Tsibouris Privacy & Technology Law Blog

This blog has moved

2010-04-29T11:36:00.001-04:00

This blog is now located at http://tsibouris.blogspot.com/.
You will be automatically redirected in 30 seconds, or you may click here.

For feed subscribers, please update your feed subscriptions to
http://tsibouris.blogspot.com/feeds/posts/default.

NJ Supreme Court Addresses Privilege in Employee Web-Based Personal Email Accounts

2010-04-13T17:08:00.001-04:00

by Mehmet Munur

New Jersey Supreme Court ruled on March 30, 2010 that an employee did not waive attorney-client privilege to the emails she sent using her personal, web-based, password-protected email account from a computer owned by the employer. The employer had an Electronic Communication Policy that limited the employee’s expectation of privacy but did not explicitly discuss the use of personal email accounts on employer owned computers. The Court also stated in dicta that even a more clearly written policy would not be enforceable due to the public policy concerns over the attorney-client privilege. The Court also placed the burden of compliance with the ruling on attorneys by referring to the Rules of Professional Conduct. The case may require a re-write of electronic communication policies, at least as it relates to NJ employees. The case illustrates the importance of having clearly written policies that not only address the realities of personal use of employer-owned computers, but also the importance of properly implementing such policies.

The plaintiff, Marina Stengart, sued her former employer Loving Care Agency for employment discrimination. Stengart used the laptop provided by Loving Care to send emails to her attorney using her personal, web-based, password-protected Yahoo email account before turning in her laptop at the end of her employment. While she intended such communication to remain confidential, her laptop cached the emails in the temporary files folder. Loving Care imaged the laptop’s hard-drive for electronic discovery and found 7-8 of these emails, which had attorney-client privilege disclaimers. Attorneys for Loving Care reviewed these emails and referenced them in answering interrogatories. Plaintiff requested the immediate return of all other communication. Loving Care’s attorneys refused, Stengart moved for a temporary restraint. The trial court judge denied Stengart’s motion and found that the emails were not protected by attorney-client privilege because Loving Care’s Electronic Communication Policy had placed Stengart on notice that that the emails would be company property. The Appeals Court reversed and the New Jersey Supreme Court agreed with the Appeals Court. The New Jersey Supreme Court held that the Policy was ambiguous, that Stengart had both an objective and a subjective expectation of privacy, that the attorney-client privilege applied to the emails, and that the privileged had not been waived.

I. The Appeals Court Decision.

The Appeals Court overruled the trial court on four issues. First, the Appeals Court held that there was a genuine issue of material fact as to whether the Policy had been properly implemented. Second, it held that the Policy was ambiguous and that it did not specifically address web-based email use for personal reasons. Third, the Appeals Court held that the Policy was not enforceable due to the application of the attorney-client privilege. Lastly, it held that Loving Care’s attorneys were bound by the rules of professional conduct to bring the emails to the attention of the plaintiff’s attorneys or the court for a determination on the application of privilege.

First, the Appeals Court examined whether Loving Care’s Electronic Communication Policy had properly been implement. Stengart argued, with certification in support from former executives, that the Policy was not supposed to apply to Executives and that the Policy was not in effect during her time there. The Appeals Court concluded that there was a genuine issue of material fact as to whether the Policy applied to Stengart as an executive. The Appeals court relied on the multiple versions of the Policy that it found on the record with no information as to the effective dates of the Policy. This portion of Appellate Court Opinion highlights the importance of properly implementing Electronic Communication Policies. Such policies should be properly dated and properly disseminated to the workforce to extinguish any arguments that they are not applicable.

Second, the Appeals Court examined whether the terms of the Policy were sufficiently clear to warrant enforcement and whether the Policy covered the web-based Yahoo email account that Stengart used to communicate with her attorney. The trial court had held that the Policy put Stengart on notice that her communication would be subject to review as company property. The Appeals Court disagreed. Loving Care’s Electronic Communication Policy read:

[1] The company reserves and will exercise the right to review, audit, intercept, access, and disclose all matters on the company's media systems and services at any time, with or without notice. . . .

[2] E-mail and voice mail messages, internet use and communication and computer files are considered part of the company's business and client records. Such communications are not to be considered private or personal to any individual employee.

[3] The principal purpose of electronic mail (e-mail) is for company business communications. Occasional personal use is permitted.

The Appeals Court held that “company’s media systems and services” was not defined and it was not clear whether that included personal, password protected, web-based email accounts. Furthermore, the Appeals Court held that the lack of privacy for business communications conflicted with the occasional personal use that was permitted. Therefore, the Appeals Court held that the Policy was ambiguous.

Third, the Appeals Court turned to whether the Policy was enforceable. The Appeals Court examined the short history of employee manuals and their enforceability in contract theory. The Appeals Court wanted to reign in employee policies and wanted to create a reasonableness requirement on such policies before they could be enforced. Weighing the legitimate business interests of the employer against the interest in privacy of the employee, the Appeals Court appeared to argue that an employer could not make personal communications into company property by placing such language in a policy. Only after going into the history of employee-employer relationships and other cases in this area did the Appeals Court finally turn to the attorney-client privilege issues. The court held that “the company policy is of insufficient weight when compared to the important societal considerations that undergird the attorney-client privilege.”

Fourth, the Appeals Court addressed the issue of whether counsel for Loving Care had violated New Jersey Rule of Professional Conduct 4.4 requiring a “lawyer who receives a document and has reasonable cause to believe that the document was inadvertently sent . . . not [to] read the document [,] to, if he or she has begun to do so, . . . stop reading the document, [to] promptly notify the sender, and [to] return the document to the sender.” The trial court found that Loving Care’s attorneys did not have an affirmative duty to alert the plaintiff that it was in possession of the emails. The Appeals Court was not convinced and held that the Loving Care attorneys had violated the rule. The Appeals Court remanded the case to determine whether counsel should be disqualified.

Thus, the Appeals Court reversed the trial court, ordered the emails to be destroyed, and remanded the case for a hearing on disqualification of Loving Care’s attorneys.

II. The Supreme Court Opinion

The Supreme Court modified and affirmed the judgment of the Appellate court and created a bright line rule in dicta for attorney-client privileged communications from personal web-based accounts using employer owned computers. On appeal, the Supreme Court only addressed the ambiguity of the Policy, the application of the privilege, and the application of the ethics rule. Unlike the Appeals Court, the Supreme Court did not determine whether the Policy had been properly implement. Instead, the Court simply assumed that the Policy applied.

The Supreme Court agreed with the Appeals Court that the language of the written policy was ambiguous. The court then turned to the reasonable expectation of privacy by Stengart in her communications with her attorney. However, the Supreme Court did not take the same reasonableness approach to limit all employer policies regarding electronic communication as the Appeals Court did. Instead, the court distinguished between company provided email accounts and web-based personal email accounts based on 4th Amendment cases by analogy, tort of intrusion on seclusion, NERA v. Evans, Quon v. Arch Wireless, In re Asia Global Crossing, and others. The Court also emphasized the importance of company policies in diminishing the reasonableness of employee’s claim to privacy. The Court analyzed the reasonableness of Stengart’s expectation of privacy both objectively and subjectively. Her use of a web-based, password protected account—the password to which she did not save on her computer—led the Court to conclude that Stengart had a subjective expectation of privacy for the communication. The ambiguity of the Policy and the fact that it did not address personal email accounts led the Court to conclude that her expectation of privacy was objectively reasonable. The Court rejected any arguments of waiver as well and concluded that the communications were privileged.

The New Jersey Supreme Court also went one step further and created a bright line rule in dicta. Court did not mention the same reasonableness requirement in Electronic Communication Policies that the Appeals Court mentioned. Instead, the court stated that companies were free to “adopt lawful policies relating to computer use to protect assets, reputation, and productivity of a business and to ensure compliance with legitimate corporate policies.” However, the Court stated that

Employers have no need or basis to read the specific contents of personal, privileged, attorney-client communications in order to enforce corporate policy. . . . [E]ven a more clearly written company manual – that is, a policy that banned all personal computer use and provided unambiguous notice that an employer could retrieve and read an employee’s attorney-client communications, if accessed on a personal, password protected e-mail account using the company’s computer system – would not be enforceable.

The Court then turned to the ethics issue and agreed with the Appeals court. In effect, both courts appointed the attorneys for the employer as the custodian of an employee’s communication with his attorneys. Loving Care’s attorneys argued that the New Jersey Rule of Professional Conduct 4.4 was meant to address situations where attorneys inadvertently received communications from third parties and not this particular situation where the plaintiff had left them behind. The Court disagreed with the characterization of emails found in the cache of a browser as “left behind” and agreed with the Appeals Court in stating that the counsel for Loving Care had violated the New Jersey Rule of Professional Conduct 4.4 by not setting aside the privileged communications, and failing to notify its adversary or the court. Therefore, in New Jersey, if a company finds potentially privileged emails, its attorneys will be ethically bound to inform opposing counsel or the court about these emails before they use them, or risk disqualification.

With this decision, the New Jersey Supreme Court joins a line of cases, similar to NERA v. Evans, holding that attorney-client communications creates a special case for employer Electronic Communication Policies. However, it is unique for creating a bright line rule for attorney-client privileged emails using personal web-based email accounts. Additionally, by placing the onus of compliance with the rule on the attorneys instead of the businesses, the court ensures that the rule will be followed.

The decision is also important because the Supreme Court did not follow the reasonableness approach to Electronic Communications Policies that the Appeals Court wanted to put in place. Such an approach for the content of all Policies could not simply be based on the attorney-client privilege, but would have to have another basis in the tort of intrusion upon seclusion. Interestingly, the Supreme Court neither struck down, nor agreed with that portion of the Appeals Court opinion.

III. Conclusion

The New Jersey Supreme Court opinion demonstrates the importance of proper drafting and implementation of Electronic Communication Policies. Such Policies should be updated to take into effect the realities of employee’s use of personal web-based email use at work. Companies may either completely ban the use of employees’ personal use of company computers or allow such personal use but specifically address issues related to the privacy of such communications. Updating such Policies will allow companies to decide to what extent they will limit an employee’s expectations of privacy in the personal of use employer-owned computers. Either way, the employer’s decision regarding attorney client privileged communications must be accurately reflected in their policies, or such policies may not be upheld in court. Additionally, such policies should be properly dated and properly disseminated to the workforce to extinguish any arguments that they are not applicable.

Insurance Provider Settles Case Due to Deficiencies in Electronic Signatures, Electronic Evidence, and Contract Drafting

2010-03-08T09:55:00.004-05:00

By Mehmet Munur

A District Court in New York recently decided a case where the perfect storm of messy contract drafting, which left a key term undefined and ambiguous, lack of proper evidence to prove the date of formation of the contract, and deficiencies in electronic signatures forced a life insurance provider to settle the case. While the court held that the electronic signatures used to sign the life insurance application survived summary judgment, the definition of the term Participant was vague and could not result in summary judgment for the insurance company. The case highlights the importance of precisely defining terms in a contract, building appropriate procedures for proving the existence of electronic contracts, and procedures for identifying the person electronically signing documents.

Neil Dukoff, an AICPA member, and Shari Dukoff, as his dependent, entered into a group life insurance contract with Prudential Insurance for Mrs. Dukoff using an electronic application in 2004. After Shari Dukoff passed away in May 2006, Prudential refused to honor the insurance contract arguing that the insurance contract was based on material misrepresentations in the application related to Mrs. Dukoff’s cancer surgery. Both sides moved for summary judgment, both motions were denied.

