by Donald R. Pinto, Jr.
The Massachusetts Land Court is one of a kind. Created in 1898 to administer the then-new land registration system, the court’s jurisdiction has since expanded to encompass an extraordinarily wide range of real estate and land use disputes. The only other state with a Land Court is Hawaii, and that court’s jurisdiction remains limited to land registration matters. The Massachusetts Land Court stands alone as the nation’s only all-purpose real estate specialty court.
Among the many types of cases it now hears, the Land Court has exclusive original jurisdiction over complaints for the confirmation and registration of land, as well as (except for certain domestic relations cases), “[c]omplaints affecting title to registered land . . . .” M.G.L. c. 185, §§ 1(a) & 1(a ½). From time to time this provision prompts questions concerning the jurisdiction of other trial courts over claims involving registered land. The Appeals Court recently addressed such a question in Johnson v. Christ Apostle Church, Mt. Bethel, 99 Mass. App. Ct. 699 (2019). Before turning to Johnson, some background on the development of the Land Court’s expansive jurisdiction will provide useful context.
The Evolution of the Land Court’s Subject Matter Jurisdiction
Originally named the Court of Registration, the Land Court was created by Chapter 562 of the Acts of 1898. The court’s jurisdiction was limited to “exclusive original jurisdiction over all applications for the registration of title to land within the Commonwealth, with power to hear and determine all questions arising upon such applications, and also . . . jurisdiction over such other questions as may come before it under this act . . . .” After a brief period as the Court of Land Registration, in 1904 the court was re-named the Land Court and its exclusive original jurisdiction was expanded to include four causes previously heard by the Superior Court: writs of entry; petitions to require actions to try title; petitions to determine the validity of encumbrances; and petitions to discharge mortgages. During the next 15 years the court was given exclusive original jurisdiction over petitions to: determine the boundaries of tidal flats (another transfer from the Superior Court); determine the existence and extent of a person’s authority to transfer interests in real estate; determine the enforceability of equitable restrictions on land; foreclose tax titles; and determine county, city, town, and district boundaries.
The 1930s saw an even greater expansion of the Land Court’s jurisdiction. In 1931, the court was given original jurisdiction concurrent with the Supreme Judicial Court (“SJC”) and the Superior Court over suits in equity to quiet or establish title to land and to remove clouds from title. In 1934, one of the most significant expansions of Land Court jurisdiction occurred: the court was given original jurisdiction concurrent with the SJC and the Superior Court over “[a]ll cases and matters of equity cognizable under the general principles of equity jurisprudence where any right, title or interest in land is involved, except suits in equity for specific performance of contracts.” In 1934 and 1935, the court also was given exclusive original jurisdiction over petitions under M.G.L. c. 240, § 14A to determine the validity and extent of municipal zoning ordinances, bylaws, and regulations, and original jurisdiction concurrent with the SJC and the Superior Court over suits in equity involving: redemption of tax titles; claims between joint trustees, co-executors and co-administrators; fraudulently conveyed real estate; and conveyances of real estate to municipalities, counties, and other subdivisions of the Commonwealth for specific purposes.
The Land Court’s jurisdiction remained relatively static for the next 40 years. In 1975, the legislature enacted the Zoning Act, M.G.L. c. 40A, and the court’s existing jurisdiction under M.G.L. c. 240, § 14A, was broadened, empowering it to hear (concurrently with the Superior Court) appeals from zoning boards of appeals and special permit granting authorities. Jurisdiction over appeals from planning board decisions under the subdivision control law was added in 1982.
In 1986, in response to confusion over the scope of the Land Court’s exclusive jurisdiction over the land registration system – particularly regarding other trial courts’ ability to decide claims involving registered land – the legislature added to the Land Court’s list of exclusive jurisdictional grants, “[c]omplaints affecting title to registered land . . . .” As will be discussed below, while this language clarified the issue to a degree, it left important questions unanswered.
In 2002, the Land Court’s jurisdiction was again significantly expanded. The court was given original jurisdiction concurrent with the Probate and Family Court (the “Probate Court”) over petitions for partition, and original jurisdiction concurrent with the SJC and the Superior Court over civil actions for trespass to real estate and actions for specific performance of contracts where any right, title, or interest in land is involved. The legislation also expanded the court’s jurisdiction over land-use disputes, granting the court jurisdiction to hear certiorari and mandamus actions under M.G.L. c. 249, §§ 4 and 5 where any right, title, or interest in land is involved “or which arise under or involve the subdivision control law, the zoning act, or municipal zoning, subdivision, or land-use ordinances, by-laws or regulations.” Two notable exceptions to this latter grant of jurisdiction are appeals from decisions of conservation commissions under local wetlands protection ordinances and bylaws and appeals from decisions of boards of health under Title 5 of the state sanitary code.
The most recent expansion of the Land Court’s jurisdiction occurred in 2006, when the legislature established a special “permit session” within the court. This special session provides more intensive case management and expedited handling of cases involving larger real estate developments, defined as those comprising 25 or more dwelling units, or 25,000 or more square feet of gross floor area, or both. In cases accepted into the permit session, the Land Court’s original jurisdiction (which is concurrent with the Superior Court) is even more expansive than its regular jurisdiction, encompassing virtually every type of local, regional, and state land-use permit, approval, order, and certificate. This sweeping jurisdiction includes, for example, appeals from decisions under the Boston zoning code, local wetlands protection ordinances and bylaws, and Title 5 of the state sanitary code – actions that are outside the Land Court’s regular jurisdiction.
It should be noted that in addition to the elements of the Land Court’s jurisdiction compiled in M.G.L. c. 185, § 1, and its permit session jurisdiction set forth in M.G.L. c. 185, § 3A, other statutes confer jurisdiction on the Land Court over other categories of cases. Two notable examples are M.G.L. c. 240, §§ 10A, which gives the Land Court jurisdiction concurrent with the Superior Court over actions to determine the scope and enforceability of restrictions on land, and St. 1943, c. 57, under which the court has jurisdiction concurrent with the Superior Court over suits in equity to determine, in connection with mortgage foreclosures, whether the mortgagor is a servicemember entitled to protection under the federal Servicemembers Civil Relief Act, 50 U.S.C.A. § 3901.
St. 1986, c. 463, § 1
Before 1986, there was uncertainty over the extent to which trial courts other than the Land Court could decide cases involving registered land. For example, a damages claim for breach of a purchase and sale agreement for a parcel of registered land does not affect the title to that land, and thus can be brought in Superior Court. However, a case involving the scope of an easement over registered land presents a more difficult question. In Deacy v. Berberian, 344 Mass. 321 (1962), the plaintiff filed suit in Superior Court seeking to enjoin the defendants from interfering with her use of a right of way over registered land. Based on the language of the original Land Court decree, the defendants claimed that the plaintiff’s use of the way was limited to passage “on foot and with teams,” and that passage by automobiles was precluded. 344 Mass. at 326. On appeal from a judgment for the plaintiff, the defendants argued that the Superior Court lacked jurisdiction to decide the issue. Id. at 328. In response the SJC stated, without further comment or analysis, “[w]e are of opinion [sic] that the purposes of the Land Court Act are not violated by the Superior Court interpreting the original decree so as to give effect to a common mode of transportation.” Id. Similarly, in Cesarone v. Femino, 340 Mass. 638 (1960), the plaintiff filed suit in Superior Court seeking a declaration that he was the owner of a parcel of registered land because his signature on a deed purportedly conveying that parcel was forged. 340 Mass. at 639. On appeal from a judgment for the plaintiff, the defendants argued that because it involved ownership of registered land, the plaintiff’s claim was within the Land Court’s exclusive jurisdiction. Id. The SJC disagreed, characterizing the claim as one based on general principles of equity, concluding, “it appears that either the Land Court or the Superior Court could take jurisdiction.” Id. at 639-640.
In an effort to clarify the scope of the Land Court’s exclusive jurisdiction over registered land and, by implication, the scope of other courts’ jurisdiction over cases involving registered land, in 1986 the legislature – as noted above – amended the court’s main jurisdictional statute, M.G.L. c. 185, § 1, to provide that the court has exclusive jurisdiction over “[c]omplaints affecting title to registered land . . . .” St. 1986, c. 463, § 1; M.G.L. c. 185, §1(a ½). However, it appears this amendment has failed in its mission: while the question whether a claim “affects title” to registered land seems like a simple one, in practice it has proved difficult for our appellate courts to answer in a consistent fashion.
Johnson v. Christ Apostle Church, Mt. Bethel
Such a question was at the center of the Appeals Court’s decision in Johnson v. Christ Apostle Church, Mt. Bethel, 96 Mass. App. Ct. 699 (2019). Johnson involved a dispute between the plaintiff homeowner (“Johnson”) and an adjacent church over Johnson’s use of a driveway on the church’s property that provided access to Johnson’s property. Both properties are registered land. 96 Mass. App. Ct. at 700. After years of peaceful coexistence, in 2013, the church installed a six-foot fence on the property line, which prevented Johnson from continuing to use the driveway. Id. Johnson filed suit in Superior Court asserting claims of negligence, adverse possession, and violation of the “spite fence” statute, M.G.L. c. 49, § 21, which deems certain fences a form of private nuisance. Id. After a trial solely on the nuisance claim, the court ruled for Johnson and ordered the church to install gates in its fence to restore Johnson’s access. Id. at 700-701.
On appeal, though neither side raised the issue, the Appeals Court vacated the judgment on the ground that it effectively granted Johnson “a permanent easement to use the church’s property.” Id. at 701. Citing M.G.L. c. 185, §1(a ½), the Appeals Court held, “[t]he Superior Court does not have jurisdiction to so encumber registered land.” Id. In support of its holding the Appeals Court cited Feinzig v. Ficksman, 42 Mass. App. Ct. 113 (1997), which also involved use of a driveway on registered land. In Feinzig, the Superior Court had entered a judgment enjoining the defendant from interfering with the plaintiffs’ use of the defendant’s land. 42 Mass. App. Ct. at 115. The Appeals Court vacated that judgment, characterizing it as “a de facto encumbrance in the nature of an easement” that affected the defendant’s registered title, and therefore was within the Land Court’s exclusive jurisdiction and outside the jurisdiction of the Superior Court. Id. at 117. The Appeals Court observed, “while a Superior Court judge may order the discontinuance of a trespass on registered land, that judge may not fashion a judgment which has the effect of imposing an encumbrance on the registered title.” Id. at 115-116.
