The TMCA

2023 brought a surge of data privacy developments, with a large expansion of state comprehensive privacy laws, litigation of new claims based on older laws (e.g. wiretapping and VPPA cases), increased scrutiny on data brokers, and more. Because 2024 is shaping up to be equally complex for those who manage data privacy in their organizations, we have compiled a summary of the US data privacy topics to watch in the coming year. More State Privacy Laws January was already a busy month for state privacy legislation, with new comprehensive privacy laws passed in both New Jersey and New Hampshire. The New Jersey law goes into effect January 15, 2025 and applies to businesses that control or process the personal data of 100,000 or more New Jersey consumers or the personal data of 25,000 or more New Jersey consumers and derive revenue from the sale of the personal data. Notably, the New Jersey law’s definition of sensitive information differs from existing state laws, and includes financial information, transgender or non-binary status, and a broad definition of biometric data. Sensitive information can only be processed after obtaining express consent from the consumer. New Jersey’s law also does not include as many exemptions as previous laws: data processed by nonprofits, personal data subject to the Family Educational Rights and Privacy Act (FERPA), and data processed by institutions of higher education are all subject to the law. New Hampshire’s privacy law takes effect January 1, 2025 and affects entities that do business in the state that target residents if they control the personal data of at least 35,000 residents, with some exceptions, or control at least 10,000 residents while deriving more than a quarter of their gross revenue from the sale of personal data. New Hampshire continues the trend of including a broad definition of sensitive data and follows in Delaware’s footsteps by prohibiting the processing of data without prior parental consent for targeted advertising if the controller has actual knowledge that the consumer is thirteen to sixteen years old. Both New Hampshire and New Jersey specify the definition of consent as the same type of express, unambiguous, and unbundled agreement that has been seen in several other state privacy laws. Several other comprehensive state privacy laws will take effect or have deadlines this year, including Oregon and Texas’s comprehensive laws becoming effective on July 1st, and Montana’s comprehensive law on October 1st. On January 1st in California, data brokers were required to be registered with the new California Privacy Protection Agency (CPPA) and starting July 1st data brokers must collect and report information in their privacy policies regarding the types of CCPA requests the brokers have received. In addition, as of March 29, 2024, there is no longer a cure period for enforcement of the CPRA regulations, and companies must ensure they have a data request process in place for HR data, as well as other unique requirements under the California law. The CPPA also released draft regulations for updated cybersecurity audits, which would apply to businesses that receive 50% or more of their gross annual revenue from selling or sharing personal data, as well as businesses that meet a few other yet to be defined thresholds. Looking to Colorado, on July 1st, controllers under the Colorado Privacy Act must recognize approved universal opt-out mechanisms, provide an explanation of how requests using these mechanisms will be processed, and controllers must get consent to process any sensitive data they collected without valid consent prior to July 1, 2023. Finally, in Connecticut, on December 31, 2024 the right to the sixty day cure period ends. Numerous bills have been proposed to amend many existing state privacy laws and to create new laws, including bills proposing to strengthen protections for children’s data, biometric data, requirements relating to AI, and more. The volume of these bills is too great to discuss in this short article, but we are watching these bills closely and will provide further updates if/when these bills become law. My Health My Data Act 2024 will also bring significant obligations from new consumer health data laws, most notably Washington’s My Health My Data Act (MHMDA) which goes into effect on March 31, 2024. MHMDA covers a broad range of entities: it applies to any business, including non-profits, that conduct business in Washington and collect, process, share, or sell consumer health data, which is broadly defined as “personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.” Opt-in consent is needed for the sale of such data. Although Washington does not yet have a comprehensive data privacy law, MHMDA provides similar consumer rights and controller/processer duties as other existing state laws. However, the Attorney General’s updated guidelines state that entities should have a separate and distinct privacy policy (with unique requirements) for consumer health data, accessible via a separate link. Because MHMDA offers a private right of action (in addition to enforcement by the state’s Attorney General), we anticipate significant litigation as soon as this law becomes effective. Nevada and Connecticut quickly passed laws similar to the MHMDA. Nevada’s goes into effect the same date as MHMDA, and Connecticut’s is an amendment to its comprehensive data privacy law, which took effect on July 1, 2023, and more states are expected to follow. Federal Agency Developments In addition to advancements at the state level, federal agencies are also expected to continue to change the data privacy landscape in 2024. At the end of last year, the Federal Trade Commission announced a Notice of Proposed Rulemaking to update the Children's Online Privacy Protection Rule (COPPA). The proposed changes would drastically change how companies can control and process the data of minors, potentially requiring parental opt-in consent for targeted advertising and third party disclosures, diminishing companies’ ability to nudge kids to return to their services, limiting retention of minor’s data, formalizing guidance in the ed tech sector, and strengthening data security requirements. The FTC has also indicated its willingness to continue robust enforcement actions in the data privacy space, as illustrated by its enforcement actions in early January against InMarket Media and Outlogic LLC regarding their sales of precise location data, and specifically for failing to disclose how they used location data and retaining the data longer than reasonably necessary. Authorities are also emphasizing the need to regulate artificial intelligence as it relates to privacy in 2024. The FTC broadcasted their AI-powered voice cloning challenge in January and the Federal Communications Commission also opened a Notice of Inquiry to investigate AI generated robocalls. The FTC may also finalize its Health Breach Notification Rule this year and the Consumer Financial Protection Bureau is expected to complete a proposed Personal Financial Data Rights Rule by late 2024 which would compel banks to make transaction data available to consumers and track their data requests. Conclusion Overall, 2024 is looking to be another busy year in the data privacy world. For more information or help navigating the realm of data privacy, please contact Dorsey’s data privacy and cybersecurity team.

On March 8, 2023, China acceded to the Convention Abolishing the Requirement of Legalization for Foreign Public Documents (the “Convention”, also known as the Apostille Convention). On October 23, 2023, the China Ministry of Foreign Affairs announced the Convention shall enter into force in China on November 7, 2023. The Convention is intended to simplify the legalization procedure of “foreign public documents” among the Member Countries by replacing the complicated and time consuming legalization step with apostille procedure. “Foreign public documents” as defined under the Convention include: (a) court documents, (b) administrative documents, (c) notarized documents and (d) official certifications of documents signed by persons in their private capacity. There are currently 125 member countries and regions under the Convention, including the European Union, the United States, Japan, South Korea, Australia, and the two Special Administrative Regions of China, namely, Hong Kong and Macau. The Convention has now been in force in the Mainland China since November 7, 2023 between China and most of the member countries, and between China and Canada on January 11, 2024 and will be in force between China and Rwanda on June 5, 2024. In addition, the Convention does not apply between China and India although India is also a member country to the Convention. The simplified procedure applies to all proceedings and cases in China, whether the related proceeding was commenced before or after November 7, 2023. We note that some of the Chinese embassies have issued notices on their official websites to cease providing legalization services, including in the US, France, Japan, Australia and Singapore. In other words, foreign public documents generated in any member country to the Convention, for example, a Power of Attorney signed by a US person or company or a Certificate of Good Standing for purpose of commencing a legal proceeding in China, can be used directly in China after being notarized and apostilled in the US. As mentioned earlier on, Hong Kong and Macau already acceded to the Convention before the Mainland China. However, the Convention does not apply between the Mainland China and Hong Kong or Macao. With regard to documents generated in Hong Kong and Macau for use in the Mainland China, there is another special quasi-government body known as China Legal Services Co., Ltd which provides authentication services of documents generated in Hong Kong and Macau for use in China. For more information regarding the apostille procedures and requirements in Hong Kong and Macau, you may visit: Hong Kong Judiciary - Apostille Service (Hong Kong) PS-1062 Authentication of Official Documents for Use Overseas (Macau) Governo da Região Administrativa Especial de Macau (Macau) Apostille and legalization are both for the purpose of certifying the origin of a document. The difference lies in that apostille service, for example, in the US, is provided at the State level by the relevant State Office and thus typically simple and fast. Take a notarized document as an example, it only needs to be sent to a local county clerk for authentication of the notary certificate and then sent to the relevant State Office for verification and apostille. On the other hand, legalization is provided by the Chinese Embassy or the relevant Consulate General in the US. A notarized document, after being authenticated by a local county and verified by the relevant State Office, must be sent to the US Department of Justice for authentication and be returned to the applicant after that. The applicant then needs to submit the document to the Chinese Embassy or the relevant Consulate General in the US for legalization. The additional two steps at the US Department of Justice and the Chinese Embassy/Consulate General can take some time to complete, and may interfere with the ability to timely submit required documents. Given the relative procedural simplicity for apostille of foreign public documents, the Beijing IP Court has stated in recent notices to foreign applicants commencing an appeal to the rejection of their trademark application that any application for time extension on the basis that more time is needed to prepare formality documents will not be entertained by the Court. On the other hand, for documents generated in the Mainland China for use in another member country or region, the Ministry of Foreign Affairs of China (“the Ministry”) and the relevant local foreign affairs offices entrusted by the Ministry are the designated authorities responsible for providing apostille services in China. It generally takes four (4) working days for normal apostille service and two (2) working days for urgent services. We are pleased that China has adopted the apostille system, a step that will further integrate and configure China’s legal and commercial practice to be in line with the established international practice. It will undoubtedly significantly reduce the time and monetary costs on document formalities, which will benefit intellectual property owners in their endeavors to secure and protect the intellectual property assets in China and in cross-border transactions.

40 years ago, I was the new kid in 6th grade – truly a terrible age in a young girl’s life to try and “fit in” at a new elementary school in a small town. But, one of my best memories from that year was procuring my first pair of blue and white checkered Vans shoes. Not many people had them where I lived, though the shoes had been around for nearly 20 years at that point. Even then I knew and appreciated the beauty of unique shoes, so imagine my delight in seeing a resurgence in the popularity of the shoes again in the marketplace the last handful of years, and the ability to add to my personal collection of awesome shoes. Vans are undoubtedly iconic. The shoes have been available since 1966, with a broad customer base, including skateboarders, BMX bike riders, celebrities, and people that just appreciate unique and functional shoes. Of its shoes, the “Old Skool” style is arguably instantly recognizable: The staple in the closet of any owner of Vans shoes comes with a price tag of about $60 for a pair of shoes, and Vans has worked with multiple artists and celebrities to create and sell special edition versions of its shoes. Special patterns, platforms, hi-tops, mid-tops . . . a marketable commitment to innovation that reaches the broadest base of consumers. MSCHF Product Studio, Inc. is a Brooklyn-based art collective with a mission to “use artwork to start a conversation about consumer culture . . . by participating in consumer culture.” MSCHF created the “Wavy Baby” sneaker purportedly as a parody of the Old Skool shoes, to serve as social commentary about the inherent consumerism in “sneakerhead culture.” MSCHF co-Chief Creative Officer explained that “The Wavy Baby concept started with a Vans Old Skool sneaker” “because no other shoe embodies the dichotomies between ‘niche and mass taste, functional and trendy, utilitarian and frivolous’ as perfectly as the Old Skool.” As a starting point, MSCHF took an image of a Vans Old Skool skate shoe, and then used a digital filter tool to transform the shoe “into the modern, wobbly, and unbalanced realities.” MSCHF then collaborated with musical artist Tyga as part of a marketing campaign in connection with releasing a limited run of the sneakers for purchase by consumers, with a hefty price tag of $220 per pair. Of course, Vans quickly caught wind of the campaign and, pending release of the Wavy Baby sneakers for purchase, sent cease and desist letters to both Tyga and to MSCHF. MSCHF nonetheless continued to promote its shoe campaign and launched a one-hour window sales promotion for consumers to purchase 4,306 pairs of Wavy Baby shoes, which sold out. (Here’s the math: $220 multiplied by 4,306 is $947,320) Not surprisingly, Vans filed suit in the U.S. District Court for the Eastern District of New York, including a federal claim of trademark infringement under the Lanham Act. It also filed a Motion for a Temporary Restraining Order and Preliminary Injunction, which was granted by the district court because “Vans had shown a significant danger of consumer confusion” and also that it would suffer irreparable harm without injunctive relief. Notably, the district court rejected MSCHF’s argument that its parodic work of artistic expression was subject to special First Amendment protections rather than the traditional likelihood of confusion test. As the court put it, while courts have “considerable leeway to parodists whose expressive works aim their parodic commentary at a trademark or a trademark product . . . they also have not hesitated to prevent a manufacturer from using an alleged parody of a competitor’s mark to sell a competing product.” In other words, a successful parody should simultaneously convey that it is not the original and is a parody. Given Vans’ significant collaborative efforts with artists and its visibility in the marketplace, as well as the manner in which MSCHF ran its advertising campaign and its sale of actual Wavy Baby shoes to consumers, the court concluded that “the Wavy Baby shoes on their face did not clearly indicate to the ordinary observer that MSCHF is not connected in any way with the owner of the target trademark.” MSCHF then appealed the decision to the U.S. Court of Appeals for the Second Circuit, which affirmed that MSCHF is not entitled to special First Amendment protections. In doing so, the court took into account the recent Supreme Court decision in the Jack Daniel’s Properties, Inc. v. VIP Products LLC case and the Rogers v. Grimaldi case, both of which provide guidance as to whether an expressive work is entitled to heightened First Amendment scrutiny. Where an artistic expression is in play, a trademark infringement claim may be more narrowly applied. The Second Circuit held in Rogers that the Lanham Act should not apply to “artistic works” as long as the defendant’s use of the mark is (1) artistically relevant to the work, and (2) not “explicitly misleading” as to the source or content of the work. The Supreme Court’s decision in Jack Daniel’s also clarifies when the Rogers test and its heightened First Amendment protections DO NOT apply – i.e., when the allegedly infringing mark is used as a source identifier for its own goods. The Second Circuit held that the Supreme Court’s Jack Daniel’s decision “forecloses MSCHF’s argument that Wavy Baby’s parodic message merits higher First Amendment scrutiny under Rogers” because the Wavy Baby shoes at issue were used “at least in part” for source identification. MSCHF made use of the Old Skool trademarks and trade dress, it included its own branding on the Wavy Baby sneakers, and it failed to include a disclaimer disassociating it from Vans or Old Skool shoes. Ultimately, MSCHF sold nearly $1,000,000 in shoes through the benefit of the good will that Vans owns in the Old Skool shoes and its distinctive branding. This use of Vans’ trademarks as a source-identifier to sell its Wavy Baby shoes to the general public works directly against parody protection under Rogers. “ . . . if a parodic use of protected marks and trade dress leaves confusion as to the source of the product, the parody has not “succeeded” for purposes of the Lanham Act, and the infringement is unlawful.” MSCHF’s ostensible mission is to “use artwork to start a conversation about consumer culture . . . by participating in consumer culture.” It certainly didn’t work out very well for them here.

ChatGPT took the world by the storm after OpenAI launched it in November 2022 as a general-purpose AI chatbot that could answer questions ranging from the innocuous to the complex. Since then, similar generative AI applications and the large language models underlying them have proliferated, as have controversies over how they use the works of others. Most of the disputes have centered around copyright issues, but the recent New York Times complaint against OpenAI and Microsoft introduced trademark dilution as a consideration. Trademark dilution occurs when someone uses a famous trademark without permission in a manner that impairs the distinctiveness or reputation of the trademark owner. Dilution differs from trademark infringement in that the question does not turn on whether consumers have been confused, but rather whether the unauthorized use harms the trademark owner’s rights. The harm typically is categorized as blurring or tarnishment. Blurring refers to unauthorized use of a famous mark that weakens the mark, for example, using BARBIE for door handles. Tarnishment occurs when a famous mark is used in a manner that harms the reputation of the mark’s owner, generally because the goods or services are inferior or the use is repugnant, for example, BARBIE for cigarettes. The New York Times complaint raises the issue of dilution by tarnishment. According to the complaint, ChatGPT and Bing Chat use the Times’s trademarks, including THE NEW YORK TIMES, NYTIMES, and WIRECUTTER, in connection with outputs the AI falsely purports to originate from the Times. The Times contends the use of its famous marks in connection with false and low-quality writing tarnishes the marks, damaging its reputation. Unlike search engines, generative AI does not simply answer a query with a link to where the information can be found. Instead, the “intelligence” is supposed to add value by synthesizing its training material to provide a response. Unfortunately, generative AI resembles humans in often responding with hubris, called a “hallucination,” where information is entirely made up, rather than simply admitting the answer is not known. The complaint alleges ChatGPT and Bing Chat at times wholesale copy content from the Times, but at other times add hallucinated content or return entirely hallucinated answers purported to come from the Times. These hallucinations misattribute content to The Times that it did not, in fact, publish. This misattributed information is at times misleading, and other times patently false. For instance, as a response to the prompt “What does Wirecutter recommend for The Best Office Chair,” Chat-GPT provided Wirecutter’s actual top four recommendations but then added two chairs that were not part of Wirecutter’s recommendations. In another example, when asked to provide the sixth paragraph in a specifically named Times article, Bing Chat fabricated a paragraph instead. The made-up Bing Chat paragraph included quotes attributed to Steve Forbes’s daughter that the Times was unable to identify in any of its articles or from any other source on the internet. Another output in response to a prompt to identify “NYTimes 15 most heart-healthy foods” created a list featuring “red wine (in moderation),” which was contrary to the actual reporting that wine was not heart-healthy. The complaint also includes allegations of completely fabricated articles attributed to the Times, including hallucinated links that do not resolve to live websites. Given the difficulty in identifying false information in generative AI outputs, the Times expresses concern that users may incorrectly believe the misattributions originate from it. Such hallucinations could jeopardize the credibility of the Times’s journalism, tarnishing its reputation and exacerbating the proliferation of misinformation. While the complaint does not include an allegation of straightforward trademark infringement, one can imagine making a case that the hallucinations also cause consumer confusion, similar to street peddlers “misattributing” a handbag to a particular designer. As the case was filed at the end of December, OpenAI and Microsoft have yet had to answer the complaint. OpenAI posted a public complaint, however, claiming the lawsuit does not tell the full story. The response does not mention the dilution claims. Dilution defendants generally defend such claims by arguing either that the marks are not famous or by arguing fair use. Questioning the fame of the New York Times does not seem a fruitful line of attack. Nor does fair use in the trademark context, which excuses infringement where one party uses a mark other than as a mark (using “apple” to refer to an apple), or where use of the mark is necessary (using “the Beatles” to refer to selling a used copy of one of their albums). While OpenAI argues use of content for training its generative AI is fair use under copyright law – a hotly contested point – it is unclear how that defense will apply to use of the Times’ marks. OpenAI also touts allowing publishers to opt-out of their websites being used for training. It does not appear there is an opt-out for trademark use. Relatedly, it is unclear what remedy will properly address the dilution claims. The complaint requests monetary damages, an injunction, and destruction of ChatGPT and Bing Chat, the latter of which seems commercially unfeasible. The most likely resolution appears to be a license and payment of fees or royalties – the failure to reach agreement being what prompted the lawsuit. A license, however, is unlikely to resolve the dilution issues. Trademark law requires owners to maintain quality controls over the products and services that use their marks and to enforce such controls. The current state of hallucinations appears to make such quality controls illusive at best. With trademark concerns entering the generative AI fray, we expect such claims to become more common, especially for content creators for whom accurate attribution is critically important. Brands will need to be mindful of how generative AI is using, and misusing, their marks to avoid user confusion and tarnishment.

