There have been 449 data breaches reported in media in 2008, according to the Identity Theft Resource Center’s 2008 Data Breach List.  That number exceeds the 2007 year-end total, and counts as only one breach even massive incidents such as the Hannaford Bros. breach.  Note that some of the breaches in the 2008 list were reported in 2008 but occurred in earlier years. 

The public availability of the breach information reported by media and catalogued in the Data Breach List is a direct result of the data breach notification laws of 44 states.  As a reminder, the most recent list of state data breach laws is available here on the Proskauer on Privacy blog.

• Print
• Comments
• Trackbacks

 

Proskauer on Privacy will never be confused with TMZ, but we would be remiss if we failed to report on the high profile privacy scandal unfolding in the backyard of our Los Angeles office. As we previously reported, California’s data breach notification law was amended effective January 1, 2008, to include breaches of medical and health insurance information. A number of recent incidents illustrate once again that it is not enough to have written policies and procedures in place for the handling of sensitive information – employee training is essential. 

 

The Los Angeles Times recently reported that over 120 employees viewed the medical records and personal information of approximately 900 celebrity patients at UCLA Medical Center between April 2003 and May 2007. According to the latest report, the unauthorized snooping continued even after the facility cracked down on peeking employees in April.

Continue Reading...

• Print
• Comments
• Trackbacks

Google Inc. (“Google”) has filed a motion to dismiss a complaint by a Pittsburgh couple, Aaron and Christine Boring (“the Borings”), over Google’s alleged invasion of the Borings’ privacy through Google’s Street View service. Launched last May, Street View provides a navigable, 360-degree view from the streets of many U.S. cities, including Pittsburgh. 

The Borings have sued for invasion of privacy, trespass, negligence and unjust enrichment and seek damages from mental suffering and diminished property value. In their complaint, the Borings argue that Google recklessly invaded their reasonable expectation of privacy by trespassing onto their property, passing a sign reading “Private Road, No Trespassing.” From the Borings’ driveway, Google captured exterior images of the Borings’ residence and swimming pool that Google made visible with Street View.

 

Continue Reading...

• Print
• Comments
• Trackbacks

A host of state laws require that companies take measures to protect the confidentiality of the Social Security Numbers that they possess regarding employees and consumers. But Connecticut’s new law, “AN ACT CONCERNING THE CONFIDENTIALITY OF SOCIAL SECURITY NUMBERS,” requires more. 

Continue Reading...

• Print
• Comments
• Trackbacks

According to regulations published by the Federal Trade Commission and the federal banking agencies, covered companies that hold any customer accounts must implement identity theft prevention programs that identify and detect “Red Flags” signaling possible identity theft.  Companies establishing such programs must create policies and procedures not only to recognize and detect Red Flags, but also to respond to Red Flags by preventing or mitigating potential identity theft. Furthermore, companies must develop reasonable policies and procedures to verify the identity of a customer opening an account, and must also periodically update their identity theft programs.  The rules went into effect on January 1, 2008, and businesses must comply by November 1, 2008.  You can read more about Red Flags in this Client Alert.

• Print
• Comments
• Trackbacks

Binding corporate rules (“BCRs”) may now be easier to implement due to much needed guidance issued last month by the European Union’s Article 29 Working Party, the group responsible for the oversight of the EU’s data protection regime. The guidance consists of three documents, which clarify the requirements for establishing BCRs. These documents are: (1) a checklist outlining the required elements of the BCRs; (2) a framework for the structure of BCRs; and (3) a list of frequently asked questions regarding BCRs.

           

Continue Reading...

• Print
• Comments
• Trackbacks

On July 17, 2008, the House Telecommunications and Internet Subcommittee examined the practice of deep packet inspection (DPI), a method for networks and third parties to determine what information users (identified by IP addresses or random ID numbers) are searching for and accessing on the Internet in order to tailor more relevant advertising based on an individual’s interests. DPI is often cookie-based and does not link personally identifiable information with user surfer behavior.

The House Subcommittee’s hearing focused on whether the online advertising industry should be required to use opt-in systems, or whether current opt-out systems adequately protect consumers’ privacy. The July 17 hearing is the latest in a series of efforts by regulators and legislators to better understand behavioral targeting. Continue Reading...

• Print
• Comments
• Trackbacks

Alaska passed a breach notification law in June, making it state number 44 to do so.  As most are aware by now, Alaska's new law, Alaska Stat. § 45.48.010 et seq., includes breach notification requirements, restrictions on use of Social Security numbers, and allows consumers to place a security [deep] freeze on their credit reports.  Notification of a breach is not required if, after an appropriate investigation and written notification to Alaska’s attorney general, the covered entity determines that there is not a reasonable likelihood that harm to consumers has resulted or will result from the breach.  By popular demand, following is our updated list of security breach notification laws.

Continue Reading...

• Print
• Comments
• Trackbacks

State governments and federal prosecutors are cracking down on individuals who use the internet to harass or threaten others.  On June 30, Missouri Governor Matt Blount signed into law a measure that criminalizes online harassment.  This new law represents a marked change in the legal treatment of this form of harassment, also known as “cyber-bullying.”  Other states have enacted legislation to help stop cyber-bullies, but none has gone so far as to impose jail sentences on violators.  The Missouri law, however, criminalizes the transmission of an electronic communication for the purpose of frightening or disturbing another.  V.A.M.S. 565.091 (not yet chaptered).  Adult violators of this new law face up to 4 years in prison if they perpetrate the offense against a child.

The legislation responds to the 2006 death of 13-year old Megan Meier, who committed suicide after being harassed repeatedly on MySpace.  The harassment was allegedly perpetrated by Lori Drew, a 47-year old woman who falsely assumed the identity of a fictitious teenage boy on MySpace and posed as this character to develop an online relationship with Meier.  The girl’s suicide was allegedly prompted by disparaging comments made by Ms. Drew disguised as the teenage boy.  The tragedy outraged the Missouri community in which it occurred, but local authorities were unable to prosecute Ms. Drew because cyber-bullying was not illegal. Continue Reading...

• Print
• Comments
• Trackbacks