The Appeals Court’s Johnson decision omits any reference to O’Donnell v. O’Donnell, 74 Mass. App. Ct. 409 (2009), a decision that is hard to square with Johnson. In O’Donnell, the defendant mother was embroiled in litigation in the Probate Court with one of her sons over the validity of deeds to two parcels of registered land. 74 Mass. App. Ct. at 411. The mother claimed that those deeds had been procured by undue influence and fraud, and in breach of the son’s fiduciary duty. Id. The son unsuccessfully moved to dismiss the Probate Court action on the ground that it fell within the Land Court’s exclusive jurisdiction over registered land. Id. In response, the son and his brothers filed a new case in the Land Court seeking a declaration that the deeds were valid. Id. The Land Court dismissed that case on the ground of the prior pending Probate Court action, concluding that the judgment the mother sought in the Probate Court “would not of its own force purport to modify the registered title,” and therefore did not intrude on the Land Court’s exclusive jurisdiction over claims “affecting title to registered land.” Id. The Appeals Court affirmed, noting that both the Land Court and the Probate Court have general equity jurisdiction and can decide claims concerning registered land, “as long as the action desired would not have the effect of altering the registered title.” Id. at 412, citing Steele v. Kelley, 46 Mass. App. Ct. 712, 725 (1999). The Appeals Court added that, if a Probate Court judge were to find the deeds valid, “they still would represent no more than ‘a contract between the parties, and . . . evidence of authority to the recorder or assistant recorder [of the Land Court] to make registration.’ A separate act of registration would remain necessary to modify the title directly.” Id., quoting Steele, supra.
It is true that under our system of land registration, with a few narrow exceptions, no matter can formally affect a registered title unless it appears in the certificate of title or is noted on that certificate’s memorandum of encumbrances. M.G.L. c. 185, § 57 crisply states, “[t]he act of registration only shall be the operative act to convey or affect the land.” This is the principle on which O’Donnell rests. But if the Probate Court can enter a judgment determining the validity of a deed to registered land because that judgment itself does not affect the title, why is the Superior Court, in the exercise of its equity jurisdiction, precluded from entering a judgment ordering a defendant to install gates in its fence so that the plaintiff can use the defendant’s registered land (Johnson), or enjoining a defendant from interfering with the plaintiffs’ use of the defendant’s registered land (Feinzig)? After all, such judgments would not of their own force purport to modify the registered title. They would stand simply as adjudications of the parties’ respective rights, and “evidence of authority to the recorder or assistant recorder to make registration.” O’Donnell, supra at 412. Under the reasoning of O’Donnell, it appears, other courts would be free to adjudicate virtually any dispute involving registered land – not only claims concerning the validity of deeds, but claims involving easements and other lesser interests in registered land.
If there is a reasoned way to harmonize the Johnson/Feinzig view of the Land Court’s exclusive jurisdiction over registered land with the O’Donnell view, it is not readily apparent. The Johnson/Feinzig view is preferable in that it comports with the legislature’s presumed intent in 1986 to curb decisions like Deacy and Cesarone, supra, and reserve most disputes involving registered land for resolution by the Land Court, which is solely responsible for administering the registration system and has over a century of expertise in handling such disputes. The distinction that the Feinzig court drew between a claim of trespass on registered land, which does not affect title (at least where the trespasser claims no rights in the land), and a claim of a right to use registered land (whether direct or de facto), which does affect title, is sound and consistent with M.G.L. c. 185, §1(a ½). The O’Donnell view, in contrast, allows for no limiting principle and could lead to a significant erosion of the Land Court’s exclusive jurisdiction over registered land. The real estate bar will be grateful if a future appellate decision resolves the contradiction between these two approaches and finally provides the clarity that the legislature sought to achieve in 1986.
See HRS § 501-1.
 St. 1904, c. 448, § 1.
 St. 1906, c. 50, § 1.
 St. 1906, c. 344, § 1.
 St. 1915, c. 112, § 1.
 St. 1915, c. 237, § 3.
 St. 1919, c. 262, § 1.
 St. 1931, c. 387, § 1.
 St. 1934, c. 67, § 1.
 St. 1934, c. 263, § 1.
 St. 1935, c. 318, §§ 1-5.
 St. 1975, c. 808, § 3.
 St. 1982, c. 533, §§ 1 & 2.
 St. 1986, c. 463, § 1.
 St. 2002, c. 393.
 St. 2006, c. 205, § 15.
 M.G.L. c. 185, § 3A.
Donald R. Pinto, Jr. is a partner of Pierce Atwood LLP based in the firm’s Boston office. He has over 30 years of experience representing clients in all aspects of real estate and land-use litigation in the trial and appellate courts.
by Daniel Lyons
Like many popular tourist destinations, Boston benefits from the sharing economy. Innovative intermediaries such as Airbnb have helped middle-class residents supplement their incomes by monetizing their greatest assets: their homes. The new short-term rental market allows homeowners to keep up with rising living costs while providing additional capacity to attract tourists who contribute to the local economy.
Also like many cities nationwide, Boston has struggled with the unintended consequences of this new marketplace. Policymakers are concerned that the new market is incentivizing owners to remove long-term rentals from the housing stock, particularly in popular and space-constrained areas like Chinatown. To mitigate this risk, a new City of Boston ordinance (City of Boston Code, Ordinances, § 9-14) requires homeowners to register short-term rental properties with the City and prohibits certain categories of properties from being offered as short-term rentals.
But it is the enforcement mechanism that has drawn the most controversy. In addition to punishing individual homeowners who run afoul of the rules, the ordinance fines intermediaries like Airbnb $300 per day for each ineligible rental booked on the site. Presumably, the fine is designed to entice these intermediaries to police their sites for violations. But while this attempt to deputize Airbnb reduces the City’s enforcement costs, it cuts against one of the fundamental tenets of Internet governance: that platforms generally are not liable for a user’s misuse of a neutral tool. This immunity, codified in Section 230 of the Communications Decency Act, 47 U.S.C. § 230, makes it possible for companies from eBay to Twitter to connect millions of users without having to monitor their every interaction for potential legal violations. In Airbnb v. City of Boston, 386 F. Supp. 3d 113 (D. Mass. 2019), the federal district court upheld the Ordinance against a Section 230 challenge, in a decision that weakens this core statutory protection and may have significant ramifications for the broader Internet economy.
Background: Section 230
Section 230 is the legal cornerstone of the modern Internet economy. Jeff Kosseff, Professor of Cybersecurity at the United States Naval Academy describes it as The Twenty-Six Words That Created the Internet. The statute provides that
No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.
Congress passed Section 230 in 1996 to address the holding of Stratton Oakmont v. Prodigy Services Co., 1995 WL 323710 (N.Y. Sup. Ct. May 24, 1995), which held that online service providers could be held liable as publishers for defamatory statements made by their users. Section 230 itself states that it was designed to “preserve the vibrant and competitive free market that presently exists for the Internet and other interactive computer services, unfettered by Federal or State regulation,” 47 U.S.C. § 230(b)(2), by giving platforms discretion to decide when and how to police their sites. It contains exceptions for claims arising under federal criminal statutes (including, in particular, sex trafficking), intellectual property laws (which are governed by a different intermediary liability regime), or state laws that “are consistent with this section.” 47 U.S.C. § 230(e).
The following year, the seminal case Zeran v. America Online, 129 F.3d 327 (4th Cir. 1997), displayed the expansive scope of the statute in the defamation context. This case involved ads posted on America Online (AOL) selling offensive T-shirts that made light of the 1995 Oklahoma City terrorist bombing. The ads falsely listed plaintiff Ken Zeran as the vendor and included Zeran’s home telephone number, prompting irate AOL users to inundate Zeran with angry calls and death threats. Zeran sued AOL, alleging that he notified the company of the defamatory posts but it unreasonably delayed in removing them. The Fourth Circuit found that Section 230 immunized AOL from liability even for messages that the company knew were defamatory. The court justified this broad immunity by noting that with “millions of users,” interactive computer services process a “staggering” amount of information. Id.. “Faced with potential liability for each message republished by their services, interactive computer providers might choose to severely restrict the number and type of messages posted,” a threat to free speech that Congress sought to guard against. Id..
Subsequent court cases have extended Section 230 far beyond the defamation context, to immunize Craigslist against claims of facilitating housing discrimination, eBay from products liability claims, and StubHub from violations of state ticket scalping laws. It is the resulting broad immunity, protecting intermediaries from liability for most user misconduct, that has shaped much of the current Internet ecosystem. Section 230 entices online news outlets and blogs to permit comment threads without fear of what readers may say. It allows Amazon, TripAdvisor, and Yelp to aggregate and display consumer feedback about products and services. Without Section 230, social media platforms like Facebook and Twitter likely would not exist—or would not be free—because of the high cost of screening every post for potential liability.
Of course, while Section 230 shields the platform from intermediary liability, the user remains liable if the underlying post violates the relevant law. And as the Ninth Circuit explained in Fair Housing Council of San Fernando Valley v Roommate.com, 521 F.3d 1157 (9th Cir. 2008), the platform loses its immunity if it is responsible, in whole or in part, for formulating the offending message.
Section 230 and Boston’s Short-Term Rental Ordinance
Given this robust history of Section 230, it seemed an uphill battle for Boston and similar cities seeking to deputize platforms to enforce short-term rental regulations. Like eBay and StubHub listings, the content of an Airbnb listing is written by the individual homeowner. While a local ordinance could penalize individual homeowners for listing ineligible properties, Section 230 prohibits a local ordinance from forcing Airbnb to “verify” that listed properties comply with the law by punishing it for listing an illegal unit. In 2012, a court struck down a comparable attempt by the State of Washington to fine online classified ad publishers unless they verified that models featured in online prostitution ads were adults. See Backpage.com v. McKenna, 881 F. Supp. 2d 1262 (W.D. Wash. 2012).
Boston sought to circumvent Section 230 by punishing not the listing of an illegal unit, but rather providing booking services for an illegal unit. The law provides that “any Booking Agent who accepts a fee for booking a unit as a Short-Term Rental, where such unit is not an eligible Residential unit, shall be fined” $300 per violation per day. Airbnb sued to enjoin the provision, arguing that the focus on a booking fee rather than the listing was a distinction without a difference, that the effect of the ordinance was to hold intermediaries liable for their users’ misrepresentations, and that Section 230 therefore preempts the ordinance.
