Supreme Court to Review Electronic Communications Case

by Mehmet Munur

The Supreme Court will review a 9th Circuit Court case finding that the unauthorized search of employee text messages on an employer provided text messaging pager may have violated the employee’s privacy rights despite a written policy stating that the employees should have no expectation of privacy.

Once again, the Supreme Court’s review of the case highlights the complexity of employee electronic communications in the workplace. With the extensive use of blogging and social media in the workplace, it is becoming more and more important to put in place explicit electronic communication policies and to implement those policies uniformly. You can find our previous blog post on the 9th Circuit Opinion here.

Read More...

Regulators Issue Final Model Privacy Notice

By Mehmet Munur

On November 17, eight federal regulators issued final rules and model privacy notice forms as required under the Gramm-Leach-Bliley Act. While the use of the notice forms are not required, the two-page forms create a safe-harbor for disclosures required under the GLBA.

The notice forms replace the Sample Clauses previously issued by the regulators. The regulators stated that their studies “confirm[ed] that a notice composed solely of the Sample Clauses promotes ease of scanning to perform simple tasks – because the notice is short and not because it is understandable – but the Sample Clauses do not do well on comprehension measures. Moreover, the testing showed that current notices – in which the Sample Clauses are typically embedded – do poorly on all measures.” Therefore, the regulators appear to want to increase the use of the model clauses as much as possible.

The FTC has been pushing for alternate means of providing notice to individuals for some time. The FTC noted in its February 2009 Behavioral Advertising Staff Report that “privacy policies have become long and difficult to understand, and may not be an effective way to communicate information to consumers. Staff therefore encourages companies to design innovative ways – outside of the privacy policy – to provide behavioral advertising disclosures and choice options to consumers.” Then in its recent Sears Enforcement, FTC stated that Sears failed to “disclose adequately that the software application, when installed, would: monitor nearly all of the Internet behavior that occurs on consumers’ computers.” Sears had mentioned the broad nature of data collection only in the 75^th line of a legal agreement. Then in August, FTC once again mentioned the Sears enforcement and the need to provide better notice in the Health Breach Notification Rule; stating “[b]uried disclosures in lengthy privacy policies do not satisfy the standard of ‘meaningful choice.’” FTC will be conducting Privacy Roundtables in the near future. We expect the highlights notices, model privacy notices, and Carnegie Mellon’s Nutrition Label Approach to privacy statements to take center stage in these roundtables.

Read More...

FTC Settles with Six Companies with Lapsed Safe Harbor Certifications

By Mehmet Munur

On October 6, 2009, Federal Trade Commission filed six complaints against companies falsely claiming that they were self-certified to the Department of Commerce EU Safe Harbor when their certification had lapsed. This FTC action should serve as a reminder to Safe Harborites either to keep up their annual recertification or to avoid misrepresenting that they are self-certified to the Safe Harbor.

The EU Safe Harbor is one of the methods allowing US corporations to export data from the EU while complying with the Article 25 of the EU data Protection Directive, which requires that data only be transferred to countries with adequate data protections—with exceptions. The Department of Commerce, European Commission, and the Article 29 Working Party negotiated the Safe Harbor. US companies self-certify for the Safe Harbor and the DoC maintains a list of these companies on its export.gov website. However, the Federal Trade Commission and the Department of Transportation have the authority to enforce the Safe Harbor. While the Safe Harbor plays a crucial role for multinational corporations in transferring personal data from the EU without violating the EU Data Protection Directive’s adequacy requirements, now more than ever, failure to abide by the Safe Harbor requirements can result in enforcement actions by the FTC.

Six companies, World Innovators, Inc.; ExpatEdge Partners LLC; Onyx Graphics, Inc.; Directors Desk LLC; Collectify LLC; and Progressive GaitWays LLC, each represented that they were self-certified to the Safe Harbor when in fact their certification had not been renewed for several years. At least three of the companies had failed to either recertify or remove their representations related to their certification from their websites for two to three years. For example, ExpatEdge had certified for the Safe Harbor in 2002 but had failed to recertify since 2006. Onyx Graphics had certified in 2006 but failed to recertify since 2007. Progressive GaitWays had certified in 2004 but failed to recertify since 2006. Since the FTC enforcement, the remaining three companies have recertified for the Safe Harbor.

