Apple contends Epic’s ban was a ‘self-inflicted’ prelude to gaming the App Store

Apple has filed legal documents opposing Epic’s attempt to have itself reinstated in the iOS App Store, after having been kicked out last week for flouting its rules. Apple characterizes the entire thing as a “carefully orchestrated, multi-faceted campaign” aimed at circumventing — perhaps permanently — the 30 percent cut it demands for the privilege of doing business on iOS.

Epic last week slyly introduced a way to make in-app purchases in its popular game Fortnite without going through Apple. This is plainly against the rules, and Apple soon kicked the game, and the company’s other accounts, off the App Store. Obviously having anticipated this, Epic then published a parody of Apple’s famous 1984 ad, filed a lawsuit, and began executing what Apple describes quite accurately as “a carefully orchestrated, multi-faceted campaign.”

Epic files motion for injunction against Apple over threat to revoke all developer access

In fact, as Apple notes in its challenge, Epic CEO Tim Sweeney emailed ahead of time to let Apple know what his company had planned. From Apple’s filing:

Around 2am on August 13, Mr. Sweeney of Epic wrote to Apple stating its intent to breach Epic’s agreements:
“Epic will no longer adhere to Apple’s payment processing restrictions.”

This was after months of attempts at negotiations in which, according to declarations from Apple’s Phil Schiller, Epic attempted to coax a “side letter” from Apple granting Epic special dispensation. This contradicts claims by Sweeney that Epic never asked for a special deal. From Schiller’s declaration:

Specifically, on June 30, 2020, Epic’s CEO Tim Sweeney wrote my colleagues and me an email asking for a “side letter” from Apple that would create a special deal for only Epic that would fundamentally change the way in which Epic offers apps on Apple’s iOS platform.

In this email, Mr. Sweeney expressly acknowledged that his proposed changes would be in direct breach of multiple terms of the agreements between Epic and Apple. Mr. Sweeney acknowledged that Epic could not implement its proposal unless the agreements between Epic and Apple were modified.

One prong of Epic’s assault was a request for courts to grant a “temporary restraining order,” or TRO, a legal procedure for use in emergencies where a party’s actions are unlawful, a suit to show their illegality is pending and likely to succeed, and those actions should be proactively reversed because they will cause “irreparable harm.”

If Epic’s request were to be successful, Apple would be forced to reinstate Fortnite and allow its in-game store to operate outside of the App Store’s rules. As you might imagine, this would be disastrous for Apple — not only would its rules have been deliberately ignored, but a court would have placed its imprimatur on the idea that those rules may even be illegal. So it is essential that Apple slap down this particular legal challenge quickly and comprehensively.

Apple’s filing challenges the TRO request on several grounds. First, it contends that there is no real “emergency” or “irreparable harm” because the entire situation was concocted and voluntarily initiated by Epic:

Having decided that it would rather enjoy the benefits of the App Store without paying for them, Epic has breached its contracts with Apple, using its own customers and Apple’s users as leverage.

But the “emergency” is entirely of Epic’s own making…it knew full well what would happen and, in so doing, has knowingly and purposefully created the harm to game players and developers it now asks the Court to step in and remedy.

Epic’s complaint that Apple banned its Unreal Engine accounts as well as Fortnite related ones, Apple notes, is not unusual considering the accounts share tax IDs, emails, and so on. It’s the same “user,” for their purposes. Apple also says it gave Epic ample warning and opportunity to correct its actions before a ban took place. (Apple, after all, makes a great deal of money from the app as well.)

Apple also questions the likelihood of Epic’s main lawsuit (independent of the TRO request) succeeding on its merits — namely that Apple is exercising monopoly power in its rent-collecting on the App Store.

[Epic’s] logic would make monopolies of Microsoft, Sony and Nintendo, just to name a few.

Epic’s antitrust theories, like its orchestrated campaign, are a transparent veneer for its effort to co-opt for itself the benefits of the App Store without paying or complying with important requirements that are critical to protect user safety, security,
and privacy.

Lastly Apple notes that there is no benefit to the public interest to providing the TRO — unlike if, for example, Apple’s actions had prevented emergency calls from working or the like, and there was a serious safety concern:

All of that alleged injury for which Epic improperly seeks emergency relief could disappear tomorrow if Epic cured its breach…All of this can happen without any intervention of the Court or expenditure of judicial resources. And Epic would be free to pursue its primary lawsuit.

