Can ProctorU Be Trusted With Students' Personal Data?

from the legal-bullies dept

One of the hard lessons that I have learned over my years of practice is that, although some lawyers believe that they can increase the in terrorem effect of a complaint or a demand letter by piling on claims, the net effect of adding silly assertions can be to make things worse for your own client and not better. That may be true as well of the demand letter recently sent by David Vance Lucas of Bradley Arant Boult Cummings on behalf of their client, ProctorU.

Criticisms and Demand Letter

The saga begins with a faculty association at the University of California at Santa Barbara, which heard about a potential problem with the data-sharing policies of ProctorU, a business that provides internet-based test monitoring services. The group took a look at the ProctorU privacy policies and did not like what they saw – in their view, it provided too little specificity about the limitations on data-sharing, and no protection for the data in the event that ProctorU were to go into bankruptcy or merge, possibly without restrictions on use of the data. And online discussions by students subject to ProctorU monitoring have shared a variety of concerns about the creepy nature of ProctorU’s interventions; the students were plainly worried about the attending possibility of data accumulation. The faculty association voiced its concerns in a letter to the leadership of the University of California at Santa Barbara, urging them to stop using ProctorU and to avoid using “any other private service that either sells or makes students’ data available to third parties.” The letter was discussed in a story in the school’s student newspaper.

It is apparently ProctorU’s position that the faculty association’s concerns are overwrought. I have no opinion about that dispute. But instead of simply saying so, ProctorU hired attorney Lucas, who sent a blistering demand letter to the faculty group, accusing it of defamation, of linking to ProctorU’s web site without permission (so what?), of copyright and trademark infringement, of a bad faith violation of the federal anti-cybersquatting law (ACPA), and of willfully interfering with efforts to mitigate civil disruptions stemming from the COVID-19 pandemic. Without quite meeting the faculty criticisms, the letter provided a restatement of the ProctorU privacy policy from a sanitized perspective, and on that basis demanded that the faculty group stop its “misrepresentation and misstatement” of the privacy policies; retract the complaints; and agree never to use ProctorU’s “family of marks and copyrighted materials.” In subsequent correspondence, Lucas has demanded that each member of the faculty group’s board sign a groveling letter in which they would have to take personal responsibility for the group’s criticisms, admit that many of statements for which they would be taking personal responsibility were false, endorse Lucas’ unproven assertions about his client’s privacy practices, and retract both the letter and the request that USCB stop using its services.  It is my firm belief that Lucas's letter and followup emails, and especially the demanded retraction letter, had the intended effect of terrifying the faculty group, if only because they know how much it can cost to hire lawyers even when you have done nothing wrong  -- until they started hearing that pro bono representation could be a significant possibility.

The Federal Law Claims Are Completely Bogus

My immediate reaction to this letter was to feel uncertain about whether ProctorU had any valid defamation claims, but my attention was drawn quickly to the contentions about federal intellectual property law, all of which are nonsensical.

First, the copyright claims. Lucas argues that by repeating some of the language from the privacy policy in their letter, the faculty group infringed the copyright in the privacy policy. One thing that is decidedly odd about this copyright claim is that, at the same time that Lucas is claiming improper copying, he is claiming that the letter misstated the privacy policy. Either the letter contains exact quotes or it doesn’t. But beyond that, any language taken from the policy is plainly fair use — when you are criticizing a written text, you often have to quote the text being criticized. And beyond that, my search of the copyright database did not identify any copyright registrations by ProctorU.  So it would have to register before suing, and failure to register previously would be fatal to any monetary claims besides actual damages. Those would be copyright damages, not damage to reputation. Hard to believe there is any copyright injury here.

The demand letter invokes the ACPA but it is hard to see why, other than to give Lucas an excuse to put the phrase "bad faith" into the letter (he mentions that statute’s “bad faith factors,” none of which point in the direction of bad faith so far as I can see), and to threaten statutory damages and attorney fees. But the ACPA could have provided a remedy only if the faculty group had the registered or used  a domain name to place its communications online; it does not provide a remedy for mentioning the URL's of some pages within ProctorU’s own web site in the body of a text, or for linking to those pages. Moreover, quite a number of cases under the ACPA and the Lanham Act allow the use of trademarks in domain names for web sites that comment on the trademark holder, including Lamparello v. Falwell, Bosley Medical v. Kremer, and Taubman Company v. WebFeats (a wonderful account of that latter litigation, full of the quirky sense of humor that my client Hank Mishkoff maintained throughout the litigation, can be found at the Taubman Sucks web site). I should note that although the faculty group did not register a domain name for their letter about ProctorU, there are plenty of ProctorU domain names ready for the taking, each of which could be lawfully used for a campaign to criticize that company for hiring David Lucas to send this letter, or indeed for criticizing Lucas or his client's funders.