On preliminary injunction, the court sided with the City. The court found that the penalty provision punished Airbnb for the company’s own conduct, namely accepting a fee for booking an ineligible unit. The court explained that the fine is not tied to the content of the underlying listing, and noted that Airbnb remains free to list ineligible units without incurring liability, as long as it does not provide booking services for one. In essence, it requires the company, at the booking stage, to confirm that a listing is eligible under the statute before collecting a fee to complete the transaction. The decision mirrored, and relied upon, two recent decisions upholding similar ordinances in California: HomeAway.com, Inc. v. City of Santa Monica, 918 F.3d 676, 680 (9th Cir. 2019), and Airbnb, Inc. v. City & Cty. of San Francisco, 217 F. Supp. 3d 1066, 1071 (N.D. Cal. 2016). In the process, the court rejected Airbnb’s argument that the First Circuit has interpreted Section 230 more broadly than the Ninth Circuit.
Although Airbnb appealed the decision to the First Circuit, it ultimately settled before argument to reduce its financial exposure. Under the settlement agreement, the company agreed to require any user posting a Boston listing to provide a City-issued Registration Number. The company also agreed to send Boston a monthly report of active listings within the City. The City will then notify Airbnb of listings that it believes are ineligible, which Airbnb will deactivate within 30 days. The agreement provides that compliance with this procedure will constitute a safe harbor shielding against booking agent liability under the ordinance.
Unintended Consequences of Court Decision
One can sympathize with Boston’s desire to rein in the excesses of the short-term rental market. Tourist demand for alternatives to traditional lodging remains high, increasing the risk that short-term rentals will siphon off housing stocks in an already capacity-constrained residential market. This is especially problematic if the properties in question receive benefits (such as low-income assistance) designed to encourage residential stability, if the property poses a risk to tourists, or if increased tourist activity harms the local community.
In that sense, it is both expected and appropriate that the City would regulate Boston homeowners who seek to participate in the short-term rental market, just as it does innkeepers and landlords. Boston has authority to decide which properties can be made available and on what terms. And it is free to enforce those regulations directly against individual violators, by dedicating resources to reviewing listings, identifying properties that are out of compliance with the ordinance, and bringing appropriate enforcement action against the lawbreakers.
But the court’s approval of the City’s plan to commandeer platforms to aid enforcement reflects a potentially problematic shift in Section 230 jurisprudence. As an initial matter, the court’s distinction between listing and booking seems strained. The court posited that Airbnb remains free to list illegal units, as long as it doesn’t actually book them. But as Professor Eric Goldman of Santa Clara University notes in connection with the similar San Francisco ordinance, listing properties that the company cannot or will not book could set up Airbnb for a false advertising suit; if it wishes to adhere to its preexisting business model and avoid bait-and-switch liability, the company effectively must verify that listings are eligible before posting.
Even if, as the court suggested, Airbnb need only verify eligibility at the point of booking, the verification obligation imposes significant costs upon these intermediaries. The court minimized this obligation, stating the ordinance “simply requires Airbnb to cross-reference bookings against the City’s list of ineligible units before collecting its fees.” But this simplifies the burden that Airbnb faces. Boston’s ordinance punishes the accepting of a fee for booking an ineligible unit, a category that includes:
- Units subject to affordability covenants or housing assistance under local, state, or federal law;
- Units prohibited from leasing or subleasing under local, state, or federal law; and
- Units subject to three or more violations of any municipal ordinance or state law relating to excessive noise, improper trash disposal, or disorderly conduct within a six-month period.
While the ordinance requires the City to create an ineligible units list, it does not provide a safe harbor for booking agents that cross-reference bookings against that list. On its face, then, booking agents must independently determine whether each Boston booking violates any of the myriad eligibility requirements.
The settlement reduced Airbnb’s compliance costs, but the ordinance remains as written for other booking agents. Of course, the cost of even the settlement’s modified monitor-and-takedown procedure is not trivial—particularly if, as Professor Goldman notes, other cities follow Boston’s example. Airbnb and other intermediaries must keep abreast of nuanced ordinances in myriad cities and states nationwide and tailor their algorithms to verify eligibility. While this increased cost may not make the booking model uneconomic, it could lead some booking companies to withdraw from more heavily regulated markets.
The proliferation of ordinances like Boston’s could also entrench existing companies by raising the costs of entry for new entrepreneurs in this space. Indeed, this could be one reason why Airbnb settled the Boston case and similar litigation in Miami Beach, Florida: as the market leader, Airbnb can perhaps bear these compliance costs easier than its competitors. The settlement agreement itself suggests that Airbnb is using regulation to secure its position: a provision titled “Fairness Across Platforms” requires the City to negotiate with Airbnb’s competitors, three of which are listed by name, mandates that the City provide Airbnb a copy of any agreement it enters with another platform, and provides for Airbnb to modify its agreement if another platform receives a more favorable provision. It also requires the City to confer with Airbnb to discuss compliance efforts taken against platforms that have not entered such agreements.
Ramifications for the Broader Internet Economy
The Boston Airbnb decision shows that the erosion of Section 230 immunity is now spreading beyond the Ninth Circuit. Other cities that share Boston’s concerns about the growth of the short-term rental market now have a model to enlist platform providers as enforcers. For Airbnb and similar platforms, this likely means staffing additional compliance resources to learn and respond to a growing number of local regulations.
Entrepreneurs and those advising platform-based startups should also recognize that this erosion is not necessarily limited to the short-term housing market. The court’s approval of a verification obligation could potentially open the door to significant state and local regulation of the Internet economy. For example, Professor Goldman notes that licensing boards could require that online marketplaces verify that sellers have appropriate business licenses before completing a transaction. Cities may require ride share operators to assure that drivers meet local qualifications. States could require eBay and other clearinghouses to confirm that goods comply with local commerce and product liability laws. And payment processors further up the supply chain could find themselves saddled with similar verification requirements.
The court’s decision also shapes how future tech entrepreneurs should structure their businesses. By bifurcating Airbnb’s listing and booking functions, the decision favors certain business models over others. Airbnb faces liability for facilitating rental of an ineligible property, while online classified ad companies like Craigslist retain Section 230 immunity for the same action, based solely on how each company chooses to fund its activities. Going forward, this decision incentivizes companies to move away from collecting fees for facilitating transactions, and instead to embrace advertising-based revenue models, or models that charge a fee per listing—both of which would remain protected under Section 230.
It is too early to state with precision what effect this decision will have on the development of the sharing economy. But the court’s decision, coupled with the San Francisco and Santa Monica cases, suggest that local regulators may have a powerful new tool to address their public policy concerns. Internet-based platform providers must adapt if they wish to continue relying upon Section 230 to shield innovative new efforts to connect buyers and sellers online.
 As the court clarified, “ineligible” properties are those that categorically cannot be offered as short-term rentals. The statute does not punish booking agents for booking eligible but unregistered properties.
 Airbnb, 386 F.Supp.3d at 120.
 Id. at 120-121.
 The Court contrasted this Penalty Provision with another part of the statute, the “Enforcement Provision,” which prohibits Airbnb from operating within Boston unless it enters an agreement with the city to “actively prevent, remove, or de-list any eligible listings.” See id. at 123-124. At oral argument, the city conceded that the threat of banishment for failure to monitor and remove listings effectively imposed liability on Airbnb for publication of third-party conduct, and on the basis of that concession, the court enjoined the Enforcement Provision. Id. at 123. The court also enjoined parts of a data reporting provision on unrelated grounds. Id. at 124-125.
 Id. at 120 n.5.
 Airbnb, 386 F.Supp.3d at 121.
 See An Ordinance Allowing Short-Term Residential Rentals in the City of Boston, Section 9-14.4A.
Daniel Lyons is a Professor at Boston College Law School, where he researches and writes in the areas of telecommunications, energy, and administrative law. Professor Lyons is also a Visiting Fellow at the American Enterprise Institute, where he regularly blogs about tech policy issues.
After Goodridge: the Potential of Equal Protection Challenges Under the Massachusetts Constitution Involving Non-Economic, Personal InterestsPosted: February 19, 2020
Massachusetts courts apply an enhanced version of rational basis review where regulations infringe on non-economic, personal interests. In light of Goodridge v. Department of Public Health, 440 Mass. 309 (2003), this analysis has the potential to support constitutional challenges on equal protection grounds to two existing Massachusetts statutes related to families. They are: (1) M.G.L. c. 119, § 39D, the grandparent visitation statute; and (2) M.G.L. c. 209C, § 10, custody of children born out of wedlock.
Equal Protection and Enhanced Rational Basis Review in Massachusetts
Equal protection requires “that all persons in the same category and in the same circumstances be treated alike.” Opinion of the Justices, 332 Mass. 769, 779-80 (1955). The standard of review in Massachusetts for equal protection claims that do not involve a fundamental right or suspect class is rational basis review. See Tobin’s Case, 424 Mass. 250, 252-53 (1997).
The Massachusetts Constitution requires that a regulation be “rationally related to the furtherance of a legitimate State interest.” Mass. Fed’n of Teachers, AFT, AFL-CIO v. Bd. of Educ., 436 Mass. 763, 777 (2002) (quoting Chebacco Liquor Mart, Inc. v. Alcoholic Beverages Control Comm’n, 429 Mass. 721, 722 (1999)). However, the Supreme Judicial Court (SJC) has determined that in cases involving non-economic regulations, Massachusetts’s Constitution “may guard more jealously against the exercise of the State’s police power” than the Federal Constitution. That is, the SJC has applied an enhanced version of rational basis review where classifications affect personal, non-economic interests that are not considered fundamental. See Friedman, supra note 2.
The most prominent example of this analysis is Goodridge. There, same-sex couples alleged that the denial of their access to marriage licenses and the status of civil marriage violated the Massachusetts Constitution. The Court held that this exclusion violated equal protection. The Court concluded that “[t]he marriage ban works a deep and scarring hardship on a very real segment of the community for no rational reason,” noting that “[t]he absence of any reasonable relationship between” the exclusion of same-sex couples from marriage and the protection of the general welfare. Goodridge, 440 Mass. at 341 (emphasis added).
As exemplified by Goodridge, enhanced rational basis review under the Massachusetts Constitution requires that there be an actual, rather than merely a conceivable, connection between the government’s legitimate regulatory interest and the imposed regulation, and that the connection be reasonable. See Friedman, supra note 2 at 418. Moreover, Massachusetts’s rational basis review for equal protection claims, “requires that an impartial lawmaker could logically believe that the classification would serve a legitimate public purpose that transcends the harm to the members of the disadvantaged class.” Goodridge, 440 Mass. at 330 (emphasis added) (internal quotations omitted) (quoting English v. New England Med. Ctr., Inc., 405 Mass. 423, 429 (1989)).
Under this enhanced rational basis review, Massachusetts’s grandparent visitation statute, as-applied, arguably violates equal protection under the Massachusetts Constitution.