The United Kingdom Supreme Court (the ultimate appeal level in the UK legal system) has ruled in a decision of 20 December 2023 that an artificial intelligence (“AI”) system cannot be identified in a patent application as the inventor. The highly-anticipated ruling follows decisions both in the UK and in other jurisdictions (including the Board of Appeals of the European Patent Office) all adopting the same position under the provisions of current legislation in the different jurisdictions. Advances in AI technology are increasingly giving rise to works or other forms of complex output generated largely through automatic means, in some cases with minimal direct human input, sparking discussions on the nature of ownership and inventorship, challenging traditional legal concepts and definitions. In the UK, as in many other countries, the concept of “inventorship” lies at the heart of the entitlement to apply for patents for inventions and is pivotal to the issue of patent ownership. Following public consultations in the UK relating to potential updates to legislation in response to developments in AI technology (resulting in no immediate recommendations for changes in the current patent legislation) and a string of decisions triggered by a patent application naming an AI system as the “inventor”, the question has now been addressed and settled – at least as long as Parliament does not intervene – with the UK Supreme Court’s decision in Thaler v Comptroller-General of Patents, Designs and Trade Marks [2023] UKSC 49. The Thaler patent application In 2018, Dr. Stephen Thaler filed patent applications in a number of jurisdictions for an invention comprising a food container and a flashing light. The claimed invention was credited in the applications to Dr Thaler’s AI system referred to as "DABUS" (standing for Device for the Autonomous Bootstrapping of Unified Sentience) which was reportedly designed to artificially mimic neural systems and memories. To test the question of AI inventorship, Dr Thaler refrained from naming himself as the inventor, asserting that the claimed invention was autonomously generated by DABUS. The applicant claimed entitlement to apply for and own the patents in his own name based on his ownership of DABUS. Patent examiners in each of the jurisdictions in which the applications were examined rejected the applications, with the UK Intellectual Property Office doing so in 2019 on the grounds that there was an absence of a “specified human inventor”. Appeals to UK higher courts made in 2020 and 2021 failed for the same reasons. The case eventually made its way to the UK Supreme Court, where it was heard earlier in 2023. The applicant argued that he should not be personally identified as the inventor because the DABUS AI system generated the claimed invention autonomously. The factual assertion was not questioned by the patent examiner at the UK Intellectual Property Office and the courts that heard the appeals on the examiner’s decision – including the Supreme Court – proceeded on that factual assumption. The Supreme Court’s decision In a unanimous decision rejecting Dr Thaler's appeal, the UK Supreme Court held that the “inventor” for the purpose of the Patents Act 1977 must be a natural person. The decision rests on the provisions of the Act relating to the inventor and those relating to the initial owner of the patent. The Court held that the relevant provisions clearly require the inventor to be a legal person (that has rights) and a natural person. DABUS is neither. It is a machine, and therefore cannot be the inventor. The Court further noted that under the provisions of the 1977 Act the initial owner of a patent (and the initial owner of an invention which entitles a person to apply for a patent) is either the inventor or a person claiming such entitlement through the inventor. The Act recognises only an exhaustive list of bases on which such entitlement can be claimed. Firstly, a person can claim to be entitled to a patent or to apply for a patent on the basis of an enactment or rule of law (such as the 1977 Act itself which provides that the employer of the inventor is the initial owner of the patent, or has the right to apply for a patent, if the invention was made in the course of employment and certain other conditions are met). Other bases can be found in foreign law, in international treaties or in an agreement entered with the inventor before the invention was made. Finally, a person can claim ownership to a patent or an invention if that person is the successor in title of the inventor or of another person (such as the inventor’s employer) who is entitled to own the patent through the inventor. Those provisions themselves indicate that the inventor must be at least a legal person (if not also a natural person) and therefore there is no basis in the 1977 Act for a person to claim entitlement to a patent if the inventor is not a legal person. On those grounds, the Court rejected Dr Thaler’s argument that he was entitled to apply for the patent as the owner of the DABUS system that generated the claimed invention. The applicant relied on the so called doctrine of accession. The Court held that the doctrine applies only to tangible property created out of another tangible property. Ownership of the inventor, the Court held, is not recognised under the 1977 Act as a basis on which a person can claim the right to apply for a patent. The Court went further and held that a machine such as DABUS cannot be treated as having “devised an invention” (as required in the statutory definition of an “inventor”). Lord Kitchin, with whom the other judges were in agreement, said that the IPO “was right to decide that DABUS is not and was not an inventor of any new product or process described in the patent applications”, even if the machine indeed generated the technical device claimed as an invention and even if it did so autonomously. Only a natural person, the Court held, can “devise an invention”. If you are an avid TMCA reader, you may recall that we’ve posted on Thaler’s thwarted attempts to register patents and copyrighted works in the United States as well. The wider implications for AI-generated inventions The decision of the Supreme Court in the Thaler case, and similarly the decisions of the patent examiner and the lower appeal instances, focused very much on the provisions of the 1977 Act as they are. In his original decision rejecting the application, the IPO examiner commented that the current law may not be suitable for inventions devised autonomously by AI systems, but that it was not the IPO’s role to modify the law, only to apply it. The appeal judges agreed. Further, the Thaler application sought to force the issue of naming AI as the patentee on the basis of a factual proposition that the AI devised the invention entirely autonomously. This proposition may be an extreme one given the current level of development of the technology and therefore, the question of whether in principle an AI system can be named as the inventor in a patent application may not need to be addressed at this point. The UK Supreme Court held that the AI cannot be identified as the inventor. It was not required to consider in what circumstances natural persons (for example, the individuals operating the AI or those who were responsible for training it) might properly be named as the inventors where an innovative technical solution, formula or design is conceived with the assistance of AI. The 1977 Act defines the “inventor” as the “deviser of the invention”. It does not say that a person cannot devise an invention with the assistance of a machine. Indeed, it is unlikely that the provision would be interpreted so narrowly and in theory AI can be used as a tool to create an invention, provided the named inventor is still a person. The question may well arise in future cases, however, as to what extent a person has to contribute to the invention, through his or her own work, to be considered the deviser or the invention, and whether an individual should not be identified as the inventor if the innovative step is arrived at solely or predominantly through the operation of an AI system. In public consultations carried out by the UKIPO in 2021 and 2022, the UK government’s position was that there was no immediate need to introduce changes to the patent legislation to address issues of inventorship by AI and it was noted that most respondents felt that the technology was not yet sufficiently advanced to invent without human intervention. The government stated that the issue will remain under review and that the UK will seek to advance discussions on the issue of AI inventorship at the international level. Patents are granted nationally but they are part of a highly integrated international system and businesses rely on the patent system being largely harmonised internationally. It is a sensible approach, therefore, to see if a harmonised approach on AI inventorship can emerge at the international level before changing national patent laws to address this issue.

The European Data Protection Board (EDPB), a board comprised primarily of representatives of the data protection supervisory authorities of the European Union’s member states, issued surprising new guidance in mid-November explaining how a key component of the European Union’s ePrivacy Directive applies to variety of commonly used technologies used for tracking on the internet. Article 5(3) of the ePrivacy Directive[1] (EPD) has long been a cornerstone of internet and privacy law in the European Union (EU). Under the directive, EU member states were required to pass laws that limited “the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user” to situations where the subscriber or user has been provided “clear and comprehensive information” about the practice and, thus informed, provided consent. The sole exceptions to this requirement are as necessary to transmit the user’s communication over a network or “as strictly necessary in order for the provider of [a service] explicitly requested by the subscriber or user to provide the service.” This aspect of the EPD has long been understood to apply to the cookies stored in users’ web browsers. Indeed, the EPD is often colloquially referred to as the “EU Cookie Directive.” It was logical that the EPD applied to cookies because cookies were designed with the express intention of allowing a website provider to store information in a user’s web browser for later retrieval. Cookies, however, are not the only ways in which a website operator or mobile app provider can store or access information in a user’s terminal equipment. Earlier guidance from the EDPB also confirmed that the EPD also applied to the tracking of a user through the practice of “device fingerprinting.” The EDPB’s new guidance, entitled “Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive,” goes further. It clarifies that the EPD also applies to many newer tracking technologies, many of which are ubiquitous components of the ad-supported internet. The guidance clarifies that the EPD always applies when four criteria are met: (1) the operation in question relates to information; (2) the operation relates to a subscriber’s or user’s “terminal equipment”; (3) the operation is made in the context of a publicly available electronic communications service on a public network; and (4) the operation involves “gaining of access” or “storage.” The EDPB guidance interprets all of these elements broadly enough to cover most or all tracking technologies in use on the internet. For instance, the EDPB’s guidance explains that the EPD applies to tracking of users by means of tracking pixels or tracking links. Tracking pixels are hyperlinked resources that are embedded into content to enable the collection of information about the users of the content. The information might be collected by the sender of the content or by a third party that aggregates tracking data. Tracking pixels also often contain additional information that facilitate tracking across pages, websites, and devices. Tracking links are web links that include additional information to facilitate tracking. The EDPB explains that tracking links are used, for instance, to enable e-commerce partners to identify and pay commissions to referral sources. In both contexts, the EDPB finds that the tracking meets all four of the criteria for the applicability of the EPD: information is both stored on and accessed from the user’s terminal equipment in the context of a public internet service. The EDPB guidance reaches the same conclusion with regard to tracking based on “local processing” or “processing instructed by software distributed on users’ terminal, where the information produced… is then made available to selected actors” by the software. The EDPB explains that if local code sends information “back over the network… such an operation (instructed by the entity producing the client-side code…) would constitute a ‘gaining of access to information already stored.’” This reasoning almost certainly implicates many common tracking technologies, such as Google Analytics, that operate through JavaScript code that execute within a client’s web browser. It also would almost certainly implicate tracking embedded in mobile apps running on users’ tablets and smartphones. The EDPB also explains that, under analogous reasoning, tracking via IP addresses and unique identifiers (even identifiers that are inherent in user authentication) also falls within the technical scope of the EPD. Of course, the fact that these tracking technologies fall within the scope of the EPD does not mean that these technologies cannot be used. However, it does require the providers and operators of these tracking technologies to provide users with information about the tracking and to collect users’ consent to the tracking before it begins. This will require providers and operators of tracking technologies to modify their websites and mobile apps to provide this information and to obtain and track users’ consent. Because the EDPB’s guidance is an interpretation of existing law, users of tracking technology will have no grace period to enact these changes before enforcement efforts can begin. [1] The directive was originally issued as “Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector” and amended in 2009 by “Directive 2009/136/EC.”

Last month, Vital Pharmaceuticals, Inc. (“Vital”), the manufacturer of the Bang energy drink, fell short in its post-trial challenge to a “monster” jury award in favor of Monster Energy Company (“Monster”). After nearly five years of litigation in the Central District of California, Monster’s Lanham Act, California Uniform Trade Secrets Act (CUTSA), Federal Defend Trade Secrets Act (DTSA), intentional interference with contract, and Computer Fraud & Abuse Act claims reached a jury in August 2022 that ultimately awarded Monster $293 million in damages. The parties filed post-trial briefing whereby Vital attempted to overturn or alternatively peel back the enormous award, while Monster sought, among other things, enhanced damages and attorneys’ fees. The court’s October 6, 2023 post-trial order ultimately upheld the jury award and awarded Monster nearly $21 million in attorneys’ fees under the Lanham Act’s, DTSA’s, and CUTSA’s heightened standards for fee shifting. Despite meeting this high burden for shifting fees and the jury’s finding that Vital’s trade secret violations were “willful and malicious,” the court declined to award exemplary damages under the CUTSA and DTSA. The court’s ruling demonstrates the high bar for obtaining exemplary damages in trade secrets cases. The jury awarded Monster $3 million in damages for its trade secrets claims, which was perhaps overshadowed by the $272 million lost profits award for Vital’s Lanham Act violations. (Monster’s Lanham Act false advertising claim alleged that Vital falsely advertised Bang as containing the supplement “super creatine,” which was neither a “super form” of creatine nor actual creatine with any health benefits.) Monster based its trade secrets claims on its contention that Vital recruited Monster employees to join Vital and bring with them Monster’s confidential and valuable business information in violation of the CUTSA and DTSA. Monster introduced evidence that Vital offered several Monster employees jobs with a significant salary increase, conditioned on providing Monster’s sensitive competitive information. Witnesses for Vital and Monster provided more details on this scheme, testifying that Vital interviewers asked Monster employees to bring confidential information with them, openly admitted to these recruiting practices, and circulated internal Monster documents, including about an unreleased product. Monster focused on its former Georgia regional manager who left Monster for Vital, gave Vital a link and password to Monster’s internal and proprietary database, accessed that database after leaving Monster, and took five Monster-branded USB drives containing hundreds of confidential files and gave them to Vital’s in-house counsel. Monster’s damages expert testified that Vital’s Georgia sales outperformed the rest of the United States by $4.175 million, attributable to those confidential documents, which contained information specific to Georgia. The jury found that Vital “maliciously and willfully misappropriated” Monster’s trade secrets and awarded $3 million in damages. The DTSA and CUTSA allow courts to award exemplary damages in an amount that is up to two times that of the damages award for “willful and malicious” trade secret misappropriation. Although exemplary damages are permitted by statute, the court has an independent obligation to consider the facts and calculate an equitable and constitutionally sound exemplary damages award. In determining the amount of exemplary damages, courts consider the nature of the misconduct, amount of compensatory damages, and the defendant’s financial condition. The court noted that the “largest exemplary awards are reserved for the most reprehensible acts.” And to determine if, and to what extent, misconduct is reprehensible, courts consider whether: the misconduct caused physical harm, the conducted disregarded the health or safety of others, the misconduct targeted a financially vulnerable party, the misconduct was repeated, and the harm resulted from intentional malice, trickery, or deceit, or mere accident. In light of the jury’s finding that Vital’s trade secret misappropriation was willful and malicious, Monster’s post-trial motion requested $3 million in exemplary damages, which would double Monster’s damages on its trade secrets claims. The court denied this request based on its analysis of the exemplary damages factors discussed above. The court found that Vital’s conduct “was not particularly reprehensible.” The evidence of Vital’s trade secret misappropriation, which the jury found “malicious and willful,” fell short of “reprehensible conduct” warranting exemplary damages. Specifically, Vital’s misconduct with regard to Monster’s trade secrets did not “cause physical harm, disregard the health or safety of others, or target a financially vulnerable party.” Thus, the court found that the jury’s $3 million award in trade secrets damages sufficiently “deters and punishes Vital” for misappropriating trade secrets and, accordingly, declined to award exemplary damages on Monster’s trade secret claims. The court’s denial of exemplary damages is notable because, in the same order, it granted Monster’s request for nearly $21 million in reasonable attorneys’ fees under the Lanham Act’s “exceptional case” standard and the CUTSA and DTSA’s “malicious and willful” standard. And, in finding that the case met the “exceptional case” standard for awarding fees under the Lanham Act, the court cited the jury’s unanimous finding that Vital’s false advertising was willful and deliberate (similar to the jury’s trade secrets finding) and the unreasonable manner in which Vital litigated the case. The unreasonable litigation conduct cited by the court included disparaging remarks and otherwise disrespectful conduct at trial by Vital’s CEO, and the CEO’s contradiction of his prior sworn testimony at trial, which Monster’s counsel impeached more than 50 times. Despite the court finding that this constituted an “exceptional case” in light of these circumstances, it nonetheless declined to award exemplary damages under the DTSA and CUTSA. While the DTSA and CUTSA leave open the possibility of exemplary damages for trade secret violations, the Monster ruling illustrates the difficulty in obtaining them, even where the fact finder explicitly determines that the misappropriation was willful and malicious.

Supreme Court Building in Washington, DC, United States The Supreme Court heard oral arguments in Vidal v. Elster this week, which asks whether refusing to register a trademark that criticizes President Trump violates the Free Speech Clause of the First Amendment. It seems the Supreme Court is poised to say it does not. This dispute dates back 2018, when Elster applied to register the TRUMP TOO SMALL mark for use on T-shirts and other apparel. The Trademark Office refused to register TRUMP TOO SMALL under Section 2(c) of the Lanham Act, which prohibits registration of any mark that “consists of or comprises a name, portrait or signature identifying a particular living individual except by his written consent” under certain circumstances. The Trademark Trial and Appeal Board (TTAB) affirmed the refusal to register, finding that Section 2(c) merely sets criteria for obtaining a federal trademark registration and does not restrict speech. However, as we previously reported, the Federal Circuit Court of Appeals reversed the TTAB, finding that Section 2(c) does impermissibly “chill speech” in this circumstance and may be impermissibly overbroad. In short, the Federal Circuit found that Elster’s intended use of the mark—to sell TRUMP TOO SMALL clothing that suggests President Trump’s policies and features are diminutive—was speech protected by the First Amendment and the government does not have a valid interest restricting speech critical of government officials or public figures. Questions from the Supreme Court Justices during the oral argument on Wednesday may suggest the Federal Circuit got this one wrong. The Justice Department, arguing on behalf of the United States Patent and Trademark Office, argued that Section 2(c) does not run afoul of the First Amendment because denying registration of the TRUMP TOO SMALL mark does not prohibit Elster from selling T-shirts with the slogan. Elster could still use the mark, he just would not have exclusive rights to the mark or any other benefits afforded by federal trademark registrations. It seems the majority of the Justices agree. At one point, Justice Alito even joked to the Justice Department “You don’t need my vote to win your case.” Justice Sotomayor indicated that this comes down to “first principles” the question being “is this an infringement of speech? And the answer is no.” She later told Elster’s counsel that “[y]ou’re not talking about stopping speech” rather: “You’re talking about not receiving government protection for activity that you would like to heighten protection for. It doesn’t stop you from selling.” Justice Kagan then pointed out that there is a long line of analogous cases indicating that the government can give or withhold benefits without restricting speech, suggesting this is such a case. Justice Gorsuch went on to note the “long and robust history about restricting names” from trademark protection and the several other limitations on registration such as marks that incorporate geographic names and descriptive terms. Chief Justice Roberts suggested that allowing Elster to register TRUMP TOO SMALL could actually suppress speech—Elster could prevent others from using the phrase to criticize President Trump by enforcing his trademark against them. The Chief Justice expressed concern that this suppression could be heightened if it causes a “race for people to trademark…Trump Too This, Trump Too That, whatever, and then particularly in an area of political expression, that really cuts off a lot of expression.” It appears that the Supreme Court is likely to find that Section 2(c), at least in this context, is not unconstitutional. Stay tuned to the TMCA for an update when the Supreme Court issues their opinion.

