The New York State Information Security Breach and Notification Act amends the State Technology Law (Section 208) and the General Business Law (Section 899-aa), and requires that any New York State entity, as well as any person or business conducting business in New York and who owns or licenses computerized data that includes private information, must disclose any breach to New York residents (New York State governmental entities must also notify non-residents). This is similar to well more than 30 other states that have data breach notification statutes. Did you also know that when notification is necessary, New York law requires notification to the Attorney General, the Office of Cyber Security & Critical Infrastructure Coordination, and the Consumer Protection Board? Did you know there’s a “New York State Security Breach Reporting” form? No company relishes the idea of having to deal with a compromise of sensitive customer data? And no company should have to worry about not having the right legal advice when dealing with their customers, regulators and law enforcement officials. Rimon has a Data Security Group that keeps track of these laws in the United States and throughout the world.
Internet Privacy & Defamation – Mind Your ISPs & Qs
John Hines in our Chicago office is one of the authors of “Anonymity, Immunity and Online Defamation: Managing Corporation Exposures,” published in the Sedona Conference Journal and cited by the 7th Circuit. Earlier this month, the 9th Circuit rendered a decision many think may erode immunity accorded to ISPs, websites and services with defamatory content posted on their sites (Fair Housing Council v. Roommates.com). But did you know that last week, the New Jersey Supreme Court rendered a significant decision recognizing a privacy interest in subscriber data which may impact corporations’ ability to pierce anonymity (State v. Reid). John has authored a Rimon Bulletin noting this extraordinary decision, departing from U.S. Constitutional standards and holding that the right to privacy extends to subscriber data in the possession of an ISP. The case involves a company that gave local police the IP address, registered to Comcast, of an employee on leave who visited a company supplier’s website, making unauthorized changes. After she was indicted, lawyers moved to suppress the evidence, arguing that without a valid subpoena, the employee’s expectation of privacy barred Comcast’s disclosure. New Jersey agreed, expressly extending its State “Constitutional” right of privacy to subscriber data provided to ISPs, noting “[u]sers make disclosures to ISPs for the limited goal of using that technology and not to promote the release of personal information to others.” Given the state of technology, the “IP addresses cannot be matched to an individual user without the help of an ISP,” and users have a reasonable expectation of privacy. Although the ruling is in the context of a criminal case, it will likely present challenges for corporations pursuing civil remedies and seeking to pierce the anonymity of individuals responsible for defamation and other speech torts. John and a team of Rimon lawyers know this area—reach out to him.
To Collect or Not To Collect, That’s the Dilemma?
This article was contributed by Adam Snukal, Esq.
Surfed the web lately? Seen a banner promoting a product, service or trip to Ireland you priced yesterday? Serendipity? Luck? Cookies? Yes, it’s those tiny files placed on your computer when you visit a website. Advertisers can now parse through cookies on your computer when you visit certain websites and instantaneously serve up advertisements based on your historical online behavior—“behavioral marketing.” For some, this is a great convenience. For others, like New York State Assemblyman Richard Brodsky, this is invasive and should be stopped unless the consumer has given consent.
Assemblyman Brodsky sees the acquisition of Doubleclick by Google as a step backward for consumers since the combined company could tap into a reservoir of consumer behavior and search data on an individual basis. So he introduced a bill aimed at restricting Internet behavioral marketing—The Third Party Internet Advertising Consumers’ Bill of Rights Act of 2008—that would prohibit advertisers from collecting and using sensitive, personally identifiable information from users online; require websites to clearly and conspicuously disclose behavioral policies and practices; give consumers the right to opt-out of profiling practices; prevent their online behavior from being collected and used to deliver targeted advertisements; and police how advertisers are permitted to merge and synthesize such information with other data (e.g., merging personally identifiable information collected offline with information collected online). Opponents—some of the largest interactive advertising and media companies—have voiced their opposition in a letter to Assemblyman Brodsky, noting, “Time after time, state laws that have attempted to impose this sort of broad Internet regulation have been struck down by the courts, doing nothing more than making taxpayers bear the expense both of defending the lawsuit and paying the successful plaintiffs’ attorneys fees.”
Continue reading “To Collect or Not To Collect, That’s the Dilemma?”
It’s a Dyanmic Environment Out There: Yes, You Can Still Avoid Being a Target
Most of us know the law tends to lag behind the marketplace. It is in the nature of most legal systems to try and balance statutory and regulatory authority—which makes rules based on experience or potential issues that will apply to future conduct—with judicial and regulatory decisions—cases that are adjudicated, create precedent and help shape the contours and boundaries of what is or is not permissible behavior within the statutory authorities.