Although Apple eschews speculating further in its filings, one source close to the matter suggested that it is of paramount importance to that company to avoid the possibility of Epic or anyone else establishing their own independent app stores on iOS. A legal precedent would go a long way towards clearing the way for such a thing, so this is potentially an existential threat for Apple’s long-toothed but extremely profitable business model.

The conflict with Epic is only the latest in a series going back years in which companies challenged Apple’s right to control and profit from what amounts to a totally separate marketplace.

Apple goes to war with the gaming industry

Most recently Microsoft’s xCloud app was denied entry to the App Store because it amounted to a marketplace for games that Apple could not feasibly vet individually. Given this kind of functionality is very much the type of things consumers want these days, the decision was not popular. Other developers, industries, and platforms have challenged Apple on various fronts as well, to the point where the company has promised to create a formal process for challenging its rules.

But of course, even the rule-challenging process is bound by Apple’s rules.

You can read the full Apple filing below:

Epic v. Apple 4:20-cv-05640… by TechCrunch on Scribd

from Apple – TechCrunch https://ift.tt/2QaxEDQ

No parties allowed at the Airbnb IPO

Hello and welcome back to Equity, TechCrunch’s venture capital-focused podcast (now on Twitter!), where we unpack the numbers behind the headlines.

What happens when the entire podcast crew is a bit tired from, you know, everything, and does its very best? This episode, apparently. A big thanks to Chris Gates for helping us trim the fat and make something good for you.

Before we get into the topics of the week, don’t forget that Equity is not back on YouTube most weeks, so if you wanted to see us do the talking with some fun extra from the production team, you can do so here. More to come once I get my new external camera to work.

That done, here’s what Natasha and Danny and I got into this week:

• The public markets are afire these days with Apple reaching $2 trillion in market cap, and Tesla’s stock doing all sorts of odd things. In short, stocks have only gone up for a while and that means that there’s warm, nigh-stuffy temperatures around assets of all types.
• This is leading to a surge in liquidity, unsurprisingly, as asset managers of all types look to take advantage of the times. So, Asana is prepping a direct listing, Airbnb has filed privately, And ThredUp is eyeing an early-2021 IPO. Around the same time as Coinbase, we’d reckon.
• Airbnb banned parties as well, which wound up being the title of the show.
• And SPACs are still happening in rapid-fire fashion. The Equity crew is not super impressed about the whole affair, but I’ll say that with Paul “Fucking” Ryan involved, it’s probably a sign of the top.
• And capping the liquidity chat, Natasha ran us through what Chamath is up to now, and Danny rabbited on about Kabbage.
• Funding rounds! Welcome raised a $1.4 million check that I covered, Labster raised $9 million that Natasha wrote about, Carrot Fertility picked up $24 million that we all thought was pretty smart, and our friends at Crunchbase News wrote about PadSplit, which is honestly neat but we ran low on time after spending too much time on SPACs. Check them out here.

Whew! We’re doing a lot over at TechCrunch.com, so, stay tuned and know that if we were a bit frazzled this week it’s because we’re working our backends off to bring you neat things. You will dig ’em.

Ok, chat Monday, a show that we’re already planning. Stay cool!

Equity drops every Monday at 7:00 a.m. PT and Friday at 6:00 a.m. PT, so subscribe to us on Apple Podcasts, Overcast, Spotify and all the casts.

from Apple – TechCrunch https://ift.tt/3gjoBea

Report: Apple quietly acquired Israel’s Camerai, formerly Tipit, a specialist in AR and camera tech

Apple is well known for picking up smaller startups on the hush-hush to augment its business, and today news leaked out about the latest of these… nearly two years after the fact. Sometime between 2018 and 2019, the iPhone giant reportedly acquired and shut down Camerai, an augmented reality and computer vision company based out of Israel, which used to be called Tipit.

The news was first reported earlier today by Israeli newspaper Calcalist, and we have reached out to ask Apple directly about it. In the meantime, Jonathan (Yehonatan) Rimon, who had been Camerai’s CEO and co-founded the company with Moty Kosharovsky, Erez Tal, and Aaron Wetzler, declined to comment one way or the other on the report to us when we contacted him directly about it. A separate source confirmed the story to us. We’ll update as we learn more.