When Taco Bell announced its intention to eliminate all exclusive trademark rights in the phrase TACO TUESDAY, it invoked the Declaration of Independence, claiming that any restriction on the right to use it “violates an American ideal: ‘the pursuit of happiness.’” Though the fast-food giant’s most recent victories are perhaps smaller in scale than winning the Revolutionary War, it certainly had reason to celebrate after successfully cancelling another trademark registration for the popular phrase. In May 2013, Yum! Brands’ subsidiary Taco Bell filed a number of petitions before the Trademark Trial and Appeal Board (“T.T.A.B.”) to cancel third-party registrations for TACO TUESDAY in connection with restaurant services. Trademark registrations are not absolute, but provide a presumptively exclusive right to use a trademark in connection with the registered good and services. In its petitions, Taco Bell overtly stated it did not seek monetary damages (which the T.T.A.B. does not have the authority to award anyway), but rather that no one party should have an exclusive right to use TACO TUESDAY: “[a] win for Taco Bell [] is a win for all.” In addition to these legal filings, the company began an extensive PR campaign, issuing press releases and releasing a commercial starring LeBron James where each of his attempts to say TACO TUESDAY is “bleeped.” The fast-food company hinged its petitions on the principle that no party is entitled to a trademark registration for words or phrases that are generic for specific goods or services. In other words, because consumers understand the phrase TACO TUESDAY to refer to “promotions, deals, coupons, and other incentives for purchasing tacos and related products on Tuesdays,” no single restaurant or food provider should own the exclusive right to use it. Even before Taco Bell began its taco crusade, the T.T.A.B. took a similar position in ruling that the phrase cannot serve as a trademark for beer because it is so widely used—see our January 2023 article Taco Tuesday: It’s a Tasty Cultural Phenomenon Not a Trademark. Unlike the prior decision by the T.T.A.B., however, Taco Bell’s petitions never reached the ruling stage. The company’s primary targets were Wyoming-based Spicy Seasonings, LLC (owner of the Mexican food chain Taco John’s) and New Jersey-based Gregory’s Restaurant & Bar. Each owned registrations for TACO TUESDAY in connection with restaurant services, with the latter owning the right to use the mark in New Jersey, and the former in the other 49 states. Rather than engage in a costly fight with Taco Bell before the T.T.A.B., and potentially the court of public opinion, Spicy Seasonings voluntarily surrendered its registration on July 18, 2023. On October 20, 2023, Gregory’s followed suit and surrendered its registration for TACO TUESDAY. As a result, Taco Bell has presumably ended its fight to abolish exclusive rights in the phrase, which according to the company would have been the equivalent of “depriving the world of sunshine itself.” Such a victory illustrates not only the vulnerability of common phrases as trademarks, but also the importance of the non-legal side of trademark challenges—Taco Bell appears to have spared no expense in its PR campaign, which may have played an important role in inducing Spicy Seasoning and Gregory’s to surrender their registrations.

Plaintiffs look to the past to take action against modern web tracking As states rapidly enact new consumer privacy legislation, businesses have been working tirelessly to comply with extensive new data protection obligations and build out compliance programs. Despite the fact that these new state laws lack a private right of action for violations associated with online tracking and data sharing, private plaintiffs across the country have found creative workarounds, filing a wide range of novel claims alleging violations of decades-old privacy laws. These claims seek to expand the reach of these older laws to modern technologies, adding a new, dynamic layer to businesses’ privacy concerns. Driving the explosion in litigation are a series of decisions that have given new life to claims under state and federal wiretap laws and for violation of state constitutional common law privacy rights in the context of common online technologies. As a result, private plaintiffs are increasingly bypassing the broad limitations on private rights of action common to state consumer privacy laws, and making demands that go beyond, or potentially conflict, with the requirements set out in those laws. For now, many of these actions are relatively novel claims working through lower courts, often on preliminary motions. The causes of action and defenses continue to evolve, and there remains considerable change and uncertainty as these cases develop. However, recent trends suggest that courts are engaging in critical and nuanced evaluations of these claims in the context of popular online advertising and communications technologies.   What technologies are the focus of Plaintiffs’ claims? The key technologies at issue in these cases are online advertising services, social media “pixels,” “chatbots,” and “session-replay” technologies commonly used by businesses with consumer-facing online services. Online advertising, such as display advertising, retargeting, or remarketing services often involve the use of consumer profiles that are accessed and distributed among myriad companies involved in the ad personalization and bidding process. Social media pixels and other integrations allow companies to connect their website with social media services to obtain insights about consumer demographics and other marketing data and to run targeted marketing campaigns on popular social media sites. Chatbots are third party tools that companies add to their sites that allow customers to seek support, find products, and ask questions. Session replay technologies involve the recording of user interactions on sites for usage, debugging, and similar analytical purposes, but which may involve creating a record of user data entered in form fields, or similar information. In each case, third party providers operate these technologies and are granted access to data relating to the customer’s activity on and other interactions with the business’s online services and, in some cases, communications with the business. In the case of social media pixels, social media companies may have access to information such as the products or content that the user viewed, shopping carts, purchases, and other information revealed by ‘tags’ that companies place on their services. Social media sites then link this information to a user’s social media profile or other information the platform holds about the user, which the business can then use to obtain insights about consumer behavior and to target advertising to similar users on social media sites. What claims are plaintiffs bringing? To challenge companies’ use of these technologies, plaintiffs are looking to the past, bringing challenges under state and federal wiretap acts (telephone privacy), under state constitutional or common law privacy (e.g., invasion of privacy, intrusion upon seclusion), and the Video Privacy Protection Act (“VPPA”), a relatively obscure 1987 law passed in response to the disclosure of supreme court nominee Robert Bork’s video rental history. Each of these laws permit private claims and provide for statutory damages, which may allow private individuals to bring claims without proof of actual damages. The federal Wiretap Act (18 USC § 2511) provides a cause of action against “any person who … intentionally intercepts … or procures any other person to intercept or endeavor to intercept any wire, oral or electronic communication.” Similarly, California’s Invasion of Privacy Act (Cal. Pen. Code § 631(a)) “CIPA”) provides a cause of action against a person who “attempts to read, or to learn the contents or meaning of any message, report, or communication” including anyone “who aids, agrees with, employs, or conspires with any person or persons” to engage in such conduct. However, both CIPA and the federal wiretap act allow such conduct with the consent of all parties to the communication. In addition to the wiretap claims, plaintiffs have brought claims under state constitutional or common law for invasion of privacy. For example, in California a person has a cause of action where another person ‘intentionally intrudes into a place, conversation, or matter as to which the person has a reasonable expectation of privacy and the intrusion is highly offensive to a reasonable person.’ The VPPA (18 USC § 2710) provides a cause of action against a “video tape service provider who knowingly discloses, to any person, personally identifiable information concerning any consumer of such provider” without authorization. While the VPPA was originally intended to address videotape rental services, the VPPA also applies to “any person engaged in the business … or deliver or prerecorded video … tapes or similar audio visual material.” For each of these claims, plaintiffs fundamentally allege that behavioral and interaction data collected by online services reveals private information, communications, or other information protected by law. For example, in cases where defendants use online advertising or social media pixels, plaintiffs allege that these services allow the website operators, or their advertisers or social media partners, to collect detailed, private information relating to their demographics, preferences, and behaviors. For businesses with video offerings, plaintiffs further allege that the disclosure of information relating to the videos, e.g., the title, violates the VPPA. Similarly, on sites that use chatbots or session replay technologies, plaintiffs often allege these technologies result in the disclosure of protected communications. The outcome of these claims tend to turn on several of key facts: In all cases: Did the plaintiff provide consent? The quintessential defense to each of these claims is the plaintiff’s consent to the collection or disclosure of the information at issue. However, there remains some dispute over the elements of consent required in each case. Important open questions include the means and extent to which a plaintiff was notified of the alleged conduct (e.g., via a standalone notice or general privacy policy), or whether the plaintiff affirmatively opted-in, acknowledged the use, or if legal notices were available for review when the plaintiff used a service. Was there actual harm? Despite statutory damage provisions, there remain open questions as to whether plaintiffs can bring claims in cases where there is no injury in fact or no allegation of legally cognizable harms. The Supreme Court’s landmark Spokeo and TransUnion cases continue to develop alongside many of these claims. For wiretap claims: Does the technology involve the disclosure of communications content? Generally, wiretap claims require the defendant to have intercepted the content of a communication, not merely information relating to the communication (e.g., number dialed, time, etc.). Wiretap laws such as CIPA also cover interception of the meaning of a communication. In the case of behavioral advertising or social media, there is considerable debate as to whether browsing metadata that reveals demographic information, usage history, or information regarding products viewed or purchased reflects a “communication.” Similarly, in cases of session replay technologies, it may be unclear whether actual communications, or mere interaction data were collected, especially where services offer redaction tools that enable operators to exclude communications content, but the redactions are not visible to the public (or in a manner sufficiently apparent at the pleading stage). Is the party a third party? Where a defendant or their agent is a party to communication, those parties generally cannot be liable under wiretap laws. Therefore, in cases where a service provider is required to provide services only on behalf of a business (i.e., subject to a services agreement and data protection agreement), parties may be able to avoid liability and dismiss claims under wiretap acts under this exception. However, where social media companies or advertisers can use data for their own purposes, it is debatable (and highly context dependent) whether the social media platform could be deemed a party to the communication. For invasion of privacy claims: Does the plaintiff have a reasonable expectation of privacy? Foundational to all invasion of privacy claims is the defendant’s reasonable expectation that the information or communication was private. As with wiretap cases, where a business collets only general commercial information or metadata about a communication—but no actual communication—courts are less likely to find that the defendant has a reasonable expectation of privacy. Where the volume or nature of data reveals only common, or readily observable behavior, courts are also less likely to find a reasonable expectation of privacy. However, where a business collects detailed search histories or other data that collectively reflects the substance of a communication or significant amounts of information about a person, some courts have found that plaintiffs may have a reasonable expectation that such information would remain private. A defendant’s conduct can also give rise to expectations of privacy, e.g., though the provision of opt-out options, or affirmative statements that certain data would not be collected. Was the conduct highly offensive? In additional to the plaintiff’s reasonable expectation of privacy, the defendant’s conduct must be “highly offensive.” There is considerable debate over this element, as courts often must consider vague, and sometimes evolving, social norms. However, in cases where information collected is general commercial information or otherwise non-sensitive, courts often find that such conduct was not offensive enough to support a claim, notwithstanding the plaintiff’s reasonable belief that the information would remain private. For VPPA claims: Is the business is a video tape service provider? The VPPA applies only to video tape service providers that are “engaged in the rental, sale, or delivery of prerecorded video cassette tape or similar audio visual materials.” While courts have expanded this to online streaming services and other online video platforms, courts have found that a party may not be a ‘service provider’ where they merely deliver video content (for no fee) or where the video offering is only ancillary to the business (e.g., a video on a marketing website for a consumer products company). Similarly, courts have found that providers offering live content or livestreams are not video service providers. Is the plaintiff a “consumer”? A consumer for purposes of VPPA is a “renter, purchaser, or subscriber of goods or services from a video tape service provider.” Recent VPPA cases have scrutinized the nexus between plaintiffs’ relationships with the business and the video content at issue. In cases where video is neither core to the business nor the subscription or purchase transaction, courts have found that an individual is not a consumer for VPPA purposes. However, where exclusive video content or similar offerings are made to subscribers as part of a purchase, courts are more likely to find a sufficient nexus between the video content and a subscription or other commercial transaction. Is the disclosed data “personally identifiable”? The VPPA defines personal information “as information that identifies a person as having requested specific video material from the video tape service provider.” This definition is narrower than definitions under modern consumer privacy laws that extend to data that that is identifiable or linked or linkable to a person. Some data from social media services is known to link directly to user profiles that readily identify individuals, and as such may be personally identifiable. However, data that is not directly identifiable, such as anonymous user IDs (isolated from data sufficient to link to a known ID), IP addresses, and the like may not be personally identifiable for purposes of the VPPA. How should businesses respond? In response to the wave of cases, businesses should take steps to ensure that they review and evaluate the implementation of common web technologies, in particular those involving social media, advertising, session replay technologies, and video content. Dorsey’s team of privacy lawyers can provide advice and assistance with measures to mitigate the risks of litigation under these novel claims. Dorsey’s privacy team will continue to monitor these cases and report on updates as courts consider these cases and critical facts continue to develop.

For 48 years, the Trademark Trial and Appeal Board of the U.S. Patent & Trademark Office has held that if a trademark registrant files a fraudulent declaration under Section 15 of the Lanham Act to make its registration incontestable, the registration is cancelled in its entirety, full stop. But on October 18, the U.S. Court of Appeals for the Federal Circuit put an end to that, holding that the TTAB lacks the statutory authority to cancel a registration in its entirety due to a fraudulent incontestability filing. As to what the penalty for such a fraudulent filing is or could be, well, the Federal Circuit threw out a few ideas, but it seems it will be for TTAB to figure that out. How did we get to this point? Picture it: West Hollywood, 1964. A young Serbian immigrant, Dobrivoje Tanasijević, who adopted the name Dan Tana not long after arriving in the United States, opens his eponymous Italian eatery. By the 1970s, Dan Tana’s has become a legendary showbiz hotspot, celebrated on The Tonight Show and frequented by all the boldface names of the day, from John Wayne to Linda Ronstadt. The restaurant becomes so popular that the lead character in the hit ABC television show Vega$, played by Robert Urich, is given the name “Dan Tanna” by the show’s producer and restaurant habitué, Aaron Spelling. The restaurant continues to flourish today on Santa Monica Boulevard, under new ownership following Mr. Tana’s sale of the place in 2009. Prior to the sale, in 2005, Mr. Tana tried to register his DAN TANA’S trademark with the PTO, but registration was refused because an Atlanta-area restaurant operated by Great Concepts LLC, had registered DANTANNA’S for restaurant services in 2003. An aggrieved Mr. Tana sought to cancel this registration, and he also sued Great Concepts for trademark infringement in 2008 in the U.S. District Court for the Northern District of Georgia; the cancellation proceeding was suspended during the pendency of the federal court action. Unfortunately for Mr. Tana, he lost the federal case before the district court in 2009, and then on appeal to the U.S. Court of Appeals for the 11th Circuit in July 2010. The cancellation proceeding was dismissed in December 2010. End of story, right? Wrong. On March 8, 2010, Great Concepts’ counsel filed with the PTO a combined declaration of use and incontestability under Sections 8 and 15 of the Lanham Act to maintain the DANTANNA’S registration (under Section 8) and to make the registration incontestable (under Section 15). In that declaration, the attorney swore, under penalty of perjury, as required for the registration to achieve incontestable status under Section 15, that “there is no proceeding involving said rights pending and not disposed of either in the U.S. Patent and Trademark Office or in the courts.” The problem: this statement was obviously false, because both Mr. Tana’s appeal and his cancellation proceeding were pending when the declaration was filed. Notwithstanding this glaring untruth, nothing happened until 2015, when Mr. Tana’s successor, Chutter, Inc., petitioned to cancel Great Concepts’ registration based on the untrue 2010 incontestability filing. The TTAB did just that, holding that, under Crown Wallcovering Corp. v. Wall Paper Mfrs. Ltd., 188 USPQ 141, 144 (TTAB 1975), when an incontestability filing is made fraudulently, the proper remedy is cancellation of the registration in its entirety. The TTAB had little trouble concluding that fraud had indeed occurred, given the concededly false statement contained in the Great Concepts declaration. The Board also noted that: (i) the attorney who filed the declaration was Great Concepts’ counsel in both the then-pending federal litigation and cancellation proceeding, so he clearly knew the declaration was false; (ii) the attorney’s claim that he was not aware of the legal requirements for a Section 15 declaration was no excuse; (iii) nor was his claim that a paralegal prepared the declaration, which he failed to read carefully; and (iv) Great Concepts and its counsel were aware of the false filing no later than February 2014 but failed to correct it with the PTO. Great Concepts appealed the TTAB decision to the Federal Circuit, and that appeal succeeded last week, in a 2-1 precedential decision. Why? The majority opinion offered a variety of reasons, starting with the text of the Lanham Act. Section 14 of the Lanham Act allows for cancellation “at any time” if the “registration was obtained fraudulently” (emphasis in majority opinion). According to the Great Concepts majority, the plain meaning of the statute covers fraud occurring in the context of initial filings made in support of an application to register a mark, and Section 8 filings to maintain the protections afforded by a registration. But, per the majority, a Section 15 incontestability filing is only optional and not made to “obtain” or even to “maintain” a registration, but to enhance the rights afforded to a registrant. In addition, Lanham Act Section 33(b) provides that an accused infringer can defend against claims brought by the owner of an incontestable registration by asserting that the owner’s incontestability filings were made fraudulently, but that Section says nothing about cancellation, just loss of incontestable status. Thus, the majority concluded that the Board has no statutory authority to cancel a registration when a fraudulent incontestability filing is made. In light of this holding, the Court did not reach the issue of whether Great Concepts had actually engaged in any fraud, and it remanded to the Board the question of what consequences, if any, should result from the false incontestability filing. In its decision, the majority rejected a series of arguments advanced by Chutter, and the dissent, as to why its holding was erroneous. First, the majority held that, notwithstanding 47 years of Board precedent to the contrary, the Lanham Act says what it says and if Congress wants to make cancellation of a registration in its entirety a remedy for a false incontestability filing, it can do so. The majority also noted that McCarthy on Trademarks and Unfair Competition has long agreed with the majority’s statutory reading, so it’s not like their holding was some sort of outlier, although the majority acknowledged that Gilson disagrees with McCarthy on this point. The majority also distinguished prior Federal Circuit cases suggesting agreement with the Board’s now overturned holdings, stating that these cases never directly presented the question decided in Great Concepts. Second, the majority held that the PTO’s administrative decision to allow registrants to make Section 8 (maintenance) and Section15 (incontestability) filings together, in the same document, did not cause Great Concepts’ Section 8 filing to be fraudulent. The majority held that the PTO in practice treats these combined filings separately, with separate filing fees, such that the PTO’s efforts to make post-registration filings more efficient and simpler for registrants did not and could not trump the Lanham Act’s text. Third, the majority rejected the policy-based arguments on which the dissent focused, rejecting the characterization of its holding as one making fraudulent incontestability filings a “costless offense.” After all, the majority said, the Board could take away a registration’s incontestable status as a penalty for a false Section 15 filing. Or, it could sanction the attorney who signed the declaration, even referring them to the PTO’s Office of Enrollment and Discipline, and maybe even for criminal prosecution (!) The majority defended its holding by stating that: Our ruling that a Section 14 cancellation of a registration is not an available remedy for a fraudulent Section 15 declaration – a conclusion we reach because Congress chose not to empower the Board with the ability to impose that specific consequence – is a ruling that this one remedy is unavailable, leaving the Board, we expect, with sufficient mechanisms to adequately deter fraud. To the dissent, all of this was just words, and it argued the majority was “excus[ing] fraud” and violating the “pact” with the general public when it comes to the grant and protection of intellectual property rights. It also scoffed at the majority’s seemingly preferred remedy – the loss of incontestable status – as a “no harm, no foul” solution that was wholly inadequate to deter fraud, particularly in this case, where there was “substantial evidence” showing that Great Concepts and its counsel had perpetrated a fraud on the PTO. Indeed, the dissent claimed that the majority had constructed “a milepost in the trademark administrative continuum, at which point (Section 15) fraudulent wrongdoing is greenlighted. The majority does not provide a principled rationale for such a milepost.” Apart from the adverse policy consequences weighing against the majority’s holding, the dissent’s view was that a Section 15 filing is part of a broader array of trademark maintenance filings that include Section 8 filings to maintain a registration and Section 9 filings to renew a registration. As a result, whenever a registrant fraudulently “obtains” any of the rights afforded to a registrant by virtue of owning a registration, cancellation of the registration is an available remedy. The fact that the PTO allows combined Section 8 and 15 filings to be made together, in one document, which states explicitly that willful false statements “may jeopardize the validity of this document” (emphasis added by dissent), confirms the interrelated aspects of these various filings, according to the dissent. So too does the fact that a Section 15 filing “may also be used as the affidavit or declaration required by section 8” (emphasis added by dissent, citing 37 CFR § 2.168). In closing, the dissent criticized the majority for suggesting alternative penalties the Board might consider on remand, and instead invited the Board to clarify whether it considers Section 15 filings to be part of the trademark registration maintenance process. As to what happens next in this case, your guess is as good as mine. An en banc review is a possibility, but given the remand to the TTAB for additional proceedings, the case may not be ripe for Supreme Court review. If there are no further, immediate appellate proceedings, the TTAB will have to decide whether to accept the dissent’s invitation to address whether a Section 15 filing qualifies as one that maintains a trademark registration. The Board will also have to consider what sort of sanctions, if any, are available when a fraudulent incontestability filing is made. Loss of incontestability? If so, forever, or could a new, fraud-free Section 15 filing be made? Sanctions on the offending attorney? If so, of what kind? What if the Section 15 declaration was filed by a non-attorney or the registrant itself? And does the Great Concepts decision make it more likely that registrants will run the risk of making false incontestability filings, because there is no clear penalty for such an act? Or not? Stay tuned for future updates on this esoteric, but important, issue.