I. Prudential’s Arguments for Summary Judgment

Prudential made two arguments for summary judgment. First, it argued that there was no valid contract because Mr. Dukoff was not a party to the contract. Second, Prudential argued that the contract was procured through fraud and was, therefore, invalid. In both cases, Prudential could have helped resolved the issues by properly defining and using the words “Participant,” “Dependent,” “I,” and “My.”

A. Parties to the Contract

The court denied Prudential’s motion for summary judgment on the ground that Mr. Dukoff was not a party to the contract because there was enough doubt as to whether Mr. Dukoff or Mrs. Dukoff signed the contract. The court also found that the contract was ambiguous as to who was the intended party.

Prudential argued that there was no contract because Mrs. Dukoff was in the hospital recovering from surgery during the time she was to have signed the contract. Prudential offered as evidence a computer printout showing that the contract was submitted on May 15, 2004, the date on which both parties agree that Mrs. Dukoff was recovering from surgery in the hospital. However, Mr. Dukoff stated under oath that the contract was signed around March or April 2004. The court held that this printout was not sufficient to accurately show that the date reflected was the date of submission.

Needless to say, this is far too small a digital footprint for a contract that was formed online. Prudential could have built systems that logged applications submitted on its servers. In this log, Prudential could have recorded the time, location by IP address, unique cookie information, and other information related to the submission of the application and produced this evidence in trial. Prudential could have sent an automatic confirmation email to the email address of the applicant right after the submission of the application online. Finally, Prudential could have shown that a confirmation letter was sent several days after the submission with welcome letters and the signed contract. It is likely that Prudential had one or more of these processes in place. However, Prudential did not present any of more evidence than the printed contract with the date. Counsel for Prudential may have been more worried about the ambiguities in the contract than the proving the exact date of formation of the contract.

The court then turned to the language of the contract to address these ambiguities. In at least one section, “the applicant state[d] that ‘I’ authorize Prudential to access ‘my’ medical records to determine eligibility for insurance.” Considering that Mr. Dukoff did not need to provide his medical records, the court concluded that this language pointed to Mrs. Dukoff as the party to the contract. The certificate of coverage was of no use because it stated both names on it. Adding apparent authority and ratification issues to the mix, the court decided that there was a genuine issue of material fact as to who were the parties to the contract.

B. Procurement through Fraud

The court then turned to Prudential’s second argument for motion for summary judgment: fraud. However, the court did not need to address the admissibility of the evidence related to Mrs. Dukoff medical records and fraud. Once again, there was a genuine issue of material fact as to whether Prudential challenged the validity of the contract in the appropriate time.

Prudential contested the validity of the insurance policy after more than 2 years of its effective date. However, Prudential argued that the contract allowed it to contest its validity using Mrs. Dukoff’s statements 2 years after her death. The court found that the undefined term “Participant” made the language related to challenge within 2 years ambiguous. The contract and the certificate of insurance stated:

Incontestability of Dependents Life Insurance
This limits Prudential’s use of a Participant’s statements in contesting an amount of Dependents Life Insurance for which the Participant is insured with respect to a dependent. These are statements made to persuade Prudential to accept you for insurance.
They will be considered to be made to the best of your knowledge and belief. These rules apply to each statement:
(1) It will not be used in the contest unless:
(a) it is in a written instrument signed by the Participant; and
(b) A copy of that instrument is or has been furnished to the Participant or the Participant’s Beneficiary.
(2) If it relates to the dependents [sic] insurability, it will not be used to contest the validity of Dependents Life Insurance which has been in force, before the contest, for at least two years during the Participant’s lifetime.

The court held that the term Participant was not expressly defined and could refer to either Mr. Dukoff or Mrs. Dukoff. On the one hand, the terms “Participant Insurance” and “Dependent Insurance” appropriately and respectively referred to Mr. Dukoff and Mrs. Dukoff. On the other hand, the sentence above relating to “statements made to persuade Prudential accept you for insurance” suggested that Mrs. Dukoff was the Participant.

Most importantly, the last statement quoted from the contract above suggested that the Participant’s statements would not be used to contest validity of the Dependent’s life insurance for at least two years during the Participant’s lifetime. However, the lack of definition of the words “Dependent” and “Participant” resulted in ambiguity in deciding whose words could be used against whom. Therefore, the court returned to basic contract interpretation and sought extrinsic evidence, considered the New York statute where the language was supposed to have come from, and lacking additional evidence to the parties’ intent, rejected Prudential’s motion for summary judgment.

Such key terms should have been appropriately and clearly defined, especially if they were capitalized. Additionally, Prudential might have been better served by inserting the required language directly from the statute, which referred to “statements made by any person” instead of the complex Participant and Dependent scheme that Prudential created.

II. Mr. Dukoff’s Arguments for Summary Judgment

In its motion for summary judgment, Mr. Dukoff argued, among other things, that the statements related to Mrs. Dukoff’s health were not signed due to the failure of the electronic signatures scheme that Prudential used. The court held that particular information used in the application was sufficient to identify her as the person signing the application; therefore, Mr. Dukoff was not entitled to summary judgment on the issue.

The insurance contract prohibited the use of statements made by the insured that was not “in a written instrument signed by the [insured]” to contest the contract. Thus, Mr. Dukoff argued that Mrs. Dukoff did not sign her statements. In return, Prudential argued that the electronic signature on the application satisfied the NY Electronic Signatures and Records Act as well as the contractual requirement for written statement and signature. The New York law states that electronic signature “shall have the same validity and effect as a signature affixed by hand.” The law also defines electronic signature as “an electronic sound, symbol, or process, attached to or logically associated with an electronic record and executed or adopted by a person with the intent to sign the document.” The court then turned to Prudential’s application process to determine whether it complied with NY law.

Prudential used a “standard” click through that included the following language at the end:

*I agree By submitting this form, I hereby request coverage under the CPA Spouse Life Insurance Plan. I have read the Conditions Applicable to This Subscription on this web site and agree to those statements and conditions. I also hereby subscribe to the AICPA Insurance Trust in accordance with Member’s Subscription and agree to the applicable conditions.

The applicants also had to enter home address and social security numbers. Prudential argued that this click-through agreement and the use of the identifiers satisfied the definition of electronic signature under NY law.

Not finding any case that invalidated a contract based on electronic signatures, the court turned to State of New York Insurance Department opinions. One particular Opinion stated that, generally speaking, a checked box on an electronic form on the Internet constitutes a valid electronic signature so long as it abides by the definition of electronic signature under the New York law. However, the opinion then added that such technology must be “capable of verifying that the person providing the electronic signature is actually the party to be charged. “ The Opinion further stated that “without such verification measure in place, the Department would not consider a checked box to be a valid signature.” Based on this Opinion, Mr. Dukoff argued that Prudential did not have the means to verify the identity of the person electronically signing the document.

The court deferred to the Opinion but it seemed puzzled by one finding. The NY legislature had removed a reference to a requirement for the electronic signature to include a unique identifier capable of verification from the law several years ago. More specifically, the NY law used to require a unique identifier “capable of verification, under the sole control of the person using it, attached to or associated with data in a manner that authenticates the attachment of the signature to particular data.” The court must have felt that the Opinion inserted back this unique identifier and verification requirement. Therefore, in its interpretation, the court changed the “actual identification” language of the Opinion to “reasonable identification” of the person. However, this being a motion for summary judgment, the court’s finding that “it is at least possible that Prudential satisfied this requirement” by using identifying information, such as address, social security number, and physical description, is excusable.

However, considering that the electronic signature in this case was supposed to be able to distinguish between a husband and a wife signing an application for a $500,000 life insurance, the click-through could not have satisfied the standard created by the Opinion. Under the circumstances, provision of the three pieces of information cannot actually identify the person signing the document. The technology supporting the electronic signature was required to identify the person signing the application to a higher degree of certainty than reasonable identification. Here, Prudential did not have the technology or the processes in place to ensure that Mrs. Dukoff and not Mr. Dukoff electronically signed the application. Considering the amount of money at stake, Prudential could have authenticated the signature by sending a password via text message to her cell-phone, via email to her email address, via mail to her home address, or using any other similar method. The first two methods would likely help distinguish between a husband and a wife signing a document under most circumstances. However, it is unlikely that any of these circumstances would help distinguish between the two when one of them is in the hospital recovering from surgery. This is probably one reason that other life insurance companies require applicants to sign their applications over the phone using a voice signature.

In sum, this perfect storm of electronic signatures that barely survived legal scrutiny, lack of evidence proving the date on which the contract was signed, and contract terms that were confusing even to the court to interpret resulted in Prudential having to settle the case shortly after it lost its motion for summary judgment. This case is just another reminder that companies must continue to pay attention to the fundamentals of contract drafting while at the same time paying particular attention to electronic signatures and electronic evidence relating to those contracts.

The case is Prudential Ins. Co. of Am. v. Dukoff, No: 2:07-cv-01080-ADS-MLO (E.D.N.Y. Dec. 18, 2009).

Court Upholds Forum Selection Clause in B2B Clickwrap

2010-01-14T17:07:00.000-05:00

By Mehmet Munur

A District Court in Indiana recently held that NexTag’s clickwrap Terms of Service was enforceable against Appliance Zone despite arguments by Appliance Zone that no contract was formed and that if an agreement were formed it was procedurally unconscionable. Ironically, NexTag was helped by the fact that Appliance Zone was an ecommerce merchant that used a similar sign-up process and similar website terms of use in its own business.

Appliance Zone advertises and distributes appliance parts and accessories through its commercial website. NexTag operates a commercial comparison website and advertises the goods of third parties such as Appliance Zone. NexTag refers customers to the third parties’ website where they can purchase the good and charges a few dimes for every referral.

When Appliance Zone found out that NexTag used Appliance Zone’s trademark to promote the prices of goods of Appliance Zone’s competitors, Appliance Zone brought a trademark infringement suit under the Lanham Act against NexTag in Indiana. NexTag, being a Delaware corporation based out of California, argued improper venue due to the forum selection clause in its Terms of Service Agreement, which every business must agree with before listing their products on NexTag. Thus, the court had to decide whether the forum selection clause in NexTag’s Terms of Service Agreement was enforceable.

Appliance Zone raised three arguments to state that the forum selection clause not applicable: 1) there was no agreement between the parties; 2) if there was an agreement, it was unconscionable; and 3) the lawsuit did not arise out of the agreement and thus it was not governed by the forum selection clause.

First, Appliance Zone argued that the employee that signed up with NexTag did not have the authority to enter into the contract. The court held that the employee had apparent authority to enter into the contract. The employee clicked the radio box next to the statement “I accept the NexTag Terms of Service,” uploaded 20,000 product descriptions and 14,000 product images onto NexTag’s website, and Appliance Zone paid for NexTag’s services. Therefore, the conduct demonstrated acceptance of a valid contract.

Second, Appliance Zone argued that the Terms of Service Agreement was unconscionable because 1) it was inconspicuous, 2) parties had unequal bargaining power, and 3) Appliance Zone did not read it. The court rejected each of these arguments. The court held that the presentation of the Terms of Service Agreement was typical for the online retail industry, that it was clearly labeled, and that it was placed in a highly visible portion of the web page. Appliance Zone also had to check a box to manifest assent to the Agreement. The court also cited Appliance Zone’s similar sign-up process and similar language in its Terms of Use against Appliance Zone to state that NexTag’s Terms of Service Agreement was not procedurally or substantively unfair. The court also stated that Appliance Zone had failed to demonstrate the disparity in the bargaining power and that Appliance Zone would be presumed to have read the terms and agreed to them when it signed them as a matter of fundamental contract principle.

