TechLaw

Trademarks and Meta Tags: Very Superstitious

No news here, but I find fascinating, in 2009, trademark attorneys' and courts' abiding interest in meta tags. The following passage comes from China International Travel Services Inc. v. China & Asia Travel Services Inc., No. 08-1293 (N.D. Cal., Dec. 18, 2008), a trademark case in which the court enjoined the defendant from:

using, seeking to register, or otherwise appropriating the trademarks, service marks, or trade names CITS, USA CITS, CITS USA, CHINA INTL TRAVEL SERVICES (USA), CHINA INTERNATIONAL TRAVEL SERVICES (USA), or the CITS GLOBE DESIGN (collectively the "CITS USA Name and Marks"), any name or mark containing the CITS USA Name and Marks, or any name or mark that is a colorable imitation or confusingly similar to the CITS USA Name and Marks ("Prohibited Names"), in any manner likely to cause confusion with the CITS USA Name and Marks, including but not limited to use as or as part of an e-mail address, domain name, URL, trademark, corporate name, business name, trade name, metatag, or other identifier ... (emphasis mine).

Why include meta tags here? Maybe it is just a matter of thoroughness. No one knows for certain the extent to which search engine algorithms rely on meta tags. But most experts believe the answer is "not at all," or nearly so. A study published by leading search engine optimization experts revealed a widespread belief that keywords in meta tags have no effect whatsoever on search engine behavior. Are there studies to the contrary? I'm not aware of any. And of course Web users have no idea which meta tags are coded into the site. It is likewise fascinating that, given this same evidence, Web sites continue to put the competition's trademarks in their keyword meta tags. Here again, maybe it is just a matter of thoroughness.

Curious also that the trademark owner's attorney didn't enumerate search engine keywords among the forbidden uses of the mark. Unlike meta tags, search engine keywords have a direct impact on what a Web user sees.

No Justice for Victim of Attempted Reverse Domain Name Hijacking

A UDRP panel's finding that a trademark owner has engaged in reverse domain name hijacking (ICANN-speak for using the UDRP in a bad faith attempt to deprive a registered domain-name holder of a domain name) is pretty much worthless. I think you get a piece of paper, suitable for framing. As it turns out, a claim for attempted reverse domain name hijacking--the unsuccessful attempt to use the UDRP to in a bad faith attempt to acquire a registered domain name--is worth even less. Frayne v. Chicago 2016 Corp., No. 08-5290 (N.D. Ill. Jan. 8, 2009). It's worth nothing. The court dismissed the claim, which arose from the plaintiff's unsubstantiated assertion that, merely by filing a UDRP claim disputing the plaintiff's registration of , the defendants had attempted to reverse-hijack the domain, allegedly in violation of 15 U.S.C. 1114(2)(D).

Many State Data Breach Laws Don't Protect Paper Records

This is likely more in the nature of "news to me" than "news." I learned, or at least I think I learned, that most of the many state data breach notification laws don't reach a common source of privacy violations: personal information snatched by dumpster divers. In Pinero v. Jackson Hewitt Tax Service Inc., decided last week, the court turned back a claim under Louisiana's data security breach notification law, because the mishandled personal information was recorded on paper -- not in electronic form. The records at issue were the plaintiff's tax returns which, along with those belonging to 100 other Jackson Hewitt customers, were found unshredded in a public dumpster.

The Louisiana Database Security Breach Notification Law, La. Rev. Stat. Section 51:3071, authorizes a civil action to recover actual damages resulting from the failure to make a timely notification of a breach that results in the disclosure of personal information.

The statute, at Section 51:3073(2), defines a data breach as "the compromise of the security, confidentiality, or integrity of computerized data." The court said that no breach had occurred here because the plaintiff's personal information was not in computerized form. Paper documents are not protected by the law, it said.

I did a little investigation and, as it turns out, a lot of state laws are written in the same fashion as Louisiana's data breach statute. If other courts interpret "computerized data" the same way as the Louisiana court, then carelessness with paper records containing personal information is not going to get a business in hot water in very many states.

True, some states, such as California and Alaska, protect all records containing personal information regardless of physical form. But most states do not. I learned, before I got weary of clicking and looking, that Arizona, Colorado, Connecticut, Delaware, Florida, Idaho, Illinois, Indiana, Iowa, Maryland, Minnesota, all have data breach notification laws that protect either "computerized data" or "unencrypted computerized data." Florida's statute, Fla. Stats. Section 817.5681(1)(a), is typical:

Any person who conducts business in this state and maintains computerized data in a system that includes personal information shall provide notice of any breach of the security of the system, following a determination of the breach, to any resident of this state whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.

The National Conference of State Legislatures maintains a list of all enacted data breach laws, so jump in if I haven't mentioned your state.

For what it's worth, the first data breach notification law of the 111th Congress, Sen. Diane Feinstein's S. 136, likewise protects only computerized information (Section 13(5) defines personally identifiable information as "any information, or compilation of information, in electronic or digital form serving as a means of identification ...." ) And of course S. 136 preempts states laws. So if S. 136 were to be enacted, would the few states laws that impose security breach notification requirements for mislaid paper records be preempted?

The case is Pinero v. Jackson Hewitt Tax Service Inc., No. 08-3535 (E.D. La., Jan. 7, 2009).