CF on Cyber: An Update on the Florida Security of Communications Act (FSCA)

In a case of new wine in old bottles, these recent cases are using this long-established statute to claim that the defendants in these lawsuits use tracking and session replay software to intercept their consumer's interactions with their websites. These complaints allege that the technology used by the defendants in these cases track things like mouse clicks and page scrolling but do not disclose this to the user. The plaintiffs claim that this conduct violates Florida's Security of Communications Act.

Carlton Fields has put together a seasoned litigation team that can assist with these cases. Our team is led by Miami shareholder Aaron Weiss, who is a national recognized class action litigator, with a particular emphasis on telecommunications-related class actions, and Tampa shareholder Joe Swanson, a former federal prosecutor who is a leading authority on data privacy issues.

In this podcast, Aaron and Joe discuss some of the key questions involved in these cases, including:

• Is removal to federal court advisable?
• Can defendants take advantage of the recognized "business extension exception" and good faith conduct defenses under Florida's Security of Communications Act - and do those defenses play better in federal court?
• Is pursuing arbitration on a non-class basis a possibility - particularly pursuant to any contract the named plaintiff may have signed with the defendant for any type of service - a viable defense strategy?
• And, even if the named plaintiff is not subject to arbitration, can defendants argue that class certification is inappropriate in cases in which some, but not all, members of the class are subject to arbitration?
• Do defendants have sufficient disclosures/privacy policies in the terms of service displayed on their websites and mobile applications?
• Will the courts enforce such policies under the concept of "inquiry notice," or will the courts take a strict "anti-browsewrap" stance?
• Can a class action be certified if individualized inquiries are required to determine who received the call? Under this framework, at least one Florida judge has denied class certification in a class action under Florida's Security of Communications Act. Stalley v. ADS Alliance Data Sys., 296 F.R.D. 670 (M.D. Fla. 2013). Will the Stalley decision provide the framework to defeat certification in these cases?
• Likewise, in light of emerging case law from the Eleventh Circuit suggesting that whether a person has a reasonable expectation of privacy against being recorded is potentially a question based on specific circumstances, will this concept also be a viable class defense?

Transcript:

Joe Swanson: Hello, this is Joe Swanson with Carlton Fields and I'm joined today by my law partner Aaron Weiss with Carlton Fields. I'm in the Tampa office, Aaron is in Miami. I am the chair of the firm's cyber security and privacy practice group, and I'm very excited to be joined by Aaron today. Aaron is, as I mentioned, a shareholder in Miami, a very experienced litigator with a deep knowledge on class actions and, in particular, consumer protection statutes, both federal and state. So, given the nature of our discussion here today, really pleased to have Aaron with us to talk about an emerging trend or an emerging claim in Florida and that involves the Florida Security of Communications Act. But before getting into the substance, I want to welcome Aaron and thank him for his time. Aaron, good to have you.

Aaron Weiss: Thanks, Joe. Appreciate the opportunity to talk with you about these new claims on the Florida Security of Communications Act related to recording people's web surfing. Also, we'll have an opportunity to see how that fits into the wider picture of consumer data protection cases, in particular how a lot of these claims are being prosecuted as class actions and then how some of the claims, depending on the state, are prosecuted as governmental investigations. So, that's an area - this topic is certainly not going to go away, and it blends expertise in data protection and in class actions and something that we both do and that we've worked together on. And this may be an area, as things progress, that we'll have a chance to work together more on in the future. So, we wanted to give everybody an overview of how some of these claims are developing.

But the first thing we wanted to talk about very specifically, this new set of claims under the Florida Security of Communications Act, it's really the Florida Wiretapping Act that the federal statute is the Federal Wiretapping Act, and Florida has its own equivalent. This law has been on the books for a very long time. There are different states that people talk about one party consent states, two party consent states, can you record a message or phone call in some states. Florida is what you call a two party consent state, which means you need, broadly speaking, you need the consent of both parties on the line. Some states that are one party consent states, you only need the consent of one person on the line, which means you can make a call and record it and you've given consent and that's the one party consent. In the traditional recording phone calls, there have been some cases over the years, not a ton, but there has been litigation over the years in Florida as to how you deal with these privacy claims in recording private phone calls.

