While the United States may not have data protections in place that are as extensive as those seen the European Union’s adoption of GDPR, there is still a comprehensive framework of state and federal regulations in place to protect personal information. Many industries are building on the foundation set by state and federal guidelines by creating industry-specific cyber standards. For example, various organizations in the insurance industry are taking steps to ensure their members have guidance on cyber security.

• The Insurance Industry’s Data Protection Standards

The National Association of Insurance Commissioners (“NAIC”), an organization that coordinates the efforts of state insurance regulators, provides one of the best examples of an industry taking steps on its own to regulate cyber security for the insurance industry. Early NAIC cyber security initiatives included creating Principles for Effective Cybersecurity Insurance Regulatory Guidance to “help state insurance departments identify uniform standards, promote accountability and provide access to essential information.” The NAIC’s initiatives are based on the realization that the insurance industry faces its own unique issues in protected sensitive data. In short, the NAIC’s initiatives provide one of the best examples of an industry taking steps to regulate itself rather than wait for state or federal regulations to plug the gaps.

• The Data Protections Found In The NAIC’s “Model Law.”

The NAIC furthered its track record on cyber security measures when it adopted the Insurance Data Security Model Law (“Model Law”) in October 2017 to encourage members of the insurance industry to adopt cyber security programs that would protect consumers’ personal information, create standards that would limit damage caused by a breach and create a protocols to investigate incidents and notify the state insurance commissioner. Specifically, the the Model Law is intended “to establish standards for data security and standards for the investigation of and notification to the Commission of a Cybersecurity Event” that involves an entity regulated under the insurance laws of a given state. (A copy of the Model Law can be found here.)

Insurance entities that operate in a state that has adopted a version of the Model Law may be subject to new regulations spanning the time prior to a cyber incident to points after an incident.  First, under the Model Law, an insurance entity may be required to create an “Information Security Program” and “Incident Response Plan” prior to an incident. The Model Law would also govern the insurance entities’ response to a cyber incident by creating guidelines to investigate and provide notification after an incident. The Model Law is currently being considered in a number of states (Connecticut, Mississippi, Nevada, Rhode Island and New Hampshire) and has been adopted in some form in Michigan and South Carolina.

• Ohio’s Adoption Of The “Model Law”

Ohio is one of the first states to adopt a version of the NAIC’s Model Law through Senate Bill 273. On December 19, 2018, John Kasich, Ohio’s governor, signed Bill 273 into law which requires entities subject to Ohio’s insurance laws to take certain steps to protect private information. While the Ohio legislature adopted a large portion of the Model Law, Senate Bill 273 had some notable changes that include:

• Affirmative Defense: Senate Bill 273 provides insurance entities that are in compliance with the statute with an affirmative defense to liability if they are sued for a cyber security incident;

• Other Considerations: The Ohio Department of Insurance can consider other factors related to a breach including the type of business and size of the insurance entity; and

• Easy Compliance: A streamlined process allows the insurance entity to file documents to comply with the provisions of this law with other corporate documents filed with the State of Ohio.

Ohio’s law is more than an abstract cyber security guideline. Rather, deadlines include all insurance entities must conduct a risk assessment to address the nature and likelihood of any internal threat to private information and implement a security program resulting from the risk assessment by March 19, 2020.  Therefore, Ohio’s insurance entities have work to do over the next year.

• Industry Standards Provide Guidance

While many data collectors struggle to comply with various state and federal privacy laws, industry standards provide a uniform set of regulations. Further, industry standards that are crafted by members of the industry provide guidance on the issues facing that particular industry. And, while there is an argument that more regulations may become burdensome, regulations such as Ohio’s Bill 273 are helpful to the extent they protect sensitive data, provide guidance to data collectors and may limit liability when there is a cyber security incident.

The post Industry Cyber Regulations Fill The Gaps Left By Federal And State Law appeared first on Privacy Risk Report.

A class action entitled Wade v. ABM Indus. Inc., 2018 CH 3855 was initiated last week against ABM Industries (“ABM”) in Illinois based on allegations that ABM recently breached its employee’s Personal Information.  In summary, the class action plaintiff claims he was damaged by his employer, ABM, “when it ‘allowed hackers to obtain access to Plaintiff’s and other employees’ Personal Information.”  In particular, the class action plaintiff claims his Personal Information “should not have been susceptible to unauthorized access through the use of one of the oldest, and least sophisticated types of cyber-attacks – the ‘phishing email scheme.’”

Allegations Related To The Breach

The class action plaintiff claims his Personal Information, including documents containing medical information, was taken during a breach in August of 2017.  Specifically, the class action plaintiff claims ABM was the target of “cyber attackers” a number of times over the years and, therefore, should have taken better steps to protect its employees’ information prior to the “phishing” attack which led to the subject data breach.

The class action plaintiff claims ABM should have been better prepared for this incident since it had “been targeted by cyber-attacks many times in the last decade.”

Allegations Related To ABM’s Notification

The class action plaintiff further alleges that ABM should not have waited more than seven months to notify its employees of the incident on March 5, 2018.  In addition to failing to be timely, the class action plaintiff claims the notification letter failed to provide sufficient information concerning the incident to allow its employees to protect themselves.

Causes Of Action

The class action plaintiff claims he has had to take steps to protect against identity theft and fraud and has suffered mental anguish when “he experiences anxiety and anguish when he thinks about what would happen if his identity is stolen as a result of the Data Breach.”

In addition to claims for breach of contract, breach of implied contract and a violation of Illinois’ Consumer Fraud and Deceptive Business Practices Act, the class action plaintiff’s complaint also contains the following causes of action:

• Violation Of N.Y. Gen. Bus. Law §349 et. seq.: In his first cause of action, the class action plaintiff claims ABM engaged in “deceptive, unfair and unlawful trade acts or practices.”  Here, the class action plaintiff claims he had to provide his Personal Information as a condition of employment.

• Negligence: In his fourth cause of action, the class action plaintiff claims ABM was negligent when it failed to implement reasonable security measures and cybersecurity protocol and failed to timely notify the class action plaintiff of the incident involving his Personal Information.

The allegations found in the class action plaintiff’s complaint against ABM highlight the difficult position employers may find themselves in when employees claim their personal information has been compromised.  Of course, the employer-employee relationship requires the parties continue to work together and exchange information even after an employee claims their information has been compromised.  Further, these allegations are part of a growing trend calling into question not only the technical safeguards of a data collector, but also calling into question non-technical safeguards such as security protocols and the reasonableness of a data collector’s notification process.  In the end, liability for a breach involving customer data or employee data will be limited if a data collector can show it took as many reasonable steps as possible to protect that data.