In such a framework, we are often asked to counsel clients as to what is or is not acceptable when there may be little law, few regulations and sometimes no precedent. What to do? Well, as you may imagine, there is no simple answer. But there are some guideposts. A key guidepost is to consider common sense, best practices and some lessons learned from analogous legal precedent.
Continue reading “It’s a Dyanmic Environment Out There: Yes, You Can Still Avoid Being a Target”
‘You Know How to Whistle, Don’t You? Just Put Your Lips Together and Blow.’
If you don’t know who said that or in what motion picture, stop reading and go to the next article. California Governor Schwarzenegger has just signed a bill specifically aimed at altering the future results of fact patterns analogous to two recent court decisions relating to the licensing of publicity rights for deceased celebrities. The two cases—one in New York and the other in California—dealt with a challenge to the right to license the use of Marilyn Monroe’s name and likeness for commercial purposes. The rulings stated that because at the time of her death neither California nor New York had a law allowing publicity rights to survive the death of a celebrity, and because those rights were not specifically bequeathed by Marilyn Monroe, those rights could not be construed as part of the “rest, residue and remainder” of her estate, and consequently not be part of the rights available to her estate (or subsequent licensors like the plaintiffs in these cases).
The legislation just signed by Gov. Schwarzenegger makes retroactive to before Jan. 1, 1985, the right of a celebrity’s estate to construe publicity rights as part of a “rest, residue and remainder” as a bequest in a celebrity’s will. January 1, 1985 was the effective date of the current California law allowing publicity rights to survive the death of a celebrity. Unfortunately, New York still does not have a law allowing publicity rights to survive the death of the celebrity.
The Empire Strikes Back?
You can’t possibly have missed the flurry of articles in the press over the past few years regarding identity theft and the measures being taken (or vulnerabilities exposed) to protect the non-public, personally identifiable financial information consumers access, use and provide in the course of routine payment transactions—both off and online. Indeed, several years ago, the Payment Card Industry (“PCI”) began formulating it’s own self-regulatory standards governing the protection of consumer information relating to the processing of credit, charge and debit card transactions. This has led to the development of the PCI Data Security Standards (“DSS”) and corresponding Data Security Audit Guidelines. In broad terms, the PCI DSS requires the protection (by encryption or other effective means) of personal information in the payment card process—whether in storage, card processing, point of sale/purchase, recordkeeping—in every link in the chain of payment using a payment card or device linked to an account at a financial institution.
As a result of the furor over the release of private information—including releases from governmental agencies and databases (e.g., social security numbers, drivers license numbers)—more than 30 states have passed specific legislation requiring companies that know, or reasonably suspect, that data, databases or electronic/digital information involving personal information of consumers has been compromised or actually leaked, to disclose and notify consumers affected (or potentially affected) by the security lapse or potential breach. Federal legislation has been proposed, although nothing has yet been enacted, and the states have stepped in to fill the perceived gap and protect the information of its citizens, and to regulate the conduct of companies doing business within their borders.
Much of the angst over the private sector, commercial transaction compromises over security—starting most visibly with ChoicePoint several years ago and continuing in a steady stream thereafter—arises from the fact that retail merchant establishments have traditionally not had to worry about privacy and the secure management of customer personal and financial information, primarily because they haven’t been regulated or needed to do so. Enter the digital age of information and the ability of marketing and advertising gurus (within and for retailers) to data-mine and use vast amounts of previously cumbersome and often unattainable information about customers. If information has always been power, than digital information transforms that power exponentially, at the speed of light (literally for those physics majors masquerading as lawyers or marketing professionals).
COPPA – Xanga Settles
Based on a complaint that Xanga knew it was collecting (and sharing) personal information from children under the age of 13 (they asked for and were given the birth dates from registrants), the FTC reached a settlement agreement in which Xanga.com agreed to pay a civil penalty of $1 million. The complaint also alleged that Xanga didn’t notify children’s parents, nor did they give parents access to or control over their children’s information.
The Children’s Online Privacy Protection Act (“COPPA”) mandates that commercial web sites give parents notice and get consent before collecting personal information from children they know to be younger than 13 years old. The order which is part of the settlement with the FTC forces Xanga to erase any personal information collected and stored that violates the Act. Xanga also will have to put up hypertext links for the next five years to FTC-designated consumer educational materials.
Social networking has been in the news recently for many reasons. Recently, Facebook was faced with controversy when it started serving automated alerts about users’ friends and classmates. Facebook has less than 10 million users, compared with MySpace—which is now owned by News Corp.—which has in excess of 100 million users.