But this new set of cases has to deal with - it's a little bit of a wrinkle - but it has to deal with recording website activity. And I really thought when these cases came in as class actions, and I've been studying them as somebody who does a lot of class actions and consumer class actions. But when I hear of wiretapping, I really think of The Wire, the television program and people installing wiretaps. I've had one criminal case in my almost 20 years of practice, but I know Joe Swanson was the lead cyber prosecutor in Tampa for several years. And, unlike me, Joe has actually seen a federal wiretap. So I thought no better person to really delve into what real wiretapping is than somebody who can really talk the talk.

Joe Swanson: Happy to do it. I think it would be helpful, Aaron, for our listeners, given that helpful background you gave on this law, to sort of explain what the paradigmatic claim is under the law with regard to phone recordings, phone calls and maybe what is kind of your garden variety case. And I know you've handled dozens of these. And then we'll pivot to a discussion of how they're being recast or alleged these days vis-a-vis a company's website.

Aaron Weiss: Sure. The garden variety claim in the Florida Security of Communications Act claims is, it's pretty much as you would think it is. If you're somebody who says, "This is the wiretapping statute. What is prohibited?" And the argument is what's prohibited is recording somebody's phone call without their consent. Now it comes up a lot and we do a lot of work, for instances, advising companies on what you have to say when you're making outgoing phone calls or when you're getting incoming phone calls. Everybody's heard them whenever you call a prominent company or even a not prominent company. "This call may be recorded for training purposes." That's the disclosure that is the consent. And you say if you don't want to stay on the call or you don't want to be recorded, you can hang up. I'm broadly speaking, and if you're listening to this podcast and you say, "Oh, we better put that in," give us a call and we'll help you out on making sure you have compliant language. But that's sort of the core of it. Companies sometimes over the years have gotten sued if they don't have such a recording, or sometimes they could have some type of glitch in place where they're recording phone calls that come in. I always think of one situation where you have some of these companies now have the call back information where you call whatever company. You can be on hold for 20 minutes, or by the way, if you don't want to be on hold just put your number and we'll give you a call back. So sometimes you have the scenario where you get the call back and the system is in provision to play the disclosure message on the call back. So, over the years people have been sued, both individually and in class actions, for recording the calls without permission.

Now, let me just briefly talk about the non-class action cases. Sometimes you'll see those, not that infrequent fact pattern, disputes with people sometimes really. You could think family law disputes, divorce proceedings, or other just situations where people don't like each other and used to be friends or used to be not adverse to each other and now became adverse to each other. So that you see sometimes. And those are pretty straight forward. My ex-wife is recording my calls. I didn't give her permission. Those are somewhat up or down. Was there permission? Was there consent? And so forth.

The bigger liability cases and the ones that really get corporations involved, the plaintiff playbook is to file such a claim as a class action. And these claims can be pretty conducive to class actions because the damages could be pretty big. There is statutory damages, up to $1,000 per violation. So, they get filed as class actions. There hasn't been a ton of success historically that, what I'll call the plaintiff's bar prosecuting cases has had is because #1 consent can be awfully individualized and #2 it can be pretty hard to determine who was on the other line. So, you call it's often hard to determine who the subscriber is who picked the call. So that's where historically a lot of those cases have fallen apart.

I've been doing a lot of work on the Telephone Consumer Protection Act, the TCPA. This is what people call colloquially the Robo Call Statute or something like that. A lot of the concepts that are in the TCPA will really, to the extent these new cases have legs, I really do think a lot of the TCPA concepts will follow through. And the other thing I'll note, this group of cases that have been filed in Florida - and he'll ask me about that next - but as I mentioned, the TCPA, the plaintiffs' lawyers who are prosecuting this new set of cases really made their bones on the TCPA. So, it's two or three law firms that have filed all of the suits. And they are to the core - and they're very good. They're TCPA lawyers, so they know all the concepts and I really do think that's where a lot of the actions will be on these cases as they play out.