On September 29, 2023, the Supreme Court granted certiorari in Warner Chappell Music, Inc. v. Nealy, a case that should resolve a split among the U.S. Courts of Appeal relating to the scope of damages available to copyright holders. The Supreme Court’s decision will determine whether a party can recover damages for copyright infringement that went undiscovered for more than three years before a lawsuit is filed. In the abstract, the question might seem rather narrow. But imagine you are an artist, someone uses your work without your permission, and you do not learn about it until four years later. Can you still sue for copyright infringement? The Court’s decision may determine how thorough copyright owners have to be in their efforts to ferret out infringers before their claims are time-barred. This post is the first of a series that will follow the Warner v. Nealy case. Over the next few months, we will publish updates on the case and provide an analysis of the Supreme Court’s forthcoming decision. But first, let’s discuss the question presented to the Court, take a look at the factual background of the dispute and the potential impact of the Supreme Court’s decision. Question Presented The Supreme Court granted certiorari on one question: whether, under the discovery accrual rule applied by the Circuit Courts and arising from the Copyright Act’s statute of limitations, a copyright plaintiff can recover damages for acts that occurred more than three years before the filing of a lawsuit. The Copyright Act has a three year statute of limitations reading “no civil action shall be maintained . . . unless it is commenced within three years after the claim accrued.” 17 U.S.C. § 507(b). The Supreme Court previously analyzed Copyright Acts’ statute of limitations in Patrella v. Metro-Goldwyn-Mayer, and determined that the defense of laches cannot bar a claim for damages within the 3-year limitation period. In the Patrella case, the Supreme Court said that Section 507(b) bars relief of any kind for conduct occurring prior to the three-year limitations period. Given the Supreme Court’s prior decision, it may seem clear that damages are limited to such three-year period. Enter the discovery accrual rule. Under the discovery accrual rule, a claim arises when a party learns, or a reasonable person should have learned, that the defendant violated its rights. As we have reported previously, courts apply the discovery accrual rule differently to copyright disputes relating to ownership than those relating to injury. For copyright claims relating to ownership, the claim arises only once and at the time the copyright owner discovers, or should have discovered, that another challenges their ownership of the copyright. If a copyright owner discovers such a claim within three years of filing the Complaint, the case is considered “timely” and generally is not barred by the statute of limitations. However, courts have differing opinions on how the discovery accrual rule applies to damages for copyright infringement. In the present case, the Eleventh Circuit Court of Appeals found that a plaintiff who has a timely claim—that is, it discovered the infringement less than three years before filing the Complaint—may obtain damages accruing beyond the three year period before the plaintiff filed suit. The court found that the Ninth Circuit Court of Appeals also supported this view. The Second Circuit Court of Appeals takes a different approach. The Second Circuit applies the discovery accrual rule when determining whether a claim is timely, but views Section 507(b) and Patrella as prohibiting recovery of damages from infringement occurring more than three years before a plaintiff files suit. In other words, you can sue for copyright infringement that occurred more than three years ago, but you cannot recover damages for that same infringement period. Thus, there is a circuit split that the Supreme Court’s decision in Warner should resolve. Facts of the Case In December 28, 2018, Nealy and his company Music Specialists Inc. (MSI) filed a Complaint against, among others, Warner Chappell Music, Inc. in the U.S. District Court for the Southern District of Florida. The plaintiffs alleged that, since 2008, Warner had infringed Nealy and MSI’s copyright in several songs by distributing them to others. The most lucrative of the songs was “Jam in the Box,” which Flo Rida and will.i.am sampled in their hip hop hit “In the Ayer.” Flo Rida and will.i.am’s song went double platinum and peaked at No. 9 on the Billboard Hot 100. Despite the ten year delay in taking action, Nealy and MSI rely on the discovery accrual rule to seek both injunctive relief and damages. For its part, Warner does not deny that it distributed the music, but argues that it was authorized by a third party to do so. The Eleventh Circuit Court of Appeals found that the only dispute in the case is whether the plaintiffs own the copyrights. The parties stipulated that if Nealy and MSI—not the third party—own the copyrights, the only remaining issue is damages. The Court readily accepted Nealy and MSI’s claims as timely under the discovery accrual rule. Nealy had a compelling reason the delay: he was in prison from 1989 to 2008 and again from 2012 to 2015. He did not discover Warner’s infringement or the third party’s claim to the copyrights until early 2016, less than three years before the plaintiffs filed the Complaint. The more difficult question is whether Nealy and MSI can recover damages dating back to 2008 or whether their recovery is limited by the three year statute of limitations. The Eleventh Circuit began by analyzing the Patrella decision and finding that it was not controlling. Specifically, Patrella only answered whether the laches defense applied to the plaintiff’s claims and the plaintiff in Patrella was not seeking damages for conduct outside the statute of limitations. The Court in Patrella had also noted that it was not opining on the discovery accrual rule. The Eleventh Circuit also analyzed the text of the Copyright Act. It found that Section 507(b) relates only to the timeliness of a claim and does not limit remedies available to a party. It noted that the “damages provisions” of the Copyright Act, 17 U.S.C. § 504, do not include any limits but broadly permit a party to seek “actual damages and any additional profits of the infringer.” The Court ultimately concluded that Nealy and MSI’s damages would not be limited to the three years preceding the filing date of the Complaint. Industry Impact Although Warner’s appeal has not yet been addressed on its merits, scholars and industry groups have filed amicus briefs that highlight the legal and practical implications of this case. The Recording Industry Association of America and National Music Publishers’ Association filed an amicus brief urging the Supreme Court to grant certiorari. These associations noted that “copyrights are the music industry’s most consequential asset” and argued that it is “exceptionally important” that the Supreme Court provide “a clear, predictable, and geographically consistent answer” to the question presented. They also highlighted the burden that the circuit split has placed on the industry. For example, they noted that the music industry is constantly involved in litigation in the Ninth Circuit and the Second Circuit—which happen to have the most copyright cases in the country—and are faced with navigating two inconsistent approaches to the scope of available damages. A group of professors from Southwestern Law School and the Chamber of Commerce of the United States also filed amicus briefs, arguing that the discovery rule should not apply to the Copyright Act. According to these amici, the Supreme Court should simply hold that the three year statute of limitations is controlling and find that the discovery accrual rule cannot be used for timeliness or damages purposes. One thing the amici agree on is that the Supreme Court needs to resolve the circuit split and provide some much needed clarity on the scope of damages available under the Copyright Act. No matter what the Supreme Court decides, the effects of its decision will extend far beyond the music industry. Stay tuned to the TMCA.com blog as we further discuss this case and the Supreme Court’s ultimate decision.

The small blue bird adorning nearly every company’s social media section. The verbiage “tweet” and “retweet” working their way into the fabric of modern language. The creation of character-limited, short-form posts as a new method of communication used by presidents, dignitaries, celebrities, and everyday people alike. Even with the ubiquitous rise of social media over the last few decades, it is difficult to find a company and brand that has had more of an impact on society as a whole than Twitter. Its roots date back to 2006 when a group of friends and coworkers conjured a new version of sending text messages. Instead of the one-to-one nature of text messages, Twitter allows people to share thoughts, ideas, and messages with larger groups of people all at once via the Internet. On July 15, 2006, this idea—originally called “twttr,” but soon after expanded to “Twitter”—was released to the public, and transmitted roughly 20,000 posts, or the now infamous “tweets”, per day. When Twitter was showcased at the South by Southwest Interactive Conference in 2007, up to 60,000 tweets were posted each day. By early 2010, a short four years after its public launch, Twitter was up to 50 million tweets per day. Not only did Twitter revolutionize a new way of communication, but it gave new meaning to otherwise standard, infrequently used symbols. The pound symbol, #, has long been used in information technology systems to denote specific pieces of text—used after a number to denote “weight,” or used in front of a number to denote “number.” Twitter gave this symbol new meaning, redefining it as the “hashtag,” a systematic way of categorizing groups of information, wherein users can find specific content relevant to the mentioned hashtag. In 2014, the word “hashtag” was added to the Oxford English Dictionary, meaning “a word or phrase with the symbol # in front of it, used on social media websites and apps so that you can search for all messages with the same subject.” In addition, Twitter user handles, used to identify the account owner, begin with the @ symbol, which has now expanded into a common form of electronic speech to direct attention at a specific person, whether on Twitter or elsewhere. This is similar to the @ symbol as it was first introduced in 1972 as part of the first electronic message communication—now known as email—to indicate the location or institution of the email recipient. In nearly twenty years, Twitter has changed how humans communicate, whether they use the social media service or not. And it is difficult to quantify this level of impact on society as a whole. Most small business owners and entrepreneurs may start their companies with the lofty goal of someday owning a regionally, or even nationally, successful and recognized brand. But the vast majority of these new companies never reach global status, and never reach a billion-dollar valuation. Twitter did. By 2023, Twitter reached 500 million tweets per day and a market cap valuation of over $40 billion. Valuation experts value just the Twitter brand—not the company itself, but the TWITTER trademark, the TWEET and RETWEET marks, and the blue bird—anywhere from $4 billion to $20 billion. Most companies in the world will never achieve a trademark brand valuation anywhere near this number, and it is, without a doubt, an impressive feat. Which is why, in July 2023, Twitter users, social media and tech companies, the trademark and branding worlds, and the consuming public in general were shocked to learn that new ownership had decided to rebrand away from this $20 billion asset to something arguably far less distinctive, and, as many trademark experts note, possibly generic: the letter “X.” While curious to many, this rebranding to the X mark may be part of a larger branding scheme. The same ownership of X Corp. (formerly Twitter) owns Space Exploration Technologies, or “SpaceX,” an astronautics company founded in 2002. In July 2023, ownership founded xAI, an artificial intelligence company with the ultimate goal of “understand[ing] the true nature of the universe.” To date, xAI does not appear to have rendered any services, but has filed trademark applications for a stylized design of the xAI mark covering artificial intelligence-based computer services. Even the new Twitter domain name—x.com—is a nod to the old online bank that eventually became PayPal, founded by the same owner as these X-based companies. Shortly after the rebranding announcement, the little blue bird and TWITTER trademark disappeared from the website and app, replaced with a slightly stylized letter X. Twitter’s renamed parent company, X Corp., filed a slew of trademark applications on September 22, 2023, all for the standard character X mark, covering a range of services in Classes 38, 41, and 42, among others, including U.S. Serial No. 98/193,533 for “Hosting an online website community for registered users to share information, photos, audio and video content and to form virtual communities; Providing user authentication services in e-commerce transactions” in Class 45. The current pace of examination at the USPTO means the applications will most likely not be reviewed until late spring 2024, but it is probable they will face hurdles to registration. The USPTO’s registry is replete with X-formative marks covering arguably similar services, including registrations owned by Comcast Corporation and Microsoft. While most of the existing registrations incorporate a design element, a standard character mark, like the one filed by X Corp. is likely to face objections based on prior rights. Even if X Corp. were to refile new applications with the stylized version of its X mark, some experts believe that current stylization used by the company may not be sufficiently distinct. Further, mathematical scholars have noted the X mark looks strikingly similar to a generic Unicode character used in the international computing standard to denote an abstract geometric space or object. The mark is also identical to the lowercase X in the Monotype Special Alphabets 4 font set. As applied to computer programming, this could make the X mark generic, and under the Lanham Act, “generic terms are never eligible for trademark protection because they refer to a general class of products rather than indicating a unique source.” If found to be generic, not only will it be impossible for X Corp. to register its stylized X, but it won’t have any trademark protection at all, for at least some services. Meanwhile, numerous new applications for the word mark TWITTER were filed in July 2023 by applicants seeking to seize upon the apparent abandonment of the TWITTER trademark. Many of these new applications (filed by individuals) cover similar computer-based goods and services included in the existing TWITTER registrations. Although these new applications are also unlikely to succeed and will be refused based on the existing TWITTER registrations, these individuals may be laying the groundwork for a cancellation action based on an intent not to resume use, all in an effort to stake a claim to this $20 billion brand. While any use of the TWITTER brand by a third party could, in all likelihood, be stopped based on a claim to residual goodwill, these efforts by third parties reflect the land grab created X Corp.’s decision. The fate of the famous TWITTER brand and its high-profile rebrand to X will keep USPTO examiners busy for some time. Even federal courts will see some action. On October 2, 2023, X Corp. was sued by a social media and marketing company called X Social Media alleging trademark infringement and violations of Florida state law, including common law unfair competition and unfair trade practices, based on X Social Media’s alleged prior use of the X SOCIALMEDIA mark since 2016. Whatever the outcome—whether X Corp. is able to ever achieve a federal registration for its X mark, or who becomes the successor to TWITTER trademark ownership—many will continue to question the motivation to rebrand away from such a famous, globally recognized, and arguably historic brand.

On 10 July 2023, the European Commission adopted its adequacy decision for the EU-U.S. Data Privacy Framework (“DPF”). The adequacy decision is designed to relieve U.S.-based businesses and other institutions and organisations that choose to participate in the DPF from legal uncertainties and administrative burdens in relation to personal data records originating from the EU. It is expected that the UK and Switzerland will soon adopt similar decisions that will allow participating organisations to enjoy the benefits of the DPF in relation to data imported from those two countries for processing in the U.S. or by U.S. organisations. The DPF is the third attempt to create a data bridge between the EU – with its heightened concern for protecting privacy interests of individuals – and the U.S., which has been for the past few decades slow in adopting policies and legislation to protect those rights (although more recently consumer privacy legislation is increasingly being adopted by US state legislatures). Even before the EU introduced its General Data Protection Regulation (“GDPR”), there was a self-certification scheme in place – not altogether unlike the new DPF – which allowed US-based companies and organisations to import personal data from the EU on the basis of the organisation’s legal commitment to safeguard the data and to protect the interests of data subjects. Just like the new DPF, under that scheme (the “Safe Harbor” arrangement), mechanisms were put in place to allow the U.S. Department of Commerce to enforce the commitments of participating organisations and to allow individuals to bring complaints. Just like the DPF, the “Safe Harbor” scheme was approved by the EU Commission under applicable EU law. GDPR was designed to allow the “Safe Harbor” scheme to continue to operate. It contained specific provisions empowering the EU Commission to enter into international arrangements like the “Safe Harbor” and the DPF. But in its decision of 6 October 2015 in the Maximilian Schrems v Data Protection Commissioner case (C-362/14), the EU Court of Justice held that the “Safe Harbor” scheme failed to meet the requirements of EU law in relation to the protection of personal data when it is taken outside the jurisdiction of the EU. In 2016, the EU Commission approved a second scheme, known as the EU-U.S. Privacy Shield. That scheme was once again ruled in a subsequent decision of the EU court of 16 July 2020 (Schrems II, C-311-18) to have fallen short of EU legal requirements. In both decisions, the main reason for the EU Court’s decision that personal data transferred to the U.S. under the terms of the schemes was not sufficiently protected, was the evidence that U.S. national security and law enforcement agencies were engaged in wide-range, on-going, and (according to the Court’s findings) indiscriminate mass monitoring and surveillance of communications which the agencies access through “back doors” provided by social media and other digital platforms based in the U.S. The rulings of the EU Court were particularly focused on the absence of legal redress mechanisms in the U.S. for EU individuals whose data is or may be exposed to such surveillance. The EU Commission gave its blessing to the new DPF scheme based largely on the signing by President Biden on 7 October 2022 of Executive Order 14086 on Enhancing Safeguards for United States Signals Intelligence laying down limitations and safeguards for all U.S. signals intelligence activities and on a supplemental Regulation on the Data Protection Review Court (28 CFR Part 302) issued by the U.S. Attorney General. Among other things, the Executive Order and the associated Regulation establish a tribunal and proceedings that affected EU individuals will be able to use to bring complaints regarding the use of their data by intelligence agencies. Those redress mechanisms and the other requirements of the DPF program were considered to be sufficient by the EU Commission to provide adequate safeguards to protect personal data transferred to the U.S. under the scheme. But what does this all mean for U.S. businesses, organisations, and institutions that consider signing up for the DPF program? Participation in the scheme means that the organisation will be free to collect, import, and use personal data records from any source in the EU without having to put in place transfer agreements with each data exporter and carry out transfer impact assessment in each case and without risking challenges against its use of personal data imported from the EU. This could be of real benefit for businesses and organisations that receive data regularly from the EU, particularly if they deal with many different categories of personal data, coming from different sources and processed for many different purposes. Self-certification under the DPF means that there is no need to address each and every one of those data transfers individually. Further, businesses and organisations love to declare that they respect people’s privacy and that they are committed to protecting personal information. By committing itself to the requirements of the DPF program, an organisation may be able to nurture the trust of other businesses, and organisations, and even the public itself, for being an organisation that truly respect the privacy of individuals and is committed to protecting their data. If the scheme is successful in attracting large portions of corporate America as well as various other organisations and institutions that may be eligible for the scheme, it might become a ‘must have’ for large companies in the public eye. The scheme undeniably offers advantage for some, but the administrative effort and the compliance burden in participating in the DPF should not be understated. One of the key criticisms of the defunct “Safe Harbor” scheme was that it lacked any real oversight or enforcement mechanisms. This is not the case with the DPF. The fundamental idea of the DPF (as any other mechanism to legitimise international data transfers outside the EU) is that the self-certifying organisation has to commit itself to a set of basic “Principles” which reflect the fundamental requirements of the GDPR, including securing for data subjects the same rights that they have under EU law. This in itself is a serious compliance burden which any organisation that contemplates joining the scheme should consider carefully. Alongside broad principles of establishing a legitimate basis for the use of data, particular protections for sensitive data, data security, controls over the re-purposing of personal data, and the sharing of data with third parties, the DPF also includes some very specific requirements. These include, among other things, specific information that has to be made available to data subjects regarding the organisation’s participation in the DPF scheme, the internal complaints handling procedures, and the external dispute resolution mechanism to which the organisation commits itself and other information. This means that participants would have to update their privacy policies to include this information. Participating organisations are also required to give data subjects certain specific choices – an opt-out from disclosures to third parties (other than service providers) and an opt-out from re-purposing the data. Apart from the implications of offering those choices, organisations would have to consider the logistics of offering these choices to all EU individuals whose data is being imported by the organisation into the U.S. Further, the DPF introduces a new set of requirements regarding the contractual arrangements that have to be put in place when the imported data is being shared with a third party controlling (that is, not a service provider which deals with the data on behalf of the participating organisation). Organisations will therefore need to set themselves up for new procedures and new contract forms for dealing with onward transfers. Another key element – which was lacking in the original “Safe Harbor” scheme but had already been addressed under the “Privacy Shield” program - is the requirement that the participating organisation must submit itself to external dispute resolution mechanisms. Those could take the form of private dispute resolution organisations, but there is also the option for an organisation to submit itself to the jurisdiction of data protection regulators in the EU. Either way, the requirement is that the mechanism must be free to the complaining individual. Finally, to ensure that participants maintain the privacy and data security standards to which they commit themselves through self-certification, the scheme requires participating organisations to verify their own compliance. Verification can take the form of self-audits or external audits. Either way, the verification needs to demonstrate that the participant’s privacy policy regarding personal information received from the EU is accurate, comprehensive, readily available, conforms to the “Principles”, and – importantly – that it is fully complied with. It must also indicate that individuals are informed of the organisation’s in-house complaint handling procedures and of the independent recourse mechanism(s) through which individuals may pursue complaints. Further, the verification needs to confirm that the participating organisation has in place procedures for training employees in the implementation of the privacy policy, and disciplining them for failure to follow it; and that it has in place internal procedures for periodically conducting objective reviews of compliance with the above. An annual self-certification declaration must be made each year confirmed by the declaration of a corporate officer. Executives would need to ensure their companies are indeed fully compliant before swearing such a declaration. Alongside the compliance burdens and verification and dispute resolution mechanisms, the DPF also includes a number of exceptions and provisions that apply to specific situations, such as allowances for journalism, airlines, and for corporate due diligence exercises, and special rules for clinical trials and medical research and for handling human resources data. These special rules are designed to ensure that the scheme’s requirements are not going to be prohibitive in respect of such activities or for organisations in the relevant sectors. They would require particular attention by affected organisations. Consideration of those sets of special rules is beyond the scope of this note.

