The Children’s Advertising Review Unit recently held that screening for age to avoid collecting personal information from children under 13 was not enough. In Bandai America (the website is Bandai’s Wireless.com site), CARU found that although Bandai’s website had a screening mechanism that asked for a date of birth, there was no tracking once a child put in a birth date. Thus, anyone under 13 could come back and enter a different (inaccurate) date of birth to get by the screen. CARU’s COPPA compliance guidelines require that not only must interactive sites have an age screening mechanism, but there also must be some reasonably effective means of tracking so children can’t get around the screening process. Forewarned is forearmed.
Who Pays For the Data Security Breach?
Have you received one of those “data security breach” letters? Quick, call the credit bureau and bank. Change the checking, credit card and license numbers. Most financial institutions have absorbed the cost of reissuing payment cards or providing new checks, even when these financial institutions had nothing to do with the security breach. When B.J.’s Wholesale Club disclosed that a theft of credit card information had occurred, two financial institutions sued to recover the costs that resulted from that breach. The institutions claimed B.J.’s breached its legal obligation to maintain the security of the financial institution and should be liable for the damages. Those claims were initially rejected, but have now been revived by the U.S. Court of Appeals for the Third Circuit, which has issued a decision holding these financial institutions were intended third-party beneficiaries of the contract among the retailer, its merchant bank, and the payment card industry, to keep customer data safe. If the retailer breached data protection rules imposed by the payment card industry and the financial institutions were third-party beneficiaries of that agreement, then any damage and loss could be recovered based on contract law claims. Stay tuned.
You Would Think They Would Know Better
Cyber-Ark Software, a U.S.-based information security company, surveyed information technology professionals at the Infosecurity Europe Expo 2008 in London this past April. They asked 300 senior IT folks attending the Expo about abuses relating to information access, and guess what they found? First, about one-third of all IT professionals surveyed abused their own company’s information access rights policies to view information unrelated to their job (e.g., spying on employees or looking at confidential information). The survey report noted that passwords of IT and systems oversight staff often aren’t required to be changed as often as user passwords—or sometimes not at all. In most cases, IT administrators have free reign to use or abuse access privileges—which apparently happens too often.
The notion of “internal firewalls” is highlighted by this report. While companies often take great pains to protect themselves from external threats, as history has shown us in the physical world, the biggest dangers are from “inside jobs.” Without protections that apply internally, snooping, economic espionage, sabotage, spying and data security risks will remain a looming threat to the information assets of a business enterprise.
Data, Data Everywhere, But Hackers Drop into Secure Websites
Criminals stole customer information from the Hannaford Bros. and Sweetbay grocery chains’ computer networks. As shoppers swiped cards at checkout and their information was routed to transaction processors using state-of-the-art, fiber-optic, hard-wired cable for transmissions, malicious software intercepted the information and transmitted it to an ISP off-shore. Experts are still trying to figure out how the code got into the systems in the first place.
Continue reading “Data, Data Everywhere, But Hackers Drop into Secure Websites”
Data Security Breach – Who Are You Going to Call?
The New York State Information Security Breach and Notification Act amends the State Technology Law (Section 208) and the General Business Law (Section 899-aa), and requires that any New York State entity, as well as any person or business conducting business in New York and who owns or licenses computerized data that includes private information, must disclose any breach to New York residents (New York State governmental entities must also notify non-residents). This is similar to well more than 30 other states that have data breach notification statutes. Did you also know that when notification is necessary, New York law requires notification to the Attorney General, the Office of Cyber Security & Critical Infrastructure Coordination, and the Consumer Protection Board? Did you know there’s a “New York State Security Breach Reporting” form? No company relishes the idea of having to deal with a compromise of sensitive customer data? And no company should have to worry about not having the right legal advice when dealing with their customers, regulators and law enforcement officials. Rimon has a Data Security Group that keeps track of these laws in the United States and throughout the world.
Internet Privacy & Defamation – Mind Your ISPs & Qs
John Hines in our Chicago office is one of the authors of “Anonymity, Immunity and Online Defamation: Managing Corporation Exposures,” published in the Sedona Conference Journal and cited by the 7th Circuit. Earlier this month, the 9th Circuit rendered a decision many think may erode immunity accorded to ISPs, websites and services with defamatory content posted on their sites (Fair Housing Council v. Roommates.com). But did you know that last week, the New Jersey Supreme Court rendered a significant decision recognizing a privacy interest in subscriber data which may impact corporations’ ability to pierce anonymity (State v. Reid). John has authored a Rimon Bulletin noting this extraordinary decision, departing from U.S. Constitutional standards and holding that the right to privacy extends to subscriber data in the possession of an ISP. The case involves a company that gave local police the IP address, registered to Comcast, of an employee on leave who visited a company supplier’s website, making unauthorized changes. After she was indicted, lawyers moved to suppress the evidence, arguing that without a valid subpoena, the employee’s expectation of privacy barred Comcast’s disclosure. New Jersey agreed, expressly extending its State “Constitutional” right of privacy to subscriber data provided to ISPs, noting “[u]sers make disclosures to ISPs for the limited goal of using that technology and not to promote the release of personal information to others.” Given the state of technology, the “IP addresses cannot be matched to an individual user without the help of an ISP,” and users have a reasonable expectation of privacy. Although the ruling is in the context of a criminal case, it will likely present challenges for corporations pursuing civil remedies and seeking to pierce the anonymity of individuals responsible for defamation and other speech torts. John and a team of Rimon lawyers know this area—reach out to him.
To Collect or Not To Collect, That’s the Dilemma?
This article was contributed by Adam Snukal, Esq.