Finally, the court addressed Appliance Zone’s argument that the trademark issue did not arise out of the Terms of Service Agreement. The court held that the binding precedent required that the Agreement govern the dispute between the parties—Appliance Zone had cited to persuasive 2nd Circuit Precedent.

This case highlights how electronic Business-to-Business agreements are more difficult to overturn than electronic Business-to-Consumer agreements. Plaintiff’s arguments related to not having read the agreement, uneven bargaining positions, and unconscionability are mostly arguments raised in Business-to-Consumer settings. However, such arguments are unlikely to work in cases where the party arguing against the enforceability of the contracts employs a similar contract in a similar settings.

The case is Appliance Zone, LLC v. NexTag Inc., No:4-09-cv-0089-SEB-WGH (S.D. In. Dec. 22, 2009).

Article 29 Working Party Releases 12th Annual Report

2010-01-12T17:57:00.003-05:00

By Mehmet Munur

The Article 29 Working Party, a group created under the EU Data Protection Directive and made up of the data protection regulators of each Member State to provide guidance on data protection and privacy issues, has released its 12th Annual Report. The Chairman, Alex Turk, states that the four main issues of the year were protection of children’s personal data, search engines and the large of amounts of data they gather, international transfer of personal data with emphasis on the use of Binding Corporate Rules, and air passenger name records. Overall, Enforcement by the DPAs appears to have increased compared to the previous year.

The report serves as a summary of all EU DPAs’ reports on the implementation of the EU Data Protection Directive, the E-Privacy Directive, major case law, and major specific issues. The following are some of the interesting tidbits from the Annual Report.

The Austrian DPA found that a whistle-blower hotline of a US multinational required that the Austrian subsidiary be considered a data controller. The Austrian DPA held that data transfers by the employees would be imputed to the employer because the employer’s Code of Conduct required its employees to report illegal or unethical activity.

The Danish DPA highlighted the case of a nightclub that wanted to create an electronic access control system that used fingerprints, photos, and black lists of unwanted customers who would be rejected at the door. The DPA allowed the database so long as customers gave explicit consent and data was deleted after consent was withdrawn.

The French DPA, CNIL, stated that it had been in session 50 times and adopted 586 resolutions during the year, an increase of 50% compared to previous year. CNIL also handled 4,244 complaints during the year. It conducted 218 inspections, “an increase of 33 % compared to the previous year.” The DPA imposed fines ranging between $30,000 to $100. CNIL also issued 126 warnings, an increase of 20% compared to the previous year.

The Dutch DPA greatly increased its enforcement activity compared to the previous years. It carried out 95 investigations, an increase of 50% compared to the previous year, and imposed sanctions or threatened to impose sanctions on 68 cases, compared to 39 in the previous year and 2 the year before.

The Spanish DPA, AEPD, was just as active as it was in the previous year. The DPA did not disclose how much money it collected in fines; however, it reported a sharp increase in reported offences. AEPD continued to focus on telecommunications, financial institutions, and video surveillance issues during its investigations. In fact, the financial sector and the telecommunications sector made up the top two spots for fines imposed during the year. The Spanish DPA has also been increasing its activities in the international arena. In addition, AEPD is taking larger leadership role in the Ibero-American Network for Data Protection. During the 31st International Data and Privacy Protection Conference, AEPD made a “Joint Proposal to Draft International Standards for Protection of Privacy and Personal Data” that was unanimously adopted. AEPD is now in charge of developing international standards for the protection of privacy with regard to processing of personal information.

You may read our blog post on the previous year’s report here.

Article 29 Working Party Adopts Documents, Deems Israel and Andorra Adequate

2010-01-06T16:25:00.003-05:00

The Article 29 Working Party started the new year with a volley of announcements. The Working Party document WP 165 states that Israel guarantees an adequate level of protection and WP 166 states that Andorra has adequate privacy protections. Additionally, the Working Party issued WP168 on “The Future of Privacy: Joint contribution to the Consultation of the European Commission on the legal framework for the fundamental right to protection of personal data.”

WP168 is a response to the Consultation by the European Commission asking for views on whether the EU’s current legal framework was satisfactory for the challenges posed by new technology and shifts in culture since the adoption of the EU Data Protection Directive in 1995. The Working Party, with the cooperation of the Working Party on Police and Justice, state that “the main principles of data protection are still valid despite the new technologies and globalisation.” However, the consultation also proposes that concepts of consent and transparency be clarified, additional principles such as privacy by design and accountability be adopted, bureaucratic burdens be simplified, and that fundamental rights be unified to apply to police and judicial cooperation in criminal matters. This document suggest the direction that European Data Protection is likely to take in the near future.

Florida Ethics Opinion Underscores Risks Associated with Social Media for Attorneys

2009-12-21T10:46:00.008-05:00

by Mehmet Munur

Florida Judicial Ethics Advisory Committee recently issued an opinion that answered the question “Whether a judge may add lawyers who may appear before the judge as ‘friends’ on a social networking site, and permit such lawyers to add the judge as their friend” in the negative. Though social media can be a valuable tool for any profession, the opinion emphasizes why attorneys should consider the risks involved in contributing to social media. While not mentioned in the opinion, attorneys should also consider other risks associated with listing specialties, receiving client testimonials, and unintentionally forming attorney-client relationships.

Commentators, such as Professor Stephen Gillers (see NY Times Article) have argued that the judges may be oversensitive to judges “friending” attorneys in Facebook, I believe that the opinion is just the beginning in a series of opinion that are likely to highlight related issues that may come up in social media. Before joining LinkedIn, we considered the Ohio Supreme Court’s guidance on some of the issues mentioned above. First, we considered whether we could join such an organization in the first place and be listed as attorneys. Ohio Supreme Court Opinion 88-4, though superseded by the Ohio Rule of Professional Conduct 7.4, stated:

A lawyer may ethically be listed in a legal directory or law list provided the listing does not contain a false, fraudulent, misleading, or deceptive statement or claim.

This opinion probably refers to MartinDale Hubbell listings, which are dominated by attorneys. While LinkedIn is professional in nature, attorneys in no way dominate it. I remember seeing that LinkedIn included about 700,000 attorneys (apologies for the lack of citation) out of their 50 million professionals. Nevertheless, the Ohio Supreme Court opinion highlights issues involved in joining such social media outlets in the first place. Therefore, attorneys must ensure that their listings in any social media do not contain false, fraudulent, misleading, or deceptive statements.

Issues related to attorneys’ specialties may also arise on social networks. The Supreme Court of Ohio only recognizes a few areas of specialization, such as admiralty, trademark, and patent law. Therefore, avoid listing specialties unless you are actually specialized under Rule 7.4. LinkedIn includes a "specialties" section by default field in profiles, which if overlooked, may inadvertently describe an attorney to have specialized in those areas. Therefore, double-check your profile to ensure that you have accurately listed your specialization.

Another cause for concern is client testimonials. While the prohibition against client testimonials have been superseded, Model Rule 7.1 states that a “lawyer shall not make or use a false, misleading, or nonverifiable communication about the lawyer or the lawyer’s services.” Note that the Model Rule, which came into effect in 2007, “does retain the DR 2-101 prohibition on unverifiable claims.” Therefore, “[w]hatever means are used to make known a lawyer’s services, statements about them must be truthful.” The Ohio Supreme Court Opinion 2000-6 further states that:

a law firm’s public communication of client quotations describing the general nature of the legal services provided, responsiveness of the law firm, and other non-substantive aspects of the firm’s representation is improper under the professional rules of conduct. This view is based on the current rules in the Ohio Code of Professional Responsibility and is consistent with ABA Model Rule 7.1, the Comment thereto, and the advice offered by the Board in Opinion 89-24.

Therefore, it may be a good idea to ensure that client testimonials are verifiable to an objective degree or avoid client testimonials altogether.

While the Model Rules are silent on the issue of the formation of an attorney-client relationship, the Restatement Third of the Law Governing Lawyers section 14 provides that:

A relationship of client and lawyer arises when:
(1) a person manifests to a lawyer the person's intent that the lawyer provide legal services for the person; and ...
(b) the lawyer fails to manifest lack of consent to do so, and the lawyer knows or reasonably should know that the person reasonably relies on the lawyer to provide the services

Such an issue may arise while answering LinkedIn questions or a direct inquiry by another Facebook or LinkedIn member. Inadvertent formation of an attorney-client relationship bring with it all of the conflicts issues that an attorney should consider before representing a client.

Therefore, attorneys should double-check their jurisdictions’ ethics guidance to ensure that they are not running afoul of ethical rules that have been in at work for some time but may arise in ways not previously imagined.

See also Legal Blog Watch regarding a related South Carolina opinion regarding law enforcement officials and judges.

You can also find a link to the ABA Model Rules here.

Court Rejects Plaintiff’s Argument that Overbroad Privacy Policy Led to Waiver of 1st Amendment Rights

2009-12-15T17:36:00.007-05:00

By Mehmet Munur

A federal district court in Missouri ruled on December 9 that the broad website privacy policy of a newspaper did not lead to an anonymous commenter’s contractual waiver of his First Amendment rights. While the case does not break new ground in First Amendment jurisprudence, it emphasizes some of the shortcomings of the self-regulatory system of privacy regulation of the web in the US. Such overbroad privacy policies and underlying practices may be one reason why the FTC is shying away from the Notice-Choice paradigm.

The plaintiff brought a motion to compel in order to reveal the identity of an anonymous commenter, who was not a party to the litigation, for comments posted on a News-Leader article. First, the Plaintiff argued that the anonymous commenter’s speech was not given absolute protection. While the court agreed, it stated that political speech was given high level of protection especially in circumstances where the commenter was not a party to the litigation and dismissed the argument.

Second, the plaintiff argued that the anonymous commenter agreed to the News-Leader’s Privacy Policy during the sign-up process and, therefore, waived his First Amendment rights to anonymous speech. The Privacy Policy stated:

We also reserve the right to use, and to disclose to third parties, all of the information collected from and about you while you are using the Site in any way and for any purpose, such as to enable us or a third party to provide you with information about products and services that may be of interest to you. In some cases we will use and/or share only non-personally identifiable information, but in other cases we may use and share personally identifiable information.

The District Court rejected this argument as well because “a contractual waiver of constitutional rights ‘must, at the very least, be clear.’” Therefore, the District Court declined to reveal the identity of the anonymous poster.

Leaving aside the free speech issues, the case also highlights some of the issues with the current state of privacy regulation on the web in the US. First, FTC’s aspirational Fair Information Practice Principles seek to stop such overreaching privacy policies. The Notice principle, which is “the most fundamental” of the principles, states that the entity collecting the data should “properly inform” consumers “of the uses to which the data will be put” and the “identification any potential recipients of the data.” Therefore, stating that the data transferred to any third party for any purpose does not properly inform a consumer. Nevertheless, this inconsistency does not create any liability because the FIPPs are only guidelines and they are not enforceable. FTC expects the industry participants to regulate themselves and only appears to bring enforcement actions against the most egregious of violators.

In contrast, websites in jurisdictions with omnibus data protections laws, such as the EU, would be hard pressed to implement such privacy policies. The EU Data Protection Directive states in Article 6 that personal data must be “collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes.” Since the purposes in the privacy policy are neither specified nor explicit, any further use by the collecting entity or a third party would violate the Directive and its national counterparts.