Calcalist said that the startup sold for several tens of millions of dollars. From being founded in 2015, Camerai had raised around $5 million — including a $2.5 million round in 2017 and another unreported $2.5 million in 2018 — with investors including the Atooro Fund and another called the SKO Fund.

It seems that the acquisition came on the heels of multiple approaches from a number of companies at a time when AR was arguably at a peak of hype and many big tech companies wanted a piece of the action. (Recall that 2018 was the year when Magic Leap raised nearly $1 billion in a single round of funding.) Back in 2018, we heard rumors that those approaching and looking at the startup included Apple, Samsung, and Alibaba.

The Calcalist report said that Camerai employees joined Apple’s computer vision team, and that the company’s technology has been incorporated into Apple products already. It’s not clear specifically where and when, but recall that both iOS 13 and iOS 14 have featured big software updates to the camera.

Camerai had built an SDK and specifically a range of software-based AR tools to help edit and use camera-made images in more sophisticated ways,

Its tech included the ability to detect different objects in the picture, and outline them with precision to alter them cosmetically; the ability to outline and apply filters across the whole image; a “skeleton tracking” neural network API that could detect and draw body joints in real time overlaid on a picture of a human; and its own version of selective focus for enhanced portrait modes (remember this was 2018 and this was not standard on phones at the time). Camerai’s site is shut down, but here are some screenshots of how it all looked, pulled from the Internet Archive:

[gallery ids="2034083,2034084,2034086,2034087"]

Camerai’s acquisition underscores a couple of interesting, and ongoing, trends.

The first of these is in the development of smartphone technology, particularly around cameras. Some of the more interesting innovations in smartphone camera technology have come not out of improvements in hardware, but software, where the application of breakthroughs in artificial intelligence can mean that an existing combination of sensor, lens, and on-phone and cloud processors produce a better and more technically dynamic picture than before.

At a time when smartphone replacement cycles have really slowed down and we are seeing also slower innovation on hardware, bolting on talent and tech created outside the phone companies is one way to gain a competitive edge.

(Separately, I wonder if making cutting edge technology software-based also means that there could be scope in the future for paid updates to older phone models, which could mean more incremental revenues from consumers that don’t want to invest incompletely new devices.)

The second trend that this deal underscores is how Israel remains fertile ground for bigger companies on the hunt to pick up and bolt on technology, and that the secretive approach is likely to remain for some time to come.

“In Israel there are over 350 global corporate companies, from 30 countries, who search for local innovation. Some of them like Apple, MS, Google, even have local R&D [operations],” said Avihai Michaeli, a Tel Aviv-based senior investment banker and startup advisor. “Those global companies look mainly for tech which could serve as its competitive edge. It is not the first time that an acquired startup is asked not to publish it was acquired, nor talk about it.”

Other acquisitions that Apple has made in Israel have included camera module maker LinX, semiconductor startup Anobit, and 3D sensor company PrimeSense.

We’ll update this post as we learn more.

from Apple – TechCrunch https://ift.tt/2Qd15VE

Daily Crunch: Apple hits $2 trillion market cap

Apple stock reaches a big milestone, Facebook Portal gets more work-friendly and Twitter reports progress against hate speech. This is your Daily Crunch for August 19, 2020.

The big story: Apple hits $2 trillion market cap

Apple’s share price is up around 59% since the beginning of the year, despite seeing relatively modest, 11% year-over-year revenue growth in its most recent earnings report.

Alex Wilhelm argues that Apple’s strong market performance, and similar strength from other tech giants, is a good thing for startups:

Public rallies can help advance IPOs, and acquisitions. So today’s news that Apple is now sufficiently rich enough to shame Croesus means that your friendly, local startup might be able to close that next round at a price that it likes.

The tech giants

Facebook Portal gets serious about remote work with BlueJeans, GoToMeeting, Webex and Zoom apps — All of the apps will be arriving at some point in September for the Portal Mini, standard Portal and Portal+.

Twitter claims increased enforcement of hate speech and abuse policies in last half of 2019 — The company claims that its ability to “proactively” surface content violations for human review has helped it increase enforcement.

