IndyBar Case to Watch: State of Indiana v Google LLC
By Adam Ira, Frost Brown Todd LLC
Recently, the Indiana Attorney General’s Office filed a lawsuit on behalf of the State of Indiana against Google LLC. State of Indiana v Google LLC is pending in the Superior Court of Marion 4 under case number 49D04-2201-PL-002399. In the complaint, the state alleges that Google collects consumers’ personal data, including location data, when consumers use Google products. Google would in turn use this data to target advertisements to consumers and assess the effectiveness of these advertisements.
The gist of the complaint is that Google allegedly “systematically mislead, deceive, and conceal material facts from consumers regarding how their location is tracked and used by the company and how and to what extent consumers can protect their privacy by stopping Google’s tracking and use of their location. The complaint further alleges that “there is effectively no way for consumers to prevent Google from collecting, storing and leveraging their location data. location”. A multi-state investigation reportedly found that “although Google claims to offer consumers meaningful choices about the data Google collects and uses through customizable controls, Google’s ambiguous, contradictory, and incomplete statements about these controls ensure consumers will not understand when their location is being tracked by Google or for what purpose. »
The factual allegations in the complaint are quite detailed and cover 47 pages. The allegations lead to multiple causes of action under Indiana’s Consumer Deceptive Sales Act seeking (among other things) a permanent injunction against the offending privacy practices and restitution of all profits and benefits obtained through the offending practices. In the absence of a comprehensive data privacy law in Indiana, consumers should turn to the Deceptive Consumer Sales Act, Ind. Code § 24-5-0.5-3, et seq., to provide a remedy against unlawful privacy practices.
A comprehensive data privacy law is important for both consumers and data processors. Consumers need to have defined rights, and data processors need clarity on what exactly those rights are so they can govern their privacy practices accordingly. The wheels of justice are turning slowly, and currently, data privacy rights in Indiana are almost exclusively defined by common law, either by common law tort case law. , or through the judicial interpretation of laws that were not specifically designed to enforce privacy rights.
On this point, a bill (Senate Bill 358) is currently being considered by the Indiana General Assembly and could establish a consumer data protection law similar to that in force in Virginia, Colorado and California. The bill, as currently drafted, would not give consumers a private right of action to enforce privacy rights, but would vest enforcement power in the Indiana Attorney General’s office. . Among the rights set out in the bill are:
• The right to know whether a controller is processing consumer data.
• The right to access personal data processed by a data controller.
• The right to correct information,
• The right to delete information.
• The right to data portability.
• The right to opt out of targeted advertising or the sale of data.
• A guarantee that a consumer’s privacy rights are non-contractual.
Michael Daniells, executive committee member of the E-Discovery, Information Governance & Cybersecurity Section, recently wrote an insightful post on LinkedIn explaining the new bill making its way through the Indiana General Assembly. While still in its infancy, and its fate uncertain, this bill could put Indiana at the forefront of data privacy reform in the United States.
One thing is certain: State of Indiana v Google LLC is going to be an interesting case with a huge impact on data privacy in Indiana, regardless of the outcome.•
This article originally appeared on the IndyBar E-Discovery Blog, Information Governance & Cybersecurity Section. To learn more about the section, visit indybar.org/edisc.