The six companies each entered into consent agreements with the FTC related to their infringing activities. The consent agreements are similar to the previous FTC settlement on the Safe Harbor. The consent agreements prohibit any of the companies from “misrepresent[ing] in any manner, expressly or by implication, the extent to which respondent is a member of, adheres to, complies with, is certified by, is endorsed by, or otherwise participates in any privacy, security, or any other compliance program sponsored by the government or any other third party.” Furthermore, the companies must make all documents related to compliance with the consent agreement available for inspection for the next 5 years.

In our previous blog post, we had stated that the FTC’s enforcement was tacked onto other issues related shipment of goods. This time the FTC has squarely addressed Safe Harbor violations using its deceptive trade practices powers. According to the FTC policy statement on deception, a material representation, omission, or practice that is likely to mislead the consumer is needed for any enforcement activity. Any “act or practice is likely to affect the consumer's conduct or decision with regard to a product or service” is considered material. Additionally, any express claims are presumed material. Furthermore, the Safe Harbor Principles and FAQ 11 of the Safe Harbor clearly state FTC’s jurisdiction to bring actions against Safe Harborites for deceptive trade practices. Therefore, the companies’ express claims that they were self-certified with the Safe Harbor when their certifications had expired are clearly material misrepresentations that would mislead a reasonable consumer under the circumstances.

The recent enforcement actions in this area are certainly signs of FTC’s willingness to bring enforcement actions in this area in the future. The recent changes to the list showing organizations certified to the Safe Harbor is possibly another indication of things to come. International Trade Administration website used to host the Safe Harbor list. Recently, it has moved to the Department of Commerce’s export.gov/safeharbor/ website, which is where all other Safe Harbor related documents used to reside. The list now more readily identifies non-compliant companies.

The FTC is likely to bring more enforcement actions against companies in the Safe Harbor list that represent that they are certified but have not in fact kept up their certifications with the Department of Commerce. The FTC is also likely to expand its enforcement activities into more substantive issues related to the privacy practices of Safe Harborites in the near future. Therefore, Safe Harborites intending to leave the Safe Harbor should either promptly renew their certifications or remove any public representation that they are certified with the Safe Harbor. This should help alleviate any FTC deceptive trade practices claims. However, note that obligations undertaken by a Safe Harborite do not disappear with the organization leaving the Safe Harbor. Therefore, removing such representations only resolves part of the issues involved in joining then leaving the Safe Harbor.

Read More...

FTC Obtains TRO Against E-Commerce Merchant Falsely Claiming Safe Harbor Certification

By Mehmet Munur

On July 31, the Federal Trade Commission obtained a temporary restraining order against a California website for deceptively claiming to be a member of the EU Safe Harbor administered by the Department of Commerce. This is the first FTC enforcement involving the FTC’s authority to prosecute violations involving EU Safe Harbor and FTC’s authority to prosecute an American company for deception of foreign consumers.

According to the FTC complaint, the defendants posed as UK websites, did not deliver on minimal consumer protections, and lied about being in the Safe Harbor. Balls of Kryptonite, LLC, is based out of Pasadena, California. However, it operates under www.bestpricedbrands.co.uk and www.bitesizedeals.co.uk, states prices in pound sterling, and referred to UK competitors and Royal Mail. The website did not specifically state its location, though such a disclosure is required under the Distance Selling Directive. Therefore, the FTC inferred that the websites advertised and sold consumer electronics products to consumers in the UK “under the pretext of being located within the UK.”

