When technology executives imagine the boogeyman, they see a baby-face guy in wire-rim glasses. His name is Jay Edelson.
Edelson, 42, is a class-action lawyer. He is also, if not the most hated person in Silicon Valley, very close to it. His firm, Edelson PC, specialises in suing technology companies, claiming privacy violations. He has gone after pretty much every tech company you have heard of - Amazon, Apple, Google - as well as many that you have not. His cases read like a time capsule of the last decade, charting how computers have been steadfastly logging data about our searches, our friends, our bodies.
Remember when companies started clogging your phone with text messages? Edelson sued dozens of them for that. Have you ever searched for yourself online and found that some of the stuff about you is wrong? This is the basis of a lawsuit against Spokeo, a search engine based in Pasadena, California.
If you have ever wondered how Facebook is able to automatically name your friends in pictures that you have uploaded to the social network, then you may be interested in a lawsuit Edelson filed on Wednesday. That one contends that Facebook has "secretly amassed the world's largest privately held database of consumer biometrics data."
Edelson is full of self-deprecating comments about how he is "not technologically savvy at all" and that his move into privacy law was "a total accident." Nevertheless, his firm, which is based in Chicago, has become one of the most prolific filers of privacy class actions, a growing legal area that tech companies describe with a litany of unprintable terms. Asked to sum up the tech community's feelings about Edelson, Sam Altman, president of
Y Combinator, a technology incubator that invests in very young companies, said the lawyer was regarded as "a leech tarted up as a freedom fighter."
Edelson PC is on the 13th floor of a high-rise building that looks over the Chicago River. The building's lobby is full of people in suits, but the firm has the playful feel of a start-up. Lawyers - there are 20 of them - wear hoodies emblazoned with the Edelson logo, and their offices are labelled with old circuit boards mounted beside the doors. One of those offices has a pool table.
The start-up motifs are by design. Edelson may make his living suing tech companies, but he is breathless in his admiration for Silicon Valley culture and products. His office is decorated with images of Grumpy Cat, the famous Internet feline known for its morose-looking mouth, and he described the iPhone 6 Plus as "my favourite thing on earth."
"He wants to be perceived as running a tech firm, but since he's not a tech guy, the closest he will come is a law firm," said Scott A Kamber, a rival class-action lawyer who was Edelson's partner before they amicably split.
Another way in which he is similar to a start-up founder is that he does not like to talk about money, except when he is talking about not being motivated by money.
"Money doesn't mean a ton," Edelson said during an interview in the lobby of the Four Seasons hotel in San Francisco, wearing a watch whose face was loaded with diamond flecks.
The firm started suing technology companies in the early 2000s, before data privacy was a national debate. Edelson claims to have won more than $1 billion in settlements in all, a number that is difficult to confirm because many of those agreements are private. Today he views these cases the same way Apple views its collection of iPhones and other iThings: as a line of products to be refined, repackaged and resold. Text messages are a product line. Online video is a product line.
"When we go after a dozen big companies and win," he said, "the trickle-down effect is so much larger than if it's perceived as a one-off suit."
On a snowy day in February, Edelson's team was laying the groundwork for the recent Facebook suit, which they hope will create a new line of cases centered on biometric information. Given the explosion of "wearable" technologies, along with voice and face recognition software, this could be a lucrative area.
"We're really eager to test it out," Edelson said before the meeting.
The Facebook case concerns a feature that analyzes users' photos and then suggests names to go with the faces in the picture from the users' lists of friends. When it was introduced in 2010, bloggers regarded it, like pretty much every new technology, as incredibly useful but also a little creepy.
In the suit filed on Wednesday, Edelson asserts that the social network violated an Illinois law, called the Biometric Information Privacy Act, by storing images of its users' faces without telling them or obtaining their permission and neglecting to say how long it planned to keep them.
"This lawsuit is without merit, and we will defend ourselves vigorously," a Facebook spokeswoman said in an emailed statement. She noted that the face-tagging feature could be turned off, at which point the data used to suggest tags to other people is deleted.
The idea came from Edelson's investigative team, which consists of three lawyers and a computer analyst. The group's job, to put it plainly, is to find ways to sue companies, and a few months ago the firm started looking into laws that regulate biometric data. This was inspired, in part, by a call to the firm by someone who was leery of cameras and wanted to know if wearing a mask in public was legal.
"He wanted to wear a mask at all times," recalled David Mindell, an associate at the firm.
One of the members of the investigative unit is Shawn Davis, a digital forensics expert who previously worked as a network security analyst. Now, from an office strewn with cables and old cellphones, he spends his day playing with new devices as well as trawling through websites and mobile apps to try to figure out what kinds of data companies are collecting and how.
He joined the firm because "it seemed like a private version of the F.T.C." - the Federal Trade Commission.
After several weeks of investigating Facebook, Davis presented his findings at the February meeting. Sitting in a corner conference room, he projected strings of computer code on a monitor, showing what he believed was evidence that Facebook was collecting and storing digitized facial images. Lawyers in the room said they thought Facebook had done this without the consent of its users.