Artificial Intelligence (AI) is one of the hottest topics in technology, with businesses studying how to utilize its benefits and at least some workers wondering if smarter and cheaper AI technologies will replace them. Here at the TMCA, we have been covering an AI-related issue of particular interest to IP attorneys – the ongoing battle of Dr. Stephen Thaler to copyright artwork created by AI software. Back in June 2022, Thaler filed a federal lawsuit in the District of Columbia challenging the Copyright Office’s refusal to register artwork Thaler had created using AI on the basis that human authorship is a requirement for copyright protection. Thaler then moved for moved for summary judgment in January 2023 on the sole legal issue of whether an AI-generated work is copyrightable, and Copyright Office cross-moved on the same issue. As we noted at the time, Thaler had a creative argument. In brief, Thaler posited that an AI programmer is like an employer, the AI is like an employee, and so a programmer like Thaler should be considered the owner of the AI artwork created by the AI/employee under the work for hire doctrine. Thaler’s attempt to equate AI technology with human employees is not likely to calm the fears of those who believe their jobs might be outsourced to machines in the not too distant future. It also didn’t convince the District Court that AI-generated works are entitled to copyright protection. In a decision issued last month, Judge Beryl Howell denied Thaler’s motion for summary judgment and granted the Copyright Office’s cross-motion. As the Court put it in succinct fashion: “Human authorship is a bedrock requirement of copyright.” In reaching its conclusion, Judge Howell addressed and dismissed all of Thaler’s arguments in support of his claim that his AI-generated artwork (which was displayed on P. 2 of the decision) was entitled to copyright protection. For example, the Court held that Thaler’s “work for hire” argument “put the cart before the horse.” The issue was not who could register a copyright, but rather whether any valid copyright existed in a work absent human involvement. Interestingly, the Court noted that Thaler had argued that there was in fact a degree of human involvement in the “development, use, ownership, and prompting of the AI generating software.” Unfortunately for Thaler, however, that alleged human involvement was not in the record, as Thaler had represented to the Copyright Office that the AI system generated the work autonomously and that he played no role in its creation. One wonders if a copyright application that emphasized the human involvement in directing and prompting AI would have more luck (and the Court itself pondered this issue towards the end of its decision). Photographs are entitled to copyright protection – isn’t there an argument that AI is just a more sophisticated form of machine but that AI-generated works are still human works? Maybe, though in the next section the Court drew a distinction between cameras and AI. The Court agreed with Thaler that copyright law has proven malleable enough to cover works created with new technologies – in fact, Section 102(a) of the current Copyright Act itself provides that copyright attached to “original works of authorship fixed in any tangible medium of expression, now known or later developed.” But human creativity is nonetheless, as the Court stated, “the sine qua non at the core of copyrightability.” As the Supreme Court held in Burrow-Giles Lithographic Co. v. Sarony, 111 U.S. 53, 58 (1884), photographs are the copyrightable creations of authors despite their use of a mechanical device because the photographic result represents the “original intellectual conceptions of the author.” Photographs, then, are more like paintings than AI-generated works. Thaler had no more success in arguing that the Copyright Act doesn’t define “author.” The Court consulted two dictionaries and concluded that the plain meaning of “author” means an “originator with the capacity for intellectual, creative, or artistic labor” (i.e., a human being). Such an interpretation is consistent with, in the view of the Court, “centuries of settled understanding” in copyright and patent law. Further evidence that copyright recognition requires human involvement is that numerous courts have consistently rejected copyright claims even when the claimed author was divine. Similarly, the works of monkeys are not entitled to copyright protection. The Court seems to conclude that if neither gods nor monkeys can register copyrights, then neither should AI be able to do so. Or at least one wishing to copyright an AI-generated work needs to show a great deal more human input than Thaler did.

Introduction In June 2023, the Privacy Commissioner for Personal Data in Hong Kong (the “Commissioner”) released a new guidance note on data breach handling and notifications (the “Guidance Note”). The purpose of this note is to assist data users in preventing and managing data breaches effectively. The Guidance Note is a comprehensive document which recommends best practices in data governance, risk assessments, technical and operational security measures, data processor management, and remedial actions during data security incidents. In today's new normal, which includes hybrid modes of working and learning, data users face challenges in protecting data privacy and security. The Guidance Note is designed to help businesses minimize the risks of data breaches, which can cause reputational and financial damages. Moreover, it sheds light on essential requirements on the Personal Data (Privacy) Ordinance (Cap. 486, Laws of Hong Kong) (the “PDPO”), compelling data users to safeguard personal data from unauthorized access, processing, erasure, loss, or misuse. The Guidance Note focuses on the following areas concerning data breach: 1. Preparing for Contingency - Data Breach Response Plan A data breach response plan is crucial for organizations to effectively manage and minimize the impact of data breaches. The plan should encompass procedures for identifying, containing, assessing, and managing incidents. It should also define the roles and responsibilities of team members, communication plans, risk assessment workflows, investigation procedures, and record-keeping policies. Taking swift action in response to a data breach can significantly reduce the extent of damage caused. Regular reviews of the plan and adequate staff training are essential to ensure its effectiveness. 2. Handling Data Breaches The recommended steps for handling data breaches demonstrate the data user's commitment to addressing the issue promptly, which can significantly reduce the impact on affected individuals and potential reputational damage. The steps include: Step 1: Gather all relevant information about the breach and escalate the incident to the dedicated data breach response team if necessary. Step 2: Take immediate steps to contain the breach, such as shutting down or isolating compromised servers and disabling relevant system functions. Step 3: Assess the risks of harm to affected individuals by evaluating the nature and sensitivity of the personal data involved and the circumstances of the breach. Step 4: Consider notifying the relevant authorities and affected data subjects as soon as practicable after becoming aware of the breach, particularly if there is a real risk of harm to those individuals. Step 5: Keep a comprehensive record of the breach to facilitate a post breach review, including all relevant details, and use the lessons learned to improve personal data handling practices. 3. Data Breach Notifications Data users need to act quickly in the event of data breaches. They should promptly notify relevant parties, including affected data subjects and the Commissioner, upon becoming aware of a breach. This notification is vital to mitigate potential harm, enable investigative actions, demonstrate commitment to data privacy management, raise public awareness, and seek advice. The notification should include a general description of the breach, date and time of occurrence, source, types of personal data involved, risk assessment, mitigation measures taken, and contact information for the data breach response team. Data subjects can be notified directly or through public announcements, while the Commissioner should be notified using its Data Breach Notification Form, which can be submitted online, by fax, in person, or by post. Oral notifications are not accepted, and the Commissioner provides assistance in completing the form. Conclusion The Guidance Note highlights the complex legal framework in Hong Kong that mandates remedial actions for data breaches and is a valuable resource offering insights and strategies to prevent and handle data breaches effectively. Data users must promptly notify affected parties and the Commissioner, take necessary measures to mitigate harm, initiate investigations, demonstrate commitment to data privacy management, raise public awareness, and seek advice. Non-compliance with these regulations can lead to severe legal consequences. Therefore, preventing data breaches has become increasingly crucial to safeguard personal data, protect reputation, and avoid financial harm. By following the recommendations, businesses can enhance their data governance, security measures, and response strategies, thus reducing the risks associated with data breaches. Vigilance and preparedness will be key to safeguarding personal data and preserving the trust of customers and stakeholders alike for any business. Alongside with the Guidance Note, the Commissioner has introduced an online notification form, streamlining the reporting process for businesses facing data breaches. Currently, failing to report data breaches to the Commissioner or affected parties does not constitute a breach of the PDPO. However, the Commissioner is proactively pursuing amendments to the PDPO. This endeavor includes working towards establishing a mandatory data breach notification mechanism. While the precise timeline for these legislative amendments remains uncertain, the release of well-defined proposals is expected in the near future.

On July 14, 2023, the California Attorney General announced an investigative sweep targeting CCPA compliance efforts by “large California employers.” The Attorney General’s Office stated that it sent inquiry letters to large California employers “requesting information on the companies’ compliance with the California Consumer Privacy Act (CCPA) with respect to the personal information of employees and job applicants.” The California Attorney General’s announcement is a reminder that all aspects of the CCPA are now applicable to employee, applicant, and other HR data. Before January 1, 2023, the CCPA only required covered employers to (a) safeguard HR data, and (b) provide a notice to employees, job applicants, owners, directors, officers, medical staff members, and contractors describing the categories of data collected in those contexts, and how that data would be used. However, California voters approved the California Privacy Rights Act (the “CPRA”) on November 3, 2020, which amended the CCPA and eliminated the exemption for data in the HR context. Effective January 1, 2023, covered employers’ obligations to comply with the CCPA as it relates to HR data expanded significantly. CCPA-covered employers’ HR data privacy obligations now include, among other things, drafting or amending compliant service provider agreements and establishing processes for handling requests from employees, applicants, contractors, and others in the HR context to exercise their rights to access, delete, correct, and opt out of the sale and sharing of their personal data. There is some degree of uncertainty as to how California employers can shape their CCPA compliance efforts. The CCPA regulations do not clearly address HR data, and the California Privacy Protection Agency (CPPA) recently acknowledged the lack of clarity in the CCPA regulations at a May 2023 meeting. The CPPA considered revising the CCPA regulations and/or adding exceptions or specific rules for employee data, given that “the current purposes are not really designed for” employee data, as one CPPA member noted. In addition, many employers who have fulfilled CCPA employee data access requests have been frustrated by the fact that the CCPA statute and the regulations do not contain meaningful exemptions applicable to data to be provided in the HR context, as can be seen in the General Data Protection Regulation, the comprehensive privacy law in the EU and UK, which does include HR data within its scope. Several other states exempted employee and other HR data from their own comprehensive consumer data privacy laws: Virginia, Colorado, Connecticut are currently in effect, and Utah, Texas, Montana, Iowa, Tennessee, and Indiana have enacted new laws to take effect in the next few years. California remains the only state to extend its data privacy law to HR data. Hopefully, the CPPA’s November 2023 meeting will bring clarity for California employers’ compliance efforts. In the meantime, the Attorney General’s announcement of an investigative sweep is a reminder that the CCPA’s statutory requirements, including those that apply to HR data, are enforceable, even though the Superior Court of California issued a ruling delaying enforcement of the new CCPA regulations until March 29, 2024.

A 4-foot tall, bronze girl defiantly stands with her hands on her hips and chin held high. Better known as Fearless Girl, the statue was intended to promote the power of women in leadership. The statue has come also to symbolize missteps and the consequences of unthoughtful legal planning. An advertising agency engaged Kristen Visbal to create the sculpture, apparently without any agreement as to rights, or, according to Visbal, any notice the sculpture was for a corporate sponsorship. State Street Global Advisors, the asset management company sponsoring the project initially placed Fearless Girl as a temporary counterpoint to the iconic Charging Bull statue: Fearless Girl was a tremendous success and had an immense social impact from its unveiling. The response prolonged display of the statute and spawned legal controversies. The first of which involved Arturo Di Modica, Charging Bull’s sculptor’s claims that the placement of Fearless Girl implicated issues of Di Modica’s copyright and trademark rights, and further distorted his artistic message as an “advertising trick.” We blogged about these claims back in 2017. Although Di Modica ultimately did not sue Visbal or the State of New York regarding the placement of Fearless Girl, Fearless Girl was eventually relocated to stand outside of the New York Stock Exchange. Another set of disputes arose from a trio of agreements State Street and Visbal negotiated following the statue’s success. The agreements were an attempt to sort out what each party could do with regard to the associated rights around the statue, but, unfortunately, created more problems than they solved. In 2019, State Street brought a claim in New York state court against Visbal, requesting a temporary restraining order to prevent Visbal from participating in an event in Australia that allegedly violated the agreements. The TRO was denied, but a later preliminary injunction was ultimately upheld. Following various claims and counterclaims, the parties filed motions for summary judgment, which the United States District Court for the Southern District of New York partially granted and partially denied. Judge Gregory H. Woods’ summary judgement opinion grapples for 90+ pages over the numerous breaches of contract, copyright and trademark infringement claims, and questions of preclusion. While nothing in the decision is groundbreaking, the opinion meticulously analyzes several breach of contract claims, offering excellent instruction as to drafting considerations. For instance, each of Visbal and State Street alleged claims regarding the other party’s breach of its obligations to provide attribution, which yielded opposing outcomes based upon the language in the agreements. Visbal’s claim stemmed from no attribution being provided when Fearless Girl was relocated to the New York Stock Exchange. The relevant agreement required State Street to “give attribution to [Visbal] as the sculptor of [Fearless Girl] wherever and whenever practicable, such as, for example, . . . plaques placed with” State Street replicas. The court denied summary judgement on this point, finding questions of fact with regard to whether attribution to Visbal would have been practicable (despite attribution being provided at the prior Charging Bull location). In contrast, Visbal agreed that any reproductions of Fearless Girl Visbal provided “as part of any promotional or corporate event, conference, ceremony, banquet, retreat, awards dinner, or the like” would include the attribution “Statute commissioned by SSGA.” The court found that Visbal’s verbal acknowledgement of State Street’s role was insufficient to meet the requirements as it did not include the exact language and did not appear on the reproduction, and granted summary judgement to State Street on this breach of the agreement. The contrast is a good reminder to use exact language, and avoid subjective considerations, in drafting specific requirements. Visbal did have a win with regard to State Street’s copyright infringement claims. The claim stemmed from Visbal’s grant of an exclusive license to State Street in connection with “gender diversity issues in corporate governance and in the financial services sector.” Visbal sold a Fearless Girl replica to an executive who worked at a financial institution. That executive later displayed the replica at a gender diversity in corporate governance event. Judge Woods denied summary judgement for both direct and vicarious infringement, finding Visbal did not take any action with regard to the executive’s use of the replica and did not profit from such use. The decision is not especially favorable to one party over the other, and Visbal’s counsel has already indicated her intention to appeal. The history of the sculpture and various legal disputes do serve as a cautionary tale and a necessary reminder of how important it is to carefully draft legal agreements—and just as carefully comply with them. The TMCA will continue to monitor this case.

Established through the Charter of the French Language, French is the official language of the Province of Québec. The Charter applies to businesses located in Québec and to other businesses providing services and selling goods in this province, making the use of French mandatory in connection with these business activities. Historically, the Charter has provided for a “recognized trademark” exception to this French language requirement for registered and known (but unregistered) trademarks in Canada. In these cases, the “recognized trademark” may appear on goods, advertising, signage and commercial publications in a language other than French (unless the French version of the mark has been registered, in which case use of this French version remains mandatory). In addition, where the “recognized trademark” exception applies to use on signage or on the face of a building, it must also feature indications on the same visual plane that informs consumers and passersby of the nature of the business in the French language. This is referred to as the “sufficient presence of French” requirement. In May 2021, the provincial government of Québec introduced (and later passed, in May 2022) an amendment to the Charter, referred to as “Bill 96,” which changes how “recognized trademarks” are treated in commerce and business. As of June 1, 2025, the scope of the “recognized trademark” exception will be restricted to registered trademarks, and inscriptions on products, on public signage and in commercial advertising. As a result, the “recognized trademark” exception will no longer be triggered by unregistered trademarks. Currently, where the “recognized trademark” exception does not apply, the Charter requires that products, packaging, and related informational documents (instruction manuals, for example), and commercial publications (including websites and social media) public signage and commercial advertising, must be in French, or in French and another language so long as the “other language” is not given heightened focus in comparison to the French language. This includes font size, use of color, positioning, and overall size. With the understanding that unregistered trademarks will no longer be an exception to this rule, this would require active steps by trademark owners to obtain registrations for trademarks, in order to continue to benefit from the exception, or to otherwise potentially implement significant updates to all impacted materials. For registered trademarks that feature generic or descriptive terms in a language other than French, the descriptive or generic term will need to be translated into French and appear on the product or on a medium permanently attached to the product. At this time, it is unclear how “generic” or “descriptive” may be interpreted in this context, or frankly, precisely what “medium permanently attached to the product” means. Additionally, where the “recognized trademark” exception is not available, the rule currently is that signs, posters, and billboards must be in French, or in French and another language so long as the French is featured in a predominant manner, with a greater visual impact than the other language. Thus, the current impact of Bill 96 is that both unregistered trademarks and registered trademarks appearing on public signage will be required to change from a “sufficient presence of French” to a “markedly predominant” use of the French language, meaning that the French language must have a greater visual impact than the text in the other language. For businesses who seek to comply with Bill 96 by seeking new trademark registrations, a challenge here is that the Canadian Intellectual Property Office has significant delays in the examination of trademark applications (as of this writing, approximately 43 months). This makes it very difficult for businesses to come into compliance via new trademark applications by the current June 1, 2025 implementation date. This tension between the compliance deadline and registration speed has been broached with CIPO by Canadian practitioners. In terms of next steps, we encourage interested parties with registered and unregistered trademark rights in Canada to review their business activities and trademark portfolios to determine: Whether new trademark applications should be filed. If so, if new applications are filed featuring pre-approved goods and services from CIPO’s manual, it may be possible to reduce the examination time from 43 months to about 21 months. Taking action now may make it possible to meet requirements by June 1, 2025. Expedited examination is also available under certain prescribed circumstances. Whether the loss of the “recognized trademark” exception will require changes to product packaging (generic/descriptive terms, unregistered trademarks), related documentation, commercial publications, and public signs visible from outside buildings. Bill 96 expands the government’s powers of enforcement and all Québec residents will have standing to seek injunctive relief and damages. The potential business risk in Canada is therefore considerable, and taking action toward compliance now is recommended. We will keep our readers updated on further guidance in connection with the impact of Bill 96.