The trademark claims are equally faulty. First of all, under the doctrine of nominative fair use, trademarks can be used to identify the subject of a criticism, and injunctive relief imposed for the use of marks for criticism would run afoul of the First Amendment, as established in such cases as Nissan Motor Co. v. Nissan Computer Co., and CPC International v. Skippy, Inc.  Moreover, a number of cases, including Bosley and Taubman, cited above, hold that trademark claims may only be brought over commercial uses of trademarks, thus avoiding unnecessary conflict with the First Amendment. In a case called Radiance Foundation v. NAACP, the Fourth Circuit came awfully close to agreeing with that limitation, but confined itself to holding that the statutory language of the trademark laws must be read as being limited to regulation of uses that could properly be treated as commercial speech.

The faculty association's letter was not commercial speech. The letter seems to suggest that the UCSB faculty are worried about facing economic competition from ProctorU for their proctoring services. But apart from the fact that the mere possibility of an economic interest at play does not make speech commercial (for which see Nike, Inc. v. Kasky), the argument reflects a certain air of unreality. All of the college faculty that I know hate proctoring and do not want to spend their time on that task; when possible, they slough off this work on graduate students. They might, at the same time, have genuine concerns about student privacy.

Lucas’ bio page at the Bradley Arant web site indicates that “intellectual property” is among his practice areas. My initial assumption was that, being an IP specialist, he must have known how frivolous his trademark and copyright claims are. But as I started reading the IP cases listed on his bio page, it struck me that his IP practice may have been confined to patent law; if so, then his letter only reflects bumbling, not malice.

Even the Libel Claims Seem Spurious

Although it was the silly intellectual property claims that spurred my interest in this matter, the more I have thought about the libel side of the case, the less potent the claims have seemed to me. On its face, the strongest point in the demand letter is the contention that ProctorU never sells the data that accumulates – and if that were true, and if the faculty letter had accused ProctorU of selling the data, that might well qualify as material falsity. But in fact the letter only complains that ProctorU shares the data with others; the only reference in the faculty letter to “selling” is in the phrase quoted above: after urging that UCSB drop ProctorU, it also urges a more general policy: not to use “this service or any other private service that either sells or makes students' data available to third parties.” There is no charge in the letter that I can see saying that ProctorU sells data.

The rest of the libel discussion in the demand letter is a big nothing. Lucas says this in his letter: “Contrary to your misrepresentations, ProctorU does not sell or share any information it collects to any third parties.” But would Lucas make that assertion under oath? After all, just two paragraphs before that, his letter says, “ProctorU only collects, uses and shares student personal information to provide its proctoring services . . . and to ensure the integrity of the tests it proctors.” And one paragraph before the denial, he says, “ProctorU . . . transparently discloses all information that could be collected, used or shared, and specifically identifies the types of third parties with whom it shares student information.”  (all the emphasis is added).  Now, this admitted sharing may or may not be justified – that is a matter of opinion – but it is simply not false to say that ProctorU shares information with third parties. Not false unless Lucas’s own admissions are erroneous.

Without a claim of substantial falsity, ProctorU’s threat to sue for defamation falls apart. Lucas also tosses in the names of two more torts: intentional interference with existing and prospective business relations into his hopper. But without a sustainable claim of falsity, those tort claims cannot survive.

ProctorU’s disproportionate response to the faculty group’s criticisms make me wonder just what there is to hide about the company’s data-sharing practices. Lucas’s letter contains a number of broad and conclusory assurances about his client, but no proof. I have to wonder what discovery, or an investigation by state authorities proceeding with enforceable subpoenas, might reveal about just what data gets shared with what third parties, and under what circumstances and with what protections against further dissemination.

I have asked Lucas to justify his claims under both state and federal law, and he refused to respond, claiming that I would surely appreciate that he “cannot address issues pertaining to a client with you” unless I told him that I was representing the faculty group.  (I have not yet decided about that).   No, I do not appreciate that he “cannot” - I took it as a dodge by a lawyer who would rather not explain his misstatements about the law.  After all, he sent his demand letter not only to the faculty group but also to counsel for the University of California and for UCSB, as well as to the California Attorney General and to the U.S. Attorney for the Central District of California, the latter two with the pretense that the faculty’s letter is “directly impacting emergency efforts to mitigate civil disruption across the United States.” Ah, yes, terrorism – maybe he should ask them to invoke the PATRIOT Act against these faculty terrorists. (Some of the respondents to the Popehat Signal on this case  raised the question whether this is an unlawful threat of criminal prosecution).   But he has showed no compunction about providing his thoughts about the case to lawyers who do not represent the target of his threats.

Stop the Bullying of Critics

In sum, I see little merit to this demand letter, and the nasty character of the demand deserves a forceful response. My efforts to  engage Lucas in explaining his claims, and to get him to listen to reason, have failed.   So my suggestion to members of the public is that they communicate their views both to ProctorU itself and to Eastside Partners, a venture capital firm that has provided funding for this company. Three of the five members of the ProctorU board appear to work at Eastside Partners. So Eastside Partners could pull the plug on Lucas’s bullying, if it chose to do so.

Reposted (with permission) from the Public Citizen Consumer Law & Policy Blog

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: bullying, copyright, data sharing, david lucas, defamation, free speech, privacy, privacy policies, trademark
Companies: procturu, ucsb