"Why wouldn't we want to go after a smaller company first?" asked one of the lawyers at the meeting. What he meant was that Facebook, with its practically limitless legal budget, might be too big a target.
Another colleague disagreed. If they sued a smaller company first, some other law firm would steal their idea, swoop in and sue Facebook - the big fish with the biggest potential rewards.
This led to a natural conclusion: "Why not file them all?" someone else said.
Helped by Snowden
There is no good data on how many cases have been brought claiming privacy violations by tech companies, but lawyers say the practice is escalating with the growth of social media and mobile phones, which are tracking people virtually all of the time. A recent legal treatise by Ian Ballon, a lawyer at Greenberg Traurig's Silicon Valley office, describes "an explosion" in class-action suits related to data privacy. Defense firms are bolstering their privacy practices in response.
"It's out there and it's growing," said Ted Frank, who runs the Center for Class Action Fairness, a nonprofit group in Washington that represents consumers unhappy with class-action settlements.
In Washington, the F.T.C. has stepped up its enforcement of privacy violations, and legislators like Senator Al Franken, Democrat of Minnesota, are pushing for laws that would give people more control over the ways Internet companies use their data. But Edelson says the biggest lift to the kind of data privacy litigation he does came from Edward J. Snowden, the former National Security Agency contractor who leaked documents about government spying. Those revelations have, in his opinion, made judges much more sympathetic to privacy plaintiffs.
"Before, we would to go court and judges would just scoff at us," he said. "Now they seem eager to listen to us and find ways to help us."
Many prominent privacy suits involve big news events, such as when hackers stole 40 million credit card numbers from Target. Edelson tries to avoid these, partly because they are so competitive within the plaintiffs' bar. His business niche relies on applying old laws to new technologies. Those cases can generate tens of millions of dollars each year for the firm, which usually collects 25 per cent of its settlements.
Take, for instance, the Video Privacy Protection Act. The law, signed in 1988, was passed shortly after President Ronald Reagan nominated Judge Robert Bork to the Supreme Court. During the fight over Bork's ultimately unsuccessful confirmation, a newspaper published the names of some of the videotapes he had rented from a local store.
They were not very interesting, but the next year a chilled Congress - acting in an age in which many people and possibly a few congressmen obtained their pornography from curtained rooms in local video stores - swiftly put the law on the books.
Three years ago, Edelson used the video law to sue Netflix for keeping data on the movies its users watched after they canceled their service, and settled for $9 million. The firm has used the same law to sue various dealers in online video. Mr. Edelson claims that his suits have led companies to be less cavalier with their users' information. The firm's settlement with Netflix, for instance, prompted the company to change its privacy policy. Now, when people cancel their service, the company has agreed to remove their names and other personal identifiers from their rental history within a year.
In addition to the video privacy law, Mr. Edelson's practice relies on the Telephone Consumer Protection Act, which was enacted in 1991 to restrict the use of automated telemarketing, as well as the Electronic Communications Privacy Act, which protects the privacy of phone calls and emails.
The penalties for each instance of breaking these laws are small, usually in the hundreds or thousands of dollars. But when they are applied to modern creations like an email service that has 425 million daily users, the potential liabilities can be comically high. One class action, in which Edelson was not involved, accused Google of violating wiretap laws by scanning messages in its Gmail email service. The suit was dismissed, but it could theoretically have been worth trillions.
What this means is that a company's defense strategy typically involves trying to persuade a judge to throw the suit out of court on a "motion to dismiss," or to try to prevent lawyers from suing on behalf of a class. If the judge lets the case go forward as a class action, companies usually start thinking about settlements. And that is good news for the plaintiffs' lawyers.
"It's legal gotcha, and he tries to convince you that because there's a legal gotcha with a big number, then you should pay him instead of litigating," said Michael Rhodes, a partner at the Cooley law firm in San Francisco, who has defended clients like Sony and Facebook against Mr. Edelson's firm. "That's his business model."
'Annihilating' Damages
Mr. Edelson grew up outside Boston and went to the University of Michigan Law School. He worked first at defense firms but hated it, so he quit to file his own cases. He started with more traditional class actions, suing companies for things like tainted cat food and toys containing lead paint. "What I used to say at the beginning was that the only company I wouldn't sue is Dr Pepper," he said. "I really like Dr Pepper."
His first run of technology suits, in the early 2000s, included a case that accused Register.com, which sells domain names, of running advertising on web pages it had sold to the customers for their use. Since then, the world has evolved. Our ordinary daily activities - communicating, buying things, seeking out information - often require us to reveal information that in the past was never created or collected.
The most muscular response to this corralling of data has been in Europe, where a sweeping new law nicknamed the "right to be forgotten" has set up a process for people to have links about them removed from search engines. Average Americans, however, seem caught in a gap between the privacy they say they want and what they actually do about it. A recent survey from the Pew Research Center found that 91 per cent of American adults thought they had lost control over how their personal information is used by companies. Yet they gleefully use Facebook and Twitter while showing zero appetite for paying for those services with money instead of data.