M.G.L. c. 119, § 39D states in relevant part:
If the parents of an unmarried minor child are divorced, married but living apart, under a temporary order or judgment of separate support, or if either or both parents are deceased, or if said unmarried minor child was born out of wedlock whose paternity has been adjudicated by a court of competent jurisdiction or whose father has signed an acknowledgement of paternity, and the parents do not reside together, the grandparents of such minor child may be granted reasonable visitation rights . . . upon a written finding that such visitation rights would be in the best interest of the said minor child . . . .
The statute, as interpreted by Blixt v. Blixt, 437 Mass. 649 (2002), essentially imposes two conditions for grandparents to seek visitation: that the parents are separated or divorced; and that the grandparents have either a significant preexisting relationship with the grandchildren, or that the grandchildren will suffer significant harm absent visitation with the grandparents. Under Blixt, the second condition amounts to a heightened pleading requirement that grandparents must meet in order to seek visitation.
As-applied, the law discriminates against grandparents of grandchildren whose parents are not divorced or separated with respect to their ability to seek visitation when it is in the grandchildren’s best interest. The statute creates two classes of grandparents: (1) those who can seek visitation because the parents are divorced or separated; and (2) those who cannot because the parents are not divorced or separated. The classes are similarly situated because both sets of grandparents would presumably seek visitation regardless of the parents’ marital or living status on the grounds that it would be in the best interests of their grandchildren.
Applying enhanced rational basis review, the statutorily-created classifications of grandparents do not rationally serve a legitimate public purpose that transcends the harm in denying the opportunity for grandparents of parents who are not separated or divorced from seeking visitation when it is in the grandchildren’s best interest. Three potential rationales for the discrimination are: preserving judicial resources; preventing infringement of parental rights; and safeguarding the welfare of children and giving deference to Blixt’s rationale “that the burden of the traumatic loss of a grandparent’s significant presence may fall most heavily on the child whose unmarried parents live apart” in using parental status to distinguish between classes of grandparents. 437 Mass. at 664; see Goodridge, 440 Mass. at 331. Each of these rationales likely fails enhanced rational basis scrutiny.
First, the requirements for visitation would continue to preserve judicial resources even if grandparents of parents who are not separated or divorced petitioned for visitation because the heightened pleading requirements would serve as a gatekeeping mechanism. Second, the heightened pleading requirements would protect the rights of parents to make child-rearing decisions because only grandparents who can demonstrate that there was a significant preexisting relationship with the grandchildren, or that the grandchildren will be significantly harmed, could seek visitation. Finally, denying certain grandparents the right to seek visitation when it is in the grandchildren’s best interests would not safeguard children’s interests, especially when Blixt acknowledges that there may be children whose parents are not divorced or separated who would be harmed without visitation with their grandparents. See 437 Mass. at 664. It is precisely these factual circumstances that would serve as the basis for an as-applied challenge to the statute, where a court can reconsider the law in the context of an actual dispute. See Wash. State Grange v. Wash. State Republican Party, 552 U.S. 442, 449-50, 457-58 (2008).
Custody of Children Born Out of Wedlock
Similarly, Massachusetts’s statute pertaining to custody of children born out of wedlock arguably violates equal protection under the Massachusetts Constitution pursuant to enhanced rational basis review analysis.
M.G.L. c. 209C, § 10(a)-(b) provides in relevant part:
(a) Upon or after an adjudication or voluntary acknowledgment of paternity, the court may award custody to the mother or the father or to them jointly . . . as may be appropriate in the best interests of the child . . . . In awarding the parents joint custody, the court shall do so only if the parents have entered into an agreement pursuant to section eleven or the court finds that the parents have successfully exercised joint responsibility for the child prior to the commencement of proceedings pursuant to this chapter and have the ability to communicate and plan with each other concerning the child’s best interests.
(b) Prior to or in the absence of an adjudication or voluntary acknowledgment of paternity, the mother shall have custody of a child born out of wedlock. In the absence of an order or judgment of a probate and family court relative to custody, the mother shall continue to have custody of a child after an adjudication of paternity or voluntary acknowledgment of parentage.
As-applied, the law denies unwed fathers not cohabitating with the mother, the right to equal protection by discriminating against these fathers as compared to divorcing fathers when joint legal custody is in the child’s best interest. Pursuant to M.G.L. c. 208, § 31, divorcing fathers are presumed to have joint legal custody of a child until otherwise ordered and need only prove that it is in the child’s best interest for it to be awarded. Whereas, pursuant to M.G.L. c. 209C, § 10(a)-(b), unwed fathers not cohabitating with the mother are not presumed to have joint legal custody and must meet additional and burdensome requirements to have it awarded. The fathers are similarly situated because both groups are men whose parentage has either been assumed due to their marital status or established by adjudication or acknowledgment, and whose children would presumably benefit from their involvement in their life.
To be awarded joint legal custody absent an agreement with the mother, in addition to satisfying the best interest standard, an unwed father not cohabitating with the mother is required to prove that he and the mother “have successfully exercised joint responsibility for the child prior to the commencement of proceedings;” and he and the mother have “the ability to communicate and plan with each other concerning the child’s best interests.” M.G.L. c. 209C, § 10(a). A divorcing father, however, enjoys “temporary shared legal custody of any minor child of the marriage” and he need only ultimately prove that an award of joint custody is in the child’s best interest. M.G.L. c. 208, § 31.
Under an enhanced rational basis review analysis, the different treatment of unwed fathers not cohabitating with the mother and divorcing fathers pursuant to M.G.L. c. 209C, § 10(a)-(b) likely does not rationally serve a legitimate public purpose that transcends the harm in requiring that unwed fathers meet more onerous requirements. Potential public purposes that may be advanced to justify the discrimination are: preserving judicial resources; and safeguarding the wellbeing of children.
First, judicial resources would not be further expended if both classes of fathers were afforded the same presumption and held to the same standard to be awarded joint legal custody. In fact, judicial resources may be conserved if all fathers were afforded the presumption and only the child’s best interest governed. Second, the wellbeing of children is not enhanced by requiring that unwed fathers not cohabitating with the mother meet more burdensome requirements or be denied a presumption of joint legal custody because an analysis of the child’s best interest should afford all children the same protection, especially where there are divorcing fathers who do not have a history of successfully exercising joint responsibility for the child and cannot communicate or cooperate with the mother. If children of unwed fathers not cohabitating with the mother are afforded greater protections than children of divorcing fathers, this likely violates “the Commonwealth’s strong public policy to abolish legal distinctions between marital and nonmarital children in providing for the support and care of minors.” Goodridge, 440 Mass. at 325 (citations omitted); see M.G.L. c. 209C, § 1 (“Children born to parents who are not married to each other shall be entitled to the same rights and protections of the law as all other children.”). Further, these additional and burdensome requirements may discourage fathers whose children would benefit from their participation in important decisions from pursuing these rights. See Cuadra, supra note 6 at 634-35.
Looking to Goodridge as a roadmap for an enhanced rational basis review analysis, some Massachusetts statutes impacting personal interests, like a grandparent’s ability to pursue visitation or an unwed father’s ability to participate in important child rearing decisions, may well be vulnerable to challenges on equal protection grounds. This kind of judicial review recognizes that there may be instances in which legislative classifications draw lines that infringe on personal interests without adequate justification. This review does not mean every statute that differentiates among significant personal interests will fail—just that the Commonwealth must be able to articulate a reason for the discrimination that has a basis in fact. On the right facts, an enhanced rational basis review analysis has the potential to push the legal landscape to better serve families by pushing the Commonwealth either to justify the discrimination or abandon distinctions that no longer make sense.
Steven E. Gurdin is a partner at Fitch Law Partners LLP, concentrating his practice in and frequently presenting on family law and probate litigation matters. He represents clients in all aspects of family law including, divorce proceedings, paternity actions, child removal actions, modification and contempt actions, grandparent visitation cases, and alimony and child support issues.
Kelly A. Schwartz is an associate at Fitch Law Partners LLP. Her practice is in family law, which includes matters involving divorce, child custody, alimony, child support, and asset division.
 Special thanks to Lawrence Friedman, Professor of Law at New England Law, for his input and support.
 See Blue Hills Cemetery, Inc. v. Bd. of Reg. in Embalming & Funeral Directing, 379 Mass. 368, 373 n.8 (1979); Coffee-Rich, Inc. v. Comm’r of Pub. Health, 348 Mass. 414, 421-22 (1965); Lawrence Friedman, Ordinary and Enhanced Rational Basis Review in the Massachusetts Supreme Judicial Court: A Preliminary Investigation, 69 Albany L. Rev. 415 (2006) (discussing history of Massachusetts cases in which courts applied less deferential rational basis review under the Massachusetts Constitution); see also Goodridge, 440 Mass. at 328 (“The Massachusetts Constitution protects matters of personal liberty against government incursion as zealously, and often more so, than does the Federal Constitution, even where both Constitutions employ essentially the same language.”), n.18 (“We have recognized that our Constitution may more extensively protect individual rights than the Federal Constitution in widely different contexts.”).
 See Friedman, supra note 2 at 419-22, 440.
 Of note, Massachusetts House Bill No. 1534, which was submitted in the current session on January 18, 2019, provides that any grandparent may file an original action for visitation rights if it is in the child’s best interest and if, among other conditions, “the child is living with biological parents, who are still married to each other, whether or not there is a broken relationship between either or both parents of the minor and the grandparent and either or both parents have used their prenatal authority to prohibit a relationship between the child and the grandparent.”
 See Dep’t of Revenue v. C.M.J., 432 Mass. 69, 77 (2000) (determining that under M.G.L. c. 209C, § 10(b), an unwed father cohabitating with the mother and providing support to his children was presumed a custodial parent even absent a court order regarding custody); Trial Court Judgment of Dismissal and Memorandum of Decision (Gibson, J. Nov. 5, 2013); see also Com. v. Gonzalez, 462 Mass. 459, 464 & n.12 (2012); 14B Mass. Prac., Summary of Basic Law, § 8:264 (5th ed. 2019) (“[I]f the father is living with the mother and the child or children born out of wedlock, the mother’s custody is not sole custody, but joint custody with the father.”) & nn.4-5.
 See Bernardo Cuadra, Family Law–Maternal and Joint Custody Presumptions for Unmarried Parents: Constitutional and Policy Considerations in Massachusetts and Beyond, 32 W. New Eng. L. Rev. 599, 620-22 (2010) (footnote notation omitted) (discussing the difference in Massachusetts between divorcing parents and unmarried parents with regard to the presumption of joint legal custody).
