Welcome back for another week of What's Next, where we report on the intersection of law and technology. Here's what we've got for you today:

>> A privacy expert breaks down how the world might not be the same after Apple and Google's contact tracing proposal, and other employer initiatives.

>> Facebook to delete facial maps for class members in tag suggestions lawsuit.

>> Ross Intelligence responds to Thomson Reuters' allegations of AI-driven copyright infringement.

Let's chat: Email me at [email protected] and follow me on Twitter at @a_lancaster.

SPONSORED BY ALM PARTNERS

Time Management: Vital Principles to Help you Stay on Track Whilst Working from Home

Most people imagine that working from home is a casual affair that should not be treated with seriousness. However, if you are thinking about venturing into any form of home business, you have to acknowledge the fact that it requires as much seriousness as any other business. READ MORE

Heather Federman, vice president of privacy & policy for BigID.

When Will It End? Protecting Privacy in Our New Reality

Back in January, if a tech giant asked consumers if they wanted to share their location data and health status with strangers, or an employer asked workers to take daily temperatures, many folks probably would've told them to shove off. But as the U.S. death toll from the coronavirus pandemic passes 80,000, more Americans might prioritize public health and put aside a distrust of Big Tech and everyday privacy intrusions. Heather Federman, the vice president of privacy and policy for BigID, which uses machine learning to help companies protect their customer and employee data, says it's unclear how long these pandemic-era privacy incursions will remain in place.

"I've stopped using the word going back to normal, because I don't think we're going back to whatever it was before," she said.

Federman, a lawyer by training who began her career at the Future of Privacy Forum as a legal and privacy fellow, and led privacy teams at Macy's and American Express, shared her thoughts on the legal and privacy implications of contract tracing apps and other data-centric initiatives used to flatten the curve.

➤➤ What are your thoughts on Apple and Google's proposal for a contact tracing app? I have mixed feelings about it. On one hand, these companies feel like they have to do something. On the other hand, there's still a lot of questions as to how this will work. One interesting positive is that this is the first time you've had two major competitors coming together to create a system that is interoperable. That's something we're seeing pop up in various data protection laws—the ability to import your data into another system. This happens to be an interesting example of that actually happening. It does seem that they're trying to do their best to make this as privacy preserving as possible. We're using Bluetooth technology, they're trying to collect as limited information as possible. It's decentralized, so rather than it being on a central server, it is on your device. So while there are some governments taking issue with that, that is a step in the right direction.

I think the other question is yes, you're able to consent to this, but how likely is that you're actually going to have enough users adopt this? And from what I'm seeing, you need at least 60% of the population to adopt it.

➤➤ What are you most concerned about with these contact tracing apps from a privacy perspective? I think my biggest concern is I've been doing a lot of comparison to the Patriot Act after September 11. We had something that was a limited provision, because we were all freaked out after, and understandably so. But something that was supposed to be sunsetted back in 2005, it's still up for renewal. That's my concern for something like this. Apple and Google have said they want the data to be destroyed, but at what point is it actually destroyed? Is it once we're all vaccinated?

➤➤ One challenge these contact tracing apps encounter is how to responsibly reuse data from a privacy perspective. What are the major hurdles with this? I think the reuse of data has always been an issue in the privacy world. This pandemic has exacerbated that issue, because it's really front and center when we're dealing with location and health data. And the answer is unfortunately it's not clear, which brings us back to the trust issue. If it's not mandated that we do this, what's going to allow me to trust you that you're not going to use this for a secondary purpose. If you want me to be part of that 60% that's opting in, then I better know that you're using this for a limited purpose and you're only going to be using it for a limited amount of time. And I don't have those assurances yet. And that's the part that scares me, and I think scares a lot of people.

➤➤ Do you anticipate any litigation stemming from these apps? Probably. We're a litigation happy country. Hypothetically, it could come into play if we're dealing with a false positive—because Bluetooth has certain limitations. So, let's say you get a false positive that you were notified you might have COVID-19, and you need to stay at home, but it turns out you didn't have it. You could sue for losing pay for that period, because you had to stay at home. I'm not quite sure how you prevent the liability issue. They're working with public health officials, so they could potentially tell those officials, "It's up to you to be the face of this and if someone is suing you they're not suing Apple or Google as the third-party provider. They're suing you, the public health officials."

➤➤ What are you hearing when it comes to contact tracing in the workplace and other measures that could get employees back to work but potentially infringe privacy?