Mr. Edelson sees himself doing the dirty, unpopular work of protecting privacy with laws that are already on the books. Several technology companies - Google, LinkedIn, Netflix - declined to discuss Mr. Edelson and his firm. If one were to compile a list of Silicon Valley's least favorite topics, privacy would be up there with wealth inequality and gender imbalance.
Even the act of defending oneself can be unflattering. Take Google. Two years ago, in an attempt to head off a class-action lawsuit involving Gmail, the company wrote in a legal filing that people who used the service should never have expected their emails to be private, and it compared Gmail correspondence to business letters that can be viewed by assistants in an office. The company was quickly attacked by groups like Consumer Watchdog.
"A lot of privacy assurances fall away when companies like Google end up in court," said Marc Rotenberg, president of the Electronic Privacy Information Center.
When defending themselves against Mr. Edelson and his competitors, technology companies typically argue that the named plaintiffs on privacy suits do not have "standing," which is a lawyer's way of saying that you can't sue someone for damages if you didn't lose money or get hurt. That argument, which lawyers describe as the go-to defense in privacy cases, could face a big test from a 2010 suit Mr. Edelson filed against Spokeo, a search engine that, for a fee, displays everything it can find about a person.
Mr. Edelson sued under the Fair Credit Reporting Act, a 1970s law that is meant to keep credit reporting agencies from providing inaccurate information that could make it harder for consumers to borrow money or get a job.
Mr. Edelson was not the only person with such concerns. Two years after he filed his lawsuit, Spokeo paid $800,000 to settle F.T.C. charges that it marketed its service as a background check for employers but without vetting the information or giving consumers the right to correct it, as required under the Fair Credit Reporting Act, according to the F.T.C.
Thomas Robins, the named plaintiff in Mr. Edelson's case, said he had searched for himself on Spokeo and found that several things, including his age, were wrong. That has him worried that a potential employer might not consider him for jobs.
"He is not saying that has happened to him - it's just a speculative injury that could happen," said John Nadolenco, a partner at Mayer Brown in Los Angeles, who is defending Spokeo in the case. "Well, that's not an injury."
The United States Court of Appeals for the Ninth Circuit, however, ruled that Mr. Robins did have standing to sue for damages. Spokeo has appealed that decision to the United States Supreme Court and is awaiting a response.
The company has a lot to lose if the case goes forward. Under the Fair Credit Reporting Act, Spokeo could face damages of $1,000 a violation. That could add up to several billion dollars, which would be "annihilating," Mr. Nadolenco said.
The case is being closely watched in Silicon Valley. Companies have filed close to a dozen legal briefs in support of Spokeo. Lawyers for eBay, Facebook, Google and Yahoo filed a brief arguing that if the Ninth Circuit's rule stands, those companies could be sued "even where they are not actually harmed by an alleged statutory violation, and in certain circumstances, seek class-action damages that could run into billions of dollars."
Defending Class Actions
Whatever happens at the Supreme Court, Mr. Edelson is unlikely to win many new fans. Class-action lawyers, like Wall Street short-sellers, tend to justify their actions with high-minded morality, but they are often reviled as glorified extortionists.
"If we didn't allow class actions, we would be in a much worse world," said Michael Klausner, a professor at Stanford Law School. "The problem is they can also be abusive."
Over all, class actions have generally been on the decline as courts have made it harder for lawyers to certify class actions so they can go forward, said Brian Fitzpatrick, a professor at Vanderbilt Law School who studies class-action cases.
Also, over the last few years many companies have adopted so-called arbitration clauses in which, simply by clicking the "accept terms" button, users waive their rights to join class actions. The move discourages plaintiffs' lawyers because, unless they can sue on behalf of many clients at once, there is hardly any money in filing cases. "It may only be a matter of time before it is impossible for employees and consumers to file class actions," Mr. Fitzpatrick said.
Mr. Edelson seems worried about this. About three years ago, after AT&T adopted an arbitration clause, Mr. Edelson filed several dozen individual arbitrations over the course of a year. It was an expensive exercise, but forced AT&T to deal with each dispute one by one and sent a message "to other companies not to put arbitration clauses in their contracts," he said.
AT&T still has the arbitration clause.
In defending his tactics, Mr. Edelson echoes a long-running defense of class-action law. He says he is acting like a sort of private attorney general, forcing companies to change their worst behaviors. The critical view is that lawyers like him make millions while recovering almost nothing for the people they represent.
"Everyone always has a story about getting a check from a class action for 15 cents," said Christopher Dore, an Edelson partner. Mr. Dore said he had made peace with people questioning his profession.
"The funniest thing is you talk about it in the abstract, and people have one reaction," he said, "but then you give them specific examples, like I'll explain a case or something to them, and they're like, 'Oh, yeah, that's really messed up. You should definitely sue them.' "
©2015 The NY Times News Service