 Department of Revenue v. C.M.J. did not, however, address whether unwed fathers cohabitating with the mother must also meet the additional requirements outlined in M.G.L. 209C, § 10(a) to be awarded joint legal custody.
 See Cuadra, supra note 6 at 633-34 (“Joint legal custody has been shown in the context of divorce to increase a father’s involvement with his child, including parenting time and overnights. Subsequent research suggests the same outcome for unwed fathers.”).
 See Goodridge, 440 Mass. at 330; see also Cuadra, supra note 6 at 639 (suggesting that Massachusetts’s different treatment of divorcing and unwed fathers should be examined pursuant to a rational basis review where the statute would “be scrutinized with something greater than sweeping deference.”) & n.251 (citing and quoting Goodridge).
 See Goodridge, 440 Mass. at 331; Blixt, 437 Mass. at 663; Trial Court Judgment, supra note 5.
Fair Housing Enforcement in the Age of Digital Advertising: A Closer Look at Facebook’s Marketing AlgorithmsPosted: February 19, 2020
The increasing use of social media platforms to advertise rental opportunities creates new challenges for fair housing enforcement. The Fair Housing Act, 42 U.S.C. §§ 3601-19 (“FHA”) makes it unlawful to discriminate in the sale or rental of housing on the basis of race, color, religion, sex, familial status, national origin, and disability (“protected classes”). The FHA also prohibits discriminatory advertising, including distributing advertisements in a way that denies people information about housing opportunities based on their membership in a protected class. Accordingly, advertisers and digital platforms that intentionally or unintentionally cause housing advertisements to be delivered to users based on their membership in a protected class may be liable for violating the FHA.
In March 2018, in response to what they perceived to be discriminatory advertising on Facebook, the National Fair Housing Alliance (“NFHA”) and several housing organizations filed suit in federal court in New York City. The lawsuit alleged that Facebook’s advertising platform enabled landlords and real estate brokers to prevent protected classes from receiving housing ads. Facebook settled the suit on March 19, 2019. As part of the settlement, Facebook agreed to make a number of changes to its advertising portal so that housing advertisers can no longer choose to target users based on protected characteristics such as age, sex, race, or zip code. Facebook also committed to allow experts to study its advertising platform for algorithmic bias. It remains to be seen whether this agreement goes far enough in curtailing discriminatory advertising practices, as Facebook is confronting further enforcement action from a government watchdog in respect to similar issues. Moreover, a recent research study found that Facebook’s digital advertising platform may still lead to discriminatory outcomes despite changes already made.
On August 13, 2018, the Assistant Secretary for Fair Housing and Equal Opportunity filed a complaint with the Department of Housing and Urban Development (“HUD”) alleging that Facebook is in violation of the FHA. The Office of Fair Housing and Equal Opportunity determined in March, 2019 (the same time as the settlement agreement with NFHA) that reasonable cause exists and issued an official Charge against Facebook.
Notwithstanding these suits and administrative actions, it remains that, for fair housing claims to survive in court against media giants like Facebook, HUD and future plaintiffs must first successfully argue that Facebook is not protected by the Communications Decency Act (“CDA”).
Communications Decency Act
Congress enacted the CDA, in part, to prohibit obscene or indecent material from reaching children on the internet, and also to safeguard internet ingenuity. What was meant as a protectionist measure for the young, impressionable, and inventive, however, evolved into a powerful defense tool used by web applications, like Facebook. Section 230 of the CDA immunizes providers of interactive computer services against liability arising from content created by third parties. To overcome the CDA hurdle, litigants have to demonstrate that Facebook “materially contributes” to the management of content on their platform. Fair Hous. Counsel of San Fernando Valley v. Roommates.com, LLC, 521 F.3d 1157, 1163 (9th Cir. 2008). While many online service providers have successfully used Section 230 in their defense, the protections offered to internet service providers are not absolute.
The CDA contains requirements that restrict the application of Section 230. The language in Section 230 prevents a “provider or user of an interactive computer service” from being “treated as the publisher or speaker of any information” that is exclusively “provided by another content provider.” The U.S Court of Appeals for the Ninth Circuit concluded that publishing amounts to “reviewing, editing, and deciding whether to publish or to withdraw from publication third-party content.” Barnes v. Yahoo!, Inc., 570 F.3d 1096, 1102 (9th Cir. 2009). The idea is that website operators would no longer be liable for deciding to edit or remove offending third-party content.
Based on this reading, the law immunizes only “certain internet-based actors from certain kinds of lawsuits.” The statute, as discussed in Roommates.com, LLC, 521 F.3d at 1162, provides no protection to online content that was created by a website operator or developed – in whole or in part – by the website operator. Courts have reaffirmed the CDA’s limited scope to protect self-policing service providers that act as “publishers” of third-party content, as opposed to liability against all categories of third-party claims (i.e. violations of civil rights laws at issue in this article). Barnes, 570 F.3d at 1105; Accord Doe v. Internet Brands, Inc., 824 F.3d 846, 852-53 (9th Cir. 2016). These limitations are crucial. If a plaintiff can show that Facebook developed the content on its platform in whole or in part or, content aside, that Facebook produces discriminatory outcomes via mechanisms on its platform developed by Facebook, it may be excluded from Section 230 immunity.
Optimization Discrimination Study
In a recent study by researchers at Northeastern University,  evidence of Facebook’s control over ad dissemination demonstrates how Facebook manages output of information based on headlines, content, and images, using “optimization.” In short, the Study set out to determine how advertising platforms themselves play a role in creating discriminatory outcomes. The Study highlighted the mechanisms behind, and impact of, ad delivery, which is a process distinct from ad creation and targeting. For example, the Study found that inserting musical content stereotypically associated with Black individuals was delivered to over 85% Black users, while musical content stereotypically associated with White people was delivered to over 80% White users. The researchers concluded that “ad delivery process can significantly alter the audience the ad is delivered to compared to the one intended by the advertiser based on the content of the ad itself.” The study also simulated marketing campaigns and found that Facebook’s algorithms “skewed [ad] delivery along racial and gender lines,” which are protected categories under the FHA. These results suggest that, even if a housing advertiser can no longer choose to explicitly target ads based on attributes like age, gender, and zip code, a housing advertiser could still use Facebook’s marketing platform to steer ads away from protected segments of users by manipulating the content of the ad itself. Moreover, the platform may cause such discriminatory outcomes regardless of whether or not the advertiser intended such results.
Case Law Interpreting CDA
The Study’s findings set the foundation for evaluating Facebook’s control over the manipulation of content and ad distribution on their platform. Two seminal cases, Zeran v. America Online, Inc., 129 F.3d 327 (4th Cir. 1997) and Roommates.com, LLC, 521 F.3d 1152 (2008), outline tests to determine when online platforms are considered content managers versus content providers. The Study makes a strong case for why Facebook is a content manager, eliminating immunity under Section 230. Litigants can also persuasively distinguish their arguments against Facebook from a recent decision interpreting Section 230 liability. In Herrick v. Grindr, LLC, 306 F. Supp.3d 579 (2018), the U.S. Court of Appeals for the Second Circuit ruled in favor of Grindr (a same-sex dating application) on all but one of the plaintiff’s claims. The plaintiff had argued that Grindr failed to monitor and remove content created by the plaintiff’s ex-partner, and the court concluded that Section 230 barred several of his claims because they were “inextricably related” to Grindr’s role in editing or removing offending content (which is protected conduct under the CDA). Herrick v. Grindr, LLC, 306 F. Supp.3d 529, 588. The Supreme Court denied Herrick’s petition to review on October 7, 2019.
A major distinguishing feature between the facts in Herrick and the Study’s findings against Facebook is how the two websites handle third-party content. In Herrick, the claim against Grindr was based on Grindr’s failure to remove content generated by a third-person. The issue with Facebook exists in the use of optimization algorithms. The point is that discriminatory outcomes are ultimately a result of Facebook’s manipulation of ad delivery for the purpose of reaching certain groups at the exclusion of others in protected categories. Facebook’s tools go well beyond the function of “neutral assistance,” because its platform directs advertisements to sectors of people using discriminatory preferences created by Facebook, not third-parties.
If it can be successfully argued that Facebook is not immune from suit under the CDA, housing advertisers and digital platforms that intentionally or unintentionally target ads to certain groups of users based on their membership in a protected class may be sued for violating the FHA. As described above, the Facebook Study determined that housing advertisers may still be able to use Facebook’s marketing platform to steer housing ads away from protected classes of tenants by manipulating the content of the ad. In such circumstances, the housing advertiser who uses the ad’s content as a covert method of discriminatory distribution may be violating the FHA. The digital platform may also be liable either because they are actively involved in facilitating the selective distribution of ads, or as an agent vicariously liable for the advertiser’s conduct.
Even if it cannot be shown that a housing advertiser intended to discriminate, if the ad delivery mechanism has the effect of distributing housing ads in a discriminatory way, the advertiser and platform may still be liable for violating the FHA under a theory of disparate impact. Disparate impact discrimination occurs when a neutral policy or practice has a discriminatory effect on members of a protected class. See Texas Dep’t of Hous. & Cmty. Affairs v. Inclusive Communities Project, Inc., 135 S. Ct. 2507, 2523 (2015); see also 24 C.F.R. § 100.500. A three-part burden shifting framework is used to evaluate liability. Id. Protected class members have the initial burden of establishing that a practice has a disproportionate adverse effect on a protected class. To meet this initial burden, a plaintiff must “allege facts at the pleading stage or produce statistical evidence demonstrating a causal connection” between the policy and the disparate impact. Inclusive Communities, 135 S. Ct. 2507, 2523 (2015).
If a protected class member makes out a prima facie claim of disparate impact, the burden then shifts to the accused party to show that the practice is necessary to achieve a valid interest. See Robert G. Schwemm, Calvin Bradford, Proving Disparate Impact in Fair Housing Cases After Inclusive Communities, 19 N.Y.U.J. Legis. & Pub. Pol’y 685, 696-697 (2016). The protected class members then have an opportunity to show that the interest could be achieved through less discriminatory means. Id.
In the digital advertising context, protected class members would have the initial burden of showing that they were denied equal access to information about a housing opportunity as a result of a housing advertiser’s marketing campaign.