The post Illinois Class Action Suit Highlights Issues When An Employer Allegedly Breaches Employee Data appeared first on Privacy Risk Report.

Unfortunately, the law governing cyber security and privacy issues has not kept pace with the technology giving rise to these issues.   However, a recent decision applying existing law to Bitcoin and other virtual currencies provides insight on how we may expect the law controlling cyber security and privacy law to develop.

In Commodity Futures Trading Commission v. McDonnell, 2018 WL 1175156 (March 6, 2018), the District Court for the Eastern District of New York held the Commodity Futures Trading Commission (“CFTC”) “has standing to exercise its enforcement power over fraud related to virtual currencies sold in interstate commerce…”  The CFTC is tasked with stopping fraud or manipulation in derivatives markets by enforcing the Commodity Exchange Act (“CEA”).  The CEA requires “any commodity traded as a future” to be “traded on a commodity exchange approved by the CFTC.  Title 7 U.S.C. § 2.  In McDonnell, the threshold question was whether virtual currency may be regulated by the CFTC as a commodity.  And, after a lengthy analysis of virtual currencies, the District Court held the CFTC had authority over these markets and was entitled to enjoin the defendants from continuing to sell virtual currencies to the public.

The facts underpinning the McDonnell decision involve allegations that the Defendant, Patrick McDonnell (“McDonnell”), and his investment companies, “offered fraudulent trading and investment services related to virtual currency.”  Specifically, “[c]ustomers from the United States and abroad paid defendants for ‘membership’ in virtual currency trading groups purported to provide exit prices and profits of up to ‘300%’ per week.”  Unfortunately, the defendants disappeared by deleting company social media accounts and ceasing all communications with investors after receiving the initial payment and subsequent investments from members.

After hearing evidence concerning the defendants’ actions, the District Court granted a preliminary injunction to the CFTC when it found that the defendants committed fraud through false trading advice and “promised future profits.”  The District Court held that an injunction was warranted in light of the reasonable likelihood that the defendants would continue to violate the CEA.

• Virtual Currencies Are Here To Stay

Before arriving at its decision, the McDonnell Court conducts an in-depth analysis of Bitcoin and other virtual currencies.  After addressing the basics related to virtual currencies, the District Court  finds these currencies “serve the same purposes as gold in terms of a currency, but much more efficiently because it does not have any mass and can be sent easily from place to place.”  Further, the District Court acknowledges that virtual currencies may be here to stay because “online exchanges have become more accessible allowing more members of the public to trade and invest in virtual currencies.”  The District Court concludes there is a greater chance for fraud and criminal activity as these currencies grow in popularity.

• While The Regulations Are Slightly Unclear, There Is No Doubt That Virtual Currencies Are Regulated By Some Governmental Agency.

After taking a closer look at how virtual currencies could potentially be regulated by the Department of Justice, the Security and Exchange Commission, the Treasury Department, the IRS, private exchanges or through state regulations, the District Court settles on the CFTC as the administrative body that is “currently exercising partial supervision of virtual currencies.”  The District Court’s analysis of these regulations provides further support for the finding that the CFTC has standing to seek injunctive relief against anyone violating the CEA.

• Virtual Currencies Are “Commodities” That Can Be Regulated By The CFTC

The McDonnell court must also address whether virtual currencies are “Commodities” as defined under the CEA. Therefore, the District Court must analyze whether virtual currencies fall within the definition of Commodities as defined in the CEA which protects agricultural products and all other goods and articles…and all services, rights, and interests…in which contracts for future delivery are presently or in the future dealt in.”  After a lengthy analysis of this issue, the District Court ultimately concludes “[v]irtual currencies can be regulated by CFTC as a commodity.”  In short, the District Court finds “[v]irtual currencies are ‘goods’ exchanged in a market for a uniform quality and value.”

• The CFTC Is Entitled To An Injunction When The Fraud Is Not Directly Related To The Sale Of Futures Or Derivative Contracts

After finding the CFTC has standing to seek an injunction against the defendants, the McDonnell court next determines there is sufficient evidence that the defendants “committed fraud by misappropriation of investors’ funds and misrepresentation of trading advice and future profits promised to customers.”  On this issue, the District Court concluded that a preliminary injunction in favor of the CFTC was warranted in light of the finding that a fraud had been committed.

• The Scope Of This Decision May Reach Beyond Virtual Currencies

First, the McDonnell decision makes clear that it is time for insurers to start considering whether virtual currency presents losses covered under traditional insurance policies or if new products should be developed.  Over the last few months we have seen more people invest in virtual currencies.  The McDonnell court quotes the December 1, 2017 Bloomberg Businessweek which sheds more light on virtual currencies: “The initial price of bitcoin, set in 2010, was less than 1 cent.  Now it’s crossed $16,000.  Once seen as the province of nerds, libertarians and drug dealers, bitcoin today is drawing millions of dollars from hedge funds.”  (While the price in December 2017 was $16,000, the price has since dropped). The McDonnell decision acknowledges that as the pool of investors increase, we can expect to see an increase in the potential for losses, theft and all the other things the defendants in this case are accused of doing.  Consequently, as virtual currencies become more ingrained in our daily lives, it may be time for insurers to start taking a closer look at losses involving virtual currencies.

Additionally, the McDonnell decision discusses a number of issues currently facing cyber and privacy law.  First, while the District Court finds virtual currencies fall into the definition of “commodities,” the Court has to work to get there.  In the end, the District Court finds that the same law can protect agricultural products and virtual currencies at the same time.  We face many of these same issues in cyber security and privacy law as we try to fit these emerging issues into laws and regulations that may have been on the books for decades.

Finally, the section of the McDonnell decision entitled “concurrent oversight from Other Agencies” discusses how a number of governmental agencies could regulate virtual currencies.  Likewise, cyber security and privacy faces a similar situation as a number of state and federal agencies fight to regulate this emerging area of law. Therefore, while the McDonnell decision provides insight into the regulation of virtual currencies, it also provides guidance for cyber security and privacy law.

The post Court Finds Virtual Currencies Are “Commodities” Subject To Existing Laws appeared first on Privacy Risk Report.

There should be little dispute that the current patchwork of foreign, federal, state and industry cybersecurity regulations need to be harmonized in order to protect data. While these varying laws and proposed laws can be dizzying even for large corporations, it is virtually impossible for small businesses to feel confident they are meeting their obligations under these various laws.  As it stands today, a data collector, regardless of size, has to balance a number of conflicting sources when considering cyber security.  Suffice it to say, the current framework of competing laws and regulations may overwhelm data collectors causing them to simply give up on trying to meet their obligations.  In the end, data protection laws may become useless if they are too complex to be worth a data collector’s effort.

