In my review of iPhone App Law, I have discussed the case of Turner v Storm8 (Complaint), a 2009 US federal class action lawsuit that alleged a privacy breach by an iPhone app developer.  The lawsuit alleged that Storm8, creator of “iMobster” and “Vampires Live,” wrote its software to collect phone numbers automatically when players downloaded the games. The developer blamed this privacy breach on a software glitch. 

The Wall Street Journal has reported a similar breach by Facebook app developers. Many of the most popular Facebook apps have been transmitting Facebook ID numbers to at least 25 advertising and data firms.  This information can be cross-referenced to compile detailed profiles of Internet users. In this case, the breach goes far beyond phone numbers, and appears to implicate a range of rich personal data that makes up the Facebook world. The practice would violate the terms under which Facebook permits developers to sell apps, and may violate the app developers’ own privacy policies. But that is cold comfort if it’s your identity that is compromised.

Lessons for business?

• A risk of this type is not confined to Facebook apps – privacy breaches could be caused by any third-party app developer, whether it’s on the Facebook, Android or iOS platform;
• If you engage a developer to create an app for your company, make sure your terms clearly address privacy issues. A breach of this type can be fatal to the app, and can spread to implicate the whole company if the breach is serious;
• If you are a developer, ensure that you carefully manage privacy issues. If the collection of information is warranted, it should be done properly. In Canada, the collection of personal information can be permitted if there is informed consent by the end-user. And you need to compare your information-handling practices against the terms of the SDK – for example, Apple’s iOS terms are clear that developers will be liable in the event of any breach of a user’s privacy rights.

Calgary – 10:00 MT