However, this difference in approaches to privacy regulation may be changing. Commentators and regulators in the EU and the US recognize the shortcomings of the Notice-Choice paradigm and are moving away from it. Recently, in the Madrid International Conference of Data Protection and Privacy Commissioners highlighted some of the issues with Notice-Choice and the need to move towards an Accountability standard. In fact, the regulators signed a document to that effect during the conference. Two weeks later, the Department of Commerce Conference on Cross Border Data Flows, Data Protection and Privacy reiterated the same message—primarily because the attendees were the same people. Finally, just last Monday, several attendees to the FTC Privacy Roundtable highlighted the issues with self-regulation in the US and the need to move to an Accountability standard. In fact, the FTC hinted at the need to refine the current Notice-Choice paradigm with the Sears enforcement action. Given the regulatory momentum, we will likely see the FTC providing more guidance for websites on privacy issues soon after the Privacy Roundtables, at the very least in the behavioral advertising realm.

The case is Sedersten v. Taylor, No. 09-3031-CV-S-GAF, 2009 U.S. Dist LEXIS 114525 (W.D. Mo. Dec. 9, 2009).

See also Venkat Balasubramani’s comments via Eric Goldman’s Blog.

Supreme Court to Review Electronic Communications Case

2009-12-14T16:44:00.004-05:00

by Mehmet Munur

The Supreme Court will review a 9th Circuit Court case finding that the unauthorized search of employee text messages on an employer provided text messaging pager may have violated the employee’s privacy rights despite a written policy stating that the employees should have no expectation of privacy.

Once again, the Supreme Court’s review of the case highlights the complexity of employee electronic communications in the workplace. With the extensive use of blogging and social media in the workplace, it is becoming more and more important to put in place explicit electronic communication policies and to implement those policies uniformly. You can find our previous blog post on the 9th Circuit Opinion here.

Regulators Issue Final Model Privacy Notice

2009-11-23T20:15:00.018-05:00

By Mehmet Munur

On November 17, eight federal regulators issued final rules and model privacy notice forms as required under the Gramm-Leach-Bliley Act. While the use of the notice forms are not required, the two-page forms create a safe-harbor for disclosures required under the GLBA.

The notice forms replace the Sample Clauses previously issued by the regulators. The regulators stated that their studies “confirm[ed] that a notice composed solely of the Sample Clauses promotes ease of scanning to perform simple tasks – because the notice is short and not because it is understandable – but the Sample Clauses do not do well on comprehension measures. Moreover, the testing showed that current notices – in which the Sample Clauses are typically embedded – do poorly on all measures.” Therefore, the regulators appear to want to increase the use of the model clauses as much as possible.

The FTC has been pushing for alternate means of providing notice to individuals for some time. The FTC noted in its February 2009 Behavioral Advertising Staff Report that “privacy policies have become long and difficult to understand, and may not be an effective way to communicate information to consumers. Staff therefore encourages companies to design innovative ways – outside of the privacy policy – to provide behavioral advertising disclosures and choice options to consumers.” Then in its recent Sears Enforcement, FTC stated that Sears failed to “disclose adequately that the software application, when installed, would: monitor nearly all of the Internet behavior that occurs on consumers’ computers.” Sears had mentioned the broad nature of data collection only in the 75^th line of a legal agreement. Then in August, FTC once again mentioned the Sears enforcement and the need to provide better notice in the Health Breach Notification Rule; stating “[b]uried disclosures in lengthy privacy policies do not satisfy the standard of ‘meaningful choice.’” FTC will be conducting Privacy Roundtables in the near future. We expect the highlights notices, model privacy notices, and Carnegie Mellon’s Nutrition Label Approach to privacy statements to take center stage in these roundtables.

FTC Delays Enforcement of Red Flags Rule, Court Holds Red Flags Do Not Apply to Lawyers

2009-10-30T18:35:00.003-04:00

by Mehmet Munur

The FTC news release notes that the Federal Trade Commission delayed the enforcement of the Red Flags rules until June 1, 2010. The FTC news release also notes the decision by the U.S. District Court for the District of Columbia that the FTC Red Flags Rules did not apply to attorneys. The Federal Trade Commission v. American Bar Association order states that the memorandum will be published in the next thirty days.

The FTC promulgated the Red Flags Rules under the authority given to it by the Fair and Accurate Credit Transactions Act. FTC had previously suspended the enforcement of the rules until November 1, 2009. Congress is currently considering a bill that would limit the scope of the Red Flags Rules.

FTC Modifies ChoicePoint Consent Order and Imposes Stricter Compliance

2009-10-19T12:34:00.003-04:00

By Mehmet Munur

The Federal Trade Commission announced today that it had entered into a modified consent agreement with ChoicePoint due to ChoicePoint’s inability to live up to the original consent agreement entered into in 2006.

The FTC entered into a consent agreement with ChoicePoint was due to compromise of 163,000 financial records and at least 800 cases of identity theft. The breach was possibly a watershed moment in data breaches and brought attention to data aggregators. ChoicePoint paid $10 million in civil fines, $5 million in consumer redress, and countless millions of dollars in forwent business opportunities, attorneys’ fees, and settlement fees for lawsuits. ChoicePoint also agreed to “establish, implement, and maintain a comprehensive information security program designed to protect the security, confidentiality, and integrity of the personal information it collects from or about consumers” which would be subject to an audit every two years.

The FTC press release for the most recent consent order notes that ChoicePoint “turned off a key electronic security tool used to monitor access to one of its databases, and for four months failed to detect that the security tool was off.” As a result, ChoicePoint, since acquired by Reed Elsevier, compromised the personal information of approximately 13,750 individuals. ChoicePoint must now pay a fine of $275,000 and report to the FTC every two months for two years. The FTC also increased the final data by which ChoicePoint would be subject to biennial audits by two years to 2028. The new consent order may be found here.

The FTC enforcement reiterates FTC's attitudes about privacy promises. Such scrutiny by the FTC will certainly be burdensome for ChoicePoint and require it to step up its information security operation or face even more fines and enforcement from the FTC.

FTC Settles with Six Companies with Lapsed Safe Harbor Certifications

2009-10-07T15:51:00.003-04:00

By Mehmet Munur

On October 6, 2009, Federal Trade Commission filed six complaints against companies falsely claiming that they were self-certified to the Department of Commerce EU Safe Harbor when their certification had lapsed. This FTC action should serve as a reminder to Safe Harborites either to keep up their annual recertification or to avoid misrepresenting that they are self-certified to the Safe Harbor.

The EU Safe Harbor is one of the methods allowing US corporations to export data from the EU while complying with the Article 25 of the EU data Protection Directive, which requires that data only be transferred to countries with adequate data protections—with exceptions. The Department of Commerce, European Commission, and the Article 29 Working Party negotiated the Safe Harbor. US companies self-certify for the Safe Harbor and the DoC maintains a list of these companies on its export.gov website. However, the Federal Trade Commission and the Department of Transportation have the authority to enforce the Safe Harbor. While the Safe Harbor plays a crucial role for multinational corporations in transferring personal data from the EU without violating the EU Data Protection Directive’s adequacy requirements, now more than ever, failure to abide by the Safe Harbor requirements can result in enforcement actions by the FTC.

Six companies, World Innovators, Inc.; ExpatEdge Partners LLC; Onyx Graphics, Inc.; Directors Desk LLC; Collectify LLC; and Progressive GaitWays LLC, each represented that they were self-certified to the Safe Harbor when in fact their certification had not been renewed for several years. At least three of the companies had failed to either recertify or remove their representations related to their certification from their websites for two to three years. For example, ExpatEdge had certified for the Safe Harbor in 2002 but had failed to recertify since 2006. Onyx Graphics had certified in 2006 but failed to recertify since 2007. Progressive GaitWays had certified in 2004 but failed to recertify since 2006. Since the FTC enforcement, the remaining three companies have recertified for the Safe Harbor.

The six companies each entered into consent agreements with the FTC related to their infringing activities. The consent agreements are similar to the previous FTC settlement on the Safe Harbor. The consent agreements prohibit any of the companies from “misrepresent[ing] in any manner, expressly or by implication, the extent to which respondent is a member of, adheres to, complies with, is certified by, is endorsed by, or otherwise participates in any privacy, security, or any other compliance program sponsored by the government or any other third party.” Furthermore, the companies must make all documents related to compliance with the consent agreement available for inspection for the next 5 years.

In our previous blog post, we had stated that the FTC’s enforcement was tacked onto other issues related shipment of goods. This time the FTC has squarely addressed Safe Harbor violations using its deceptive trade practices powers. According to the FTC policy statement on deception, a material representation, omission, or practice that is likely to mislead the consumer is needed for any enforcement activity. Any “act or practice is likely to affect the consumer's conduct or decision with regard to a product or service” is considered material. Additionally, any express claims are presumed material. Furthermore, the Safe Harbor Principles and FAQ 11 of the Safe Harbor clearly state FTC’s jurisdiction to bring actions against Safe Harborites for deceptive trade practices. Therefore, the companies’ express claims that they were self-certified with the Safe Harbor when their certifications had expired are clearly material misrepresentations that would mislead a reasonable consumer under the circumstances.

The recent enforcement actions in this area are certainly signs of FTC’s willingness to bring enforcement actions in this area in the future. The recent changes to the list showing organizations certified to the Safe Harbor is possibly another indication of things to come. International Trade Administration website used to host the Safe Harbor list. Recently, it has moved to the Department of Commerce’s export.gov/safeharbor/ website, which is where all other Safe Harbor related documents used to reside. The list now more readily identifies non-compliant companies.

The FTC is likely to bring more enforcement actions against companies in the Safe Harbor list that represent that they are certified but have not in fact kept up their certifications with the Department of Commerce. The FTC is also likely to expand its enforcement activities into more substantive issues related to the privacy practices of Safe Harborites in the near future. Therefore, Safe Harborites intending to leave the Safe Harbor should either promptly renew their certifications or remove any public representation that they are certified with the Safe Harbor. This should help alleviate any FTC deceptive trade practices claims. However, note that obligations undertaken by a Safe Harborite do not disappear with the organization leaving the Safe Harbor. Therefore, removing such representations only resolves part of the issues involved in joining then leaving the Safe Harbor.

FTC Obtains TRO Against E-Commerce Merchant Falsely Claiming Safe Harbor Certification

2009-08-24T15:34:00.004-04:00

By Mehmet Munur

On July 31, the Federal Trade Commission obtained a temporary restraining order against a California website for deceptively claiming to be a member of the EU Safe Harbor administered by the Department of Commerce. This is the first FTC enforcement involving the FTC’s authority to prosecute violations involving EU Safe Harbor and FTC’s authority to prosecute an American company for deception of foreign consumers.

According to the FTC complaint, the defendants posed as UK websites, did not deliver on minimal consumer protections, and lied about being in the Safe Harbor. Balls of Kryptonite, LLC, is based out of Pasadena, California. However, it operates under www.bestpricedbrands.co.uk and www.bitesizedeals.co.uk, states prices in pound sterling, and referred to UK competitors and Royal Mail. The website did not specifically state its location, though such a disclosure is required under the Distance Selling Directive. Therefore, the FTC inferred that the websites advertised and sold consumer electronics products to consumers in the UK “under the pretext of being located within the UK.”

The websites shipped products from the US to the UK. Customers also had to pay substantial customs duties and import taxes. Some of these products were incompatible with the UK power grid. The websites also stated that the products would be covered under warranty. The products were not designed for distribution in the UK and, therefore, were not covered by warranty. Further, consumers were not allowed to cancel their orders, charged 50% restocking fees, and items were not shipped for weeks.

Finally, the defendants advertised that they self-certified with the Department of Commerce for the EU Safe Harbor when they were not. However, this false statement defies all logic. It does not help the defendants establish that they are a website based in the UK. A corporation must have a US establishment that receives personal information from the EU/EEA before it can certify to the Safe Harbor. Maybe this was the company’s way of stating that it was transferring data to the US. Maybe, the website owner believed that the Safe Harbor deception would make their website more attractive to UK customers. Nonetheless, Balls of Kryptonite is likely subject to this enforcement not due to inadequate legal advice, but lack of legal advice.