Joe Swanson: And, Aaron, before getting to this new wave of cases, I just wanted to follow up on one item you mentioned and that was statutory penalties per violation. What is a violation? Is it conceivably every time a phone call is made times thousands of phone calls, thousands of members in a class? Is that why these cases have garnered the attention of the plaintiff's bar and been as prevalent as they have been in the past?

Aaron Weiss: Yeah, absolutely. So, just to talk a little bit about class actions in general, the difference between class actions where you have non-statutory damages like sort of actual damages and statutory damages. So, you could have a class action. Let me just give my favorite example that I always use. You could say, "Well, I went to the store and the potato chips, they said they were 6 oz. and I went and weighed them and it was a humongous bag and it turned out that it was not a full 6 oz. of potato chips, that this company systematically under-fills its potato chips. So, I want to get my damages and represent a class of people who didn't get as many potato chips as they were promised for." And assume there's not a statutory claim at issue. You're just saying breach of contract. The promise was you were promised 6 oz. of potato chips and the bags are under-filled. So your damages in that example - and I'm going to fast forward; there could be all kinds of other problems with that case - but your damages presumably are the difference in the amount of potato chips that you bargained for and what you actually got. You just have to figure that out. How much are the potato chips? How much are they at one grocery store versus another? And it's sort of what you're going for the actual damages, the price of the potato chips that you were deprived.

Well, the difference is, in a statutory damages class action, you don't have to do that. So for statutes like I mentioned the TCPA, that's very popular. You get $500 minimum damages per violation. You have the FTCPA, for instance. You get $1,000 for that. That one's a little different because you only get $1,000 in an aggregate facto, which is the statute with printing too many credit cards on a receipt. That's $100-$1,000 per willful violation.

So, if you're a plaintiff's lawyer and you want to bring a class action and you're looking at what you have to prove, what are the hard things, what are the easy things, a statutory damages case has some attraction because you're already moving past how to quantify the individual damages. You don't have to deal with that because you have the statutory damages. So that's why in a case like this, statutory damages can be quite attractive.

Joe Swanson: Got it. And that may explain the phenomenon that has taken hold in the last few months, and that is filing punitive class actions under the Florida Security of Communications Act but with kind of a different theory. And that theory is not about phone calls but about websites. And, in fact, it's become apparently so attractive, Aaron, that I noticed yesterday the same individual filed multiple class actions under this statute in it may have been Miami-Dade or Broward County just yesterday. So, we've certainly seen an uptick in these. What is the theory behind these claims?

Aaron Weiss: So at a core - and I don't want to get too far into the weeds on the details - but the basic claim is that if you are going on these websites that some of these websites of very prominent companies if you looked at some of these recent cases and matched it up against the Fortune 500 for instance, you'll see quite a few matches. But basically the common website software that brand name companies are using are tracking your keystrokes and your browsing history. And the argument is that conduct falls under the ambit of the Florida Security of Communications Act, aka the Florida Wiretapping Act. It is an untested theory. These are new cases, but there are a lot of cases that have been filed within the year since this year started. Really I guess we're recording this in the middle of April 2021, so within the last few months really. And, again, prominent companies and they're all filed as class actions and they're all filed by the same set of law firms who have been TCPA lawyers. And as Joe mentioned, a lot of the cases are filed by literally the same named plaintiff. So we will see what happens with these cases in 2021 really. Will they have legs or will they not? So that's what we're here to look forward or one way or another see what happens.

Joe Swanson: And recognizing that we are relatively early in 2021 and most of these cases have only been on file for a month or two or in some cases only a day. But nonetheless kind of drawing on your wealth of experience in this area, Aaron, what are some strategies that you expect to see the defense bar deploying against these claims either because they've worked in defending against TCPA or more garden variety Florida Security Communications Act claims or just given your study of these claims what would be in your toolkit, so to speak?