While the Facebook Study was able to demonstrate the potential for “skewed” ad delivery based on protected characteristics, further research is needed to determine how a plaintiff might marshal statistical evidence to support a particular claim. As the Facebook Study notes, without access to a platform’s “data and mechanisms” it may be difficult to assess whether or not a particular advertising campaign has led to discriminatory outcomes. Therefore, it may be challenging for adversely affected users to develop the necessary data at the pleading stage to make out a prima facie claim of disparate impact. This might explain why HUD is continuing to pursue its legal challenge against Facebook despite the remedial measures it has already agreed to undertake, including allowing research experts to study its advertising platform for algorithmic bias. In other words, HUD’s intent may be to better understand how Facebook’s ad delivery algorithm works now so it can limit its discriminatory impact.
Because digital advertising companies play an active role in the ad delivery process, it follows that a discriminatory distribution of ads could be attributed to the platform. While there are limited case decisions involving FHA liability and algorithmic decision-making programs, the court in Connecticut Fair Hous. Ctr. v. Corelogic Rental Prop. Sols, LLC, 369 F. Supp. 3d 362 (D. Conn. 2019), found that plaintiffs had pled sufficient facts to establish a causal connection between a tenant screening company’s alleged activity and unlawful housing denials to support a claim of disparate impact based on race. Id. at 378-379. The court found that the defendant had created and provided the automated screening process, suggested the categories by which the housing provider could screen potential tenants, made eligibility determinations, and sent out letters to potential tenants notifying them of these decisions. Id.
Digital advertising companies similarly create the marketing platform for housing advertisers to use, provide criteria from which to choose the users, and design and maintain the algorithms that decide to whom the ads will be delivered. Therefore, a sufficient nexus should exist between the advertising platform’s activity and the selective distribution of ads to support a disparate impact claim.
Housing providers and digital advertising platforms arguably have a “valid interest” in being able to effectively market their housing services, and ad delivery algorithms are an efficient way to reach relevant users. However, given the abundance of print and online advertising options available for housing advertisers that do not rely solely on ad delivery algorithms, such as Craigslist, Zillow, Trulia, and Apartments.com etc., less discriminatory means exist by which housing advertisers can successfully market their services.
HUD recently proposed a new disparate impact rule that would raise the bar even higher for plaintiffs bringing disparate impact claims and provide housing advertisers with a defense if a digital advertising platform’s algorithmic model was the cause of a discriminatory outcome. A number of tenant advocacy groups and other stakeholders, such as Harvard Law School’s Cyberlaw Clinic, have submitted comments opposing the proposed rule, arguing, among other concerns, that it would perpetuate discrimination by “significantly reduc[ing] incentives for algorithm users and vendors to test their tools for bias” contrary to the purpose of the FHA.
The FHA was designed to provide all home-seekers, who have the resources, with equal access to housing stock and opportunity. It seems clear that online platforms in the business of designing and maintaining their algorithms have an impact on large segments of protected populations. The tension between the need for more information to combat discriminatory algorithms and propriety interests remain. However, one important way to move forward is to balance these interests by staying within the bounds of the FHA, including incentives for platforms to evaluate their ad delivery tools for distribution bias, and ensure a more inclusive participation in the housing market for all social media users.
Nadiyah J. Humber is the Assistant Clinical Professor of Law and Director of the Corporate Counsel, Government, and Prosecution Clinical Externship Programs at Roger Williams University School of Law (“RWU”). RWU students earn academic credit externing for in-house legal offices of corporations, offices of prosecution, and government agencies in Rhode Island and beyond. Professor Humber teaches related seminars for each program on the role of one client entities and professional development through practice.
James Matthews is a Clinical Fellow in Suffolk Law School’s Accelerator Practice and Housing Discrimination Testing Program (HDTP) where he supervises law students in housing discrimination, landlord-tenant, and other consumer protection matters related to housing. Attorney Matthews also has significant teaching and professional presenting experience. He helps conduct fair housing trainings and presentations as part of HDTP’s community education and outreach. He also teaches an upper-level landlord-tenant course he developed which includes instruction on state and federal fair housing law.
 Nat’l Fair Housing Alliance, et al v. Facebook, Inc., No. 18 Civ. 2689, Complaint (detailing allegations), available at https://nationalfairhousing.org/wp-content/uploads/2018/03/NFHA-v.-Facebook.-Complaint-w-Exhibits-March-27-Final-pdf.pdf (last visited Jan. 13, 2020).
 National Fair Housing Alliance, Facebook Settlement, available at https://nationalfairhousing.org/facebook-settlement/ (last visited Jan. 20, 2020).
Assistant Sec’y of Fair Hous. & Equal Opportunity v. Facebook, Inc., No 01-18-0323-8, 1, Charge of Discrimination (detailing procedural history), available at https://www.hud.gov/sites/dfiles/Main/documents/HUD_v_Facebook.pdf (last visited Dec. 8, 2019).
 47 U.S.C. § 230(c) (2019).
 Brief of Internet, Business, and Local Government Law Professors as Amici Curiae Supporting the Respondents at 7 Homeaway.com & Airbnb, Inc. v. City of Santa Monica, Nos. 2:16-cv-06641-ODW, 2:16-cv-06645-ODW (9th Cir. May 23, 2018). See generally 47 U.S.C. §§ 230(b) (detailing policy goals for freedom on the internet).
 Brief of Internet, Business, and Local Government Law Professors as Amici Curiae Supporting the Respondents at 9, Homeaway.com & Airbnb, Inc. v. City of Santa Monica, Nos. 2:16-cv-06641-ODW, 2:16-cv-06645-ODW (9th Cir. May 23, 2018).
 47 U.S.C. §§ 230(c)(1), (f)(3) (2019).
 Brief of Internet, Business, and Local Government Law Professors as Amici Curiae Supporting the Respondents at 4, Homeaway.com & Airbnb, Inc. v. City of Santa Monica, Nos. 2:16-cv-06641-ODW, 2:16-cv-06645-ODW (9th Cir. May 23, 2018).
 Ali, Muhammad, et. al, Discrimination through Optimization: How Facebook’s Ad Delivery Can Lead to Skewed Outcomes, available at https://www.ccs.neu.edu/home/amislove/publications/FacebookDelivery-CSCW.pdf (last visited Dec. 6, 2019).
 Id. at 7 (explaining optimization on Facebook).
 See Nadiyah J. Humber, In West Philadelphia Born and Raised or Moving to Bel-Air? Racial Steering as a Consequence of Using Race Data on Real Estate Websites, 17 Hastings Race & Poverty L.J. 129, 153-155 (2020) (analyzing pertinent case law precedent for Section 230 immunity). There is a difference between online services that manage content (content provider) on their sites versus those that act more as a store house of information (service provider). Id.
 47 U.S.C. § 230(c) (2019).
 Bloomberg Law available at https://news.bloomberglaw.com/tech-and-telecom-law/grindr-harassment-case-wont-get-supreme-court-review
 47 U.S.C. § 230(c) (2019) (citing language from the act). Distinguishing O’Kroley v. Fastcase Inc., No. 3-13-0780, 2014 WL 2881526, at *1–2 (M.D. Tenn. June 25, 2014) (finding that providing search returns based on automated algorithms and user inputs does not constitute creating content).
 Muhammad, supra note 9.
 See supra note 2.
 See HUD’s Implementation of the Fair Housing Act’s Disparate Impact Standard, 84 Fed. Reg. 42853 (proposed Aug. 19, 2019) (for example, providing a defense where a “(2) plaintiff alleges that the cause of a discriminatory effect is a model, such as a risk assessment algorithm, and the defendant . . . (ii) Shows that the challenged model is produced, maintained, or distributed by a recognized third party that determines industry standards, the inputs and methods within the model are not determined by the defendant, and the defendant is using the model as intended by the third party . . .”)
 See Cathy O’Neil, Comment Regarding Docket No. FR-6111-P-02, http://clinic.cyber.harvard.edu/files/2019/10/HUD-Rule-Comment-ONEIL-10-18-2019-FINAL.pdf (last visited Jan. 20, 2020).
by Simone R. Liebman
In October, the Supreme Court of the United States heard argument in three cases that involve an unconventional division between the U.S. Department of Justice (DOJ) and the Equal Employment Opportunity Commission (EEOC), the federal agency authorized to interpret and enforce Title VII of the Civil Rights Act of 1964 (Title VII). These cases concern whether Title VII’s prohibition against bias “because of . . . sex” encompasses employment discrimination based on sexual orientation and transgender status. At the federal circuit court level, the EEOC argued that discriminating against an employee because of sexual orientation and gender identity amounts to sex discrimination under Title VII. When the cases were appealed to the Supreme Court, however, the DOJ took the extraordinary step of filing briefs on behalf of the EEOC, rather than permitting the agency to do so. Moreover, the DOJ urged the Court to review Title VII restrictively, contrary to the EEOC’s established position, and argued that the law does not explicitly prohibit sexual orientation or gender identity discrimination. The split in the federal government was further underscored when former federal officials, including the EEOC’s former chairs, commissioners, and general counsels, filed briefs arguing that sexual orientation and gender identity are intrinsically functions of sex and predicated on sex stereotypes.
The DOJ’s effort to override the authority and precedent of the EEOC is unique and historically noteworthy. And it provides a sharp contrast with the robust protections ensuring equal opportunities in employment available to Massachusetts employees through chapter 151B of the Massachusetts General Laws as enforced by the Massachusetts Commission Against Discrimination (MCAD). In enacting G.L. c. 151B in 1946, the Legislature granted the MCAD broad remedial powers and significant enforcement authority. The MCAD is a law enforcement agency with police powers designed to vindicate public rights. This legislative mandate has shaped judicial precedent, often putting Massachusetts at the vanguard in providing protection for employees. The statutory scheme includes a case process that is accessible to victims of discrimination regardless of socio-economic class and results in remedies designed to compensate past wrongs and deter future illegal workplace conduct. Due to the independent, prosecutorial nature of the agency, courts have found that victims of discrimination at the MCAD may proceed in situations where private litigants would otherwise have been barred. The current battle in the Supreme Court over who interprets Title VII, and whether the law should be broadly or restrictively construed, demonstrates the importance of the MCAD’s ability to act in its own name as a public law enforcement agency to protect civil rights in Massachusetts.
G.L. c. 151B grants the MCAD law enforcement authority.
Chapter 151B has always prohibited religious, race, national origin and ancestry discrimination. The Legislature acknowledged that discriminatory conduct is no less than a “harmful influence to our democratic institutions” and stated that “no well-informed, right thinking person can be oblivious or indifferent to this evil.” The elimination of discrimination, the Legislature declared, was a “corner-stone” upon which “world peace must be based.” With extraordinary legislative foresight, the statute authorized the MCAD at its inception to act as a civil prosecutor with significant enforcement authority. The legislation granted the MCAD the ability to conduct investigations; subpoena individuals; and issue complaints in its own name, even where no complaint has been filed by an aggrieved person. To ensure that the MCAD has the opportunity to identify trends and, if appropriate, take action, MCAD’s enforcement proceedings “shall, while pending, be exclusive,” taking precedence over any other type of recourse available. The statute imposed criminal sanctions, including imprisonment, where an employer willfully resists, prevents, impedes, or interferes with the MCAD in the performance of its statutory duties.