• A Case Study:  Mom and Pop’s Cleaners

As 2018 unfolds, a hypothetical “mom and pop” dry cleaner in Tucson, Arizona keeps a registry of its customers’ names, addresses, phone numbers and email addresses.  We learn that “Mom and Pop’s Cleaners” has customers that include international citizens visiting the United States and others who work at nearby businesses, as well as Arizona residents and residents from other U.S. states.  In an effort to not skirt any laws, Mom and Pop have asked the Privacy Risk Report for assistance in understanding the laws and proposed laws that may impact them in 2018.  The following will take a real world approach and spot the issues presented by the laws and regulations that may impact Mom and Pop’s business in 2018.

• Foreign Regulations Must Be Part Of The Cycle.  

Mom and Pop’s Cleaners does a brisk business with international workers at the nearby regional office of French corporation.  Accordingly, Mom and Pop have questions concerning the data they are collecting on these French residents and residents of other EU nations in 2018.

European Union General Data Protection Regulation

European Union (EU) member states will begin enforcement of the General Data Protection Regulation (“GDPR”) on May 25, 2018.  The GDPR website states this legislation “replaces the Data Protection Directive 95/46/EC and was designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens data privacy and to reshape the way organizations across the region approach data privacy.”  (A guide to the EU GDPR can be found here.)

Importantly, GDPR will apply to all data collectors holding the personal data of EU residents regardless of whether the data collector may be located.  The definition of personal data is broadened to the extent it includes any information “that can be used to directly or indirectly identify the person.”  Therefore, under GDPR, this information can include “anything from a name, a photo, an email address, bank details, posts on social networking websites, medical information, or a computer IP address.”

GDPR also imposes new obligations on how the data is to handled and stored.  For example, EU residents will have a “right of access” that requires data collectors provide specific details about how information is processed.  GDPR grants EU residents a right to have their personal data deleted or erased by a data collector upon their request.  Further, under GDPR, data collectors will be required to perform routine assessments to identify risks for private data.  Finally, the penalties for non-compliance may total anywhere from 4% of annual global turnover of the breaching data collector or €20 Million (whichever is greater).

Mom and Pop should not dismiss the upcoming enforcement of the GDPR as something that only concerns large, multi-national corporations.  Mom and Pop, as with many data collectors of all sizes, may be surprised to find the amount of data they are storing that belongs to EU residents.  Here, there is no question that Mom and Pop have data belonging to customers that are EU residents and should at least consider whether they have obligations under GDPR and how a breach of this information could become a stain on their business.  Further, the GDPR may give some insight to Mom and Pop as to the direction of U.S. privacy laws in the coming years.

Just as Mom and Pop seem to understand their obligations under GDPR, they wonder if GDPR applies to their British customers in light of Brexit.  The GDPR website offers the following stitch of advice:

“If you process data about individuals in the context of selling goods or services to citizens in other EU countries then you will need to comply with the GDPR, irrespective as to whether or not you the UK retains the GDPR post-Brexit. If your activities are limited to the UK, then the position (after the initial exit period) is much less clear.”

Mom and Pop may not be ready to consider how Brexit impacts their collection of data belonging to their British customers.  They have already made more progress in this area than many of their competitors.

• Federal Regulations Need To Be More Tailored

Mom and Pop’s Cleaners also has a number of customers that are tourists from other U.S. states.  Mom and Pop have questions concerning the data they are collecting for these customers in 2018.

The Data Breach Prevention and Compensation Act of 2018

U.S. lawmakers have taken steps to directly regulate credit reporting agencies in response to the Equifax breach.  In its current form, The Data Breach Prevention and Compensation Act of 2018 would create new regulations by expanding the powers of the Federal Trade Commission (FTC).  Specifically, the proposed Act would create an Office of Cybersecurity to monitor large credit reporting agencies.  The Office of Cybersecurity would have the authority to impose fines on any credit reporting agency that breached data or failed to properly report a breach.  Under the current draft of the law, consumers would receive 50% of any fine imposed by the Office of Cybersecurity.

This legislation has been introduced by Senators Elizabeth Warren and Mark Warner after seeing the Equifax breach in 2017.  While this legislation is unlikely to pass, it still makes clear that credit reporting agencies will continue to be under heightened scrutiny in 2018 and beyond.

Of course, even if this legislation passes, Mom and Pop will not need to worry about it since they do not qualify as a credit reporting agency.

IoT Cybersecurity Improvement Act of 2017

The IoT Cybersecurity Improvement Act of 2017 would provide security practices for any company before it can sell interconnected devices to the federal government.  Importantly, this legislation would not regulate all IoT devices.  Commentators have stated that “’[b]road IoT legislation isn’t practical in the current Congress…which is was why the bill’s authors had narrowed its focus to federal procurement.”  There are further questions as to whether this is a good first step that will lead to broad IoT regulation or if these regulations will lose momentum after devices for the federal government are regulated.

Mom and Pop do not have any immediate concerns with this proposed legislation.  Down the road, their business may be safer if any interconnected device they purchase has the same security as that imposed on devices sold to the U.S. government.  However, this legislation does not appear to be of any concern to Mom and Pop over the next year.

• State Regulations Create Wrinkles For Smaller Data Collectors.

Mom and Pop do not have to worry about any national data breach notification requirements.  All attempts to create breach notification standards at the federal level have lost steam.  In particular, the bill referred to as the Data Security and Breach Notification Act appears to have no chance becoming law in 2018.  Unfortunately, as data collectors for Arizona residents, Mom and Pop will face some uncertainty in 2018.

Arizona’s Data Breach Notification Law: Changes in 2018

At present, the Arizona legislature is considering changes to Arizona’s data protection laws.  The current Arizona law requires data collectors to notify individuals of any breach that compromises their information and may cause “substantial economic loss” to that individual.  The new law under consideration in 2018 for Arizona would remove this “substantial economic loss” requirement, and, therefore, would require notice in many more situations.  Additionally, the current law defines “personal information” as an individual’s name combined with a social security number, driver’s license number, non-operating i.d. or financial account number, credit card or debit card number in combination with a security code, access code or password for that account.  The new legislation would no longer require a security code, access code or password to be compromised in order to trigger a data collector’s notification obligations.

In 2018, Arizona’s notification law may also be changed to require notice to affected individuals within 30 days of the breach.  The law presently only requires notification to take place in the “most expedient manner possible without unreasonable delay.”

Based on these changes, Mom and Pop are going to need to take a close look at the data they are storing on Arizona residents and how that data is being protected.  Further, Mom and Pop may also need to take a closer look at their procedures if a breach occurs.  The time frame for their response and the notification to their customers has been taken from a subjective deadline to an objective, 30-day deadline.  Mom and Pop have a lot of work in order to make sure they are in compliance with this law.