Aaron Weiss: Sure. So the first thing I would always mention is where is the case and can you, if it's not in a forum that you like, can you get it to a different forum? So that really means two things: the first thing that means is, if the case is filed in state court and almost all these cases, in fact I think all of them have started in state course, can the case be removed to federal court? Under the Class Action Fairness Act what likely will be the governing thing is if the company is sued is a non-Florida based company or not incorporated in Florida, there's a decent chance that such claims could be moved to federal court. If they are a Florida company, it can get a little more difficult to remove the claim to federal court. Not impossible, and there's some very recent within the last month 11^th Circuit case law on that, but without getting too far in the weeds and if you do have any very specific questions if you're a Florida company that has one of these suits, there's a sort of a back door strategy to try to get such a case removed to federal court. But, that's the first thing. And I've seen most of these cases that look to me as possibly removable have in fact been removed to the federal courts. Some either strategically the defendants decided to stay in state court or determined that they were not removable.

Hard to say, but there's somewhat of a perception and historically there's been a perception that federal court is a more favorable forum for such types of cases. I don't know if that historic perception at least in Florida will always be the case. The 11^th Circuit recently came out with a decision on what's call class ascertainability. In other words, do you have to have a way to identify everybody in the class that the 11^th Circuit had historically had in an unpublished decision a pretty tough standard. In a published decision issues earlier this year, the 11^th Circuit did away with that. On the other hand, in Florida state court you have an automatic appeal of a class certification decision to the appeals court, whereas in the federal system the right to appeal is discretionary.

And then there's a perception that the recent spate of judges that have been appointed in Florida - at least in the appellate courts where they are all appointed; in the state courts in Florida, trial courts the judges are a combination of appointed and elected, but the appellate judges are all appointed - there has been a push, at least with the last two governors, Governor Scott and Governor DeSantis, to perhaps look for judges on the appellate court who ascribe to a certain perhaps more corporation-friendly philosophy. Now, that's really just somewhat speculation. I don't want to suggest that you have any guarantee depending on which appellate court you're in, but that is something to think about. There's a perception that the judiciary, at least on the appellate level in Florida, has markedly changed in the last few years. So, just something to think about.

And then the other forum thing really is what I call the drop the mic defense in any class action, is arbitration. If you have an arbitration clause in a consumer agreement, I don't want to say it ends the case and there's some difficult things that could play out, but if you're dealing with a situation where you are a potential plaintiff and you've agreed to arbitration with the company based on prevailing Supreme Court and 11^th Circuit and Florida appellate case law, there's a very good chance that if you press the arbitration argument, the case will get sent to arbitration. And both the Florida Supreme Court and the US Supreme Court have found that a class waiver in an arbitration clause is enforceable. So, in other words you go to individual arbitration. So, if you have an arbitration clause that's far and away the most significant potential case-ender. And a lot of times it's a question of if you're passively browsing a website, have you agreed to arbitration. And that may be a question of have you in fact entered an arbitration? So, that will be an interesting area to test on these cases. Again, it's not like the person, to go back to my potato chips, when you buy a bag of potato chips from the grocery store, you don't have an arbitration clause on the bag of potato chips. On the other hand, if you sign up for cable, you've signed a whole bunch of disclosures, presumably, and one of those is you agree to arbitration. These cases sort of might be in the middle where if you're passively going through a website, did you click on a box? Was the notice of arbitration buried on the bottom? And that's where a lot of the devil in the details on this case law will shake out. So that may be very circumstance specific.

Joe Swanson: And speaking of that, Aaron, when it comes to arbitration, whether in these types of cases or any of the consumer cases that you defend, how is that defense raised? Is that something you raise at the outset and you try to get out early? Is it something that requires a development of a factual record and so the company's going to be stuck for a while dealing with this? How does that work generally and in particular in these website cases? How do you see that being raised and litigated?