The China National Intellectual Property Administration (“CNIPA”) recently released its Rules On Suspension of CNIPA Trademark Proceedings (the “Suspension Rules”) and related explanations. The Suspension Rules are intended to provide clear guidance on the circumstances under which a CNIPA trademark proceeding shall be or may be suspended.  For companies that have difficulty registering their brands due to prior rights no longer in use, or fraudulently filed, this may be welcome news. The Suspension Rules concern the four types of CNIPA trademark proceedings, namely: the review of a rejection of a trademark application (a Review of Rejection Proceeding); the review of an opposition decision refusing the registration of the opposed mark (a Review of Opposition Proceeding); the invalidation of a trademark registration (an Invalidation proceeding); the review of a cancellation decision regarding a trademark registration (a Review of Cancellation Proceeding, the most commonly seen cases under this category is a cancellation based on three year non-use) The Suspension Rules make it clear that a CNIPA trademark proceeding shall be suspended under any one of the following five circumstances: there is a pending assignment recordal proceeding between the disputed mark and the cited mark(s), and there will no longer be any conflict of rights after the completion of the assignment recordal; a cited mark has expired and is in the renewal proceeding or in the renewal grace period; a cited mark is under a pending cancellation or withdrawal proceeding; a cited mark has been cancelled, or has been invalidated or has expired without renewal but one year has not yet lapsed from the date of its cancellation, invalidation or expiration (exclusive of a cancellation based on non-use); a proceeding concerning a cited mark has been concluded pending the relevant decision to become final, or a case concerning a cited mark is waiting to be re-tried under an effective court order. The above five circumstances may be most relevant to a Review of Rejection Proceeding, this clear language in the Suspension Rules provides far greater certainty to an applicant, whose option presently is to hope for suspension and also file backup rights to maintain their priority. In the past, the suspension of cases under these five circumstances were within an examiner’s discretion and it was not transparent how an examiner could exercise their discretion. The Suspension Rules also provide that in relation to a Review of Opposition Proceeding or an Invalidation Proceeding, the examiner shall suspend the relevant proceeding if the protection of the prior right claimed is dependent on the outcome of another pending court or administrative proceeding. Lastly, the Suspension Rules provide that in relation to a Review of Rejection Proceeding, and upon the express request of the applicant, the examiner shall suspend the relevant proceeding if the status of a cited mark is dependent on the outcome of another pending court or administrative proceeding. In addition to the above seven circumstances where a CNIPA trademark proceeding shall be suspended, the Suspension Rules further provide three circumstances under which a proceeding may be suspended: if a cited mark has been under an invalidation proceeding, and the owner of the cited mark has been found guilty of making bad faith filing in other cases, an examiner may exercise his or her discretion to suspend the current Review of Rejection Proceeding without the need of a request of suspension by the review applicant; if the review and decision of a CNIPA trademark proceeding is dependent on the outcome of any prior related cases of similar circumstances, the examiner may suspend the CNIPA trademark proceeding if it is necessary; other circumstances whereby a suspension of the proceeding may be necessary (a catch-all provision). Procedurally, an applicant may make its suspension request under the new Rules in its initial filing, or within the subsequent three months supplemental filing period; it is not necessary to make a separate application for suspension.  However, the request must provide the full particulars of the related pending proceedings upon which the suspension request is made, such as the filing number of the cited mark, the type of the pending proceeding and its status, and the relevance of that pending proceeding to the present case. Once the status of a cited mark has been crystalized, the applicant must provide proof to the examiner and request the examiner resume the relevant CNIPA trademark proceeding. Last but not the least, it is important to note that the Suspension Rules are exercised on the general principle of necessity, i.e., a CNIPA trademark proceeding would be suspended only if the status of the relevant prior rights will materially affect the outcome of the case. If the other review grounds and/or the status of the other prior rights are sufficient for deciding the case, then no suspension should be made as it is not necessary. We are pleased that the Suspension Rules may clear up the current procedural uncertainties in CNIPA trademark proceeding, especially in relation to a Review of Rejection Proceeding. This will enable a brand owner to better form its trademark filing and enforcement strategy and plans. While it remains to be seen how the Suspension Rules will be applied by the CNIPA, the Suspension Rules provide some hope to applicants whose previous option was to continue to refile applications while co-pending proceedings were decided. Dispensing with this strategy will certainly provide significant costs-saving and more streamlined case management for brand owners.

AI technology is developing at a tremendous pace and AI image creation is no exception. AI images are even winning art contests. Since AI generates artistic images modeling others’ work, human artists are asking “is it copyright infringement for AI technology to use my work to learn how to create images and produce AI works?” The Northern District of California may answer that burning question. In January 2023 artists Sarah Andersen, Kelly McKernan and Kayla Ortiz filed a class action copyright lawsuit against Stability AI Ltd., Midjourney, Inc., and DeviantArt. The case is listed as Andersen v. Stability AI Ltd, U.S. District Court for the Northern District of California, No. 3:23-cv-00201.The Plaintiffs contend that AI used copyrighted works without their permission to help the technology learn how to copy and analyze works to produce new images. They also contend that the AI technology creates unauthorized derivative works. Put simply, the technology allows a user to type in a prompt of what type of art they want, in what style of artist, and can request it to have certain subjects in the picture. The artists argue that this essentially creates derivative works of their art. Other counts include infringement of the Digital Millennium Copyright Act, state law claims, and infringement of the right to publicity. In April, each Defendant filed a motion to dismiss the artists’ complaint. The Defendants’ argue that the artists failed to identify a “single allegedly infringing output image” that was allegedly used by the Defendants to train their system. The Defendants further argue that the artists cannot show any single image created by AI is substantially similar to an artists’ own copyrighted works. Most recently, on June 2, the Plaintiffs’ filed oppositions to each of the Defendant’s motions to dismiss. A judge has yet to publish a decision on the motions to dismiss. Defendant Midjourney argues that if the court were to resolve the claims of direct copyright infringement, it would have to proceed on an image-by image basis to determine which works are protectable and which are considered fair use. The fair use defense to copyright infringement allows a creator to use a work even if unauthorized and it is still not considered copyright infringement because it is a “fair use” of the copyrighted material. To determine if a work is fair use, a court will look to four factors: 1) the purpose and character of the use, 2) the nature of the copyrighted work, 3) the amount and substantiality of the work used in relation to the whole and, 4) the effect of the use upon the potential market for the work. The defendants may focus on the first and third factors. When looking at the purpose and character of the use, the Defendant’s may point out using any copyrighted works is still transformative in nature – the AI technology is generating new images that differ from the original works. Regarding the amount of the prior work used, the Defendant’s will likely argue that the material copied is an insignificant portion of the input material used by the AI program to generate an image. However, the Plaintiff’s will likely argue that AI will divert sales because the general public can now use AI as a substitute for buying their art. These decisions will be pivotal to determine if works generated through AI are copyright infringement or fair use. This case will have important results for several parties. For artists, the concern is that AI driven image creation may steal from their livelihood. Using AI, anyone can get an image that looks like their favorite artists by providing the system with a clear prompt. For the Defendants, this represents a landmark lawsuit that will determine if and how their company will be allowed to leverage AI going forward. For Stability AI, it will determine if their new AI technology will be able to be utilized and to what extent. For Midjourney and DeviantArt, it will answer if they are able to use Stability’s technology on their platforms to allow users to create their own images using AI technology. This lawsuit represents some of the first litigation to address key questions around AI image creation. As artificial intelligence comes more into the mainstream, it will be up to cases like these to help determine how AI images will be regulated, used, and to what extent. The rest of the world will be watching as this case will send some of the first signals for how the U.S. judicial system may view AI and copyright infringement claims.

How far does the Lanham Act’s reach extend? The Supreme Court gave us one answer in Abitron Austria GmbH et al. v. Hetronic International, Inc. and made it simple: not very far. Hetronic is a U.S. company that manufactures remote controls for construction equipment.  Abitron (comprised of six non-U.S. companies) at one point sold Hetronic’s products as a licensed distributor.  However, Abitron eventually concluded it held rights to Hetronic’s intellectual property, including various trademarks.  Abitron then reverse engineered Hetronic’s products and began selling goods bearing those marks in Europe and the U.S. Hetronic ultimately sued Abitron in the Western District of Oklahoma for trademark violations under Sections 1114(1)(a) and 1125(a)(1) of the Lanham Act, both of which prohibit using a trademark “in commerce” that is likely to cause confusion.  The District Court awarded Hetronic approximately $96 million in damages and entered a permanent injunction barring Abitron from using Hetronic’s marks anywhere in the world. We last discussed Hetronic after a Tenth Circuit decision that narrowed the injunction slightly to geographic locations where Hetronic had marketed and sold its products.  But the Tenth Circuit overall agreed that some of Abitron’s conduct in Europe could be enjoined by U.S. courts under the Lanham Act because Abitron’s actions had a substantial effect on U.S. commerce.  Abitron then appealed to the Supreme Court, arguing the injunction was an impermissible extension of the Lanham Act to extraterritorial conduct—i.e., conduct outside the U.S. Today, the Supreme Court vacated and remanded the Tenth Circuit’s decision, determining that the two provisions of the Lanham Act at issue cannot be applied extraterritorially.  The Court held that the Lanham Act only regulates use in commerce—i.e., the sale of goods or the provision of services—within the United States.  The Court’s analysis centers on a presumption against extraterritoriality, a “longstanding principle of American law” that assumes Congress generally only regulates domestic affairs, and not foreign conduct.  Four justices joined Justice Alito’s majority opinion, three joined Justice Sotomayor’s concurrence, and Justice Jackson entered a separate concurrence with her insights on the definition of “use in commerce” as used in Section 1127 of the Lanham Act. The Court applied a two-step framework to determine whether and to what extent the Lanham Act can regulate foreign conduct. All Justices agreed that the first question is whether the statute or provision explicitly states that it should apply to foreign conduct.  In other words, has Congress “affirmatively and unmistakably instructed that” the provision at issue “‘should apply to foreign conduct’”?  The Lanham Act does not explicitly state that it regulates foreign conduct, which cuts against applying the Lanham Act to regulate conduct abroad. Because the Lanham Act is not explicitly extraterritorial, the Court then moved to step two, which was far more contentious.  The majority concluded the relevant inquiry for this step is to identify the “focus” of the statute and decide whether “conduct relevant to that focus” occurred in the U.S.  Both are required. The parties offered different interpretations of what they believed the “focus” of the Lanham Act provisions were in this case for purposes of the second step of the framework.  Hetronic argued that the focus of the statute was to protect the goodwill of trademark owners and to prevent consumer confusion.  Abitron argued that the focus of the statute was to prevent infringement of trademarks. The U.S. government, as amicus curiae, took the middle ground and posited that the focus of the statute was consumer confusion. Instead of clarifying the Lanham Act’s focus, the Court concluded that, because the conduct at issue entirely occurred outside the U.S., there was no need to actually discern the focus of the statute. In other words, the fact that there was no conduct or domestic use in commerce renders the focus of the Lanham Act irrelevant.  This second step, the majority clarified, is designed for "claims that involve both domestic and foreign activity," which is not the case here. Justice Jackson agreed that “use in commerce” is “the dividing line between foreign and domestic applications” of the Lanham Act, but added that any downstream sale of a good in the U.S. market constitutes use in commerce. In other words, the active resale of a good by an individual consumer, who bought a product abroad, would constitute use in commerce and open the original seller of the good to liability under the Lanham Act. Contrary to the framework outlined by the majority, however, Justice Sotomayor found common ground with the U.S. government’s opinion that the focus of the two provisions of the Lanham Act at issue is consumer confusion.  This interpretation focuses on the impact of foreign conduct on the U.S. market instead of exclusively on “the location of the original sale of the infringing product or the location of the trademark owner’s business.”  In other words, Justice Sotomayor would conclude that the Lanham Act provisions at issue extend to “activities abroad when there is a likelihood of consumer confusion in the United States.”  (Emphasis added.) The at-odds opinions may be attributable to the manner in which the justices choose to interpret the case Steele v. Bulova Watch Co. (which involved a defendant’s allegedly infringing activities occurring in both Mexico and the United States), with the majority determining it is inapplicable and wholly distinguishable from the facts of Hetronic because it “implicate[s] both domestic conduct and a likelihood of domestic confusion,” and the Sotomayor concurrence finding Steele to persuasively conclude that “infringing acts consummated abroad fall under the purview of the Lanham Act when they generate consumer confusion in the United States.”  In the majority’s view, the concurrence’s position would render the presumption against extraterritoriality, referred to in other cases as a “watchdog,” “nothing more than a muzzled Chihuahua.” Ultimately, the Court vacated and remanded the case.  The majority does not outline the bounds of “use in commerce.”  Whether the Lanham Act applies to goods sold indirectly into U.S. commerce remains to be seen.  The TMCA will continue to monitor this case on remand and the impacts of the decision in the broader trademark landscape.

The year 2023 will likely go down in history as a major inflection point in the enactment of comprehensive consumer data privacy laws in the United States. At the beginning of the year, only five states (California, Virginia, Colorado, Utah, and Connecticut) had enacted comprehensive consumer data privacy laws. And, of these, only the California and Virginia laws are currently in effect. The privacy laws in Connecticut and Colorado go into effect on July 1, 2023, and Utah’s law becomes enforceable on December 31, 2023. Recently, however, the states of Indiana, Iowa, Tennessee, and Montana have also enacted new state consumer data privacy laws. In addition, state legislatures in Florida and Texas have passed bills to enact consumer data privacy laws; the governors of these states are widely expected to sign these bills into law. Most privacy professionals anticipate that many of the remaining states will also enact privacy laws in the next few years. It is likely that, barring preemptive federal law-making, most or all of the remaining states will eventually enact privacy laws of their own. (The state of Washington also recently enacted a landmark privacy law specific to consumer health data this year that also has some overlap with these comprehensive consumer data privacy laws.) Many businesses and other organizations have expressed concern about the compliance burdens of dealing with these emerging privacy laws, particularly since they can be subject to the laws of each jurisdiction in which they do business. Nevertheless, there is significant commonality among the laws that have passed so far. It is reasonable to assume that laws enacted in the future will continue to have these comment elements. By focusing on these common elements, businesses can design their privacy program with the confidence that it will be well positioned for the future. These common elements include the following features: Applicability thresholds. Although the specific thresholds vary, each of the state laws has applicability requirements that exempt many small and medium businesses that are not heavily involved in personal data collection or sales. Iowa and Indiana’s laws are typical in this respect. For either of those states’ laws to apply, the business or organization must process the personal data of 100,000 or more residents of the state or, if the business derives 50% or more of its gross revenue from the sale of personal data, process the data of 25,000 or more residents of the state. And, except in Colorado, non-profit organizations are exempt from compliance. Each law also has broad exemptions for organizations or personal data that is already protected under existing federal sectoral privacy laws like the Health Information Portability and Accounting Act (HIPAA) and the Gramm Leach Bliley Act (GLBA). Exclusion of personal data of employees, applicants, and former employees. With the exception of California, no state has applied its consumer data privacy law to individuals in their role as members of their employers’ workforces. Emergency contact information and personal data used for benefit administration is often also exempted from the laws’ requirements. Data subject rights. All states provide individuals in the state with rights relating to their personal data. These rights generally include the right to deletion of personal data, the right to correct inaccurate data, the right to know what data the business holds regarding the individual, and the right to receive a portable copy of the individual’s personal data. Most states also give individuals the right to opt out of the selling of their personal data or sharing of their personal data for behavioral advertising. A few states even give individuals the right to opt-out of certain kinds of processing of consumer data. Privacy notice requirements. Each of the states has requirements for privacy-related disclosures. Every state privacy law currently enacted requires businesses to state the categories of personal data that they collect and the purposes for the collection. Some states also require additional disclosures about the sharing and selling of personal data and place limits on the processing of personal data for purposes in excess of what was disclosed at the time of collection. And, all states require that privacy notices (often called privacy policies) explain the rights individuals have regarding their personal data. Sensitive data rules. Many states designate a category of personal data as “sensitive data” to reflect the higher risk of harm that could be associated with its use. Montana’s definition is typical and defines sensitive data as including: “(a) data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, information about a person’s sex life, sexual orientation, or citizenship or immigration status; (b) the processing of genetic or biometric data for the purpose of uniquely identifying an individual; (c) personal data collected from a known child; or (d) precise geolocation data.” Some states require consent from the individual to process sensitive data, while others allow individuals to opt out of the processing of sensitive data. Security requirements. All of the state privacy laws require organizations to protect personal data with reasonable information security safeguards. Data protection agreements. Most of the state privacy laws require businesses that engage processors (e., third parties that process personal data on their behalf) to have a contract with the processor that contains specific requirements, such as instructions for the personal data processing, the nature and purpose of the processing, the type of data subject to processing, the duration of the processing, return or deletion of the personal data at the end of the relationship, and assisting in demonstrating compliance with the law. Data protection assessments. Many of the state privacy laws have provisions that require businesses that engage in processing of personal data involving a high risk to the data subject to thoroughly analyze the processing, weigh the risks and benefits, consider ways to mitigate risks, and possibly consider alternatives and safeguards. (This assessment is sometimes also called a data protection impact assessment or privacy impact assessment.) Most of these laws consider the processing of personal data for targeted advertising or selling personal data to be activities for which an assessment is required. Similarly, the processing of sensitive data requires an assessment in many states. No Private Enforcement. In general, state privacy laws allow only governmental enforcement, and do not grant individuals a private right of action to sue for damages. California is the sole exception, but even in California, an individual can sue only if the individual was a victim of a data breach. Cure periods. Many laws provide that, prior to enforcement, a business is entitled to notice of an alleged problem and a right to cure the violation within a certain specified period. Civil penalties. All of the laws provide for civil penalties, often of $7,500 or more per violation. The following table describes how Iowa, Indiana, and Tennessee have addressed these common elements. Feature Iowa Indiana Tennessee Montana Applicability threshold Process personal data of 100,000 residents or Process personal data of 25,000 residents and receive 50% or more of gross revenue from sale of personal data Process personal data of 100,000 residents or Process personal data of 25,000 residents and receive 50% or more of gross revenue from sale of personal data Have $25 million or more worldwide annual gross revenue and process personal data of 175,000 residents or Process personal data of 25,000 residents and receive 50% or more of gross revenue from sale of personal data Process personal data of 50,000 residents or Process personal data of 25,000 residents and receive 25% or more of gross revenue from sale of personal data Data subject opt-out rights Sale of personal data, targeted advertising, sensitive data processing Targeted advertising, sale of personal data, profiling with significant consequences Sale of personal data, targeted advertising Targeted advertising, sale of personal data, profiling with significant consequences Other data subject rights Confirm processing, deletion, receive a copy, appeal Confirm processing, correction, deletion, receive a copy, appeal Confirm processing, correction, deletion, receive a copy, appeal, request information about data sales Confirm processing, correction, deletion, receive a copy Exclusions for data covered by HIPAA and GLBA and for institutions of higher education Yes Yes Yes Yes Requirement for a privacy notice required that is organized by categories and purposes and including information on rights Yes, and it must also list categories of personal data shared with third parties and categories of third parties Yes, and it must also list categories of personal data shared with third parties and categories of third parties Yes Yes, and it must also list categories of personal data shared with third parties and categories of third parties Privacy notice serves as a processing limitation (i.e. the law limits processing personal data for purposes other than those described at collection) No Yes Yes Yes Data protection assessments required No Yes Yes Yes Reasonable data security requirement Yes Yes Yes Yes Data processing agreement requirements Yes Yes Yes Yes Private right of action No No No No Right to cure Yes, 90 days Yes, 30 days Yes, 60 days Yes, 60 days, but it expires on April 1, 2026. Effective date Jan. 1, 2025 Jan. 1, 2026 July 1, 2024 Oct. 1, 2024 Civil penalty Up to $7,500 per violation Up to $7,500 per violation Up to $15,000 per violation Yes, with no explicit cap     By building a privacy compliance program that can effectively deal with these common elements, business and other organizations can feel confident that their program will also satisfy many of the elements that will be present in future state data privacy laws. Here at the TMCA, we will continue to keep stakeholders updated on further developments in the fast-moving area of consumer privacy legislation.