Other States Data Breach Notification Laws

Even if Mom and Pop happen to figure out their obligations under Arizona law, they still have to consider the laws for other states where their customers may reside.  As data collectors for residents for a number of states, Mom and Pop face even more uncertainty.  As it stands today, each state has its own data breach notification laws.  Consequently, Mom and Pop may have different obligations, including numerous deadlines to provide notification, for a single breach that includes data for residents of different states.

• Mom And Pop’s Approach For 2018

From a practical standpoint, Mom and Pop are not realistically going to put much thought into complying with GDRP.  However, they may make efforts to comply with their state data protection laws.  While Arizona’s new data law may not be in perfect harmony with GDRP, it is an important first step to get Mom and Pop to at least begin to consider Arizona’s law and make an effort to comply.  Maybe if things go right, Mom and Pop may consider buying an endorsement to their insurance policy for cyber protection in 2019.

Additionally, while it is great to see lawmakers begin to tackle these issues, it will be important to not overwhelm data collectors.  2018 promises to be an interesting year for data protection laws.

The post Ironing Out The Wrinkles In Data Legislation: A Case Study appeared first on Privacy Risk Report.

Barring a major development in the final weeks of this year, we appear to be ready to close the books on privacy/cyber law for 2017.  Of course, with two weeks left in 2017, there is still time for last-minute data breaches, cyber incidents or other surprises.  Just this week, we saw major news stories which include the US government blaming North Korea for the WannaCry cyberattack earlier this year and Sonic Drive-Ins being sued in a class action for its data breach.  Therefore, while we are hesitant to put together a list with a couple of weeks left in 2017, it is safe to form at least some broad conclusions about 2017.

Cyber has been a moving target for years and 2017 has been no different.  In 2017, we saw privacy laws evolve while legislatures attempted to keep up with the various threats.   While we did not see a pivotal cyber insurance law case, 2017 had a fair share of cases that deserve further analysis. We saw a number of cyber incidents and data breaches that should keep litigants and our courts busy for many years.  Overall, we saw a scenario where smaller data collectors have less personal information to protect and can make adjustments in 2018.  The fact that large-scale data breaches are still occurring may indicate that, despite having better information concerning data protection, large-scale data collectors may not be able to make adjustments within their organizations quickly enough to keep up with changes rules and evolving threats.

The body of information concerning data collectors’ obligations is growing and 2017 provided the following insight for consideration in 2018 and beyond:

The Further Development Of State Privacy Laws

Without having a significant body of law to rely upon, state privacy laws typically provide the most guidance for data collectors.  These laws regulate the type of information that must be protected, how to protect that information and the consequences if the information is not protected properly.  In 2017, we analyze revisions and modifications to these laws that should be addressed.

What are “Reasonable Measures” For Data Collectors?

One central issue playing out in 2017 has been how “data collectors” adapt to modifications of state privacy laws. For example, Illinois amended its breach notification statute the Personal Information Act (815 ILCS §530/5) (“PIPA”) to include a requirement that any data collector holding “personal information concerning an Illinois resident” must “implement and maintain reasonable security measures to protect those records from unauthorized access, acquisition, destruction, use, modification, or disclosure.” Illinois joined a number of other states that have expanded the definition of “personal information” to include an individual’s “user name or email address.” Therefore, an entity may have obligations to notify any individual who has had their user name or email address improperly disclosed. The Illinois legislature further broadened the definition of “personal information” to include medical information, health insurance information or biometric data.

PIPA was also amended in 2017 to require data collectors to take “reasonable measures” to protect personal information.  While we really did not get much insight on what the legislature believes may constitute “reasonable measures,” by mid-January of 2017 we had already seen courts provide some guidance.  In our January 19, 2017 post, we analyzed the Dittman decision in Pennsylvania to determine obligations for “data collectors” in the absence of controlling law. With scant law, a “data collector” may want to consider the advice in the Dittman concurrence opinion and take steps to encrypt data, establish adequate firewalls and implement an appropriate authentication protocol to protect data. Otherwise, we are still waiting on a court to address what the “Reasonable Measures” standards means.

On August 15, 2017, the Department of Commerce released Draft NIST Publication 800-53, entitled, Security and Privacy Controls for Information Systems and Organizations, which is intended to provide a “catalog of security and privacy controls for federal information systems and organizations to protect organizational operations and assets, individuals, other organizations, and the Nation from a diverse set of threats including hostile attacks, natural disasters, structural failures, human errors, and privacy risks.”

The stated objectives of the NIST publication includes: “…to make the information systems we depend on more penetration resistant to attacks; limit the damage from attacks when they occur; and make the systems resilient and survivable.” And, in meeting these objectives, the NIST publication provided the following “key questions that should be answered by organizations when addressing their security and privacy concerns”:

• What security and privacy controls are needed to satisfy the organization’s security and privacy requirements and to adequately manage risk?
• Have the security and privacy controls been implemented or is there an implementation plan in place?
• What is the desired or required level of assurance (i.e., confidence) that the selected security and privacy controls, as implemented, are effective in their application?”

At this point, NIST anticipates having a final draft of this publication complete by October 2017 and a final version published by December 29, 2017.  While there may be no requirement to meet the NIST Standards, a data collector has a better chance of showing they took “reasonable measures” if they can demonstrate they attempted to address the NIST standards in addition to the vague requirements found in state privacy laws and the general standards of some industries.

States And Courts Take Steps To Protect Biometric Data

While we saw some changes concerning the storage of “personal data” in 2017, we also received a glimpse of the importance of protecting biometric data.

In late 2016 and 2017, we saw a push by state legislatures to enact new laws that also protect biometric data, such as the Illinois Biometric Information Privacy Act (BIPA). “Biometrics” defines “the field of science relating to the identification of humans based upon unique biological traits, such as fingerprints, DNA, and retinas” and recently “has produced new ways of conducting commercial transactions.” In particular, the protection of biometrics is a growing concern as this technology is turning up in everything from watches that may collect health data, finger-scanners at grocery stores and gas stations to retina scanners for financial transactions.

Not only is this technology is here to stay, but it is already involved in litigation across the country.  For example, in Vigil v. Take-Two Interactive Software, Inc., the U.S. District Court for the Southern District of New York found class action plaintiffs lacked standing to bring suit under BIPA for claims related to how their faces were used to create personalized avatars in a video game. Without a doubt, this will not be the last time a court will be called on to interpret BIPA or similar statutes across the country.  In 2018, we can expect to see data collectors find other uses for biometric information and, therefore, more effort will be needed to protect this information.