Nevertheless, the temporary restraining order resulting from the enforcement action makes an interesting example due to its scope. The TRO enjoins the defendants from misrepresenting “[t]he extent to which Defendants are members of, adhere to, comply with, are certified by, are endorsed by, or otherwise participate in any privacy, security, or any other compliance program sponsored by any government or third party.” Thus, the FTC enjoined the defendants from misrepresenting that they are members of any third-party privacy program. In effect, the FTC is recognizing that the health of the Safe Harbor Program is intricately linked to the third-party programs. The Safe Harbor Enforcement Principle requires an independent dispute resolution mechanism that TRUSTe’s EU Safe Harbor Program and BBB EU Safe Harbor offer. However, one could argue that third-party privacy seals programs should enforce their own marks and that the FTC should focus on the Safe Harbor program exclusively.

The enforcement action sets a much-needed precedent for false claims related to the Safe Harbor program. Nevertheless, the majority of the complaint was based on false statements concerning the shipment of goods. The Safe Harbor issue appears to be tacked onto the other issues. The Safe Harbor program has been in existence for nearly a decade and studies by the European Commission in 2004 and others in 2008 have argued that enforcement has been lax. One would hope that, in the future, the FTC would bring section five claims exclusively in the data protection realm in addition to mixed consumer protection claims.

FTC Issues Final Breach Notification Rules as Required by the Stimulus Bill

2009-08-19T15:44:00.004-04:00

By Mehmet Munur

On August 18, Federal Trade Commission issued the final rules on breach notification as required by the American Recovery and Reinvestment Act of 2009, commonly known as the stimulus bill. The rules will take effect in 30 days from publication in the Federal Register. The FTC will only begin enforcement after 180 days of the publication of the final rules.

The final rules addressed the public comments to the proposed rules, clarified certain issues such as the broad scope of the rules, the application of either the HHS or FTC breach notification rules, notifying individuals by email, notifying the FTC for breaches involving more than 500 individuals, and privacy notices.

FTC received 129 comments related to its notice of proposed rulemaking. Google (see our previous blog post on Google Health) was noticeably absent from the list, while Microsoft (see our previous blog post on HealthVault) commented on several issues including email notices and use of cloud computing storage. Microsoft’s concerns related to cloud computing prompted FTC to require that vendors of PHR and PHR related entities notify their third party service providers of their status as vendors of PHR.

The FTC adopted the definition of personal health record without modification. Under the proposed rules, breach of name and credit card numbers would have triggered a notification. The FTC backed away from that interpretation and now states that name and credit card numbers alone will not constitute personal health record. On the other hand, FTC renewed its statement that de-identified data would not be considered personal health record “[g]iven the small risk that such data will be re-identified by unauthorized third parties.” Such references show FTC’s renewed interest in the identification of individuals using non-personally identifiable information. FTC had previously mentioned the issue in February in the Behavioral Advertising Staff Report.

The FTC confirmed the wide scope of the new breach notification rules. The proposed rule applies to vendors of PHR and PHR related entities “irrespective of any jurisdictional tests in the Federal Trade Commission Act.” Therefore, even if an entity is not covered by the FTC Act, it may fall under the scope of the breach notification. Additionally, the Commission reiterated that “foreign entities with U.S. customers must provide breach notification under U.S. laws.” Similar to the EU Data Protection Directive, the rules appear to apply to the individual’s data regardless of the data’s location.

The FTC agreed with some of the commentators to the proposed rules that some entities would be covered by both the FTC and the HHS rules. Therefore, the FTC “consulted with HHS to harmonize the two rules, within the constraints of the statutory language.” A related issue concerned the provision of a single breach notification for a single breach, though several entities may be involved. The FTC addresses this issue by providing examples of when entities may comply with both the FTC and the HHS requirements to provide notice.

The final rules also addressed privacy notices and, with it, FTC’s recent incursion into privacy enforcement and behavioral advertising. FTC addressed privacy notices because the “final rule provides that a breach of security means acquisition of information without the authorization of the individual.” FTC stated that “an entity’s use of information to enhance individuals’ experience with their PHR would be within the scope of the individuals’ authorization, as long as such use is consistent with the entity’s disclosures and individuals’ reasonable expectations.” The FTC reiterated its suspicion of lengthy privacy notices, which it originally voiced in the Behavioral Advertising Staff Report, by stating that “the Commission expects that vendors of personal health records and PHR related entities would limit the sharing of consumers’ information, unless the consumers exercise meaningful choice in consenting to such sharing. Buried disclosures in lengthy privacy policies do not satisfy the standard of “meaningful choice.”” The FTC cited to the recent Sears enforcement to reinforce its seriousness in enforcing the meaningful choice doctrine. There, Sears had buried its data mining activities deep in its privacy policy instead of providing clear and conspicuous notice of the broad scope of its activities. This could be an indication that the FTC may consider data processing without adequate notice as a data breach.

The final rules now make it easier to provide individual notice through email as well. The FTC is persuaded that the relationship between the vendors of PHR, PHR related entities, and consumers take place online, email notice can be used as a default option. Individual’s express affirmative consent to notify by email is no longer necessary. Nevertheless, the consumers must still have a meaningful choice not to receive notice by email. Additionally, the FTC made it clear that no confirmation is required for the receipt of emails, only “reasonable efforts to contact all individuals” is required. EPIC advocated for social media breach notification. The FTC declined to adopt such measure, but stated that the rule did not preclude other forms of notice in addition to the required forms. We are looking forward to public reactions to the first social media breach notification on Twitter, Facebook, or LinkedIn.

Web postings related to breaches on entities’ websites now need not be maintained for 6 months. The FTC shortened the public posting on websites to 90 days. With respect to notifying the FTC of breaches for breaches involving more than 500 people, the FTC increased the time to provide notice to FTC to 10 business days from 5. In addition, entities may use the form created by the FTC to notify the FTC about breaches. Email notification of the FTC is not an option at this time due to security concerns.

While the effective date of the rules were set by the Stimulus Bill and cannot be changed, the FTC stated that it will “will use its enforcement discretion to refrain from bringing an enforcement action for failure to provide the required notifications for breaches that are discovered” 180 after the publication of the final rules. The HHS should shortly follow with its final rules on the Stimulus Bill.

Federal Authorities Prosecuting Suspects of Heartland and Hannaford Breaches

2009-08-17T18:13:00.002-04:00

By Mehmet Munur

US Department of Justice reports that federal authorities are prosecuting three suspects for stealing 130 million credit card numbers from Heartland Payment systems, 7-eleven stores, and Hannaford stores. We previously reported on the Heartland Payment Systems Breach and the Hannaford Stores Breach.

The indictment details how Albert Gonzalez and his co-conspirators allegedly “used sophisticated hacker techniques [SQL injection attacks] to gain access to the networks to cover their tracks and to avoid detection by anti-virus software used by their victims.” The suspects allegedly scouted the stores of the corporate victims and their websites for vulnerabilities. Allegedly, in order to cover their tracks, the suspects “program[ed] malware to be placed on the Corporate Victims’ computer networks to evade detection by anti-virus software and then testing the malware against approximately 20 different antivirus programs.”

The breach cost Heartland not just million of dollars but also temporary loss of its PCI certification. Soon after the Heartland Payment systems breach, Heartland lost its PCI certification as reported by VISA CISP. Since then, Heartland has regained its PCI but also disclosed in its 10-Q filing with the Securities and Exchange Commission that it faced $32 million in expenses due to the breach. $22 million of those charges related to fines imposed by card brands and settlement offers, while the remaining amounts were spent on “legal fees and costs the Company incurred for investigations, remedial actions, and crisis management services.”

Shortly after the Heartland breach, in July 2009, PCI Security Standards Council issued the Wireless Guideline, which makes specific recommendation related to the deployment of wireless networks. The recommendations are sometimes as detailed as setting up firewalls, accounting for wireless access points, changing default passwords and settings on wireless devices, and using strong wireless authentication and encryption. On the other hand, despite outlining the weaknesses in WEP, PCI DSS v1.2 only requires discontinuing WEP as of June 30, 2010. Unfortunately, use of WPA or WPA2 only remains a recommendation.

In our previous review of the breaches, we had suggested that “due to the fast evolution of malware, a vulnerability is likely to develop within any system at some point.” Considering that the suspects used custom written malware that was tested to avoid detection by anti-virus software, Heartland could have only protected itself from the attack by preventing the SQL injections in the first place. While complete security remains a difficult objective to attain, we still believe that a vigorous and comprehensive approach to data security is possibly the only defense against such breaches.

Amending Website Terms of Use Requires Care

2009-08-05T12:21:00.008-04:00

By Mehmet Munur

Recent case law examining website terms of use highlights the importance of drafting qualified change of terms provisions for online agreements, proposing reasonable unilateral amendments, providing adequate notice, and keeping track of differing versions of online agreements and assents to such agreements.

Security & Privacy Update Summer 2009.pdf

Sears Settles with FTC on Information Tracking

2009-07-26T15:30:00.008-04:00

By Mehmet Munur

FTC entered into a settlement agreement with Sears in June related to its failure to provide adequate notice to its customers during the sign up process for an information collection software. This settlement highlights the need to create accurate highlight notices for privacy policies.

Sears invited customers visiting the Sears.com website and kmart.com websites to join the My SHC Community. Sears paid the customers $10 to sign up to participate in the community. Customers downloaded and installed a “research” software for participating in the community after being presented with the privacy policy and a license agreement.

Sears mentioned on its marketing material that the software would confidentially track online browsing. However, the FTC charged that the software allowed Sears to monitor consumer’s online sessions including shopping carts, online bank statements, drug prescription records, video rental records, library borrowing histories, and the sender, recipient, subject, and size for web-based e-mails. FTC appears to be concerned that Sears’ “Privacy Statement and User License Agreement” did not discuss the full scale of the data mining until the 75th line of the agreement. The agreement stated:

Once you install our application, it monitors all of the Internet behavior that occurs on the computer on which you install the application, including both your normal web browsing and the activity that you undertake during secure sessions, such as filling a shopping basket, completing an application form or checking your online accounts, which may include personal financial or health information.

Therefore, the FTC argued, burying the scope of this information collection activity in the 75th line of legal agreement did not adequately disclose the fact that the consumer was allowing the tracking for all of his internet activity. This, the FTC concluded, was a deceptive practice under section 5 of the FTC act.

In hindsight, Sears probably did not need all of the data that it gather in the first place. The competitive advantage that Sears may gain in collecting and processing such sensitive financial and health data is likely to be outweighed by the disadvantages in maintaining the confidentiality of such sensitive information and the public relations problems that follow its disclosure. Even if Sears could in fact use this data, installation of software that practically works like a commercial key logger likely requires specific and unambiguous consent.

In light of the Sears settlement, corporations should consider building several layers of privacy policies. Article 29 Working Party and the UK ICO have proposed simplifying privacy policies to provide better notice to data subjects. Such a scheme would require that corporations build and use highlights notices that provide a summary of privacy notices that then provides links to the full privacy policy.

In fact, some corporations, such as Google and Microsoft, have started using the A29WP approach in their privacy policies. Note that the users would still be bound to the full privacy policy with such an approach. Therefore, this highlights notice makes privacy policies easy to understand for consumers while maintaining the detailed approach of a privacy policy. Possibly, Sears could have used such a privacy policy on its website and more accurately described its information collection.