The websites shipped products from the US to the UK. Customers also had to pay substantial customs duties and import taxes. Some of these products were incompatible with the UK power grid. The websites also stated that the products would be covered under warranty. The products were not designed for distribution in the UK and, therefore, were not covered by warranty. Further, consumers were not allowed to cancel their orders, charged 50% restocking fees, and items were not shipped for weeks.

Finally, the defendants advertised that they self-certified with the Department of Commerce for the EU Safe Harbor when they were not. However, this false statement defies all logic. It does not help the defendants establish that they are a website based in the UK. A corporation must have a US establishment that receives personal information from the EU/EEA before it can certify to the Safe Harbor. Maybe this was the company’s way of stating that it was transferring data to the US. Maybe, the website owner believed that the Safe Harbor deception would make their website more attractive to UK customers. Nonetheless, Balls of Kryptonite is likely subject to this enforcement not due to inadequate legal advice, but lack of legal advice.

Nevertheless, the temporary restraining order resulting from the enforcement action makes an interesting example due to its scope. The TRO enjoins the defendants from misrepresenting “[t]he extent to which Defendants are members of, adhere to, comply with, are certified by, are endorsed by, or otherwise participate in any privacy, security, or any other compliance program sponsored by any government or third party.” Thus, the FTC enjoined the defendants from misrepresenting that they are members of any third-party privacy program. In effect, the FTC is recognizing that the health of the Safe Harbor Program is intricately linked to the third-party programs. The Safe Harbor Enforcement Principle requires an independent dispute resolution mechanism that TRUSTe’s EU Safe Harbor Program and BBB EU Safe Harbor offer. However, one could argue that third-party privacy seals programs should enforce their own marks and that the FTC should focus on the Safe Harbor program exclusively.

The enforcement action sets a much-needed precedent for false claims related to the Safe Harbor program. Nevertheless, the majority of the complaint was based on false statements concerning the shipment of goods. The Safe Harbor issue appears to be tacked onto the other issues. The Safe Harbor program has been in existence for nearly a decade and studies by the European Commission in 2004 and others in 2008 have argued that enforcement has been lax. One would hope that, in the future, the FTC would bring section five claims exclusively in the data protection realm in addition to mixed consumer protection claims.

Read More...

Google's EU Data Protection Issues

On May 16, 2007, the Article 29 Data Protection Working Party sent Google a letter praising Google's efforts in improving its privacy practices. However, the Article 29 Working Party questioned Google's storage of server logs of 18-24 months.

Why should Google, a company based in the United States, care about what the EU says? Simply, the Article 29 Working Party states:

Although Google's headquarters are based in the United States, Google is under legal obligation to comply with European laws, in particular privacy laws, as Google's services are provided to European citizens and it maintains data processing activities in Europe, especially the processing of personal data that takes place at its European centre.

That said, why does the EU care about server logs being kept for 18-24 months. Well, first, server logs are information that can be linked to an identified or identifiable natural person. This fact falls within the definition of "personal data" of Data Protection Directive 95/46/EC. The processing of server logs is tantamount to the processing of personal data and thus subject to the Data Protection Directive.

Article 6(e) requires that the personal data be "kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data were collected or for which they are further processed."

The Article 29 Working Party is concerned that Google has not sufficiently specified the purposes for which the server logs are to be kept. So the WP specifically asked Google to clarify why this long storage period was chosen and to specify Google's legal justification for the storage of server logs in general.

The Article 29 Working Party also questioned Google's use of cookies that last approximately 30 years. The WP stated that the lifetime of the google cookie is disproportionate with respect to the purpose of the data processing which is performed and goes beyond what seems to be strictly necessary for the provision of the service, within the meaning of Article 5(3) of the ePrivacy Directive 2002/58/EC.

The Article 29 Working Party will deal with the above issues at its June 2007 meeting and requested Google to respond to their concerns.