By March of 2017, we saw another biometric data case when the Eastern District for the Northern District of Illinois analyzed BIPA in Rivera v. Google Inc., 16 C 02714 (N.D. Ill 2016), and found allegations that Google created and stored face-scans from pictures taken on Google devices may constitute a violation under BIPA and at least may survive a motion to dismiss.

As we move into 2018, we can expect the protection of biometric data will continue to grow in importance for data collectors.

Another Large-Scale Data Breach in 2017: Equifax

While it appeared in 2017 that large-scale data breaches may not occur as frequently as we saw a couple of years ago with Target Stores, Home Depot, Best Buy or the federal government, 2017 still had its fair share of large data breaches. The growing consensus that fewer data breaches may indicate large data collectors were taking better precautions with personal information was called into question when it was announced in September that Equifax had a significant breach.  Admittedly, we are still learning the full scope of Equifax Inc.’s massive data breach which was announced on September 8, 2017. While different numbers have been discussed, it appears about 143 million people may have been impacted. Suffice it to say, this was a huge data breach.

The FTC’s website provides the following facts on the Equifax breach:

The breach lasted from mid-May through July. The hackers accessed people’s names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers. They also stole credit card numbers for about 209,000 people and dispute documents with personal identifying information for about 182,000 people. And they grabbed personal information of people in the UK and Canada too.

Equifax’s breach response at this point initially included offering one free year of its credit monitoring service and provides information via its website created just for this breach.  However, Equifax soon faced a backlash including the following complaints related to its response:

• News reports indicate that a number of people are struggling to determine if their information was included in Equifax’s breach using a website provided by Equifax. After making a number of attempts to use the website, many commentators found the website “hopelessly broken.” By September 8, 2017, Equifax had to issue a statement claiming to have fixed the problems with its website.
• Equifax’s offer to provide free credit monitoring for a year is being called into question as not providing sufficient time to properly monitor one’s credit and as a marketing ploy to get subscribers after the first year has expired. Leaving some commentators to say “so, yes, your worst suspicions are now confirmed. Equifax may actually make money on this breach.”                                                                            
• Equifax had to issue a statement to address growing concerns that the terms of service that consumers must accept before enrolling in the free credit monitoring service required them to waive their rights to sue Equifax for a breach. Equifax’s statement attempted to clarify its position that nothing in the terms of service would apply to this breach.
• More than 20 proposed class-action lawsuits were filed around the country in less than a week since the breach was announced.
• Shares of Equifax closed down 8.2% on September 11, 2017 after falling more that 13% on September 8, 2017.
• SEC filings show that three Equifax executives sold nearly $2 million in shares of the company days after the cyberattack was discovered.  Equifax had to issue another statement after its announcement indicating that while the three executives sold a “small percentage” of their shares August 1 and August 2, 2017, they “had no knowledge that an intrusion had occurred at the time they sold their shares.”

Unfortunately, Equifax’s various supplemental announcements after the initial announcement placed Equifax’s response under further scrutiny.  After the Equifax breach, it became clear that not all large data collectors, despite seeing breach scenarios play out over and over, may not be prepared for a data breach.

Allegations in Uber Breach Demonstrate Need For Clear Response To Incident

If Equifax made it clear that we are not out of the woods on large-scale data breaches, the allegations against Uber after its breach may have shed more light on how large-scale data collectors are handling breaches.  On November 28, 2017 when the City of Chicago and Illinois (“plaintiffs”) filed their Complaint in a case entitled City of Chicago et al. v. Uber Technologies, Inc., Case No. 2017CH15594 (Nov. 28, 2017). The Complaint is based on allegations that “[f]or the past several years, Uber has repeatedly failed to protect the privacy of its customers’ and drivers’ personal information.”  More specifically, the plaintiffs assert Uber took steps to cover up its breach in an effort to avoid negative publicity.  This case, regardless of whether the allegations are proven, should cause “data collectors” to consider what information they are putting (or not putting) out concerning any incidents prior to notification of the incident.

In particular, the plaintiffs contend that, in order to avoid “negative public attention, Uber paid hackers $100,000 to delete the data based on the hackers’ agreement to never speak publicly of the incident.” The plaintiffs claim the alleged cover up came to light because “criminal hackers couldn’t possibly be trusted to protect user data” and they ultimately disclosed the breach. The Complaint states that “Uber went so far as to even track down the criminal hackers and enter into nondisclosure agreements with them as if they were common business partners…”  Further, the plaintiffs claim Uber made this payment so that it appeared to be related to its “bug bounty program” rather than a ransom payment.  The Complaint asserts “[t]his concealment kept riders, drivers, and government agencies in the dark for over a year about Uber’s substandard security practices…”

The alleged cover up continued until November 21, 2017, when Uber’s Board of Directors investigated the practices of Uber’s security team. Uber has still not disclosed this incident to its customers or drivers.

Litigation In 2017 Looked Like Litigation In 2016:  “Standing” To Bring Suit Still Questionable In 2017

As seen in prior years, the threshold question in data breach lawsuits during 2017 is still whether a litigant has “standing” to bring a cause of action against the party that allegedly caused a breach. This hurdle for litigants rises out of Article III of the Constitution that limits the jurisdiction of federal courts to “Cases” and “Controversies” “which are appropriately resolved through the judicial process.” Simply, litigants have not been able to move their cases forward unless they can show a concrete injury and demonstrate that future injuries are more than merely speculative.  Nevertheless, while a number of data breach cases have been lost at the initial pleadings states, some plaintiffs have been able to persuade courts that they suffered concrete injuries and could show the source of their alleged damages to survive a motion to dismiss.

As this body of law has developed over the years, one case in particular, Lewert v. P.F. Chang’s China Bistro, Inc., 14-3700 (7^th Cir. 2014), in the Seventh Circuit, has provided hope for data breach plaintiffs.  Developments in 2017 in the P.F. Chang’s litigation  should provide more hope for plaintiffs.

The P.F. Chang’s data breach litigation traces its origins back to a 2014 data breach where plaintiffs claim their debit and credit card information had been hacked after they had visited a P.F. Chang’s in Illinois. P.F. Chang’s filed a motion to dismiss asserting first, that “the parties’ express contract precludes both an implied contract and a consumer fraud count.” (“Plaintiffs’ claims are that they purchased a meal at P.F. Chang’s and that, while P.F. Chang’s came through on the main course, it dropped the ball on the side order of data security.”) Additionally, P.F. Chang’s claimed plaintiffs’ case should have been dismissed because plaintiffs lacked standing and had no damage. The District Court dismissed plaintiffs’ data breach action for lack of standing and, therefore, did not have to address P.F. Chang’s other arguments for dismissal.