I'm on group chains with different privacy practitioners, and they're all asking, "How do we do this in a way that we can allow people safely back in the office without totally going overboard." I think that's also very unclear at this moment. Temperature checks seem to be popular right now, but the problem with that is you can be asymptomatic, so I think that's going to be a concern. The concern is how much is too much. The temperature check is one thing. But what happens if they start monitoring your web browsing activity to see if you're googling "Do I have COVID?" I don't know if we're crossing into that territory, but most employers when you get onboarded say that we can monitor any of your work devices. We're already seeing stuff around employee monitoring.

I'm also seeing a daily survey that employees have to complete before they go in. And it's not just about the employee, but the people they have close relationships with. That's not just implicating you, but your family. One way to handle that data is to segregate that information in a separate database, versus your regular HR data, and only touch that data when necessary.

The Final Destination of Facebook's Tag Suggestions

Facebook will pay $20 million in legal fees once U.S. District Judge James Donato of the Northern District of California gives his final approval to a $550 million class action settlement over the social media giant's facial recognition tag suggestions feature. Facebook would also delete class members' face templates to resolve the lawsuit, which was filed back in 2015.

A declaration filed Friday from Jay Edelson of Edelson PC in Chicago asserts that three firms that worked on the case will seek $20.4 million in attorneys fees and $981,000 in expenses. About $8.3 million of those attorneys fees are set to go to Edelson; $5.23 million for Labaton Sucharow in New York; and $6.9 million for Robbins Geller Rudman & Dowd in Boca Raton, Florida.

In addition to the monetary payout, the settlement agreement requires Facebook to set class members facial recognition settings to "off" within 90 days and delete their face maps unless they give consent. If they do consent, "Facebook will disclose how it will use the face templates that may be created for a Class Member, in a disclosure that is separate and apart from any existing 'privacy policy,' 'data policy,' 'statement of rights and responsibilities' page …" according to stipulation of the settlement. The stipulation also spells out that if the final approval of the settlement gets tangled up in fee disputes, Facebook will still move forward with the injunctive relief.

An Alleged AI Data Heist

Last week, Thomson Reuters sued legal research competitor Ross Intelligence for allegedly using artificial intelligence to scrape proprietary data out of its Westlaw database. Thomson Reuters claimed Ross Intelligence worked with LegalEase Solutions to copy Westlaw content en masse in order to "rush" development of a competing web-based legal product.

"It is clear that by copying the copyright-protected Westlaw content—piggybacking off of the creativity, countless hours, and extraordinary expense that have gone into creating Westlaw—Ross drastically sped up its development time and reduced the cost associated with the development of its competing platform," wrote Thomson Reuters' Kirkland & Ellis and Morris, Nichols, Arsht & Tunnell counsel.

A spokesperson for LegalEase said, "The claims made about LegalEase in the current lawsuit are inaccurate and misleading."

Rhys Dipshan, of Law.com's sister brand LegalTech News, reported that Andrew Arruda, co-founder and CEO of ROSS Intelligence, confirmed in a Medium post that Ross worked with LegalEase to obtain case law data to train its artificial intelligence system "to give on-point answers directly from primary law." However, Arruda said his company never asked for proprietary data from Westlaw.

The Tesla automobile factory in Fremont, California, closed since March, filed a lawsuit to reopen. (Photo: Jason Doiy/ALM)

On the Radar

Tesla Turns to Quinn Emanuel Lawyer Who Won Elon Musk's Defamation Trial to Sue California County "Alameda County has not only created a legal quagmire by wrongly declaring that its own orders trump the state level orders, it has threatened jail time and significant fines for businesses and individuals that do not comply, even where they are clearly authorized by the state order to continue critical infrastructure activities," wrote a Quinn Emanuel Urquhart & Sullivan team including New York partner Alex Spiro, Derek Shaffer in Washington, D.C., and Kyle Batter in Redwood Shores, California. Read more from Ross Todd here.

Judge Alsup Has a Word for Apple and Cisco: G-R-E-E-D "Next time, if it's not reasonable from the get-go, it will be denied in its totality," U.S. District Judge William Alsup of the Northern District of California told Desmarais partner Justin Wilcox, representing Cisco, and Hogan Lovells partner Clay James, representing Apple along with Apple Senior Counsel Katherine Kaso-Howard, regarding a request for nearly $10 million in attorneys fees in an "exceptional" patent case. "You in-house lawyer there at Apple, you ought to take good note of this, because I'm blaming you, too, for greed," Alsup said. "G-R-E-E-D." Read more from Scott Graham here.

Raising $3 Million, LexCheck Bets on Startup Survival in Current Economy "In this environment any investor can back out and who can blame them given the circumstances," LexCheck founder and CEO Gurinder "Gary" Sangha. "I think what gives our investors strength even in this environment is … I have a record with running a legal tech company during an economic downturn." Read more from Victoria Hudgins here.

Thanks for reading. We will be back next week with more What's Next. Stay safe and healthy, everyone