G.L. c. 151B Mandates Liberal Construction.
Of considerable importance, the legislation explicitly requires that G.L. c. 151B “be construed liberally for the accomplishment of the purposes” of the statute. This directive has resulted in significant protections for Massachusetts employees. In 2013, the Supreme Judicial Court held that G.L. c. 151B prohibits discriminating against an employee based on the employee’s association with an individual who is disabled, despite the absence of an explicit statutory prohibition against associational disability discrimination. In 2017, the SJC was the first state appellate court to conclude that under specific circumstances, an employer may be required to reasonably accommodate an employee with a debilitating medical condition that is treated through the use of medical marijuana. This year, the SJC concluded that an employer could be found to have engaged in illegal discrimination even when the discriminatory act in question was a lateral transfer, without any effect on the employee’s base salary, work responsibilities, or title. Each of these cases relied, in large part, on the long-standing mandate that G.L. c. 151B must be interpreted liberally to achieve its remedial purposes. In contrast, Title VII has no such mandate.
The MCAD’s case processing furthers the remedial goals of the statute.
There is no fee for filing a charge of discrimination with the MCAD and no requirement to obtain legal assistance in filing. If the investigating commissioner concludes that the case has “probable cause” to proceed, and the charging party does not hire private counsel, the matter is assigned to a Commission attorney to prosecute the matter in the public interest. Almost half of the cases found by the MCAD to have probable cause are assigned to a Commission attorney, who generally prosecutes the matter through public hearing at no cost to the complainant. After probable cause has been found, the Commission schedules a mandatory conciliation conference, again at no cost to the parties, in which an MCAD conciliator “will attempt to achieve a just resolution of the complaint and to obtain assurances that the Respondent will satisfactorily remedy any violations . . . and take such action as will assure the elimination of the discriminatory practices, or the prevention of their occurrence in the future.” Many cases are resolved at the conciliation conference, and include public interest relief such as training or policy change.
The case is certified to public hearing if the investigating commissioner determines that the public interest so requires, and a complaint is issued in the name of the Commission. It will then be heard by an MCAD hearing officer or a commissioner with expertise in G.L. c. 151B. If the employer is found to have violated the statute, the MCAD issues remedies designed to deter future illegal conduct, including a cease and desist order, a wide array of injunctive and affirmative relief such as training, reinstatement, policy change, and civil penalties, in addition to attorneys’ fees and compensatory damages to make the complainant whole. See Stonehill College v. Massachusetts Comm’n Against Discrimination, 441 Mass. 549, 563 (2004).
The MCAD may proceed where private litigants may not.
The MCAD’s “police powers” allow it to proceed with civil prosecutions in situations where a private litigant seeking redress in court could not. For example, where an employer files for bankruptcy during a civil proceeding, the automatic stay preventing the continuation of any civil proceeding generally applies. Cases pursued through the administrative process at the MCAD, however, fall within the exception to the automatic stay that allows governmental units to exercise police or regulatory power. Recognizing the “strongly felt” public policy against discrimination and the enforcement powers granted to the MCAD, the court in In re Mohawk Greenfield Motel Corp., 239 B.R. 1 (Bankr. D. Mass. 1999), held that the MCAD possessed police or regulatory power that qualified for the exception. The court further acknowledged that while back pay awards have a financial benefit to an employee who proves liability and is awarded victim-specific relief, the imposition of this remedy ensures future compliance and serves a public purpose: ensuring that the employer at issue “as well as others who might contemplate similar odious behavior, would be dissuaded from its future practice.” Id. at 9. Crucial to this decision exempting MCAD proceedings from the automatic stay was the recognition that it is fundamental to the MCAD’s authority to act in the public good to identify and remediate discriminatory conduct without excessive delay, and that “the benefit to the public arising from the continuing capability of MCAD to identify and sanction discriminatory behavior overshadows any associated pecuniary benefit to the victim of that discrimination.” Id. at 9.
Similarly, it was the public enforcement nature of the MCAD’s process that led the SJC in Joulé, Inc. v. Simmons, 459 Mass. 88 (2011), to permit the continued prosecution of an MCAD claim even where a binding pre-employment arbitration agreement required the victim of discrimination to arbitrate the claim rather than file a private right of action. Acknowledging that it is the MCAD and not the complainant that prosecutes the discrimination claim, the SJC concluded that mandatory arbitration clauses, otherwise applicable to private claims of workplace discrimination, do not and cannot bar administrative enforcement proceedings under G. L. c. 151B, § 5. Id. at 95-96. Given that over half of American private-sector nonunion employees are subject to mandatory arbitration procedures, the ability to proceed with a claim at the MCAD despite a binding arbitration agreement is of notable significance to employees in the Commonwealth. In Whelchel v. Regus Management Group, LLC, 914 F. Supp. 2d 83 (D. Mass. 2012), the substantial state interest in preserving the MCAD’s oversight role over discrimination claims led the court to refuse to allow an employer to remove an MCAD matter to federal court. These practical advantages to proceeding at the MCAD all flow from the Legislature’s recognition over seventy years ago that the main object of an MCAD proceeding is to “vindicate the public’s interest in reducing discrimination in the workplace by deterring and punishing, instances of discrimination by employers against employees.” Stonehill College, 441 Mass. at 563.
When the Legislature enacted G.L. c. 151B in 1946, no one could have foreseen the current divisiveness in the federal government, nor were there any federal civil rights protections or an EEOC in place to enforce them. That was not to come into play until 1964. But the Massachusetts Legislature created safeguards resilient enough to withstand the winds of change.
Rather than merely creating a forum through which private litigants resolve disputes, the Legislature recognized the need for an independent, public agency to promote and protect the fundamental right of Massachusetts citizens to obtain equal opportunities in the workplace.
Simone R. Liebman is Commission Counsel at the MCAD where she where she represents the agency in Massachusetts trial and appellate courts, files amicus briefs in select cases, assists with the drafting of policy and guidance, prosecutes cases through public hearing, and conducts affirmative litigation. This article represents the opinions and legal conclusions of its author and not necessarily those of the MCAD. Opinions of the MCAD are formal documents rendered pursuant to specific statutory authority.
 Altitude Express, Inc. v. Zarda, No. 17-1623 and Bostock v. Clayton County, Georgia, No. 17-1618 involve the question of whether sex discrimination under Title VII includes bias based on sexual orientation. R.G. & G.R. Harris Funeral Homes, Inc. v. Equal Employment Opportunity Commission, No. 18-107, addresses the question of whether it is a violation of Title VII to discriminate against an employee based on the employee’s transgender status or under a theory of sex stereotyping under Price Waterhouse v. Hopkins, 490 U.S. 228 (1989).
 http://www.abajournal.com/news/article/eeoc-doesnt-sign-us-brief-telling-supreme-court-that-transgender-discrimination-is-legal; https://www.reuters.com/article/us-otc-doj/once-again-trump-doj-busts-convention-splits-government-in-high-profile-employment-case-idUSKBN1AC32U.
 See G. L. c. 151B, inserted by St. 1946, c. 368, § 4. Since its enactment, G.L. c. 151B has been expanded to include other protected categories. Currently, G.L. c. 151B prohibits discrimination based on race, color, religious creed, national origin, disability, sex, gender identity, sexual orientation, genetic information, pregnancy (including a pregnancy-related condition), veteran status, age, and active military service. G.L. c. 151B, § 4. The MCAD also has jurisdiction over a host of other types of discriminatory conduct including retaliation, failure to accommodate disabilities, housing discrimination, certain inquiries regarding criminal records, parental leave, public accommodation discrimination, mortgage lending and credit discrimination, and certain types of education discrimination.
 REPORT OF THE SPECIAL COMMISSION RELATIVE TO THE MATTER OF DISCRIMINATION AGAINST PERSONS IN EMPLOYMENT BECAUSE OF THEIR RACE, COLOR, RELIGION, OR NATIONALITY, H.R. Rep. No. No. 337, 154th Leg., 1st Sess. at 2 (Mass. 1945).
 REPORT OF THE GOVERNOR’S COMMITTEE TO RECOMMEND FAIR EMPLOYMENT PRACTICE LEGISLATION, H.R. REP. No. 400, 154th Leg., 2nd Sess., at 7 (Mass. 1946).
 G. L. c. 151B, §§ 1(7) & 5, inserted by St. 1946, c. 368, § 4.
 G. L. c. 151B, § 9, inserted by St. 1946, c. 368, § 4.
 G. L. c. 151B, § 8, inserted by St. 1946, c. 368, § 4.
 G. L. c. 151B, § 9.
 Flagg v. AliMed, Inc., 466 Mass. 23 (2013) (“reading the statutory language broadly in light of its remedial purpose, and in order best to effectuate the Legislature’s intent, we think that the concept of associational discrimination also furthers the more general purposes of c. 151B as a wide-ranging law, ‘seek[ing] … removal of artificial, arbitrary, and unnecessary barriers to full participation in the workplace’ that are based on discrimination”).
 Barbuto v. Advantage Sales and Marketing, LLC, 477 Mass. 456 (2017) (employee use of medical marijuana is not facially unreasonable as a reasonable accommodation).
 Yee v. Massachusetts State Police, 481 Mass. 290 (2019) (where there are material differences between two positions in the opportunity to earn compensation, or in the terms, conditions, or privileges of employment, the failure to grant a lateral transfer to the preferred position may constitute an adverse employment action under G.L. c. 151B).
 2018 MCAD Annual Report, p. 11 (Commission counsel were assigned 46% of these cases in 2018).
 804 C.M.R. § 1.18(1)(a).
 804 C.M.R. § 1.20(3).
 See A. Colvin, Economic Policy Institute (EPI), “The Growing Use of Mandatory Arbitration” 1-2, 4 (Sept. 27, 2017).
by Christopher E. Hart
A critical component of data governance is the written information security program or policy, or “WISP” for short. WISPs are important for three reasons: first, they are often required by specific statutes or regulations. Second, their drafting and maintenance often force organizations to consider more closely the adequacy of their security practices. Third, they can be excellent defenses against liability in the event of a data security incident. Yet organizations often find themselves caught by surprise when they learn that they are either legally required to have a WISP, or ought to have one as a best practice or risk mitigator.