On April 26, 2017 the District Court filed a minute order which merely stated the “motion to dismiss is denied for the reasons stated in open court.” The District Court further granted plaintiffs’ motion to compel P.F. Chang’s to participate in a Rule 26(f) conference and begin discovery.

While it took a while to get here, we are finally at the point in this case where we will see if plaintiffs can gather sufficient evidence to support their claims. Data breach plaintiffs have struggled to survive the pleadings stage as many courts found their damages were too speculative to survive a motion to dismiss. It will be important to watch this case get through the discovery phases and move toward trial in order to get the full picture regarding liability for cyber security. Further, the P.F. Chang’s litigation is even more important since the Neiman Marcus case recently settled before we could see how that litigation unfolds through discovery and further motion practice.

Take-Away For 2018

Based on the developments in 2017, we can expect smaller data collectors to have a wealth of information to use when determining their obligations for storage of personal information.  Smaller data collectors have state privacy laws, industry regulations and cases to look to for guidance. On the other hand, Equifax may show us that larger data collectors may have trouble in 2018.  Even though all data collectors have the same information available concerning their obligations, large data collectors may have too much information and too much red tape to properly prepare for an incident. Out of all the large-scale data collectors, one would hope Equifax was prepared for a breach and had a response ready to go. We may see a scenario where smaller data collectors, despite fewer resources, have a better chance to protect data.

The post A Tale Of Two Worlds: 2017 Shows Us That Small Data Collectors May Have Advantages Over Large Data Collectors appeared first on Privacy Risk Report.

The best strategy for data collectors to prepare a breach response plan may be to look at what others did right and wrong in response to a cyber incident.  After reviewing a number of responses to large-scale data breaches, it has become clear that some responses are better than others. It is also clear that all large-scale breaches and the responses have a number of moving parts.  Therefore, in order to analyze all these moving parts to prepare for an incident, the best method for data collectors may be to break their strategy into the following three phases:

• Pre-Breach Preparations should include discussing breach scenarios in the abstract. This timeframe should be dedicated to identifying an internal and external response team and create a general roadmap for a response.
• Post-Discovery Preparations should include refining the roadmap to address the specific breach facing an entity. By this point, a data collector will have more information on the incident and should be able to prepare for the announcement of the incident.
• Post-Announcement Response should include re-working any portion of the response plan that is not going as intended and responding according to the roadmap created in the earlier phases.

While it is still early in Equifax Inc.’s response, Equifax’s recent breach provides the perfect backdrop to take a closer look at these three phases for preparing for and engaging in a successful breach response.  Admittedly, we are just learning the full scope of Equifax Inc.’s massive data breach which was announced on September 8, 2017. While different numbers have been discussed, it appears about 143 million people may be impacted.  Suffice it to say, this was a huge data breach.  The FTC’s website provides the following facts:

The breach lasted from mid-May through July. The hackers accessed people’s names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers. They also stole credit card numbers for about 209,000 people and dispute documents with personal identifying information for about 182,000 people. And they grabbed personal information of people in the UK and Canada too.

The analysis of this latest breach can be expected to go down the well-worn path of other large-scale breaches seen at Target, Home Depot or Yahoo.  And, over the coming months, we can expect to see more information concerning Equifax’s breach.  For example,  Sens. Orrin Hatch, R-Utah, and Ron Wyden, D-Oregon, respectively the chairman and ranking member of the Senate Committee on Finance, sent Equifax detailed questions about the breach seeking “a detailed timeline of the breach, information about the company’s efforts to identify the number of consumers affected, the breadth of information compromised and the steps Equifax has taken to identify and limit potential consumer harm.”  This information, and being able to analyze this information, will be key for any data collector to review their own breach response plans.

Pre-Breach Preparations Allow A Stress-Free Review Of Safeguards And The Response Game Plan

During the Pre-Breach Preparations, a data collector will have the opportunity to confirm that it has taken all steps necessary to safeguard information and have a roadmap in place if there is an incident.  Once an incident occurs, it may be too late to thoroughly review the roadmap and the general structure must be created in order to fill in the details as the breach unfolds.

First, Equifax’s breach, involving a credit reporting agency, is different than a prior breaches which took place at retailers, financial institutions or medical care providers. That is, Equifax is often called on to provide credit monitoring to individuals that may be caught up in a cyber incident at a retailer, financial institution or medical care provider.  For example, the Illinois Personal Information Protection Act states that any breach notification shall include “the toll-free numbers and addresses for consumer reporting agencies.” See, 815 ILCS 530/10  Therefore, notification letters prepared in accordance with Illinois law would most-likely direct Illinois residents to Equifax.  Equifax and the other credit reporting agencies build their entire business on keeping information safe.  At present, there is no information concerning what Pre-Breach Preparations Equifax had in place but there will undoubtedly be a substantial amount of information disclosed over the coming months.

Post-Discovery Preparations Allow A Response To Address The Specific Facts Of The Incident

Post-Discovery Preparations allow a data collector to address the specific information it has learned from its initial investigation into its response roadmap.  That is, the roadmap can now be revised and supplemented because the investigation will show if this is a case of ransomware, a data breach or some other cyber attack.  The data collector can also determine whether it will notify any individuals and if so, what law governs that notification.  The decision to contact law enforcement should be made during this phase as well.  This phase may be the last time the data collector has full control over the incident.

News reports indicate Equifax discovered the breach on July 29, 2017.  Therefore, Equifax had more than a month, post breach, to formulate a response to this particular breach before it was announced to the public.  However, there is still little information concerning Equifax’s Post-Discovery Preparations at this time.

Post-Announcement Response Allows An Entity To Address Issues That May Have Been Missed In The Other Breach Response Phases

Hopefully, the response plan will only need to be slightly tweaked by the time a data collector reaches the Post-Announcement Response.

Equifax’s breach response at this point includes offering one free year of its credit monitoring service and providing information via its website created just for this breach.  However, over the last week, Equifax has faced a backlash including the following complaints related to its response:

• News reports indicate that a number of people are struggling to determine if their information was included in Equifax’s breach using a website provided by Equifax. After making a number of attempts to use the website, many commentators found the website “hopelessly broken.” By September 8, 2017, Equifax had to issue a statement claiming to have fix problems with its website.
• Equifax’s offer to provide free credit monitoring for a year is being called into question as not providing sufficient time to properly monitor one’s credit and as a marketing ploy to get subscribers after the first year has expired. Leaving some commentators to say “so, yes, your worst suspicions are now confirmed. Equifax may actually make money on this breach.”
• Equifax had to issue a statement to address growing concerns that the terms of service that consumers must accept before enrolling in the free credit monitoring service required them to waive their rights to sue Equifax for a breach. Equifax’s statement attempted to clarify its position that nothing in the terms of service would apply to this breach.
• More than 20 proposed class-action lawsuits have been filed around the country in less than a week since the breach was announced.
• Shares of Equifax closed down 8.2% on September 11, 2017 after falling more that 13% on September 8, 2017.
• SEC filings show that three Equifax executives sold nearly $2 million in shares in the company days after the cyberattack was discovered.   Equifax had to issue another statement after its announcement indicating that while the three executives sold a “small percentage” of their shares August 1 and August 2, 2017, they “had no knowledge that an intrusion had occurred at the time they sold their shares.”