Aaron Weiss: Sure. So let's sort of talk about this scenario where a company is sued and the company believes they have an arbitration clause that would be applicable as to any claim filed against it by that particular named plaintiff, leaving off to the side other plaintiffs. Whether it's in federal court or state court, the company would then move to compel arbitration. Sometimes you call it a motion to dismiss based on arbitration, depending on whether you're in state court or federal court, but that's more semantics. What happens there is the plaintiff can say, "Well, I guess you got me. I've agreed to arbitration." Spoiler alert: most plaintiffs won't do that. They want to fight it and they'll say, "Well, I never saw the arbitration clause or the like." The question, as I said, really becomes of was there a contract formed? And under Florida law, and really it's common to other states as well, in these cases, if you're not dealing with the situation, as I mentioned, where you have an actual written contract where you bought your car or signed up for your cable and you signed something, where the real tension is if it's sort of something passive like going through a website or was there a click box, either side may ask for sort of limited discovery on taking a deposition or two of determining whether or not there was a binding contract form. There's theoretically the possibility of even having abbreviated trial on the issue of contract formation.

Once the contract is formed - and I'm going to sort of fast forward a bit - most arbitration clauses these days have what is called a delegation clause, either directly or indirectly. That basically says questions over the scope of the arbitration will go to the arbitrator. So it means is this claim at issue something that has to go to arbitration? If you have a delegation clause, that question goes to the arbitrator. But the question of was the contract formed is something that goes by the court. And if you're dealing with these browse-wraps - when I say browse-wraps it's like sort of a small thing at the bottom of a website that you don't necessarily have to click on. That's sort of what's called a browse-wrap. So those questions, the court answers those.

Joe Swanson: And you bring up some interesting concepts about what does that website say, not just about arbitration but I wonder too about consent. I mean, you talk about the kind of garden variety phone call case. The big issue is going to be consent and was there a disclosure or a disclaimer at the beginning of the phone call. Well, here the theory is I was on Company X's website. Company X was monitoring what I did on the website. That violates this Security of Communications Act. What would be the analogous arguments from the defense side about consent? Would it be disclosures in a privacy policy that say, "Hey, we put cookies. We use certain tracking mechanisms for visitors to our website"? Do you expect those to become prominent here?

Aaron Weiss: Yeah, Joe. That's exactly it. So, one of the defenses that companies in this situation have is they will say, "Well, our privacy policy said that we, as you described it, cookies, or basically say that the type of conduct that is at issue in this case, there is a disclosure that has said we may do this." I'm sort of paraphrasing it. And, Joe, I know you write a lot of, and your group writes a lot of consumer privacy policies for all kinds of companies. And one of the things that you and I and others in the group have talked about a lot is we could write the best privacy policy ever and you could say we've tested this, we've looked at all the court decisions, this is great. If you have this privacy policy, you will immunize yourself to almost all the claims that could come up. The problem is, the wrinkle is you have to make sure that the privacy policy was properly disclosed to a plaintiff. So it's sort of the same type of argument that you would have as to was an arbitration agreement properly disclosed? It's the same question of was a privacy policy disclosed? In fact, a lot of the decisions - there haven't been that many but the decisions that have come out in general on analyzing whether privacy policies have been adequately disclosed are in fact decisions that looked at arbitration terms because they're typically the same type of thing. That's always the tension, that if you are in marketing to a consumer through websites or somewhat passive things, it's sometimes tough to figure out the way to make sure that the customer has agreed to your fancy terms. So, that's the tension in the case law and that's where a lot of these privacy policies that I've seen are very good. And if they are enforceable, they will be really strong defenses. It's the problem of are they enforceable?

The other tricky part and where the arbitration gets into a little tricky - and I'm meshing in, this gets a bit into the weeds - but there's a bit of a caution for a defendant. So if you have your privacy policy and your arbitration policy, sometimes it's even in the same document. Sometimes they're both radio buttons together at the bottom of the same website. Little caution that if you press arbitration early on in the case and you lose that, the court says, "Well, no. There's no binding arbitration clause. This wasn't delivered to the customer adequately. Just thrown out there." If you're the defendant, have you now really imperiled your chances to enforce your privacy policy, which otherwise is a merits defense? So you have to be really careful there. You want to strategically think if you are a defendant. You don't want to lose one defense and then lose your other defense at the same time.