While I've not seen a formal response from Google, its global privacy counsel, Peter Fleischer, stated to Reuters that "I will tell the working party that Google needs to hold on to its log database to protect itself and the system from attacks and refine and improve the effectiveness of our search results." (eWeek)

Further, Mr. Fleischer posed the post Why does Google remember information about searches on the Official Google Blog on May 11, 2007. Mr. Fleischer outlined three critical factors in deciding upon the 18-24 month period: (1) to improve Google's services, (2) to maintain security and prevent fraud and abuse, and (3) to comply with legal obligations to retain data.

In its explanation to the third factor, in light of the Article 29 Working Party letter, it's interesting that Mr. Fleischer stated that "Google may be subject to the EU Data Retention Directive, which was passed last year, in the wake of the Madrid and London terrorist bombings, to help law enforcement in the investigation and prosecution of "serious crime."

Read More...

New England Banks to Sue TJX

The Boston Globe reports that a group of New England banks are planning to sue TJX Cos. over TJX's data breach.

Read More...

Privacy & Civil Liberties Oversight Board 2007 Report

The Privacy & Civil Liberties Oversight Board recently released its report (PDF) to Congress on the Board's major activities during the preceding year. The Board's conclusions regarding Anti-terrorism policies and programs will probably be scrutinized and discussed:

Based upon its review, the Board has concluded that the Executive Branch’s conduct of these surveillance activities appropriately considers and reasonably protects the privacy and civil liberties of U.S. Persons. As a result of the new FISA Court Orders, the highly regimented Executive Branch process of justification, review, approval, and auditing has been further augmented by court supervision. This provides reasonable assurance that national security and privacy and civil liberties interests are appropriately balanced. The Board found no evidence or reasonable basis to believe that the privacy and civil liberties of U.S. Persons are improperly threatened or impinged under the surveillance conducted by the Executive Branch, either under the TSP or subsequently under the new FISC Orders. In the opinion of the Board, it appears that the officials and personnel who were involved in conducting the TSP, and who now are responsible for implementing surveillance under the FISC Orders, are significantly aware and respectful of U.S. Constitutional and legal rights and protections for U.S. Persons, and they are actively committed to protecting privacy and civil liberties of U.S. Persons in conducting such surveillance.

Hat tip: beSpacific

Read More...

TJX Companies 10K on Computer Intrusions

This InternetNews story says that TJX Companies, Inc. revealed to the SEC that as many as 47.5 million customer records were stolen during TJX's highly publicized computer intrusion. For those interested, here's TJX's 10-K filing. Pages 7-10 are devoted to a discussion of the computer intrusion and pages 18-21 detail the 19 legal proceedings related to the computer intrusion. Page 21 also details the various government investigations in regards to the computer intrusion.

Obviously, the security breach will not be cheap for TJX.

Recent News Stories:

• State cracks down on identity theft in wake of TJX security breach
• TJX customers subject to security breach
• How the TJX breach may change security awareness
• Do data breaches really hurt retailers?
• Locals upset at TJX Companies security breach
• TJX security breach affected at least 47.5m
• Revealed: World's largest security breach

Read More...

Ohio Senate Bill No. 6

Senate Bill Number 6 was introduced:

• to allow consumers to place a security freeze on the consumer's credit report
• to specify that Social Security numbers are confidential
• to specify that certain personal information is not a public record
• to require a public office to redact from a document that is otherwise a public record certain personal information
• to require a public office to redact Social Security numbers and other confidential information from any document that is made available online to the public through the Internet
• to require the Office of Criminal Justice Services to make state funding grants available to local law enforcement agencies for enforcement of identity fraud laws
• to require the attorney general to support local law enforcement agencies with the enforcement of identity fraud laws, and
• to enact a special statute of limitations for criminal prosecutions and civil actions against identity fraud

The bill, if passed, would help erase the problem reported last year where a number of records from the Ohio Secretary of State's Office was displayed with Social Security numbers.

While I agree that government websites should not post information such as SSN's on their websites, I expect that this bill would either cost taxpayers money to find and redact SSN's already posted (which is not a trivial task). Alternatively, some agencies may take the information offline as they assess the scope of confidential information contained in their online records.

Read More...