Top Facebook executive in India files criminal complaint against a journalist for sharing news report — A review of the journalist Awesh Tiwari’s post, written in Hindi, finds that it was merely summarizing a recent Wall Street Journal report.

Startups, funding and venture capital

JD.com’s 1-year-old health unicorn to get $830M from Hillhouse — When Alibaba’s rival JD.com saw an opportunity in the prescription drug market, it spun out its healthcare unit into a subsidiary called JD Health.

Hangar raises $15 million for its venture studio for government technology startups — Founded by former Bloomberg advisor Josh Mendelsohn, Hangar has already created four businesses.

India’s first Earth-imaging satellite startup raises $5 million; first launch planned for later this year — Once all of the company’s small satellites are on orbit, the Pixxel network will be able to provide globe-spanning imaging capabilities on a daily basis.

Advice and analysis from Extra Crunch

Max Levchin is looking ahead to fintech’s next big opportunities — We sat down with Levchin for a recent session of Extra Crunch Live, where he spoke at length about what he sees as some of the big opportunities in fintech.

Dear Sophie: How can I transfer my H-1B to my startup? — An H-1B status employee at a tech company asks about the implications of founding (and working for) their own startup.

Join Twilio’s Jeff Lawson for a live Q&A August 25 at 2:30 pm EDT/11:30 am PDT — Twilio has become a giant, worth more than $37 billion today after going public in 2016.

(Reminder: Extra Crunch is our subscription membership program, which aims to democratize information about startups. You can sign up here.)

Everything else

Fearing coronavirus, a Michigan college tracks its students with a flawed app — The Aura app had at least two security vulnerabilities only discovered after it was rolled out.

Scotland spaceport gets full approval, will be able to host up to 12 launches per year — This will be the future launch site for Orbex, a startup looking to develop the U.K.’s first reusable orbital launch vehicle.

At the first-ever virtual DNC, Democrats play it safe — The first all-virtual Democratic National Convention is in full swing, but don’t expect fireworks.

The Daily Crunch is TechCrunch’s roundup of our biggest and most important stories. If you’d like to get this delivered to your inbox every day at around 3pm Pacific, you can subscribe here.

from Apple – TechCrunch https://ift.tt/34hDsUq

Fearing coronavirus, a Michigan college tracks its students with a flawed app

Schools and universities across the United States are split on whether to open for the fall semester, thanks to the ongoing pandemic.

Albion College, a small liberal arts school in Michigan, said in June it would allow its nearly 1,500 students to return to campus starting in August for the new academic year. Lectures would be limited in size and the semester would finish by Thanksgiving rather than December. The school said it would test both staff and students upon their arrival to campus and throughout the academic year.

But less than two weeks before students began arriving on campus, the school announced it would require them to download and install a contact-tracing app called Aura, which it says will help it tackle any coronavirus outbreak on campus.

There’s a catch. The app is designed to track students’ real-time locations around the clock, and there is no way to opt out.

The Aura app lets the school know when a student tests positive for COVID-19. It also comes with a contact-tracing feature that alerts students when they have come into close proximity with a person who tested positive for the virus. But the feature requires constant access to the student’s real-time location, which the college says is necessary to track the spread of any exposure.

The school’s mandatory use of the app sparked privacy concerns and prompted parents to launch a petition to make using the app optional.

Worse, the app had at least two security vulnerabilities only discovered after the app was rolled out. One of the vulnerabilities allowed access to the app’s back-end servers. The other allowed us to infer a student’s COVID-19 test results.

The vulnerabilities were fixed. But students are still expected to use the app or face suspension.

Track and trace

Exactly how Aura came to be and how Albion became its first major customer is a mystery.

Aura was developed in the months after the pandemic began by Nucleus Careers, a Pennsylvania-based recruiting firm founded in 2020 with no apparent history or experience in building or developing healthcare apps besides a brief mention in a recent press release. The app was built in partnership with Genetworx, a Virginia-based lab providing coronavirus tests. (We asked Genetworx about the app and its involvement, but TechCrunch did not hear back from the company.)

The app helps students locate and schedule COVID-19 testing on campus. Once a student is tested for COVID-19, the results are fed into the app.