District Court Holds Blockbuster Arbitration Provision Unenforceable

2009-05-16T15:42:00.004-04:00

By Mehmet Munur

A District Court in Texas recently held Blockbuster’s website terms and conditions arbitration provision illusory and therefore unenforceable due to Blockbuster’s right to unilaterally modify it. The District Court cited to established Texas precedent to argue that nothing in the website terms prevented the arbitration provision's retroactive application.

The plaintiff sued blockbuster in connection with the controversial Facebook beacon program and its integration with Blockbuster as a violation of “the Video Privacy Protection Act, 18 U.S.C. § 2710, which prohibits a videotape service provider from disclosing personally identifiable information about a customer unless given informed, written consent at the time the disclosure is sought.” The plaintiffs argued and the court held that the arbitration provision was illusory and therefore unenforceable.

The district court analyzed the Blockbuster Terms and Conditions under Texas law. The terms and conditions state:

Blockbuster may at any time, and at its sole discretion, modify these Terms and Conditions of Use, including without limitation the Privacy Policy, with or without notice. Such modifications will be effective immediately upon posting. You agree to review these Terms and Conditions of Use periodically and your continued use of this Site following such modifications will indicate your acceptance of these modified Terms and Conditions of Use. If you do not agree to any modification of these Terms and Conditions of Use, you must immediately stop using this Site.

In finding this run-of-the-mill terms of use provision illusory, the court relied not on another business-to-consumer case, but Fifth Circuit case analyzing business-to-business agreements.

More specifically, the District court relied on Morrison v. Amway where the distributors signed Amway’s standard distributorship agreement. Facing disputes relating to the calculation of profits, Amway instituted an arbitration provision and published it in its magazine as well as other media sent to the distributors. Amway required that the distributors sign an acknowledgement form and send it back to Amway. Though all distributors renewed their agreements with Amway, two different groups sued Amway in federal as well as state court, both of which were stayed pending litigation. The arbitrator issued judgments and awards without opinions and the district court confirmed these opinions. The parties appealed their case to the Circuit Court.

The Circuit Court examined Amway’s arbitration policy to determine whether it was a valid agreement to arbitrate under Texas law. While the distributors had agreed to conduct their business according to Amway’s Code of Ethics, which would be amended from time to time, “the only express limitation on that unilateral right [was] published notice.” The Circuit Court was concerned that this unqualified right to amend the arbitration policy might apply to disputes arising before as well as after its publication. The Circuit Court held that this unqualified right to modify the Code of Ethics was unenforceable.

The Circuit Court relied on two Texas Supreme Court decisions. In one case, Texas Supreme Court had concluded that application of the arbitration policy 10 days after reasonable notice would be enforceable. In another case, however, the Texas Supreme Court plainly stated that “if the defendant-employer retained the right to ‘unilaterally abolish or modify’ the arbitration program, then the agreement to arbitrate was illusory and not binding on the plaintiff-employee.”

The District Court, relying on Morrison v. Amway and the underlying Texas precedent, concluded that the Blockbuster arbitration provision was illusory. Based on this web of Texas Supreme Court, Circuit Court, and District Court opinions, companies using arbitration policies—either in human resources policies, supplier agreements, or website terms of use—should qualify them. Such qualification should include at least a 10 day delayed application period and an explicit statement that makes the arbitration provisions applicable only to disputes arising after reasonable notice to counter any arguments that the contracts are illusory.

The cases are Harris v. Blockbuster Inc., No. 09-217, (N.D. Texas Apr. 15, 2009) and Morrison v. Amway, 517 F.3d 248 (5th Cir. 2008).

FTC and HHS Issue Proposed Rules on Breach Notification

2009-04-23T11:12:00.004-04:00

By Mehmet Munur

Both the Federal Trade Commission and the Department of Health and Human Services issued proposed regulations last week to satisfy their obligations under the Health Information Technology for Economic and Clinical Health (HITECH) Act, which was a part of the American Recovery and Reinvestment Act of 2009. The FTC rules address the obligations of non-HIPAA covered entities such as vendors of personal health records and third party service providers, while the HHS rules address the procedures required to secure unprotected health care information. Affected entities should invest in technologies that prevent and detect breaches and also draft and implement policies to notify the appropriate parties when they do occur.

FTC Proposed Regulations:

While the FTC proposed regulations track the HITECH Act in many respects, they differ in others. The definitions of the terms business associate, HIPAA-covered entity, personal health record, PHR identifiable health information, vendor of personal health records, and unsecured stay substantially the same as under the HITECH act. However, the FTC adds more substance around the concepts of third party service providers, presumption for acquisition, notification of senior officials in vendors in a breach, and discovery of data breaches.

While PHR related entities and third party service provider are non-HIPAA covered entities, they are, nevertheless, covered by the HITECH Act’s breach notification provisions enforced by the FTC. Third party service providers include “entities that provide billing or data storage services to vendors of personal health records or PHR related entities.” Such services certainly include the likes of Google Health and Microsoft HealthVault. Both services have been in the spotlight recently. Google Health recently signed up CVS and HealthVault recently announced a partnership with the Mayo clinic.

Due to the difficulty in determining whether access results in acquisition of data, the proposed FTC regulations enhance the definition of breach by adding language that creates a presumption of unauthorized acquisition where unauthorized access has taken place. However, the vendor or the PHR related entity may rebut this presumption where it “has reliable evidence showing that there has not been, or could not reasonably have been, any unauthorized acquisition of such information.”

The proposed regulations also require entities to notify senior officials in vendors or PHR related entities and to obtain an acknowledgement in the event of a breach. The FTC also prevents entities from ignoring a breach by making inability to reasonably ascertain a breach to be a violation of the regulations. On the other hand, the failure to discover a breach would not constitute a violation of the rules if the organization had strong breach detection measures and still failed to detect it. Therefore, breach detection is almost as important as breach notification under the proposed regulations.

The FTC expects the rules to affect about 900 entities and cost a total of $1 million for 11 breaches per year. The FTC appears to be concerned about some overlap between the FTC and the HHS regulations and is therefore seeking comments on the dual role of certain entities which would bring them under the scrutiny of the both FTC and the HHS. More detail on the proposed rules can be found at the FTC website.

HHS Proposed Regulations:

The regulations proposed by the HHS mainly concern the definition of the term “unsecured” as it modifies “protected health information” under the HITECH Act. This term is crucial as notification is not necessary if the protected health information is secured.

If the Secretary had not issued timely guidance, the term “unsecured protected health information” would have meant “protected health information that is not secured by a technology standard that renders protected health information unusable, unreadable, or indecipherable to unauthorized individuals and is developed or endorsed by a standards developing organization that is accredited by the American National Standards Institute (ANSI).” Now that the HHS has proposed these regulations, protected health information will be secured if it is encrypted or destroyed. However, such encryption and destruction will have to abide by the strict requirements of National Institute of Standards and Technology Special Publications on encrypting and destroying data.

The HHS relies on the existing HIPAA Security Rule for encryption and requires “the use of an algorithmic process to transform data into a form in which there is a low probability of assigning meaning without use of a confidential process or key” where the keys for decryption have not been breached. However, as a new measure, the HHS issued an exhaustive list of NIST publications for encrypting data at rest and for encrypting data in motion. For example, NIST Special Publication 800-111, Guide to Storage Encryption Technologies for End User Devices, recommends that travelling laptops should be secured using full-disk encryption and pre-boot authentication. HHS also requires that electronic media be cleared, purged, or destroyed consistent with NIST Special Publication 800-88, Guidelines for Media Sanitization, which requires that magnetic hard drives be purged using “Secure Erase” or degaussing, making them inoperable. The HHS is seeking public comments on the adequacy of some of these methods. More detail about the HHS proposed rules can be found at the HHS website.

The comment period for both sets of regulations will last until June and the agencies should issue interim final rules by August, which may result in changes to the proposed regulations. In addition, Congress may create a federal breach notification law after it receives the joint FTC-HHS report on the entities the HITECH Act regulates. Nevertheless, both HIPAA covered entities and non-HIPAA covered entities should invest in technologies and policies to prevent data breaches that may affect their bottom lines through breach notification costs, regulatory fines, and tarnished brands.

Court Strikes Down Electronic Signature Due to Weak Security Procedures

2009-03-23T22:48:00.003-04:00

By Mehmet Munur

The US District Court in Kansas held on February 19, 2009 that the data security procedures Dillard’s Stores had created to authenticate the electronic signature its employees used to execute an arbitration policy were not sufficient. While the case may have turned on its particular facts, Dillard’s could have avoided such problems by abiding by ISO 17799 procedures in operating its electronic signature systems.

The plaintiff, Yolanda Kerr, successfully kept her claim in court because she disputed the formation of the arbitration agreement. In 2005, Dillard’s started requiring current and new employees to sign an electronic arbitration agreement through its intranet system. In theory, Dillard’s associates executed their agreements using either a social security number or associate identification number and a unique confidential password followed by clicking an “I accept” button. The plaintiff refused to electronically sign the arbitration agreement for nearly six months despite alleged threats from supervisors and the store secretary that she would be fired if she failed to do so.

In April of 2006, the plaintiff missed a day of work. When she showed up for work on April 28, she told the store secretary that she had missed the day of work because she did not have access to the intranet site that contained her schedule. To give her access to the schedule, the secretary accompanied the plaintiff to a computer kiosk, reset her password to the default password, and demonstrated how to access the system. Then the store secretary took control of the computer again and navigated through various screens with the plaintiff beside her. Plaintiff alleged that the store secretary electronically signed the arbitration agreement at this point. After the interaction at the computer, the two left the break room together. Five minutes later, the system automatically sent the employee’s account an email confirming the execution of the arbitration agreement. The email stated that failure to reply to the email would deem agreement to the plaintiff’s electronic signature of the arbitration agreement. Someone opened the email but did not respond. Dillard’s later terminated the plaintiff for allegedly calling a supervisor a profane name. The plaintiff sued for discrimination and Dillard’s attempted to compel arbitration at court.

In analyzing the electronic signature, the court concluded that Dillard’s failed its burden to show through a preponderance of the evidence that the plaintiff knowingly and intentionally executed the agreement for two reasons. First, the court did not want to impute the electronic signature to the plaintiff due to the possibility, however minimal, that the store secretary may have fraudulently executed the agreement while plaintiff was standing beside her. Second, the court held that Dillard’s did not have adequate security procedures in place to restrict unauthorized access to the execution of the arbitration agreement. While the record showed that the employees were at the kiosk on April 28, it did not show that the plaintiff was at the kiosk precisely at 3:26:20. In other words, Dillard’s failed to show that the username, authentication, and the signature coincided with the employee’s log in. It is unclear whether Dillard’s systems had the capacity to log such information or if Dillard’s failed to produce such evidence. Nevertheless, the two factors persuaded the court hold that Dillard’s had not satisfied its obligation to show that there was an enforceable arbitration agreement.

In sum, Dillard’s electronic signatures system failed for two reasons. The systems failed to log associates’ access to the system and the system did not require that the associates change their default passwords immediately. In fact, both policies, are recommended under of ISO 17799 Information technology — Security techniques — Code of practice for Information Security Management. ISO Section 10.10.1 Audit Logging requires that “[a]udit logs recording user activities, exceptions, and information security events should be produced and kept” and include “dates, times, and details of key events, e.g. log-on and log-off.” Arguably, the formation of a legally binding agreement that compelled arbitration is such an event. Furthermore, ISO Section 11.2.3 User Password Management requires that “when users are required to maintain their own passwords they should be provided initially with a secure temporary password . . . , which they are forced to change immediately.” Here, it appears that Dillard’s system continued to operate and allow either the plaintiff or the store secretary to electronically sign the arbitration agreement. Implementing both of these procedures would have greatly helped Dillard’s satisfy its burden. However, it is unlikely that ISO 17799 would not have protected Dillard’s store secretary from fraudulently executing the arbitration agreement by either using the default password or using the plaintiff’s username while she stood by her side.