Unfortunately, Equifax’s various supplemental announcements after the initial announcement have placed Equifax’s response under further scrutiny. Equifax is now being called on to respond to a variety of issues since its announcement of this breach.  The Equifax breach makes it clear that the Post-Announcement Response phase can be the most stressful phase and will require a solid roadmap formulated in the earlier breach response phases.

As we learn about the Equifax breach (or any other data breach) it will be key for data collectors to look at all the information related to the breach response to determine if their own brief response roadmap is sufficient.  Analyzing the various phases of a response and how those phases are connected will be necessary to continuously improve their own response plans.

The post Responses To Large-Scale Breaches, Such As Equifax, May Need To Be Analyzed In “Phases” By Data Collectors appeared first on Privacy Risk Report.

As courts and legislatures around the country struggle with issues related to data breaches, cyber, technology and privacy, they are finding a lack of standards to guide them through their struggles. Of course, a court may struggle to determine whether a duty was breached in a data breach case if there is no standard to determine what the duty is, what a breach is, or what constitutes data. Likewise, a legislature will not be able to create a statutory framework to protect its citizens if it does not speak the “language” of data protection.  Further, even if a court can understand the fundamentals related to a particular cyber issue, a court may find a patchwork of state and federal law may govern the analysis of that issue.

A recent example was seen when the United States District for the District of Columbia was called upon to address questions related to a search warrant issued for electronically information stored on the “cloud.” Specifically, in In Re Search Of Information Associated With [Redacted]@gmail.com That Is Stored At Premises Controlled By Google, Inc., 2017 WL 3445634 (D.C. Cir. July 31, 2017 D) the D.C. District Court analyzed whether the government was entitled to data held by Google on its cloud. (“The basic legal question confronting us is not a total stranger to this Court. [citation omitted] With the growing interdependence of world trade and the increased mobility of persons and companies, the need arises not infrequently, whether related to civil or criminal proceedings, for the production of evidence located in foreign jurisdictions.”) In Google, the D.C. District Court summed up this issue as follows:

As a result, the judiciary and legislature have been challenged to keep up with precipitous advancements in technology and global interconnectedness. Traditional notions of “territoriality” and “jurisdiction” have been muddied, especially when it comes to determining the scope of statutes governing access and disclosure of electronic records and communications. The picture is murkier still with the advent of so-called “cloud” computing, which is “the capacity of Internet-connected devices to display data stored on remote servers rather than on the device itself.”

And, while grappling with these new technological concepts, courts are beginning to look to the few common standards available, such as those created by National Institute of Standards and Technology (“NIST”) to form the structure for their decisions. For example, the D.C. District Court relied on a definition of “cloud computing” found in the NIST standards.

In its simplest terms, as the NIST standards gain acceptance, we may soon see a court find liability for a cyber incident when a litigant fails to meet the NIST standards to safeguard data. Therefore, it is even more important to keep current on the NIST standards, which are constantly in transition, as these standards continue to be relied upon to determine legal duty and responsibility.

On August 15, 2017, the Department of Commerce released Draft NIST Publication 800-53, entitled, Security and Privacy Controls for Information Systems and Organizations, which is intended to provide a “catalog of security and privacy controls for federal information systems and organizations to protect organizational operations and assets, individuals, other organizations, and the Nation from a diverse set of threats including hostile attacks, natural disasters, structural failures, human errors, and privacy risks.”  The stated objectives of the NIST publication includes: “…to make the information systems we depend on more penetration resistant to attacks; limit the damage from attacks when they occur; and make the systems resilient and survivable.” And, in meeting these objectives, the NIST publication provides the following “key questions that should be answered by organizations when addressing their security and privacy concerns:

• What security and privacy controls are needed to satisfy the organization’s security and privacy requirements and to adequately manage risk?
• Have the security and privacy controls been implemented or is there an implementation plan in place?
• What is the desired or required level of assurance (i.e., confidence) that the selected security and privacy controls, as implemented, are effective in their application?”

At this point, NIST is seeking public comment from August 15, 2017 through September 12, 2017. NIST anticipates having a final draft of this publication complete by October 2017 and a final version published by December 29, 2017.

While the NIST Standards are intended to create “minimum requirements for federal information systems,” these standards have proven to be the most-comprehensive set of standards for industries that have not adopted their own standards.  Consequently, we can expect to see courts and legislatures continue to borrow terms and concepts from NIST when there are no other standards to rely upon.   Further, insurers may soon require their insureds show they meet NIST standards during the application process as well as through the effective dates of coverage.

The post New NIST Standards Allow Courts And Legislatures To Learn The Language Of Data appeared first on Privacy Risk Report.

On June 27, 2017, the law firm DLA Piper (“law firm”) found itself to be one of many of targets of a recent global cyber attack. The attack reportedly did not compromise any client data.  Reports indicate that, even though email service was disrupted by the attack, lawyers were still able to communicate through text messaging and telephone calls. This attack on the law firm, which by all accounts was aptly prepared for a cyber attack, demonstrates that no business is completely safe and incident response preparation will continue to be a key element in cyber security.

This cyber attack was discussed in a recent decision and provides further proof that data breaches should not be the only concern when considering cyber security.  In Cone et. al. v. Hankook Tire Co., 2017 WL 3446295 (Aug. 10, 2017 W.D. Tenn.), the District Court for the Western District of Tennessee heard arguments during a show cause hearing on questions whether certain attorneys at the law firm, as counsel for the defendant, Hankook Tire (“Hankook”), should be held in contempt after jurors were mistakenly contacted after trial without the District Court’s permission.  While the attorney at the law firm was not held in contempt of court, the District Court made clear that cyber incident, which limited email communications, did not excuse the improper contact of jurors.

The conduct giving rise to the show cause hearing took place after a verdict was returned in favor of Hankook on June 30, 2017. At some point shortly after the case reached a verdict, the court clerk was informed that a “jury researcher” had contact with some of the jurors.  This contact violated the local rules because the parties did not have permission from the District Court to contact jurors to discuss the case.  On July 20, 2017, the District Court issued an order requiring the parties provide information on the jury researcher.