If the test comes back negative, the app displays a QR code which, when scanned, says the student is “certified” free of the virus. If the student tests positive or has yet to be tested, the student’s QR code will read “denied.”

Aura uses the student’s real-time location to determine if they have come into contact with another person with the virus. Most other contact-tracing apps use nearby Bluetooth signals, which experts say is more privacy-friendly.

Hundreds of academics have argued that collecting and storing location data is bad for privacy.

The Aura app generates a QR code based on the student’s COVID-19 test results. Scan the QR code to reveal the student’s test result status. (Image: TechCrunch)

In addition to having to install the app, students were told they are not allowed to leave campus for the duration of the semester without permission over fears that contact with the wider community might bring the virus back to campus.

If a student leaves campus without permission, the app will alert the school, and the student’s ID card will be locked and access to campus buildings will be revoked, according to an email to students, seen by TechCrunch.

Students are not allowed to turn off their location and can be suspended and “removed from campus” if they violate the policy, the email read.

Private universities in the U.S. like Albion can largely set and enforce their own rules and have been likened to “shadow criminal justice systems — without any of the protections or powers of a criminal court,” where students can face discipline and expulsion for almost any reason with little to no recourse. Last year, TechCrunch reported on a student at Tufts University who was expelled for alleged grade hacking, despite exculpatory evidence in her favor.

Albion said in an online Q&A that the “only time a student’s location data will be accessed is if they test positive or if they leave campus without following proper procedure.” But the school has not said how it will ensure that student location data is not improperly accessed, or who has access.

“I think it’s more creepy than anything and has caused me a lot of anxiety about going back,” one student going into their senior year, who asked not to be named, told TechCrunch.

A ‘rush job’

One Albion student was not convinced the app was safe or private.

The student, who asked to go by her Twitter handle @Q3w3e3, decompiles and analyzes apps on the side. “I just like knowing what apps are doing,” she told TechCrunch.

Buried in the app’s source code, she found hardcoded secret keys for the app’s backend servers, hosted on Amazon Web Services. She tweeted her findings — with careful redactions to prevent misuse — and reported the problems to Nucleus, but did not hear back.

endpoint: 'https://t.co/a5j4nvu5nQ',
accessKeyId: '[REMOVED FOR REASONS]',
secretAccessKey: '[REMOVED FOR REASONS]',
region: 'us-west-2'

— xXx_ANT1FA_5C3N3_QU33N_xXx (@Q3w3e3) August 12, 2020

A security researcher, who asked to go by her handle Gilda, was watching the tweets about Aura roll in. Gilda also dug into the app and found and tested the keys.

“The keys were practically ‘full access’,” Gilda told TechCrunch. She said the keys — since changed — gave her access to the app’s databases and cloud storage in which she found patient data, including COVID-19 test results with names, addresses and dates of birth.

Nucleus pushed out an updated version of the app on the same day with the keys removed, but did not acknowledge the vulnerability.

TechCrunch also wanted to look under the hood to see how Aura works. We used a network analysis tool, Burp Suite, to understand the network data going in and out of the app. (We’ve done this a few times before.) Using our spare iPhone, we registered an Aura account and logged in. The app normally pulls in recent COVID-19 tests. In our case, we didn’t have any and so the scannable QR code, generated by the app, declared that I had been “denied” clearance to enter campus — as to be expected.

But our network analysis tool showed that the QR code was not generated on the device but on a hidden part of Aura’s website. The web address that generated the QR code included the Aura user’s account number, which isn’t visible from the app. If we increased or decreased the account number in the web address by a single digit, it generated a QR code for that user’s Aura account.

In other words, because we could see another user’s QR code, we could also see the student’s full name, their COVID-19 test result status, and what date the student was certified or denied.

TechCrunch did not enumerate each QR code, but through limited testing found that the bug may have exposed about 15,000 QR codes.

We described the app’s vulnerabilities to Will Strafach, a security researcher and chief executive at Guardian Firewall. Strafach said the app sounded like a “rush job,” and that the enumeration bug could be easily caught during a security review. “The fact that they were unaware tells me they did not even bother to do this,” he said. And, the keys left in the source code, said Strafach, suggested “a ‘just-ship-it’ attitude to a worrisome extreme.”