Joe Swanson: Among the reasons why we wanted to have this conversation was the overlap between these consumer class actions and the privacy work that you and I and others in our group do in terms of drafting and advising on the placement of these privacy policies. One of the issues with some of the privacy statutes that we'll talk about in the second module is a requirement that you give notice at the point of collection of any data of your privacy policies and what categories of information you collect. And there's always this hand wringing among the clients, given how ubiquitous data collection is these days and the different ways in which it occurs. It could be through an app. It could be through a website. If it's through the website, is it on every page? And you start getting into these questions about where do I need to have these privacy policies disclosed so as to be compliant with the privacy statute?

It now sounds to me, based on what you're saying, Aaron, that there's also another reason to be thoughtful about the placement of these privacy policies, and that is because they may ultimately bear on the enforceability and the viability of some of these arguments about consent if that were to be a way you would try to defeat these claims.

Aaron Weiss: Oh, absolutely. And it's going to be in any, it's not just the Florida Security of Communications Act. It's any type of claims under any of these data privacy rules, laws, statutes. If your defense is my privacy policy permitted it, well you better make sure you delivered the privacy policy.

Just a couple, just flavor of some of potential merits defenses that are potentially out there on these types of claims. One is what's called the business extension exception. What this basically says is that the communication must be intercepted by equipment furnished by a provider of wire or electric communication service in the ordinary course of its business. What that basically means - that sounds like a bit of gibberish - but basically the argument is was the recording furnished essentially by the telephone or wire communications, basically the phone company? That's sort of the defense that will play out. It all depends on what this website tracking software. The website tracking software map that well onto the business extension argument. We'll just see how it plays out.

Another defense that has had some success in these Florida Security of Communications is the good faith defense. That basically says, the statute itself says the good faith determination that a Florida or federal law permitted the conduct complained of. So that's, again if the argument is to be made that this was permitted under Florida law or federal law, the conduct is OK. And it's very fact-specific and it's almost maybe a little hard that if the thing is violated, how does a good faith defense get in? There may be an argument that is like a quasi-federal preemption argument that if this conduct was permitted under federal law, that would be a good faith defense. So we'll see.

And then the last thing I just wanted to mention - again, we haven't seen how this plays out yet in the case law because these cases are all new - but class defenses. A lot of it will focus on can you identify the individual class members? As I mentioned, the case law in the 11^th Circuit recently sort of veered way off and it was going one way and it took a hard right turn or hard left turn and went the other way. But there's still an argument that in other parts of the class certification inquiry that you still shouldn't be able to certify a class if you can't identify who the class member is. In the context of a Florida Security of Communications Act based on a website tracking, the question is who was on the particular computer or tablet at the time. So, those are the things that will play out. But the short of it is, these are a new set of cases. Plaintiff's lawyers who file these are very good, very ambitious. I couldn't say it's a test case. One or two cases are a test case. A dozen, a dozen and a half cases are a trend. So we'll see what happens. I think the next year will be notable to watch in how these cases develop. And the other thing is if the plaintiffs have some success with these cases, will it be a roadmap for other data privacy cases?

Joe Swanson: Well Aaron it's been a pleasure chatting with you today about these topics and given the overlap, I'm glad we could connect on this. This program is eligible for CLE credit and I want to read the code for that now it is S as in Sam, R as in Roger, R as in Roger, 5, V as in Victor, F as in Frank, B as in Boy, H as in Hotel. And without further ado, we thank everybody for their time and attention and Aaron, appreciate your time and wisdom and look forward to continuing the conversation.

Aaron Weiss: No, of course! And thanks Joe and if anybody thought this was interesting and they have any questions for us, I'm sure you could find us on the Carlton Fields website rather than give out our contact information. We're both pretty easy to find and we'd be glad to talk about any of these things with you.

Joe Swanson: Thank you.