Global Forum Shopping in Defamation Cases Gets More Difficult
In a decision of potentially great import, the UK’s top court sided with a European newspaper (The Wall Street Journal Europe) in a defamation case. Until now, British libel laws had been among the most plaintiff-friendly of any jurisdiction in the world, in part based on a 2001 libel decision known as Reynolds vs. Times Newspapers Ltd. that was intended to protect serious investigative journalism on matters of public concern.
It is expected the ruling will now allow the media in the United Kingdom to better defend against libel actions by asserting reports were in the public interest, involving responsible journalism, protections similar to those of the U.S. media under the First Amendment of the Constitution of the United States. The High Court articulated the new standard for such decisions as being “whether the defendant behaved fairly and responsibly in gathering and publishing the information.” If journalists and editors behave responsibly and the news story is of public importance and relevance, the fact that there are defamatory allegations against prominent people in the report, does not, in and of itself, permit damages for libel.
Disclosures, Decency and Data Security
For the record, privacy, data protection, information security and international law have officially converged with management, compliance and marketing. More than 30 U.S. states have now passed legislation in one form or another that requires businesses to notify consumers if an actual or potential breach of data security may lead to the compromise of personally identifiable information. This comes on the heels of several years of the government tightening its own policies regarding data security breaches and instances of compromised security.
Recently, the Office of Management & Budget, which oversees U.S. federal agencies, announced a tougher policy for government, requiring agencies to follow the security procedures checklist prepared by the National Institute of Standards and Technology (“NIST”) to protect data. An internal OMB memo recommends that data on mobile computers and devices carrying agency data be encrypted, and suggests two-factor authentication (one being separated from the actual computer obtaining access to the data).
As noted in prior issues of Legal Bytes, requirements and compliance obligations for commercial enterprises doing business across state lines and national boundaries vary, although many have common themes. If you are concerned—and you should be—contact us. We can help you sort out your current compliance obligations and help you keep track of the changing privacy and data protection landscape, both domestically and internationally. Even if you choose not to inject your views into the regulatory process, you must keep abreast of developments or risk action by consumers and regulators.
Web Videos Test the Limits of Feeds, Uploads & Time-Shifting
Web-based videos, through links, feeds or user uploads, are generating significant legal and commercial interest these days. Advertisers are also quick to recognize the potential “buzz” marketing opportunities enabled by the use of the Internet and digital audiovisual technology. User-generated content draws consumers to websites, powerful magnets for advertising messages targeted to those consumers. But beware: Simply because a consumer creates the content, doesn’t mean it is immune from standard legal tests for advertising, endorsements, publicity and product liability.
A lawsuit has recently been filed against one online video-sharing network—Veoh—alleging it allowed video works owned by an adult entertainment company to be viewed through Veoh’s website without authorization. The claims of copyright infringement could be an important test of how the courts view sites that enable sharing or feeds of audiovisual works. Although there are a growing number of popular user-generated content sites such as IFILM, YouTube, Guba, Yahoo! and Google, these sites often have very different policies and some, but not all, of them review user-generated content before it is posted—either to ensure it meets guidelines or to confirm that the user’s tags are accurate.
Earlier this month, the New York State Consumer Protection Board published an official warning about content available on Google Video, the new Google site for user-generated content. Because videos are uploaded by users, Google Video relies on tags (labels which describe the content) which are input and generated by the users. Since the content is not indexed or catalogued by Google, a search will turn up whatever the user submits—and that is what has irritated the New York authorities. As with many websites that allow user-generated content to be uploaded for viewing, Google warns users about uploading obscene or illegal material or items protected by copyright, but currently has no mechanism for filtering it out.
In a move widely viewed as adding an air of legitimacy to these sites, Warner Bros. agreed to allow Guba to distribute some of its television shows and motion pictures, online. NBC is allegedly planning to make clips of some of its most popular programs available to YouTube to promote its fall programming lineup. NBC’s decision is reportedly coupled with advertising commitments for both companies in broadcast television medium and the Internet. That should come as no surprise since advertising is what is usually at the root of all of these revenue models—a fact that has not escaped broadcast network executives.
Also this month, a number of leading television production and motion picture companies joined forces in filing suit against Cablevision, one of the largest cable television companies in the United States. The action asks the U.S. District Court in New York to declare the time-shifting service Cablevision has announced, but not yet offered, in violation of U.S. copyright law. Cablevision has countered that time-shifting of programming by consumers is legal. Unlike an “on-demand” service which would record everything and replay programs when selected by the consumer, Cablevision intends to offer subscribers a specific amount of allocated storage space on the network. Analogous to an outsourced set-top box or digital video recording device that a consumer might purchase, Cablevision will offer consumers an opportunity to buy storage space and use it to record and play back programs and then erase them to free space for new programs—no different than if the storage medium was sitting in their living rooms. Stay tuned.