In a ruling published May, 4, the Federal District Court of Idaho granted defendant data broker Kochava’s motion to dismiss a complaint filed by the Federal Trade Commission (“FTC”).  In its complaint, the FTC alleged that Kochava’s sale of precise consumer geolocation data constituted an unfair act or practice in violation of Section 5 of the FTC Act. Despite dismissing the complaint, the Court was not convinced that the deficiencies could not be cured. Therefore, the Court granted the FTC 30 days to amend.

In its ruling, the Court rejected a number of the defendant’s arguments. It found that the FTC had reason to believe that Kochava is, or is about to violate the FTC Act and was not “only challenging past practices.” Next, it found that the FTC need not allege a predicate violation of law or policy to state a claim under Section 5(a) as claimed by the defendant.  Finally, it found that the FTC was not obligated to allege that the defendant’s practices were immoral, unethical, oppressive, or unscrupulous.

Despite these findings, the Court held that the FTC failed to allege a sufficient likelihood of substantial consumer injury.  On this point, the FTC put forth two theories of consumer injury.  First, it argued that “a company could substantially injure consumers by selling their sensitive location information and thereby subjecting them to a significant risk of suffering concrete harms at the hands of third parties.” While the Court found this plausible, it found that the “FTC has not alleged that consumers are suffering or are likely to suffer such secondary harms.” The mere possibility of secondary harms were insufficient to establish standing. Second, the FTC alleged that the non-obvious tracking itself constituted a “substantial injury” under the Act. Although the Court recognized that an invasion of privacy alone can constitute such an injury, it found that the present facts did not support that conclusion in this case.

In a separate ruling on the same matter, the Court rejected defendant’s attempt to dismiss the case under the Declaratory Judgement Act, describing it as “awkwardly” raising issues without identifying any relevant cause of action or adequate remedy at law.

The opinions demonstrate the reality that the laws surrounding data brokers and the collection and sale of tracking information are still very much in development.  Any company that is considering sharing personal data—whether sensitive or not—should therefore ensure that it complies with relevant any disclosure and choice obligations, or risk being in the crosshairs of the next regulatory enforcement action.

[View source.]