Surfed the web lately? Seen a banner promoting a product, service or trip to Ireland you priced yesterday? Serendipity? Luck? Cookies? Yes, it’s those tiny files placed on your computer when you visit a website. Advertisers can now parse through cookies on your computer when you visit certain websites and instantaneously serve up advertisements based on your historical online behavior—“behavioral marketing.” For some, this is a great convenience. For others, like New York State Assemblyman Richard Brodsky, this is invasive and should be stopped unless the consumer has given consent.
Assemblyman Brodsky sees the acquisition of Doubleclick by Google as a step backward for consumers since the combined company could tap into a reservoir of consumer behavior and search data on an individual basis. So he introduced a bill aimed at restricting Internet behavioral marketing—The Third Party Internet Advertising Consumers’ Bill of Rights Act of 2008—that would prohibit advertisers from collecting and using sensitive, personally identifiable information from users online; require websites to clearly and conspicuously disclose behavioral policies and practices; give consumers the right to opt-out of profiling practices; prevent their online behavior from being collected and used to deliver targeted advertisements; and police how advertisers are permitted to merge and synthesize such information with other data (e.g., merging personally identifiable information collected offline with information collected online). Opponents—some of the largest interactive advertising and media companies—have voiced their opposition in a letter to Assemblyman Brodsky, noting, “Time after time, state laws that have attempted to impose this sort of broad Internet regulation have been struck down by the courts, doing nothing more than making taxpayers bear the expense both of defending the lawsuit and paying the successful plaintiffs’ attorneys fees.”
Continue reading “To Collect or Not To Collect, That’s the Dilemma?”
It’s a Dyanmic Environment Out There: Yes, You Can Still Avoid Being a Target
Most of us know the law tends to lag behind the marketplace. It is in the nature of most legal systems to try and balance statutory and regulatory authority—which makes rules based on experience or potential issues that will apply to future conduct—with judicial and regulatory decisions—cases that are adjudicated, create precedent and help shape the contours and boundaries of what is or is not permissible behavior within the statutory authorities.
In such a framework, we are often asked to counsel clients as to what is or is not acceptable when there may be little law, few regulations and sometimes no precedent. What to do? Well, as you may imagine, there is no simple answer. But there are some guideposts. A key guidepost is to consider common sense, best practices and some lessons learned from analogous legal precedent.
Continue reading “It’s a Dyanmic Environment Out There: Yes, You Can Still Avoid Being a Target”
‘You Know How to Whistle, Don’t You? Just Put Your Lips Together and Blow.’
If you don’t know who said that or in what motion picture, stop reading and go to the next article. California Governor Schwarzenegger has just signed a bill specifically aimed at altering the future results of fact patterns analogous to two recent court decisions relating to the licensing of publicity rights for deceased celebrities. The two cases—one in New York and the other in California—dealt with a challenge to the right to license the use of Marilyn Monroe’s name and likeness for commercial purposes. The rulings stated that because at the time of her death neither California nor New York had a law allowing publicity rights to survive the death of a celebrity, and because those rights were not specifically bequeathed by Marilyn Monroe, those rights could not be construed as part of the “rest, residue and remainder” of her estate, and consequently not be part of the rights available to her estate (or subsequent licensors like the plaintiffs in these cases).
The legislation just signed by Gov. Schwarzenegger makes retroactive to before Jan. 1, 1985, the right of a celebrity’s estate to construe publicity rights as part of a “rest, residue and remainder” as a bequest in a celebrity’s will. January 1, 1985 was the effective date of the current California law allowing publicity rights to survive the death of a celebrity. Unfortunately, New York still does not have a law allowing publicity rights to survive the death of the celebrity.
The Empire Strikes Back?
You can’t possibly have missed the flurry of articles in the press over the past few years regarding identity theft and the measures being taken (or vulnerabilities exposed) to protect the non-public, personally identifiable financial information consumers access, use and provide in the course of routine payment transactions—both off and online. Indeed, several years ago, the Payment Card Industry (“PCI”) began formulating it’s own self-regulatory standards governing the protection of consumer information relating to the processing of credit, charge and debit card transactions. This has led to the development of the PCI Data Security Standards (“DSS”) and corresponding Data Security Audit Guidelines. In broad terms, the PCI DSS requires the protection (by encryption or other effective means) of personal information in the payment card process—whether in storage, card processing, point of sale/purchase, recordkeeping—in every link in the chain of payment using a payment card or device linked to an account at a financial institution.
As a result of the furor over the release of private information—including releases from governmental agencies and databases (e.g., social security numbers, drivers license numbers)—more than 30 states have passed specific legislation requiring companies that know, or reasonably suspect, that data, databases or electronic/digital information involving personal information of consumers has been compromised or actually leaked, to disclose and notify consumers affected (or potentially affected) by the security lapse or potential breach. Federal legislation has been proposed, although nothing has yet been enacted, and the states have stepped in to fill the perceived gap and protect the information of its citizens, and to regulate the conduct of companies doing business within their borders.
Much of the angst over the private sector, commercial transaction compromises over security—starting most visibly with ChoicePoint several years ago and continuing in a steady stream thereafter—arises from the fact that retail merchant establishments have traditionally not had to worry about privacy and the secure management of customer personal and financial information, primarily because they haven’t been regulated or needed to do so. Enter the digital age of information and the ability of marketing and advertising gurus (within and for retailers) to data-mine and use vast amounts of previously cumbersome and often unattainable information about customers. If information has always been power, than digital information transforms that power exponentially, at the speed of light (literally for those physics majors masquerading as lawyers or marketing professionals).