This article discusses what a WISP is, when they are required, what they are good for, why organizations should consider creating and maintaining them, and what the future holds. In the end, you will hopefully consider the WISP to be a critically important component of your or your client’s overall data governance strategy.
What is a WISP?
A WISP is a set of organizational practices relating to certain information, normally personally identifiable information (PII) that the organization maintains (such as a person’s name, email, password, social security number, and credit card information), memorialized in an inward-facing document. While the WISP really refers to the practices or program of information security, the memorialized document is often what people are referring to when they think of WISPs. A WISP is inward-facing in the sense that it is meant to be used internally by an organization, both as a reference and as a memorialization of practices, and not necessarily meant for consumption by consumers or the general public. (In contrast, privacy policies tend to be outward-facing documents, meant to notify potential consumers about an organization’s data use and security practices at or before the point that data is provided.)
To illustrate, one of the most important laws relating to WISPs, the Massachusetts regulations on Standards for the Protection of Personal Information of Residents of the Commonwealth, requires that “[e]very person that owns or licenses personal information” about a Massachusetts resident must “develop, implement, and maintain a comprehensive information security program that is written in one or more accessible parts.” 201 CMR 17.03(1).
What Does a WISP Require?
The purpose of the WISP is to “[i]nsure the security and confidentiality of customer information,” “protect against any anticipated threats or hazards to the security or integrity of such information,” and “[p]rotect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer.” 201 CMR 17.01(1). The WISP is a security requirement, not a privacy requirement: it mandates certain technical and administrative safeguards relating to specific kinds of information. To accomplish these objectives, regulations mandating WISPs focus on a number of common elements:
- Risk Assessment. WISPs generally require that organizations implement practices that are commensurate with the sensitivity and volume of data the organization has, and the resources the organization can bring to bear to protect that data.
- Minimum Technical Security. WISPs will carry requirements that computer systems have adequate encryption, anti-malware software, and other perimeter and internal defenses.
- Third-Party Contracts. Central to a WISP is the concept that organizations that collect information but contract with vendors or other organizations to handle data ensure that those third parties protect the data at least as adequately as the collecting organization, requiring both that vendors be adequately vetted and that assurances regarding security programs by third parties are placed into contracts as specific obligations.
- Specific Accountability. WISPs normally require that a specific individual be held out as having responsibility for implementation of the security program.
- Regular Auditing. WISPs, and the specific requirements within them (such as risk assessments), must normally be reevaluated on at least an annual basis.
- Employee Training. Employees must be trained on the organization’s security requirements, and must be knowledgeable of the WISP, in order for the WISP to be a useful instrument.
As these requirements make clear, a WISP is best seen as a bundle of living practices, rather than merely a document that allows an organization to paper its liability.
When is a WISP Required?
As creatures of statute or regulation, WISPs are legally required if an entity falls within the jurisdictional scope of a regulatory regime. So, for example, the Gramm-Leach-Bliley Act, or GLBA, will only apply to those entities that fall under the definition of a “financial institution” as defined by the statute. See 15 U.S.C. § 6809(3) (“The term ‘financial institution’ means any institution the business of which is engaged in financial activities as described in section 1843(k) of title 12”). On the state level, states such as Pennsylvania, New Hampshire, and South Carolina have a WISP requirement for certain insurers as defined by the state’s insurance code. See, e.g., 31 Pa. Code § 146c.3 (“A licensee shall implement a comprehensive written information security program that includes administrative, technical, and physical safeguards for the protection of customer information.”).
Given the relatively narrow scope of many of these WISP requirements, the Massachusetts regulations stand out as particularly broad. Far from being cabined to entities within a particular industry, the Massachusetts regulations do not limit their application to entities that are domiciled or headquartered in Massachusetts, or even that specifically do business in Massachusetts. Rather, they apply to “all persons [that is, natural person, corporation, other legal entity, etc.] that own or license personal information about a resident of the Commonwealth.” 201 CMR 17.01(2). In other words, if a business “owns or licenses” the personal information about a single resident of Massachusetts, the regulations (and thus the requirement to develop a WISP) will apply. This is true even if an organization is already regulated by some other regulatory scheme, such as HIPAA. See Commonwealth v. Milton Pathology Assocs., P.C., Civ. A. No. 12-4568 H, 2012 Mass. Super. LEXIS 2902 (Super. Ct. Dec. 20, 2012) (requiring a HIPAA-covered entity to maintain a WISP).
Why Should You Have a WISP?
The first reason to have a WISP is because the law might require it, and being out of compliance can prove to be an expensive and embarrassing risk. The Commonwealth of Massachusetts has entered into consent judgments with parties in part (if not exclusively) to bring them into compliance with this requirement. The Attorney General of Massachusetts is an avid enforcer of the WISP requirement. See, e.g., Commonwealth v. Briar Grp., LLC, Civ. A. No. 11-1185 B, 2011 Mass. Super. LEXIS 2939 (Mass. Super. Ct. March 28, 2011) (requiring implementation of a WISP against a restaurant group accused of “failing to take reasonable steps to protect the personal information obtained from its patrons” in point of sale credit and debit card transactions); Commonwealth v. Haney, Civ. S. No. 16-00183m 2016 Mass. Super. LEXIS 915 (Super. Ct. January 14, 2016) (requiring a solo real estate practitioner to implement a WISP after allegedly failing to notify clients of a data breach); Milton Pathology Assocs., P.C., 2012 Mass. Super. LEXIS 2902. So is the Federal Trade Commission with regard to the WISP requirement in the GLBA’s Safeguards Rule. See In the Matter of Paypal, Inc., 162-3102, ¶ 40a (Fed. Trade Commission, 2017) (bringing a complaint against Venmo for failing to have a WISP through “at least August 2014”).
Having a good WISP might be as important as simply having one at all. In the wake of the 2017 Equifax breach affecting millions of individuals, the Attorney General of Massachusetts (among countless others) sued Equifax. Among the claims made by the Attorney General was that Equifax had violated the Massachusetts Data Security Regulations by having an insufficient WISP: “Equifax failed to develop, implement, and maintain an adequate written information security program . . . and . . . this failure made the data breach possible.” Commonwealth v. Equifax, Inc., Opinion No. 139895; 2018 Mass. Super. LEXIS 66 at *2 (Mass. Super Ct. April 3, 2018) (emphasis supplied). Specifically, the Commonwealth alleged that “Equifax knew or should have known” that there was “a serious security vulnerability” in Equifax’s systems; that Equifax “failed to patch or upgrade its software to eliminate this vulnerability,” and that “Equifax did not even take reasonable steps to determine whether unauthorized parties were infiltrating its computer systems.” Id. Considering the issue at the motion to dismiss stage, the court concluded that the Commonwealth stated a claim and denied the motion to dismiss. Id. at *3. Critically, the Commonwealth used the WISP requirements as a basis for a series of allegations that Equifax did not take reasonable measures to prevent or mitigate the breach—emphasizing that it is not the mere existence of the document, but the adequacy of the practices, that the regulations are intended to control.
In fact, in Massachusetts, the data protection statute authorizing the regulations that require the WISP has itself recently changed, requiring that in the event of a breach triggering notification to the Attorney General and the Office of Consumer Affairs and Business Regulations, the company notify these agencies whether a WISP was in place at the time of the breach. See G.L. c. 93H § 3(b). The clear intent of this change to the statute is to (1) create an in terrorem motivation to put a WISP in place if one has not yet been developed, and (2) to make it easier for the Commonwealth to prosecute cases in which a breach occurred without adequate safeguards.
Conversely, failing to have a WISP can potentially be evidence of negligence. When in search of a working theory of liability for a claim against an organization suffering a data breach, plaintiffs can turn to WISP requirements as evidence of a duty, and thus bring a claim sounding in negligence (whether or not it succeeds). See Baum v. Keystone Mercy Health Plan, 826 F. Supp. 2d 718, 721 (E.D. Pa. 2011) (remanding a removal case to state court when the state statute requiring a “comprehensive” WISP potentially allowed for a negligence per se claim even though HIPAA did not provide a private right of action); Rebello v. Lender Processing Servs., 30 N.E. 3d 999, 1016 (Ohio App. 2015) (holding that the GLBA “manifests a clear public policy against the unauthorized access and disclosure of the nonpublic personal information of consumers” applicable to plaintiff in an unlawful termination suit, as manifested in part through the WISP requirement, and allowing the claim to proceed).
The third reason to have a WISP is that it is simply good practice. While having a WISP can help an organization avoid compliance and litigation risk, having a WISP—that is, having actual practices to safeguard PII, memorialized in a document read and understood by those who handle such data—can, before any discussion of liability, help avoid a data breach or minimize the fallout from a data breach if it occurs. In the end, isn’t that the point?
What Does the Future Hold?
The WISP is not only here to stay; it stands a good chance of becoming a universal instrument in a complete data management tool kit, both as a matter of good practice and a matter of law. For example, the EU’s General Data Protection Regulation, or GDPR, does not specifically require a WISP. But the law has a host of requirements suggesting something like a WISP is prudent, if not required. See, e.g., GDPR Art. 5(2) (noting that the controller of personal data “shall be responsible for, and able to demonstrate compliance with” the requirement that personal data be processed lawfully, which includes processing with adequate security); id., Art. 25(2) (“The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed.”). Given the GDPR’s potentially global territorial scope, something like a WISP is almost certainly going to become a legal norm.
In short, the WISP is a deeply important instrument for organizations in their privacy and security programs. While sometimes overlooked, it is both an increasingly important and ubiquitous regulatory requirement and a critical tool for creating robust security practices in an organization.
 For purposes of this article, unless otherwise indicated I will use “PII” to refer to the kind of information the practices outlined in WISPs are intended to safeguard. However, protected information can often be referred to by other terms of art, depending on the regulatory scheme: non-public financial information (the Gramm-Leach-Bliley Act); protected health information (the Health Insurance Portability and Accountability Act); and personal data (the European General Data Protection Regulation), to name three.
 A deep dive into the regulations reveals just how broad their scope is. A “person” can be a natural person or any legal entity; “owns or licenses” can mean, simply to “process” or simply “have access to” the personal information of a Massachusetts resident. 201 CMR 17.02.
Chris is Counsel and Partner-Elect in Foley Hoag’s Litigation Department, and an active member of the firm’s Data Privacy and Security Group. Chris has an active practice assisting organizations with their privacy compliance, data breach response, and government defense and litigation needs. In addition, Chris teaches data privacy compliance as a Part-Time Lecturer at Northeastern University School of Law.