Unfortunately, the court was not too impressed with the security procedures that Dillard’s already had in place because they were violated. For example, associates were prohibited from sharing passwords and supervisors could only log into associate’s accounts if they reset their password to the default password. Dillard’s also posted notices regarding the confidentiality of passwords. Nonetheless, the two employees, in effect, shared their username and their password and the authentication failed because the system could not keep track of the actual person that signed the agreement. Such user failure combined with a weak logging and password feature resulted in the failure of the electronic signature.

The case is similar to Campbell v. General Dynamics, No. 03-11848-NG (D. Mass. June 3, 2004) where the court held that the employer could not prove an employee’s acceptance of an arbitration policy simply by sending a link to the policy in an email. There General Dynamics proved that the employee had opened the agreement but could not show that he had indeed clicked on the link or agreed in any other way. Furthermore, that email did not even mention the importance of the arbitration policy until its fifth paragraph. The court had noted that General Dynamics could have required the plaintiff to signify his acceptance by a return email he had read the email and accepted the conditions of the arbitration policy. In sum, both the employers in Campbell and Kerr failed to successfully use the technology they had available to them.

This case should set a good example for all employers using electronic signatures for policies. IT, HR, and Legal Departments may need to collaborate to ensure that established security procedures such as the ISO 17799 are used for variety of issues including authentication, accurate system audit logs, and password resets. Moreover, all industries depending on electronic signatures should focus on security procedures to preempt the argument that the electronic signatures they collect do not in fact belong to their system users.

The case is Kerr v. Dillard Store Services, Inc., No. 07-2604-KHV, (D. Kan. Feb. 17, 2009).

Stimulus Bill Requires Data Breach Notification Under HIPAA and Signals Broader Enforcement

2009-02-27T17:57:00.003-05:00

by Mehmet Munur

The American Recovery and Reinvestment Act that President Obama signed into law on February 17, 2009 includes wide reaching data breach notification provisions for entities covered by the Health Insurance Portability and Accountability Act and organizations servicing those entities. It also has privacy provisions related to sales of protected health information, marketing, fines, and enforcement. The Act is likely to increase joint enforcement activities by the Federal Trade Commission and the Department of Health and Human Services Office for Civil Rights. Such enforcement will likely result in settlements similar to the CVS settlement on February 18, 2009 that arose out of improper disposal of protected health information.

I. Data Breach Notification

The Act places notification obligations on covered entities, business associates, and vendors of personal health records for breaches of protected health information as well as required updates to contracts between covered entities and business associates.

A. Covered Entities

Generally speaking and without using the defined terms of the Act, an entity’s duty to notify arises when it has a breach involving unencrypted personal health information that it processes. The entity must then notify, the individual, the media, and the Secretary of the DHHS within 60 days of finding out about the breach, so long as the law enforcement exception does not apply. In creating these obligations, the Act defines the terms breach, electronic health record, personal health record, and vendors, but retains the earlier definitions of covered entities and business associates from HIPAA. The Act and the obligation to notify will likely become effective for breaches discovered 210 days from its enactment.

A breach is the unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information. The term has several narrow exceptions related to inadvertent disclosures to authorized users. Most importantly, a breach is deemed to have been discovered on the first date on which it is known or reasonably should have been known to have occurred.

Covered entities still refer to health plans, health care clearinghouses, or health care providers who transmit any health information in electronic form. Processing, while not a term used in the language of the Act, includes access, maintenance, retention, modification, storage, destruction, using, or disclosing.

Unencrypted personal health information refers to the defined term unsecured protected healthcare information. The portion of term referring to protected healthcare information retains its definition under HIPAA and means individually identifiable health information that is either transmitted by electronic media or maintained in electronic media, or both. Unsecured, on the other hand has two meanings. The Secretary should issue guidance specifying the technologies that render protected health information unusable, unreadable, or indecipherable to unauthorized individuals within 60 days. If he does not, then that technology will be a technology developed or endorsed by the American National Standards Institute. Though the Act does not specify that technology, it will probably be the Advanced Encryption Standard used by the Federal government for sensitive documents.

Notification takes 3 forms: individual, media, and the DHHS. Notification must be made without unreasonable delay and within 60 days after its discovery. However, the law enforcement exception can delay such notification if the entity receives and documents a written or oral statement from the DHHS. The burden to prove that the notification was performed according to the Act lies with the covered entity.

Entities must notify each individual whose unsecured protected health information has been, or is reasonably believed by the entity to have been accessed, acquired, or disclosed during the breach. This individual notice may be by first class mail at the last known address of the individual or by email if that is the preference of the individual. If the entity has more than 10 individuals with insufficient or out of date contact information, then it is required to place a conspicuous post on its web page or notice in major print or broadcast media for a period of time that the Secretary specifies. The entity may also notify by phone due to possible imminent misuse of the information.

The entity must notify prominent media outlets serving a state or jurisdiction if the information of more than 500 residents are reasonably believed to have been subject to the breach. The entity must also notify the Secretary. If the breach involves more than 500 individuals, the entity must notify immediately, whereas breaches involving less than 500 individuals may be submitted in an annual log. The Secretary is then required to post breaches involving more than 500 individuals on its website.

The Act delineates the contents of the notifications. They must include a brief description of the events, the date of the events, a description of the types of information involved, the steps the individuals should take to protect themselves from any harm that may result, and procedures for contacting the entity through a toll-free phone number, email address, or website.

The Secretary must also pass interim final regulations on breach notification within 180 days. These regulations will apply to breaches discovered after 30 days after their enactment. These regulations will certainly require covered entities to craft breach response procedures and implement them promptly.

B. Business Associates

Business associates that service covered entities under HIPAA have an obligation to notify the covered entities in the event of a breach. Business associates are now also subject to the same security procedures that covered entities are under HIPAA and these requirements must also be incorporated in their agreements.

The definition of a business associate has not changed with the Act. Business associates still refer to persons that perform or assist any activity involving the use or disclosure of individually identifiable health information or persons performing legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services to or for such covered entity. The Act states that the business associates need to notify the covered entities who must then notify the individuals. However, the requirements related to timeliness and the discovery of the breach are the same.

Covered entities will need to amend their contracts with business associates to reflect the provisions of the Act. These amendments must include administrative safeguards, physical safeguards, technical safeguards, and policies and procedures and documentation requirements promulgated by the DHHS. Business associates that receive protected health information may be subject to fines for wrongful disclosures of protected health information. Prior to the Act, HIPAA only made business associates liable to the covered entity for contract breaches.

The Act also contains a whistle blowing provision for business entities and the covered entities they serve. Prior HIPAA regulations stated that a covered entity was non-compliant if it knew of a business associate’s activity that constituted a material breach of the associate’s contractual obligations and did not take reasonable steps to cure them. If the business associate did not cure the problems, the covered entity was required to terminate the contract or, if that was not feasible, inform the secretary. Now, the Act requires that business entities have the same whistle blowing responsibility towards the covered entities they service. Failure to do so is a violation of the Act.

C. Vendors and Non-HIPAA Covered Entities

The breach notification standards also apply to a new kind of entity called vendors under the Act. These are entities other than covered entities that offer or maintain personal health records. A personal health record is an electronic record of identifiable health information on an individual that can be drawn from multiple sources and that is managed, shared, and controlled by or primarily for the individual. Google Health and Microsoft HealthVault are examples of such entities.

A vendor’s obligations under the Act are similar to the covered entities’ and business associates’ responsibilities. Vendors must notify individuals and the Federal Trade Commission, instead of the DHHS, of data breaches. The FTC then notifies the DHHS. The methods and timeliness of these disclosures and the definitions of breach and unsecured protected health information are almost identical to the methods and timeliness that covered entities. Violation of this duty to notify is considered an unfair and deceptive trade practice under the FTC Act. Third party services providers that service vendors have an obligation to notify their vendors of any breaches they experience, as well.

The FTC is required to pass regulations related to vendors covered under the Act within 180 days. If, however, Congress passes breach notification laws that directly apply to vendors, then the breach notification provisions of the Act will be overridden. While this provision may be good housekeeping to prevent dual breach notification laws for vendors, it may also be a sign of further breach notification legislation to come from Congress.

II. Marketing, Sale of Protected Healthcare Information, and the Minimum Necessary Standard

The Act has several provisions that restrict marketing activities and create greater privacy protections for individuals. Covered entities will need to revise their privacy practices to accommodate their new responsibilities.

The Act reduces the amount of marketing activities allowed under HIPAA. Communication by covered entities or business associates that is about a product or service and that encourages recipients to purchase or use the product or service are not considered a health care operation under HIPAA unless they are made 1) to describe a health-related product or service, 2) for treatment of the individual, or 3) for case management or care coordination for the individual. If, however, the covered entity or business associate receives direct or indirect payment in exchange for the communication, then the communication is considered marketing. On the other hand, such a communications will still be considered to be a healthcare operation if it describes a drug that the recipient is using and the payment received is reasonable. The Secretary is charged with defining the amount of reasonable compensation through regulations. However, such communication must still be made with a valid authorization. The Act also prohibits the sale of protected health information without a valid authorization. The regulations for these authorization do not change under the Act.

The Act now makes it mandatory to comply with an individual’s request that the entity restrict the use and disclosure of protected health information about the individual to carrying out treatment, payment, or healthcare operations. Prior HIPAA regulations did not require covered entities to agree to such restrictions.

Individuals also have the right to access protected health information in electronic format if the entity maintains that information. The fee for such access cannot exceed labor costs in responding to the request.

Under HIPAA, an entity was required to make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request of that information. The Act further reduces the amount of data in circulation by requiring the Secretary to promulgate regulations based on the limited data set concept that excludes identifiers such as names, addresses, social security numbers, email addresses and similar information to the extent practicable. Such changes will certainly require that covered entities revisit their privacy practices.

III. Fines and Enforcement

The Act also promotes enhanced enforcement through required fines and investigations.

Violations due to willful neglect now require a fine by the Secretary. Furthermore, the Secretary now has an obligation to investigate any complaint of a violation of the Act if a preliminary investigation of the facts of the complaint indicate a possible violation due to willful neglect. Most importantly, the Act requires that any civil monetary fine or settlement fund collected relating to privacy and security be transferred to the Office for Civil Rights of the DHHS. This provision will likely create a positive feedback loop where enforcement will result in fines and settlements that will give the OCR more funds to carry out more investigations. Additionally, individuals harmed by such breaches may also receive a percentage of the funds received by the OCR, but this amount will be determined three years from the date of the enactment. The Act also creates four tiers of penalties for different levels of culpability ranging from $100 to $50,000 for each violation that are not to exceed $25,000 to $1,500,000 during a calendar year. These fines are effective immediately.

The law can also be enforced by the State Attorneys General. If there is reason to believe that the interests of one or more of the residents of the State is or could be threatened, then the AGs may bring action in federal district court. The courts can, in their discretion, award attorneys fees to the AGs that bring action in federal district courts. However, such state action is limited to circumstances where the Secretary is not already bringing an action. Considering the availability of attorneys fees and the public record of breaches, it is likely that this provision will increase enforcement in cases where the FTC or the DHHS decline enforcement.