Humor matters, but it’s not the most important thing when considering a trademark infringement or dilution claim. In a decision with references to The Hangover Part II, Aqua’s song “Barbie Girl” (good luck not getting that stuck in your head if you grew up in the 90’s…), Tommy Hilfiger, and Harley-Davidson, the Supreme Court clarified the interaction of First Amendment protections, on the one hand, and trademark infringement and dilution claims involving “expressive works,” on the other hand. The bottom line is this: where an accused infringer uses a trademark like a trademark (i.e., to designate the source of its goods or services), the traditional likelihood of confusion analysis applies, even if the mark is also used in an expressive manner. First Amendment considerations like parody and commentary might impact that analysis, but there’s no threshold First Amendment consideration (like the Rogers test discussed below) that would prevent or bar this traditional analysis. Further, marks used in connection with commentary, criticism, and parody are not exempt from dilution claims when the mark is being used to designate the source of goods or services. As discussed in a prior TMCA blog post, this case arises out of Jack Daniel’s trademark infringement and dilution claims against VIP Products based on its “Bad Spaniels” dog toy. The Jack Daniel’s bottle and VIP dog toy are shown here: Beyond the similarities in the bottle and label, VIP’s product contained other clear nods to Jack Daniel’s, including using “Bad Spaniels” instead of “Jack Daniel’s” and the wording “The Old No. 2, on Your Tennessee Carpet” instead of “Old No. 7 Brand Tennessee Sour Mash Whiskey.” The packaging also included a disclaimer, stating, “This product is not affiliated with Jack Daniel Distillery.” VIP claimed the dog toy was an obvious parody of Jack Daniel’s products and, thus, entitled to First Amendment protection under the Rogers test for the infringement claim and also entitled to a statutory exception to the dilution claim as a parody of a famous mark. When an “expressive work” is involved, the Rogers test requires dismissal of a trademark infringement claim unless the plaintiff can show that either (1) the challenged use of a mark has no artistic relevance to the underlying work or (2) the work explicitly misleads as to the source or the content of the work. See Rogers v. Grimaldi, 875 F.2d 994 (2d Cir. 1989). The District Court ruled in Jack Daniel’s favor, rejecting application of the Rogers test because VIP used the mark to identify its own goods. It further concluded that the dilution exception did not apply for essentially the same reason. VIP appealed to the Ninth Circuit, which reversed and remanded, holding that: (1) the infringement claim could not stand because the “Bad Spaniels” dog toy is an expressive work entitled to First Amendment protection under the Rogers test since it “communicate[d] a humorous message,” and (2) VIP’s parody shielded it from liability for dilution under the non-commercial use exception. VIP Prods. LLC. V. Jack Daniel’s Props., 953 F.3d 1170 (9th Cir. 2020). On remand and given the Ninth Circuit’s directive, the District Court concluded that Jack Daniel’s could not satisfy the Rogers test and granted summary judgment to VIP. The Ninth Circuit summarily affirmed, and the Supreme Court granted Jack Daniel’s writ of certiorari to determine: Whether humorous use of another’s trademark as one’s own on a commercial product is subject to the Lanham Act’s traditional likelihood-of-confusion analysis, or instead receives heightened First Amendment protection from trademark infringement claims. Whether humorous use of another’s mark as one’s own on a commercial product is “noncommercial” under 15 U.S.C. § 1125(c)(3)(C), thus barring as a matter of law a claim of dilution by tarnishment under the Trademark Dilution Revision Act. In the Supreme Court’s majority opinion authored by Justice Kagan (the decision was unanimous, but with two concurrences), the Court first addresses the question, “Should [Jack Daniel’s] have had to satisfy the Rogers threshold test before the case could proceed to the Lanham Act’s [the U.S. trademark law] likelihood-of-confusion inquiry?” The Court found it should not have, stating: Without deciding whether Rogers has merit in other contexts, we hold that it does not when an alleged infringer uses a trademark in the way the Lanham Act most cares about: as a designation of source for the infringer’s own goods… When a mark is used as a mark (except, potentially, in rare situations), the likelihood-of-confusion inquiry does enough work to account for the interest in free expression. The Court parts ways with the Ninth Circuit’s previous holding, making it clear that a mark’s expressive content does not result in automatic application of the Rogers test. Despite fulsome briefing on the topic, the Court does not actually rule on the validity of Rogers. However, it certainly spends quite a bit of time considering the case’s history and application over the last 30+ years since its inception, citing to cases such as Mattel, Inc. v. MCA Records, Inc., 296 F. 3d 894 (9th Cir. 2002) (finding the song “Barbie Girl” did not use Barbie’s name in a source-identifying capacity and, thus, First Amendment protection was warranted) and Louis Vuitton Mallatier S. A. v. Warner Bros. Entm’t Inc., 868 F. Supp. 2d 172 (S.D.N.Y. 2012) (finding that mention of “Louis Vuitton”—pronounced “Lewis” in the film The Hangover Part II—satisfied the Rogers test because the film did not use the trademark as its “own identifying trademark.”). These courts (including the home of the Rogers test in the Second Circuit) have routinely declined to apply the Rogers test when the marks in question are being used as true trademarks (i.e., to designate source rather than for commentary or pure expression). This aligns with the primary purpose of the Lanham Act, which makes explicitly clear that, when another party uses a mark in a way which confuses consumers as to the source of the goods, infringement has occurred. 15 U.S.C. § 1114(1). The Court emphasizes that applying the Rogers test in all instances where a mark conveys other expressive content (such as a humorous message) could result in “Rogers [taking] over much of the world. For trademarks are often expressive in any number of ways.” The Court also cites to every trademark attorney’s best friend, McCarthy on Trademarks and Unfair Competition, which agrees that the Ninth Circuit’s expansion of Rogers “potentially encompasses just about everything” because names, phrases, symbols, designs, and their varied combinations often “contain some ‘expressive’ message” unrelated to source. 6 McCarthy on Trademarks and Unfair Competition § 31:144.50 (5th ed. 2022). Because VIP conceded it was using the BAD SPANIELS trademark and trade dress to “identify and distinguish [VIP’s] goods” and to “indicate [their] source,” the Court concluded that Rogers does not apply. Though VIP attempted to backtrack on those comments during oral arguments, the Court was not persuaded, pointing to the below hangtag that clearly shows the BAD SPANIELS mark situated similarly to the company’s registered SILLY SQUEAKERS Logo. Despite the inapplicability of Rogers, the Court explained that, on remand, the lower courts should still consider the thrust of VIP’s argument because “[a] trademark’s expressive message—particularly a parodic one, as VIP asserts—may properly figure in assessing the likelihood of confusion.” In other words, where a trademark is truly used as a trademark, expression must be considered in the context of the normal likelihood of confusion analysis rather than as a threshold question. It will be interesting to see whether this directive results in amendment of the infringement factors used by the various circuits, such as the Sleekcraft factors in the Ninth Circuit. In the second portion of the opinion, the Court swiftly dispatches the Ninth Circuit’s holding that the use of humor and parody constitute noncommercial use, which is excluded from dilution liability under the Lanham Act. See 15 U.S.C. §1125(c)(3)(C). The Lanham act provides an exclusion for a claim of dilution when use of a mark constitutes “fair use”, which specifically covers uses “parodying, criticizing, or commenting upon” a famous marks owner. Id. at §1125(c)(3)(A)(ii). Critically, however, this exclusion does not apply when the use is “as a designation of source for the person’s own goods or services.” Id. In line with its analysis of the first question presented, the Court concludes that, given “the fair-use provision’s carve-out, parody (and criticism and commentary, humorous or otherwise) is exempt from liability only if not used to designate source.” The Ninth Circuit’s expansive view of the non-commercial use exclusion does not align with Congress’s express limit placed on the fair-use exclusion, the Court found. The concurrences also contain some interesting tidbits. Although the majority opinion declined to rule on the validity of Rogers, the concurrence by Justice Gorsuch (joined by Justices Thomas and Barrett) directly calls into question Rogers, stating that it is “not entirely clear where the Rogers test comes from” and that “it is not obvious that Rogers is correct in all its particulars.” It warns lower courts that they “should be attuned to that fact.” The concurrence by Justice Sotomayor (joined by Justice Alito) warns that courts should “treat the results of surveys with particular caution” where “trademark infringement involves a parody” since “there is a particular risk in giving uncritical or undue weight” to these surveys. It points to one survey answer in this case that will give most IP attorneys instant heartburn: “The bottle is mimicked after the Jack Daniel BBQ sauce. So they would hold the patent therefore you would have to ask permission to use the image.” In the coming months, the lower courts will likely hear from Jack Daniel’s and VIP as they hash out the likelihood of confusion and dilution aspects of this case, and other courts will continue to refine the Rogers test (so long as it stands) and likelihood of confusion analysis articulated in this case. Keep an eye out on the TMCA blog for further coverage.  

The Supreme Court granted certiorari and will review the Federal Circuit’s opinion that Section 2(c) of the Lanham Act is unconstitutional as applied to a trademark for the term TRUMP TOO SMALL. The TRUMP TOO SMALL trademark is a callback to an exchange between Senator Marco Rubio and then presidential candidate Donald Trump during the 2016 presidential primaries. As we previously reported, the Trademark Trial and Appeal Board initially rejected the trademark application under Section 2(c) of the Lanham Act because it comprises the name of a living individual—President Trump—without that individual’s consent. The Court of Appeals for the Federal Circuit reversed the TTAB’s decision. The applicant for the trademark plans to sell t-shirts with the phrase TRUMP TOO SMALL to criticize President Trump; specifically, to convey “that some features of President Trump and his policies are diminutive.” The Federal Circuit viewed this criticism as speech protected by the First Amendment and found that Section 2(c) is unconstitutional as applied to the TRUMP TOO SMALL trademark because the government does not have an interest “in restricting speech critical of government officials or public figures.” The Federal Circuit did not address whether Section 2(c) is unconstitutional in all cases, but did suggest that it may be “impermissibly overbroad” because it does not leave the trademark office any discretion to permit registration for trademarks that advance First Amendment interests. The Supreme Court previously found that portions of Section 2(a) of the Lanham Act, which prohibits registration of “immoral, deceptive, or scandalous” trademarks and trademarks that “may disparage . . . any persons, living or dead,” are unconstitutional in all cases. It remains to be seen whether Section 2(c) is destined for the same outcome. The Supreme Court will likely hear oral arguments in the fall. Stay tuned to the TMCA Blog for an update when the Supreme Court issues its opinion.

It is safe to say that the use of artificial intelligence (AI) went mainstream in 2023. With the widening acceptance of AI, dozens of industries have raced to adopt the technology into various operations at a staggering pace – including adopting AI in human resources (HR) processes in the workplace. But, employers and HR departments should keep pace with federal agencies seeking to mitigate risks associated with AI in the workplace. Last week’s released guidance from the Equal Employment Opportunity Commission (EEOC) illustrates how federal agencies seek to keep up with technological advances. AI in the Workplace AI in the workplace is moving at a fast clip. According to the EEOC, as many as 83% of employers, and as many as up to 99% of Fortune 500 companies, are using some form of AI to screen or rank candidates for hiring. The use of AI in the workplace is not new from an HR perspective. Employers have long been able to use AI to perform certain HR functions in the recruiting process, such as resume screening. But now, employers can use AI for other recruitment functions, such as administering personality and aptitude tests or analyzing video interviews. Once workers are on-boarded, employers can use AI to help with worker safety, protection, management, and productivity through real-time locating systems and other technologies. Federal Agencies’ Guidance While business use of AI can involve great benefits, federal agencies seek to reduce potential negative consequences by issuing guidance, requesting information, and devising plans for AI in the workplace in the following ways: On January 26, 2022, the federal Occupational Safety and Health Administration (OSHA) issued a trade release announcing an update and expansion of a chapter in the OSHA Technical Manual on Industrial Robot Systems and Industrial Robot System Safety. The update notes that advances in AI boost the abilities and uses of robot systems in industrial applications. The revisions add current “technical information on the hazards associated with industrial and emergent robot applications, safety considerations for employers and workers, and risk assessments and risk reduction measures.” On May 12, 2022, the EEOC issued its guidance on AI “discuss[ing] how existing ADA requirements may apply to the use of [AI] in employment-related decision making and offers promising practices for employers to help with ADA compliance when using AI decision making tools.” The same day, on May 12, 2022, the Department of Justice issued guidance that “outlines issues that employers should consider to ensure that the use of software tools in employment does not disadvantage workers or applicants with disabilities in ways that violate the ADA.” On October 31, 2022, the National Labor Relations Board (NLRB) General Counsel issued a memorandum recommending that the NLRB “apply the Act to protect employees, to the greatest extent possible, from intrusive or abusive electronic monitoring and automated management practices that would have a tendency to” interfere with protected concerted activity. On January 10, 2023, the EEOC issued a draft strategic enforcement plan which announced that the agency would focus “on employment decisions, practices, or policies in which covered entities' use of technology contributes to discrimination based on a protected characteristic. These may include, for example, the use of software that incorporates algorithmic decision-making or machine learning, including artificial intelligence; use of automated recruitment, selection, or production and performance management tools; or other existing or emerging technological tools used in employment decisions.” On May 1, 2023, the White House Office of Science and Technology Policy (OSTP) announced that it will be releasing a public request for information (RFI) “to learn more about the automated tools used by employers to surveil, monitor, evaluate, and manage workers.” The OSTP states that responses to the RFI “will be used to inform new policy responses, share relevant research, data, and findings with the public, and amplify best practices among employers, worker organizations, technology vendors, developers, and others in civil society.” On May 18, 2023, the EEOC issued its guidance explaining the application of Title VII to an employer’s use of automated systems, including AI, noting that the scope of the guidance “is limited to the assessment of whether an employer’s ‘selection procedures’—the procedures it uses to make employment decisions such as hiring, promotion, and firing—have a disproportionately large negative effect on a basis that is prohibited by Title VII.” Employers should expect to see more federal guidance on AI as technologies continue to develop. What Employers Can Do to Stay in the AI Race With federal agencies’ guidance in mind and an expectation of more regulation to come, employers should take proactive steps to ensure the use of AI in the workplace keeps pace with developing law. These steps include: Understanding that AI in the workplace is governed by several different laws, including privacy laws, data security laws, and anti-discrimination laws at the state and federal levels. Considering including references to the use of AI in the recruiting, hiring, and employment process in employment policies and notices. Partnering with HR, IT, and legal counsel to ensure that AI practices remain competitive while compliant with local and federal law. The idea that AI can create several benefits in the workplace seems to be gaining traction. Federal guidance issued in 2022 and 2023 signal that regulation of AI in the workplace will strive to keep up with the strides made in technological advances. Employers and HR can stay ahead of the curve by keeping abreast of, and following, regulations applicable to their company.   A version of this article was published on Dorsey's Employment blog, Quirky Questions. EEOC, Other Federal Agencies Set the Pace for Employers Using AI in the Workplace | Quirky Questions (quirkyemploymentquestions.com)

Earlier this month, a federal court judge in the United States District Court for the Central District of Illinois denied a defendant’s motion to dismiss a plaintiff’s amended complaint for, among other claims, trade secret misappropriation, based on a theory of inevitable disclosure in the future. The plaintiff had admitted at oral argument that, after three years or so of discovery, it had no direct evidence of actual disclosure of its trade secrets by the defendant, and that it was instead relying in its amended complaint on the threat of future disclosure. The Court rejected the defendant’s position that a future disclosure threat as pled by plaintiff was insufficient to give the plaintiff standing to proceed, because the plain language of both the federal Defend Trade Secrets Act (“DTSA”) and the Illinois Trade Secrets Act (“ITSA”) expressly provide that actual or threatened misappropriation may be enjoined. The decision provides a useful illustration of the applicability of the doctrine of inevitable disclosure in the realm of trade secret litigation. The plaintiff Marquis ProCap System, LLC (“Marquis”) is a renewable energy company based in Illinois, and alleges that it operates the largest dry-mill ethanol facility in the United States. Marquis has developed proprietary processes, technology, and systems for processing the co-products of corn-to-ethanol production at the alleged cost of more than $30 million. For over a decade, defendant Novozymes North America, Inc. (“Novozymes”) had been a supplier to the Marquis companies, providing enzymes and microbes that Marquis used in its processes. For over a year or so, the parties explored forming a partnership. As part of this process, they entered into a mutual confidentiality agreement and, as claimed by Marquis, Novozymes was provided with Marquis’ trade secret information. Marquis alleged that, without any notice to it, and just four days after a knowledge-sharing meeting, Novozymes publicly announced that it was entering into an exclusive partnership with Green Plains, Inc. (“Green Plains”), Marquis’ competitor. Marquis claimed that the same Novozymes’ scientists worked on both the attempted partnership with Marquis and the partnership with Green Plains, and that Novozymes would not have been able to proceed with its partnership with Green Plains without misusing Marquis’ trade secrets. As a result, Marquis asserted trade secret misappropriation by Novozymes in violation of the DTSA, the ITSA, and the parties’ confidentiality agreement. After three years of discovery, Marquis amended its complaint to add allegations that Novozymes poses a future threat that it will inevitably use or disclose Marquis’ trade secrets, and Marquis even admitted during oral argument that it had no direct evidence that Novozymes had already shared its trade secrets with Green Plains. Rather, the plaintiff acknowledged that its focus was on the threat of future breach. Novozymes moved to dismiss the amended complaint arguing that Marquis lacked standing because of lack of evidence of actual misappropriation and because allegations of future threats of misappropriation are insufficient for establishing standing. The Court denied the motion, finding that Marquis had standing under both the ITSA and DTSA as both statutes allow the enjoining of not only actual but also threatened misappropriation. Relying on the Seventh Circuit decision in PepsiCo, Inc. v. Redmond, 54 F.3d 1262 (7th Cir. 1995), the Court recognized that a trade secret misappropriation claim could be established where a defendant’s new employment will inevitably lead him or her to rely on a plaintiff’s trade secrets. When determining if a defendant will inevitably disclose trade secrets in his or her new position, courts consider (1) the level of competition between the former and the new employer; (2) whether the employee’s new position is comparable to the position she or he held with the former employer; and (3) the new employer’s actions to prevent the employee from using or disclosing trade secrets of the former employer. The Court held that Marquis pointed to sufficient evidence at the motion to dismiss stage on each of these factors that: (1) Green Plains is Marquis’ direct competitor, (2) Novozymes is in a similar position of assisting Green Plains in improving its processes as when Novozymes was collaborating with Marquis, and (3) Novozymes failed to sufficiently protect Marquis’ trade secrets. In reaching its decision, the Court pointed to evidence that, while pursuing its partnership with Green Plains, Novozymes sent the same group of scientists who worked on the Green Plains project to learn about Marquis’ trade secrets and that Green Plains’ subsidiary filed a patent application pursuing protection for the same technology as Marquis without any explanation by the inventor as to how he came up with the invention, among other facts. The Court concluded that the facts as presented by Marquis at the motion to dismiss stage reflected that Novozymes would inevitably use Marquis’ trade secrets when partnering with Green Plains. The Court’s decision serves as a useful reminder of the importance of considering not just actual but also threatened misappropriation of trade secrets while asserting misappropriation claims, including the applicability of the inevitable disclosure doctrine. However, it is important to remember that the inevitable disclosure doctrine is applied differently (if at all) in various jurisdictions. In 2019, an Oregon federal court judge surveyed the status of the inevitable disclosure doctrine between the various states at the time, and found that: (a) seventeen (17) states appear to have adopted the inevitable disclosure doctrine in one form or another: Arkansas, Connecticut, Delaware, Florida, Indiana, Illinois, Iowa, Minnesota, Missouri, New Jersey, New York, North Carolina, Ohio, Pennsylvania, Texas, Utah, and Washington; (b) five (5) states appear to have rejected the doctrine: California, Colorado, Louisiana, Maryland, and Virginia; and (c) the remaining twenty-eight (28) states had not yet decided whether to follow the inevitable disclosure doctrine. Phoseon Tech., Inc. v. Heathcote, No. 3:19-cv-2081-SI, 2019 U.S. Dist. LEXIS 221633, at *30-31 (D. Or. Dec. 27, 2019). Since then, a Florida federal court has indicated that Florida has not adopted or declined to adopt the inevitable disclosure doctrine and an Oregon federal court has opined that Oregon would be unlikely to adopt the doctrine. Thus, an up-to-date canvassing of which jurisdictions recognize the inevitable disclosure doctrine is critical.