An email sent by Albion president Matthew Johnson, dated August 18 and shared with TechCrunch, confirmed that the school has since launched a security review of the app.

We sent Nucleus several questions — including about the vulnerabilities and if the app had gone through a security audit. Nucleus fixed the QR code vulnerability after TechCrunch detailed the bug. But a spokesperson for the company, Tony Defazio, did not provide comment. “I advised the company of your inquiry,” he said. The spokesperson did not return follow-up emails.

In response to the student’s findings, Albion said that the app was compliant with the Health Insurance Portability and Accountability Act, or HIPAA, which governs the privacy of health data and medical records. HIPAA also holds companies — including universities — accountable for security lapses involving health data. That can mean heavy fines or, in some cases, prosecution.

Albion spokesperson Chuck Carlson did not respond to our emails requesting comment.

At least two other schools, Bucknell University and Temple University, are reopening for the fall semester by requiring students to present two negative COVID-19 tests through Genetworx. The schools are not using Aura, but their own in-house student app to deliver the test results.

Albion students, meanwhile, are split on whether to comply, or refuse and face the consequences. @Q3w3e3 said she will not use the app. “I’m trying to work with the college to find an alternative way to be tested,” she told TechCrunch.

Parents have also expressed their anger at the policy.

“I absolutely hate it. I think it’s a violation of her privacy and civil liberties,” said Elizabeth Burbank, a parent of an Albion student, who signed the petition against the school’s tracking effort.

“I do want to keep my daughter safe, of course, and help keep others safe as well. We are more than happy to do our part. I do not believe however, a GPS tracker is the way to go,” she said. “Wash our hands. Eat healthy. And keep researching treatments and vaccines. That should be our focus.

“I do intend to do all I can to protect my daughter’s right to privacy and challenge her right to free movement in her community,” she said.

---

Send tips securely over Signal and WhatsApp to +1 646-755-8849 or send an encrypted email to: zack.whittaker@protonmail.com

from iPhone – TechCrunch https://ift.tt/34fqyGo

Apple reaches $2 trillion market cap

The broader market melt-up has helped buoy shares of Apple to new highs this morning. In early trading today, the market capitalization of the tech industry giant and FAAMG member crossed the $2 trillion mark before slipping just beneath the threshold.

Shares of Apple have advanced just over 59% in 2020, despite the company’s most recent earnings report bearing news of a more modest 11% year-over-year revenue gain. Earnings per-share advanced 18% in the same quarter, a more impressive metric but still a far smaller result than the value increase that Apple’s equity has managed.

Many technology companies are enjoying a strong market rebound after seeing sharp lows in the immediate wake of COVID-19-related restrictions at home and abroad. The market sentiment appears to argue that when the global economy is back to full-power, the market position of tech companies within it will be one of greater strength than before. This argument is doubled among companies that offer digital services, such as Apple.

Tech shares have set new all-time highs this year, with the Nasdaq Composite worth more than 11,000 points in recent days, a record tally after a eye-popping rally.

Around three years ago the “Big Five” American tech companies — Alphabet, Amazon, Microsoft, Apple, and Facebook — were worth $3 trillion in aggregate, big news at the time. Today Apple and Microsoft are alone worth around $3.6 trillion.

The rise of the tech giants has been the story of a decade, their recent gains the story of the year. If the market cohort is now overvalued is, of course, up to the investing public even if warning signs abound that things are getting a bit too hot.

For startups, this is nearly all good news. Excited public markets for tech shares make private shares appear more valuable, and desirable. Public rallies can help advance IPOs, and acquisitions. So today’s news is that Apple is now sufficiently rich to shame Croesus, means that your friendly, local startup might be able to close that next round at a price that it likes.

from Apple – TechCrunch https://ift.tt/3g6qY44

UK class action style claim filed over Marriott data breach

A class action style suit has been filed in the UK against hotel group Marriott International over a massive data breach that exposed the information of some 500 million guests around the world, including around 30 million residents of the European Union, between July 2014 and September 2018.

The representative legal action against Marriott has been filed by UK resident, Martin Bryant, on behalf of millions of hotel guests domiciled in England & Wales who made reservations at hotel brands globally within the Starwood Hotels group, which is now part of Marriott International.