IV. Joint Enforcement and CVS’s $2.25 million DHHS Fine

The day after the Act was signed into law, the FTC and the DHHS announced separate settlements with the nationwide pharmacy chain CVS arising out of improper disposal of sensitive personal information. The settlement is significant because it is the first joint investigation by the FTC and the DHHS, involves a health provider, and employee data. Moreover, due to the language of the Act and the cooperation required between the two organizations, it is likely to be a sign of more joint investigations to come.

According to the FTC complaint, during 2006 and 2007 television stations found evidence of CVS’s disposal of names, addresses, dates of birth, bank account numbers, physicians’ names, insurance account numbers and other personal information in unsecured dumpsters in at least 15 cities. Seizing on CVS’s statements that “nothing is more central to our operations than maintaining the privacy of your health information” and that CVS took “this responsibility very seriously,” the FTC argued that CVS’s representations in its notice of privacy practices were false and misleading, likely to cause substantial injury to consumers; therefore, an unfair act or practice. As a result, CVS settled with the FTC and the DHHS in separate settlement agreements.

The FTC settlement is very similar to the other settlements that FTC reached with ChoicePoint, DSW, and TJ Maxx. CVS must create a comprehensive information security program, designate an accountable employee for that program, identify risks, and receive third party assessments of its security procedures for the next 20 years. It is the 24th FTC case that challenges a company’s failure to implement reasonable information security practices.

The DHHS settlement is similar but probably more significant. Under the resolution agreement with the OCR, CVS agreed to pay $2.25 million and implement a robust corrective action plan that includes safeguards for disposal, employee training, and employee sanctions for noncompliance. CVS must comply with this action plan for the next three years, followed by the FTC settlement’s two decade long program. The DHHS Office of Civil Rights press release on the resolution agreement highlights the OCR’s intention to make an example of CVS and its “commitment to strong enforcement of HIPAA Privacy Rule . . . [intended to] spur other health organizations to examine and improve their privacy protections.” The DHHS settlement is the second one of its kind. The previous resolution agreement was with Providence Health Information for $100,000. While the OCR conducts investigations and allows entities to correct HIPAA problems, it had not issued fines of this magnitude.

Vendor breach notifications under the Act will likely spur closer cooperation between the two agencies. OCR’s new obligation to assess fines, conduct investigations in certain cases, and its ability to keep the fines it issues will result in OCR having more resources and incentives to enforce the law. This positive feedback loop will likely result in the FTC and the OCR enforcing the requirements of HIPAA and publicizing them in the future. Therefore, the CVS settlement should provide an incentive for entities of all sizes to satisfy not only their current HIPAA obligations but also their future breach notification requirements.

V. Conclusion

The Recovery and Reinvestment Act creates broad data breach notification requirements for covered entities, business associates, and vendors on a federal level under HIPAA. These entities will need to abide by the regulations that the Secretary of the DHHS will promulgate in the next six months. Further, they will need to abide by the breach notification rules or face fines and settlements by both the FTC and the OCR. Therefore, affected organizations should act quickly to update their breach response plans, revise their privacy policies, stop sales of protected health information without appropriate authorization, and update business associate agreements.

Heartland Payment Systems Loses Credit Card Data to Malware

2009-02-02T17:44:00.009-05:00

By Mehmet Munur

Heartland Payment Systems, the 6th largest card acquirer in the United States with a processing volume of $51.9 billion, reported that its “investigation uncovered malicious software that compromised data that crossed Heartland’s network.” This data breach is disconcerting because consumers may be unable to pin down the source of the fraudulent transactions and also because Heartland was a Payment Card Industry Data Security Standard compliant acquirer. Heartland will likely be subject to liability from consumers, investors, and the FTC.

Heartland’s data breach may have revealed close to 100 million card numbers. It appears that a malicious software within Heartland’s network collected the data on the magnetic stripes of credit and debit cards. Heartland believes that the security codes or sensitive data, such as driver license numbers or social security numbers, are not a part of the data breach; therefore, the risk of identity theft is minimal. However, the risk of financial loss still exists due to the possibility of placing the magnetic information involved in the data breach on another card and using that card fraudulently. Considering that Heartland services all types of merchants, the largest risk to consumers is that such fraudulent transactions could come from any source and consumers do not have a way of identifying whether any of their cards was involved in the breach.

Another disturbing point for both consumers and corporations is that Heartland was a PCI DSS compliant acquirer. According to its 2008 10-K, Heartland “maintain[ed] current updates of network and operating system security releases and virus definitions, and have engaged a third party to regularly test [its] systems for vulnerability to unauthorized access.” Furthermore, Heartland encrypted the data stored in its databases but not when the data was in transit across its network. Heartland’s assumption was that its network was secure. As a result of the breach, Heartland’s listing in Visa’s Cardholder Information Security Program is now under review. To remedy the situation, Heartland announced that it would begin encrypting cardholder data throughout its network.

However, encryption is not the silver bullet that will save Heartland—or another acquirer—in the future. While PCI-DSS only requires that cardholder data be encrypted while crossing public networks and when it is stored, it does not require that data be encrypted while crossing an acquirer’s internal network. However, this data must be decrypted at some point in order for it to be processed. Furthermore, due to the fast evolution of malware, a vulnerability is likely to develop within any system at some point. Instead, companies that thrive on data processing must approach data security with comprehensive processes—such as ISO 270002. This is not to say that PCI-DSS is inadequate. Considering that the 6th requirement of PCI-DSS is the development and maintenance of secure systems and applications, it appears that it was Heartland’s implementation of PCI-DSS that failed—not PCI-DSS itself.

Heartland may be subject to legal liability from consumers, the Federal Trade Commission, and investors. A week after the breach, Heartland is already facing a class action lawsuit. TJ Maxx recently settled a similar class action lawsuit arising out of its data breach using its reserve of $178 million. Such a class action lawsuit may prove costly for Heartland as well.

TJ Maxx did not have to pay a fine to the Federal Trade Commission. Heartland may be lucky enough to avoid fines from the FTC, as well. Yet, similar to the TJ Maxx’s FTC settlement, Heartland may be subject to third-party audits as a part of a compliance program for the next 20 years. Heartland may also be able to avoid a lawsuit from its investors. While Heartland’s stock prices have declined from about $18 to $8 [1] since the breach became public, it appears to have made the appropriate disclosures as a part of its risk factors in its 10-K:

Unauthorized disclosure of merchant and cardholder data, whether through breach of our computer systems or otherwise, could expose us to liability and protracted and costly litigation.

Our computer systems could be penetrated by hackers and our encryption of data may not prevent unauthorized use. In this event, we may be subject to liability, including claims for unauthorized purchases with misappropriated bank card information, impersonation or other similar fraud claims. We could also be subject to liability for claims relating to misuse of personal information, such as unauthorized marketing purposes. These claims also could result in protracted and costly litigation. In addition, we could be subject to penalties or sanctions from the Visa and MasterCard networks.

In sum, corporations like Heartland that make their money through processing personal data should invest in data protection using comprehensive processes, especially if the loss of that data may result in financial liability. Such comprehensive processes are likely to better protect corporations and their customers against data breaches.

[1] The connection between data breaches and stock prices declines have been subject to several studies since the ChoicePoint data breach.

Article 29 Working Party Releases 11th Annual Report

2009-01-23T11:57:00.003-05:00

By Mehmet Munur

On January 21, 2009, the Article 29 Working Party released its 11th Annual Report on Data Protection and the report shows a rise in enforcement activities by the European Union Data Protection Authorities (DPAs) resulting in fines totaling millions of Euros, some criminal prosecutions, and concerns over liberal use of electronic discovery in US litigation involving EU subsidiaries.

While the report covers the year 2007, it is a handy (yet belated) insight into all EU Data Protection Authorities’ enforcement activities. Most importantly, it serves as a useful tool to gauge where data protection enforcement in the EU is heading. In 2007, the DPAs focused on a variety of areas of data processing such as electronic healthcare, law enforcement, employment, financial sector, biometric data, and video surveillance. The report also highlights the local implementation efforts of Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (the E-Privacy Directive) and the varying degrees of retention periods set by local legislation.

The Spanish, Dutch, French, and Italian DPAs were just as active in 2007 as in the previous years.

The Spanish DPA noted that in “2007, the number of claims filed by citizens with the AEPD rose by around 7% to a total of 1,624.” The Spanish DPA issued 399 penalties, “a 32.5% increase over the previous year” resulting in fines of 19.6 million Euros—an average of nearly €50,000. Furthermore, “[t]he greater part of the inspections carried out ha[d] to do with telecommunications and financial institutions, followed by video-surveillance, which is now in third place following an increase by over 400%.”

The Dutch DPA stated that in 2007 it had “changed its strategic direction and shifted its priority to carrying out investigations and enforcement actions – the core task of any independent supervisory authority – to ensure a more effective promotion of the awareness of standards.” The Dutch DPA also suggested that it was going after the bigger fish stating that it “g[a]ve priority, as regards requests for help and assistance, to serious violations of a structural nature and to violations which entail major consequences for a substantial number of citizens or for groups of citizens.”

The French DPA reiterated its penalty and audit powers stating that “the CNIL has sanctioning powers enabling it to levy fines to the amount of €150,000 (€300,000 in the case of repetition), within the limit of 5% of turnover.” In 2007, the French DPA issued nine fines ranging from €5,000 to €50,000, five warnings, and 101 formal notifications.

The French DPA also voiced its concerns over US data retention and electronic discovery rules stating that it had “observed a recent increase in the requirement for the communication of personal data held, inter alia, by the French subsidiaries of American companies that are the subject of discovery proceedings before American civil courts or pre-trial discovery.” The French DPA was worried not just about private litigation but discovery by the FTC and SEC. Therefore, the French DPA “attempted to draw the government’s attention to this issue” and set up inter-ministerial discussions.

The Italian DPA also enhanced its inspection activities in 2007. Interestingly, the Italian DPA benefited from the use of the specialized Financial Police when checking compliance with notification requirements, information notices, and security measures. “Overall, 452 inspection proceedings were carried out. They mostly concerned private entities and were aimed at checking compliance with the main requirements laid down in the data protection legislation.” The Italian DPA focused on “personal (medical) data by pharmaceutical companies and healthcare bodies; the online processing of personal data; processing aimed at the provision of goods and services via distance selling mechanisms (including call centres); the processing operations performed by Revenue Offices; the retention of users’/subscribers’ data by telecom operators; and e-banking services.” Out of these 452 inspections, the DPA issued 228 administrative sanctions and referred 15 cases to criminal prosecution. The Italian DPA expects revenues of €750,000 from these sanctions.

In sum, enforcement by EU DPAs and the financial liability for violations of local data protection legislation are both on the rise.

US-Swiss Safe Harbor Framework Signed

2009-01-22T11:08:00.003-05:00

by Mehmet Munur

On December 9, 2008, the Swiss Federal Data Protection and Information Commissioner and the Department of Commerce signed “an exchange of letters” to create the “US-Swiss Safe Harbor Framework.” As a result, multinational corporations certified under the Department of Commerce Safe Harbor program are now able to transfer data from Switzerland to the US more conveniently.

The Swiss Federal Data Protection Act operates similar to the 95/46/EC Data Protection Directive. Article 6 of the Swiss Act prohibits data exports in the absence of adequate guarantees, similar to Article 25 of the Directive. Since the US, without the Safe Harbor, does not offer adequate protections for personal data, companies were forced to use exceptions under Article 6 for data transfers, such as standard contractual clauses approved by the Data Protection Commissioner of Switzerland. Companies can now self-certify for transfers of personal data from Switzerland at the Department of Commerce website in addition to other European Economic Area countries.