">Postmarket Management of Cybersecurity in Medical Devices</a>” seeks to address some of the increasing concerns that medical device providers, regulators, and consumers have about postmarket cybersecurity standards related to medical devices. Because the consequences of cybersecurity breaches related to medical devices can be serious, manufacturers, health care facilities, and providers should take precautions to ensure that cybersecurity policies and protocols are thorough and up-to-date. It should be noted that this draft guidance is still in draft form and not to be implemented yet.Imagine this scenario: A rogue agent gains access to the serial number on the Vice President’s pacemaker. The agent sends the number to an associate who remotely hacks his way through the device’s security framework and accelerates the Vice President’s heart rate, inducing a heart attack. Sound familiar? Fortunately, this was not a news report; rather, it was a plot line during the second season of Showtime’s television series Homeland. But like many science fiction predictions, this one has already found roots in reality. With the rapidly expanding Internet of Things, and with millions of medical devices now connected to the Internet, hackers have more devices to target every day. Many of these devices, like the pacemaker in Homeland, are essential to a customer’s health, and as a result security breaches should not be taken lightly.BackgroundIn February 2013, President Obama issued <a href="https://www.whitehouse.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity" target="_blank">Executive Order 13636</a>, which stated that cyber threats to national security are among the most serious our nation faces. Additionally, <a href="https://www.whitehouse.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil" target="_blank">Presidential Policy Directive – 21</a> tasks Federal agencies to strengthen the security and resilience of critical infrastructure against physical and cyber threats. The FDA’s draft guidance borrows principles from these directives and represents the FDA’s current efforts to help strengthen cybersecurity in the rapidly-growing medical device market. Moreover, the FDA encourages manufacturers to apply the voluntary National Institute of Standards and Technology (“NIST”) framework in the development and implementation of their cybersecurity controls. Although the NIST framework only applies to critical infrastructure, the FDA encourages applying its principles broader than critical infrastructure and offers guideposts for companies to improve their cybersecurity posture.Although the FDA’s guidance does not establish legally enforceable responsibilities, it does paint a picture of the FDA’s “current thinking” on this topic, though it should be noted that the draft guidance does not establish any rights for any person, and it is not binding on the public or the FDA, and medical device manufacturers retain the ability to use alternative approaches.Focusing primarily on patient safety, the FDA recommends that medical device manufacturers monitor, identify, and respond to cybersecurity vulnerabilities and exploits during the postmarket management of their devices. The draft document also provides some guidance concerning reporting duties related to cybersecurity breaches.General Principles Concerning Postmarket RegulationThe FDA states that its position is that medical device cybersecurity is a shared responsibility that implicates not just the manufacturer of medical devices, but also health care facilities, patients, and providers, though manufacturers are likely to be on the front line of any litigation.The FDA stated its view that due to the continuing evolution of cybersecurity risks associated with medical devices, it is not possible to eliminate risks through premarket controls alone. Accordingly, manufacturers should[1] increase their postmarket cybersecurity risk management measures. The draft guidance suggests that medical device manufacturers focus on certain aspects, including:<ol><li>Identify problem areas in cybersecurity framework. This can be achieved through analysis of complaints, returned products, service records, and other sources of data that may help identify existing and potential cybersecurity risks. Many medical devices now contain or share internal records, statistics, and incident reports related to their performance. These metrics can be crucial for manufacturers to identify potential weaknesses in their cybersecurity armor before they are exploited.</li><li>Characterize and assess the identified vulnerabilities with regards to exploitability and potential severity of impact to health. This includes establishing and communicating the process for receiving and managing vulnerability reports. The FDA guidance provides additional detail and recommends using a cybersecurity vulnerability assessment tool or similar scoring system in this process.</li><li>Clearly define “essential clinical performance” of the medical device at issue in order to develop safeguards that protect, respond, and recover from the cybersecurity risk. Essential clinical performance is defined as “performance that is necessary to achieve freedom from unacceptable clinical risk.” In turn, an unacceptable clinical risk is one with high exploitability potential that poses a severe impact to health. The FDA admits that risk assessment may be difficult (i.e. manufacturers may struggle to categorize a risk as acceptable or unacceptable). Even so, the FDA recommends that manufacturers “make a binary determination that a vulnerability is either controlled or uncontrolled using an established process that is tailored to the product, its essential clinical performance, and the situation.”