Hackers gained access to the systems of the Starwood Hotels group, starting in 2014, where they were able to help themselves to information such as guests’ names; email and postal addresses; telephone numbers; gender and credit card data. Marriott International acquired the Starwood Hotels group in 2016 — but the breach went undiscovered until 2018.

Bryant is being represented by international law firm, Hausfeld, which specialises in group actions.

NEWS: I have filed a data breach group action in the High Court of England and Wales against Marriott International. The action seeks compensation on behalf of millions of hotel guests who made reservations at hotel brands within the Starwood group. https://t.co/JsMtwaBgLQ

— Martin SFP Bryant (@MartinSFP) August 19, 2020

Commenting in a statement, Hausfeld partner, Michael Bywell, said: “Over a period of several years, Marriott International failed to take adequate technical or organisational measures to protect millions of their guests’ personal data which was entrusted to them. Marriott International acted in clear breach of data protection laws specifically put in place to protect data subjects.”

“Personal data is increasingly critical as we live more of our lives online, but as consumers we don’t always realise the risks we are exposed to when our data is compromised through no fault of our own. I hope this case will raise awareness of the value of our personal data, result in fair compensation for those of us who have fallen foul of Marriott’s vast and long-lasting data breach, and also serve notice to other data owners that they must hold our data responsibly,” added Bryant in another supporting statement.

We’ve reached out to Marriott International for comment on the legal action.

A claim website for the action invites other eligible UK individuals to register their interest — and “hold Marriott to account for not securing your personal data”, as it puts it.

Here are the details of who is eligible to register their interest:

The ‘class’ of claimants on whose behalf the claim is brought includes all individuals who at any date prior to 10 September 2018 made a reservation online at a hotel operating under any of the following brands: W Hotels, St. Regis, Sheraton Hotels & Resorts, Westin Hotels & Resorts, Element Hotels, Aloft Hotels, The Luxury Collection, Tribute Portfolio, Le Méridien Hotel & Resorts, Four Points by Sheraton, Design Hotels. In addition, any other brand owned and/or operated by Marriott International Inc or Starwood Hotels and Resorts Worldwide LLC. The individuals must have been resident in England and Wales at some point during the relevant period prior to 10 September 2018 and are resident in England and Wales at the date the claim was issued. They must also have been at least 18 years old at the date the claim was issued.

The claim is being brought as a representative action under Rule 19.6 of the Civil Procedure Rules, per a press release, which also notes that everyone with the same interest as Bryant is included in the claimant class unless they opt out.

Those eligible to participate face no fees or costs, nor do affected guests face any financial risk from the litigation — which is being fully funded by Harbour Litigation Funding, a global litigation funder.

The suit is the latest sign that litigation funders are willing to take a punt on representative actions in the UK as a route to obtaining substantial damages for data issues. Another class action style suit was announced last week — targeting tracking cookies operated by data broker giants, Oracle and Salesforce.

Both lawsuits follow a landmark decision by a UK appeals court last year which allowed a class action-style suit against Google’s use between 2011 and 2012 of tracking cookies to override iPhone users’ privacy settings in Apple’s Safari browser to proceed, overturning an earlier court decision to toss the case.

The other unifying factor is the existence of Europe’s General Data Protection Regulation (GDPR) framework which has opened the door to major fines for data protection violations. So even if EU regulators continue to lack uniform vigour in enforcing data protection law, there’s a chance the region’s courts will do the job for them if more litigation funders see value in bringing representative cases to pursue damages for privacy violations.

The dates of the Marriott data breach means it falls under GDPR — which came into application in May 2018.

The UK’s data watchdog, the ICO, proposed a $123M fine for the security failing in July last year — saying then that the hotel operator had “failed to undertake sufficient due diligence when it bought Starwood and should also have done more to secure its systems”.

However it has yet to hand down a final decision. Asked when the Marriott decision will be finalized, an ICO spokeswoman told us the “regulatory process” has been extended until September 30. No additional detail was offered to explain the delay.

Here’s the regulator’s statement in full:

Under Schedule 16 of the Data Protection Act 2018, Marriott has agreed to an extension of the regulatory process until 30 September. We will not be commenting until the regulatory process has concluded.

from iPhone – TechCrunch https://ift.tt/3aDUBZh