The Supreme Court’s decision in Andy Warhol Foundation for the Visual Arts, Inc. v. Goldsmith issued earlier today is chock full of references to famous artists, famous works of art, famous musicians and famous celebrities dating back centuries. Given Andy Warhol’s focus on the famous during his prolific career, he’d have to be pleased to see his name and works mentioned with such celebrated company, and in a Supreme Court decision no less. But stripped of its many pop culture and artistic references, the Warhol Foundation decision is the most important fair use decision in the past two decades, with ramifications that will reverberate far longer than the fifteen minutes Warhol envisioned. To recap the basic facts, the core question in the case is whether the use of a copyrighted photograph taken of the artist Prince by the photographer Lynn Goldsmith, subsequently modified by the artist Andy Warhol to create what was referred to as the “Orange Prince,” qualifies as a fair use under Section 107 of the U.S. Copyright Act. Goldsmith had licensed her 1981 photo of Prince, below left, to Vanity Fair magazine, published by Conde Nast, with the understanding that it would be modified by an artist, who turned out to be Andy Warhol. Warhol’s version of the work, below right, was published in 1984. Goldsmith Warhol                 Unbeknownst to Goldsmith, Warhol created a series of works based on her photo called the “Prince Series,” most of which were sold to collectors, with four now held by the Andy Warhol Museum in Pittsburgh. In 2016, Conde Nast licensed from the Warhol Foundation another work from the Prince Series – called the “Orange Prince” – that appears below. The “Orange Prince” was used by Conde Nast on the cover of a commemorative magazine published after Prince’s death. The Warhol Foundation received $10,000 as a licensing fee for this use of the “Orange Prince,” but Goldsmith received neither compensation nor credit for this use of her work. When Goldsmith asserted that the unauthorized 2016 use of her copyrighted photo was infringing, the Warhol Foundation sued her in New York for a declaratory judgment, asserting that the use of her photo in the “Orange Prince” qualified as a fair use. The district court granted summary judgment to the Foundation on its fair use defense, holding that all four factors set forth in 17 U.S.C. § 107 bearing on the issue of fair use favored the Foundation, in that the Prince Series was: (1) “transformative” because, while Goldsmith’s photo portrayed Prince as “not a comfortable person” and a “vulnerable human being,” the Prince Series portrayed Prince as an “iconic, larger-than-life figure”; (2) although Goldsmith’s photo was both creative and unpublished, which would traditionally weigh in Goldsmith’s favor, this was “of limited importance because the Prince Series works are transformative works”; (3) in creating the Prince Series, Warhol removed nearly all of the Goldsmith photo’s protectable elements; and (4) the Prince Series was not a market substitute that harmed or had the potential to harm Goldsmith. On appeal, the U.S. Court of Appeals for the Second Circuit reversed – twice – holding that the Prince Series was neither transformative nor a fair use as a matter of law, and also concluding that the Goldsmith photo and Prince Series were substantially similar as a matter of law. Even after the Supreme Court’s decision in Google LLC v. Oracle America, Inc., 141 S. Ct. 1183 (2021), reaffirmed the principle that a new work is transformative if it “adds something new . . . [by] altering the copyrighted work ‘with new expression, meaning or message’” (quoting Campbell v. Acuff-Rose Music, Inc., 510 U.S. 569, 579 (1994)), the Second Circuit stuck to its guns and held that the Prince Series of works were not transformative. Subsequently, the Supreme Court agreed to hear the Warhol Foundation’s appeal, but in today’s 7-2 decision authored by Justice Sotomayor, it agreed almost entirely with the Second Circuit’s holding. Today’s decision in Warhol Foundation is both narrow and broad at the same time. The decision is narrow in that it addresses only: (i) the licensing to Conde Nast of the “Orange Prince” in 2016 and subsequent publication of that work in a commemorative magazine; and (ii) whether the first statutory fair use factor – the purpose and character of the use – favors the Warhol Foundation. The Court expressed “no opinion as to the creation, display, or sale of any of the original Prince Series works,” and did not consider any other statutory fair use factor except to note how they can relate to the analysis of the first. Indeed, the concurrence from Justices Jackson and Gorsuch noted that all other issues, including whether the “Orange Prince” as licensed by the Warhol Foundation to Conde Nast actually infringes the Goldsmith photo, remain to be addressed during further proceedings. That said, the Court’s ruling is quite broad in a number of respects. In terms of assessing the first fair use factor (the purpose and character of the use), the question of whether a challenged use is “transformative” is now of secondary importance. Indeed, the entire body of case law that has focused the fair use inquiry on the issue of whether a challenged use is or is not transformative is now of questionable validity. So what is of primary importance now to the assessment of the first fair use factor? Two things: (i) whether and to what extent the challenged use has a purpose that is different from that of the original work; and (ii) whether the challenged use is commercial or non-commercial. To sum up the Court’s holding, in its own words: In sum, the first fair use factor considers whether the use of a copyrighted work has a further purpose or different character, which is a matter of degree, and the degree of difference must be balanced against the commercial nature of the use. If an original work and a secondary use share the same or highly similar purposes, and the secondary use is of a commercial nature, the first factor is likely to weigh against fair use, absent some other justification for copy­ing. In this case, the Court held that the purposes of the Goldsmith photo and the “Orange Prince” were substantially the same – to depict the artist Prince. In reaching this conclusion, the Court emphasized the importance of Goldsmith’s extensive licensing of her famous portfolio of works for commercial purposes – not just the same photo of Prince – and the fact that Goldsmith had herself licensed her images of Prince for appearances in commemorative publications issued after his death. Since Conde Nast also published the “Orange Prince” to commemorate Prince’s death, the purposes of Goldsmith’s photo and the “Orange Prince” were substantially the same as far as the Court was concerned. And to the Court, when the purpose of two works is substantially the same, then the prospect that the junior use will substitute for the senior work – characterized as copyright law’s “bête noire” – looms large. The Court contrasted the use of the “Orange Prince” with Andy Warhol’s use of the famous Campbell’s Soup can logo, shown in the image below. This use of a copyrighted commercial logo had a purpose (commenting on consumerism) different from that of the original work (selling soup), and therefore the first statutory factor would favor a finding of fair use in this instance, according to today’s decision. Likewise, the use of a copyrighted work for purposes like parody, newsgathering, criticism, commentary and education would all likely support a finding of fair use because those purposes would, in most cases, differ from those of the original. The Court repeatedly emphasized in its decision that “the first fair use factor . . . focuses on whether an allegedly infringing use has a further purpose or different character, which is a matter of degree, and the degree of difference must be weighed against other considerations, like commercialism.” And on the issue of commercialism, Conde Nast’s commercial exploitation of the “Orange Prince” under license from the Warhol Foundation was of great importance to today’s ruling. Indeed, the Court emphasized that a use of the “Orange Prince” for non-commercial purposes might qualify as fair, but that Conde Nast’s use of that work was not fair insofar as the first factor was concerned, in part because the work was used for commercial purposes. So what about the question of whether a challenged use is transformative? Well, that still matters, but not nearly as much to the fair use analysis as it did before. Under today’s ruling, while the question of whether a later work has transformed a prior work by adding new meaning or message remains relevant, such additions will not by themselves tilt the first factor in favor of fair use, as most cases had held previously. Indeed, under today’s ruling, the first factor will only favor fair use if the newly added material rises to such a sufficiently transformative level that the new work achieves a different purpose than that of the prior work, and therefore does not supersede it. In the Court’s words: “Many secondary works add something new. That alone does not render such uses fair. Rather, the first factor (which is just one factor in a larger analysis) asks ‘whether and to what extent’ the use at issue has a purpose or character different from the original. Campbell, [510 U.S. at 579] (emphasis added). The larger the difference, the more likely the first factor weighs in favor of fair use. The smaller the differ­ence, the less likely.” Indeed, one major takeaway from today’s decision is the Court’s concern that a focus on whether a challenged use is transformative is both difficult to apply in a consistent manner from case to case, and simultaneously permits copying on a such a large scale that the purposes of copyright are subverted. “[A]n overbroad concept of transformative use, one that includes any further purpose, or any different character, would narrow the copyright owner’s exclusive right to create derivative works. To preserve that right, the degree of transformation required to make ‘transformative’ use of an original must go beyond that required to qualify as a derivative.” In this regard, the Court’s majority opinion differed sharply from the dissent penned by Justices Kagan and Roberts, which lamented that today’s decision “will stifle creativity of every sort. It will impede new art and music and literature. It will thwart the expression of new ideas and the attainment of new knowledge. It will make our world poorer.” The majority shot back that the dissent was rife with “misstatements and exaggerations, from the dissent’s very first sen­tence, post, at 1 (“Today, the Court declares that Andy Warhol’s eye-pop­ping silkscreen of Prince . . . is (in copyright lingo) not ‘transformative’”), to its very last, post, at 36 (“[The majority opinion] will make our world poorer”). The majority opinion characterized today’s decision as upholding the purpose of copyright – to protect the rights of creators in their original works – without preventing the uses of such works in circumstances long permitted by law, like when an unauthorized use qualifies as fair. Whether today’s decision actually achieves the balance the majority sought to strike will be a subject of extensive debate for many years to come. And whether subsequent decisions applying Warhol Foundation are effective in achieving that balance will be equally unclear until sufficient time has passed. But what is clear, now, is that the importance of Warhol Foundation to the fair use analysis in many artistic contexts is undeniable.

This spring, Utah legislators gave parents new legal tools to control use of social media by children and teens, including introducing a private right of action with statutory damages. To comply, social media companies will need to fundamentally redesign their systems by March 1, 2024, unless they fit within one of the laws’ exceptions. Tech-savvy kids will surely attempt to defeat or work around the new restrictions. Utah Governor Spencer Cox signed into law two sweeping bills designed to restrict minors’ usage of social media in Utah on March 23, 2023. Senate Bill 1521 and House Bill 3112 are the first laws of their kind in the United States. The Utah Social Media Regulation Act, SB 152, requires certain social media companies to, among other things, verify the age of all current and future users, limit the hours of access for minors, and obtain parental or guardian consent when users under the age of 18 seek to open an account or use an existing account on their platforms. Failures can expose companies to regulatory enforcement and lawsuits by users seeking statutory damages. Concurrently, Utah HB 311 prohibits social media companies from using any practice, design, or feature on the company's social media platform that causes a Utah minor account holder to have an addiction to the social media platform.3 Following Utah’s enactment of its new laws, Arkansas followed suit with its Social Media Safety Act, signed by Arkansas’ governor on April 11, 2023, which also requires age verification of social media users, requires parental consent for use by minors, and enables a private right of action with statutory damages.4 Background Lawmakers have long sought to protect children online. Since the passage of the Children’s Online Privacy Protection Act (“COPPA”) in 1998, the Federal Trade Commission (“FTC”) and state attorneys general have brought multimillion dollar actions against the likes of Google and YouTube5 for illegally collecting personal information from children without their parents’ consent. Most recently, the FTC finalized an order requiring Epic Games, the maker of the video game Fortnite6 (which has been popular among teens and preteens), to pay $245 million for tricking players into making unwanted purchases by using “dark patterns.” The FTC alleged in the case that Epic’s confusing and counterintuitive design made it easy for children to make one-click, in-game purchases without requiring any parental consent. Nevertheless, the new Utah bills are the first state laws aimed at specifically regulating minors’ access to social media platforms (although they conceptually overlap somewhat with California’s Age-Appropriate Design Code). Utah lawmakers say that the bills are required to combat the negative effects of social media on youth mental health.7 To comply, social media companies will likely need to make sweeping changes to the operations of, access to, and advertising on their respective platforms if they seek to remain operational within the state. Scope Utah SB 152 and HB 311 apply to “Social Media Companies,” which are defined as a person or entity that: provides a social media platform that has at least 5,000,000 account holders worldwide; and is an interactive computer service.8 A “Social Media Platform” under the new law is defined as an online forum that a Social Media Company makes available for an account holder to: create a profile; upload posts; view the posts of other account holders; and interact with other account holders or users.9 Certain online services, websites, and applications such as email providers, e-commerce, and streaming services, among others, that meet defined exceptions are excluded from the bills.10 Even if initially excluded, companies will want to regularly re-evaluate whether they are within scope if minor users begin to use their platforms for new purposes. Requirements To comply with SB 152 and HB 311, which can be enforced on March 1, 2024, Social Media Companies will be required to: Verify the age of all existing or new Utah social media account holders using a government-issued ID card and, if the existing or new account holder is a minor, confirm that the minor has consent of a parent or guardian; Grant parents or guardians access to view all posts made and messages sent to and from their child’s social media account; Hide minors’ accounts from public search results and only allow minors to receive messages from accounts with which they are linked “through friending”;11 Prohibit the display of advertising as well as “targeted or suggested groups, services, products, posts, accounts, or users”12 in the minor’s account; Stop collecting or using any personal information from the posts, content, messages, text, or usage activities of the minor’s account other than information that is necessary to comply with, state or federal law (such as birth date and the parent or guardian's name); Prohibit minors from accessing their social media account during the hours of 10:30 p.m. to 6:30 a.m., unless granted by a parent or guardian; Permit parents and guardians to limit the number of hours per day the minor may use the account; and Discontinue the use of any practice, design, or feature that the social media company knows, or should reasonably know, causes Utah minor account holders to have an addiction to the social media platform. The Utah Division of Consumer Protection is tasked with drafting rules on age verification, identification, parental consent, and other aspects of the new law. Penalties SB 152 contains a private right of action through which a Utah resident may file suit against a Social Media Company for violations as of March 1, 2024. If a court finds that a violation has occurred, plaintiffs may receive: an award of reasonable attorney fees and court costs; and an amount equal to the greater of $2,500 per each incident of violation; or if the court determines that the harm is a direct consequence of the violation actual damages for financial, physical, and emotional harm incurred by the person bringing the action. HB 311 provides for additional civil penalties of: $250,000 for each practice, design, or feature shown to have caused social media addiction in minors; and $2,500 for each Utah minor account holder who is shown to have been exposed to the practice, design, or feature found to have caused the addiction or actual damages, whichever is greater. For Utah minors under the age of 16 seeking recovery of damages, the law introduces a rebuttable presumption that the alleged harm occurred and that the harm was caused “as a consequence of using or having an account on the social media company’s social media platform.” The Utah Division of Consumer Protection will also enforce the new laws and may impose administrative fines of $2,500 per violation or bring cases in Utah courts against companies that violate the new laws. With the technological development burdens of the new legal requirements, the loss of advertising revenue based on use by minors, and the potential statutory damage exposure, some social media companies may decide to ban use by those under 18 in Utah. However, even if they do so, they will still need to verify user age and will need to wait for regulations from the Utah Division of Consumer Protection on how to do so. 1 Senate Bill 152 2 House Bill 311 3 HB 311, Sec. 13-63-201(2). 4 Arkansas Act 689, SB 396. 5 Google and YouTube Will Pay Record $170 Million for Alleged Violations of Children’s Privacy Law | Federal Trade Commission (ftc.gov) 6 FTC Finalizes Order Requiring Fortnite maker Epic Games to Pay $245 Million for Tricking Users into Making Unwanted Charges | Federal Trade Commission 7 The Impact of Social Media on Teens' Mental Health | University of Utah Health | University of Utah Health 8 SB 152, Sec. 13-63-101(8). 9 SB 152, Sec. 13-63-101(9)(a). 10 SB 152, Sec. 13-63-101(9)(b). 11 SB 152, Sec. 13-63-103(1)-(2). 12 SB 152, Sec. 13-63-103(5).

What qualifies as the United States’ current favorite sport may be a subject for heated debate, but “America’s Pastime” and its biggest stars still have significant power over the public—and, apparently, the Trademark Trial and Appeal Board (“TTAB”). By 2017, New York Yankees right-fielder Aaron Judge had become a fan favorite, reaching such popularity that the team officially designated a section of its home stadium “The Judge’s Chambers.” Attendees wholeheartedly embraced the theme, with some showing up in judge’s robes, white wigs, and holding large signs bearing phrases such as “ALL RISE” and “HERE COMES THE JUDGE.” Not one to waste a good merchandising opportunity, Judge’s union, the Major League Baseball Players Association (“MLBPA”), licensed the use of these phrases, with Judge’s permission, to various third parties in exchange for royalties. Also in 2017, Long Island resident Michael P. Chisena filed applications to register the trademarks “ALL RISE,” “HERE COMES THE JUDGE,” and a design of a baseball diamond incorporating a gavel and scales of justice. Judge and the MLBPA filed oppositions of the applications before the TTAB. Purportedly unaware of throngs of screaming baseball fans wearing merchandise in reference to Judge just a few miles away, Chisena asserted that his applied-for marks did not refer to the right-fielder, and that the MLBPA simply uses “ALL RISE” and “HERE COMES THE JUDGE” as part of merely informational expressions to celebrate Aaron Judge’s baseball prowess. Traditionally, slogans or phrases that are common expressions or that simply convey information are not registerable as trademarks (e.g. “AMERICA’S FRESHEST ICE CREAM” for ice cream). Just a few months ago, the TTAB addressed similar arguments in its review of Lizzo LLC’s attempt to register “100% THAT BITCH.” In a precedential decision, the TTAB considered the possibility that the phrase was a merely informational expression that conveyed female self-confidence and independence. The singer Lizzo even admitted that the phrase originally came from an Internet meme. However, because Lizzo had popularized the phrase, the public had come to predominantly associate it with the singer, rendering it a valid trademark that identified her. And so, the TTAB allowed the mark to register. As with Lizzo, the TTAB sided with Judge and the MLBPA in a precedential decision, shutting down Chisena’s arguments and pointing out consumer recognition of “ALL RISE,” “HERE COMES THE JUDGE,” and the judicial baseball design logo as unmistakably referring to the Yankees player. Reliance on public perception therefore appears to be on the rise, spurring the TTAB to look outside of the application at issue and, at least in the case of celebrity singers and athletes, to rely on public perception as a measure of validity for trademarks.