</li><li>Adopt a coordinated vulnerability disclosure policy and practice. Clearly defining user expectations and allocating risks appropriately can save manufacturers time and money in the long run.</li><li>Deploying mitigations that address cybersecurity risk early and prior to exploitation. If possible, risks should be addressed before they are exploited. Not only will early action protect customers, it may also limit potential damage claims down the road. The FDA notes that “acceptable mitigations will vary according to the device’s essential clinical performance”—i.e., manufacturers should apply a sliding scale analysis. For example, the FDA notes that more significant mitigation may be necessary for a vulnerability affecting an insulin pump than one affecting a thermometer.</li></ol>The FDA recognizes that even in the most sophisticated cybersecurity programs, vulnerabilities may arise and complete security is impossible. The FDA’s guidance focuses only on those vulnerabilities that may affect safety. Manufacturers should be cognizant that other issues beyond the scope of the draft guidance could become the focus of other regulating bodies and/or plaintiffs’ attorneys.ReportingThe FDA document also provides some guidance to manufacturers with regard to reporting cybersecurity vulnerabilities and breaches to the FDA. Generally, the FDA does not plan to require premarket review or approval of “cybersecurity routine updates and patches” to medical device software.Additionally, the FDA does not plan on requiring reporting when changes to a device are made to address vulnerabilities associated with controlled risks. Controlled risks are those that present “sufficiently low residual risk that the device’s essential clinical performance could be compromised by the vulnerability.” Reporting is also not necessary when these changes are implemented “solely to strengthen cybersecurity.” However, the FDA suggests that companies report newly acquired information about cybersecurity vulnerabilities and device changes made as part of a cybersecurity routine update or patch in an annual report when they concern a premarket approval (or Class III) medical device (one that supports or sustains human life).The draft guidance provides a relevant example where manufacturers may not have to report an action to mitigate a controlled risk. In this example, a manufacturer becomes aware of an “open communication port” on its device. However, a design feature prevents unauthorized remote firmware from being downloaded onto the device. This requirement for physical access to the device substantially mitigates the threat; therefore, the risk is considered by the FDA to be controlled and acceptable. The manufacturer then enhances the device’s security by closing the open communication port and notifying users. These actions would be considered a cybersecurity routine update or patch and may not require reporting under federal standards. However, if this were a Class III device, the manufacturer would need to report the changes to the FDA in its annual report.On the other hand, when manufacturers implement risk control measures to account for uncontrolled risks to essential clinical performance, the FDA’s view is different, and reporting might be necessary. However, the FDA does not intend to enforce these reporting requirements when:  (1) there are no known serious adverse events or deaths associated with the vulnerability; (2) within 30 days, the manufacturer identifies and implements device changes and/or compensating controls to bring the residual risk to an acceptable level and notifies users; and (3) the manufacturer is a participating member of an Information Sharing Analysis Organization (“ISAO”)[2], such as the National Health Information Sharing & Analysis Center.The FDA’s drafters may have been Homeland fans as the guidance contains a familiar example where reporting may be necessary:  a manufacturer becomes aware of a vulnerability in a Class III medical device (i.e. a pacemaker) that allows it to be reprogrammed by an unauthorized user. The manufacturer performs a risk assessment and concludes that the vulnerability is moderately exploitable and the risk to the device’s essential clinical performance is uncontrolled. The manufacturer notifies the relevant stakeholders and distributes an emergency patch to mitigate the risk. The manufacturer is not a member of an ISAO. Even if the manufacturer is unaware of any incidents, because this vulnerability could result in severe injury or death, reporting may be necessary.ConclusionEven in light of the FDA’s guidance, manufacturers will likely struggle to categorize risks associated with cybersecurity vulnerabilities. Consequently, determining reporting requirements (contingent on whether a risk is uncontrolled or controlled) may also present challenges unique to each medical device at issue. Manufacturers will be well served by factoring in the FDA guidance into their existing cybersecurity plans. [1] The use of the word should in Agency guidance means that something is suggested or recommended, but not required.[2] An “ISAO” is a group created to gather, analyze, and disseminate critical infrastructure information. See <a href="https://www.whitehouse.gov/the-press-office/2015/02/13/executive-order-promoting-private-sector-cybersecurity-information-shari" target="_blank">Exec. Order No. 13691 (Feb. 13, 2015)</a>.

An orthopedic implant company

A children&rsquo;s monthly subscription service product

A fertility company

A major technology company

A smart fitness equipment company

FDA Embraces Internet of Things: New Draft Guidance on Postmarket Cybersecurity for Medical Devices

The FDA’s recently issued draft guidance on “Postmarket Management of Cybersecurity in Medical Devices” seeks to address some of the increasing concerns that me

FDA Embraces Internet of Things: New Draft Guidance on Postmarket Cybersecurity for Medical Devices