Privacy & Data Security

We have litigated and advised clients on a range of emerging privacy and data security issues. Our representations include:

• The Kobe Bryant Estate in winning a liability finding and $15 million in damages in Vanessa Bryant’s invasion of privacy and federal civil rights suit against the Los Angeles County Sheriff’s Department for its members’ illegal taking and sharing of photos from the helicopter crash that killed Kobe Bryant, his daughter Gianna, and seven others.
• Netflix in obtaining a defense verdict against one plaintiff and minimal damages awarded to another in an invasion of privacy case arising from the RealHouse documentary, “Our Father.”
• A toy manufacturer in obtaining dismissal from a class action alleging that it and other YouTube channel operators collected personal information from users under the age of 13 to target the minors for advertising based on their profiles. The court ruled that the channel operators did not themselves collect the data and therefore could not be held liable.
• A social media platform in an appellate victory affirming a $20 million settlement in a privacy class action alleging it included usernames and profile photos in ads without the users’ permission. The U.S. Ninth Circuit Court of Appeals upheld the settlement, which included nominal user payments and mechanisms for users to prevent their images from being used in ads.
• ESPN in obtaining dismissal and affirmance on appeal of a high-stakes class action alleging that it violated the Video Privacy Protection Act (VPPA) by disclosing Roku device IDs to a third-party data analytics company. We successfully argued that anonymous identifiers do not fall within the VPPA’s definition of personally identifiable information.
• The Walt Disney Company in obtaining an injunctive-relief only settlement of a nationwide class action alleging that the online gaming apps of Disney and other developer defendants improperly collected personal data from the devices of minors for marketing purposes. There was no monetary payment to the class.
• Snap in obtaining the plaintiffs’ voluntary dismissal of a class action brought under the Illinois Biometric Information Privacy Act.
• Block in a class action alleging it sent an automatic receipt that divulged confidential medical information to third parties in violation of various state and federal privacy laws, including HIPAA. We reached a successful resolution with the individual plaintiff.
• The University of California in multiple class and individual actions involving unauthorized access to computer networks that contained patients’ confidential medical information or other alleged unauthorized releases of such information. We obtained the first appellate ruling that a claim under California’s Confidentiality of Medical Information Act requires proof that the plaintiff’s confidential information was viewed by an unauthorized person.
• An online payment technology company in a privacy class action alleging that it secretly tracks and collects the personal data of users and merchants and creates user “risk profiles.” We secured dismissal of most claims with prejudice, including all claims seeking statutory damages. The case subsequently resolved with the individual plaintiff, with no payment to any class.
• Transgender, non-binary and intersex prisoners and former prisoners of the Washington Department of Corrections, in obtaining a consent decree that bars the Department from disclosing their medical information, sexual history and history of sexual victimization in response to Public Records Act requests. The litigation, filed with Disability Rights Washington and the ACLU of Washington, led to a new law and a $2.4 million settlement in a related matter regarding access to care and cross-gender searches.
• Lyft in dismissing a proposed privacy class action, compelling arbitration and obtaining a judgment against the plaintiff, who had alleged violations of the federal Fair Credit Reporting Act.
• Advising numerous clients — including an online retailer, an international media company and a major developer — on actions needed to comply with California’s CCPA, other states’ privacy laws and/or laws regulating AI systems.