In response to the order seeking information on the jury researcher, counsel for Hankook filed a statement confirming they hired the jury researcher that followed up with the jurors. However, the response filed by Hankook made clear that one of its attorneys (“Sender Attorney”) put into motion a “series of mistaken assumptions” that resulted in the jurors being contacted without the District Court’s permission.  The response indicated the jurors were contacted under the following circumstances:

• On June 27, 2017, prior to the conclusion of the trial, the law firm suffered a cyber attack, disabling the firm’s email.
• On July 3, 2017, Sender Attorney emailed the jury researcher to inform them that a favorable verdict was returned for Hankook. Sender Attorney copied another attorney at his firm (“Copied Attorney”) on this email. The jury researcher responded on the same day asking whether they could contact the jurors. Sender Attorney stated that he thought the jury should be contacted unless the Copied Attorney disagreed.
• On the day after the trial ended, the Copied Attorney was traveling to South Korea and never saw the emails discussing whether the jury researcher should contact the jurors.  The Copied Attorney’s email was not restored until some point after Sender Attorney’s email had been sent.

Based on this timeline, Copied Attorney was not aware of Sender Attorney’s email until some point after the District Court issued the order seeking information on how jurors were contacted after the trial. Copied Attorney further stated that if he would have seen the emails, he would have instructed Sender Attorney to reach out to the other attorneys working on Hankook’s defense to determine if the jurors could be contacted by the jury researcher.  Unfortunately, with Copied Attorney silent on the issue, Sender Attorney and the jury researcher “mistakenly assumed” there was no reason to hold off on contacting the jurors.

The District Court found that Sender Attorney’s violation of the local rules was the result of “a series of questionable assumptions,” but did not rise to the level of contempt of court. While the holding in Cone may have little or no impact on the overall case, the District Court’s finding that there was a series of mistaken assumptions illustrates the impact that a cyber incident may have on the daily operations of any business.  In short, this cyber attack is further proof that we will likely continue to see cyber incidents causing communication disruptions in a variety of businesses.

The post Law Firm Cyber Attack Is Involved In A “Series Of Mistaken Assumptions” appeared first on Privacy Risk Report.

A class action complaint was filed against BART, the San Francisco Bay Area Rapid Transit District, on May 22, 2017 in the District Court for the Northern District of California alleging BART created a “clandestine collection of private cell phone identifiers.” In particular, the plaintiffs claim the “BART Watch APP”—a mobile application that provided users with transit information and the ability to contact the police—collected private data in violation of California’s privacy laws. Elerts Corporation, the software developer, was also named as a defendant for its development of the App.

The Plaintiffs claim that “a detailed review of the BART Watch App reveals that Defendants have been using it to secretly collect Californians’ unique mobile device identification numbers…and periodically track their location.” The Plaintiffs further allege that “by collecting the device identification numbers, locations, and other personal information…Defendants have amassed a trove of data through the App.” And, Plaintiffs claim that these actions by BART and BART Police are prohibited under California law.

• Privacy concerns over law enforcement tracking and collecting cell phone data

Some background is needed on “government surveillance technology” to fully understand the substance of Plaintiffs’ claims. The Complaint addresses news reports in March 2014 about California law enforcement agencies using “Stingray” devices to track and collect cell phone data in a given area. As the reporting on Stingray devices increased, the California legislature took steps to limit the use of Stingrays and similar data collecting technology in California. The Legislature sought to limit “the government’s use of communications interception technologies to ‘collect a variety of data about ‘caught’ cell phones, particularly the phone’s unique numeric identifier and its physical location.”

• Alleged privacy concerns with BART’s Watch App

The Complaint alleges that “[a] forensic review of the App and how it communicates with Defendants’ servers reveals the BART Watch App was programmed to operate just as the communications interception technologies the California Legislature has warned of.” That is, the Plaintiffs assert that the App improperly collects data from users’ cell phones including “the phone’s unique numeric identifier and its physical location.”   The Plaintiffs further assert the App violates users’ privacy when contact information entered by a user is combined with the phones unique numeric identifier. In short, plaintiffs claim the App results in collecting “a host of identifying, tracking, and sensitive data” from users without their permission.

The Third Cause of Action, entitled Violation of Privacy Rights, claims the BART Watch App violates Article I of the California Constitution which “protects citizens against unwanted access to data by electronic and covert means…” This provisions of the California Constitution provides that “All people are by nature free and independent and have inalienable rights. Among these are enjoying and defending life and liberty, acquiring, possessing, and protecting property, and pursuing and obtaining safety, happiness, and privacy.” The Plaintiff’s theory against BART is that the California Legislature recognized that “governmental agencies’ unchecked power to track a ‘phone’s unique numeric identifier and its physical location’” posed a threat to the public. The Legislature attempted to address this threat by enacting such laws as the Cellular Communications Interception Act.  That is, the Plaintiffs claim that BART has created this App which is “masquerading as a transit app that secretly collects” Californians’ private information in an effort to get around the Legislature’s attempt to safeguard this data.

• Impact of this litigation

The practical impact of this litigation may, admittedly, be limited in scope.  Plaintiff’s first cause of action is based on allegations that BART violated the Cellular Communications Interception Act.  This Act required BART to install proper procedures and practices to safeguard user data.  Consequently,  the outcome of this litigation may be limited to data collectors gathering information through cellular communications.  Further, the Plaintiffs’ action is based on the concern over the collection of private data by governmental agencies.

However, while this litigation may offer the most insight for cellular data collection by governmental agencies, private data collectors should not ignore the substance of these allegations.  A number of the allegations in the Complaint call into question whether users were properly informed how their data would be used by BART or other governmental agencies.  That is, the Complaint alleges that privacy disclosures were not easily accessible for users to review before agreeing to download the App.  Regardless of whether the allegations are true against BART, this litigation makes clear that data collectors have a fiduciary responsibility to use data for the exact purpose the data was provided and nothing more.

The post App Users Throw Transit Provider Under The Bus On Privacy Issues And Use Of Data appeared first on Privacy Risk Report.

Technology in the workplace has developed to a point where we now have our personal data and our employer’s data commingled on the same devices.  We may now see employees using work phones to store personal numbers and family pictures while they store work information on our equipment at home.  This commingling of data and equipment is usually not a problem until an employee leaves their position and the employer must decipher what equipment and data the employee has a right to take with them. It is becoming increasingly clear that employee training, including discussions of acceptable uses of employer equipment and data, are the best way to avoid conflicts when an employee departs.

One case in particular demonstrates the confusion that may arise when an employee commingles work and personal data with work and personal equipment.  On April 12, 2017, the California Court of Appeals in Mendez v. Piper, (unpublished) 2017 WL 1350770, Monterey County Super. Ct. No. M113943 (2017), found an employer failed to prove that an employee violated California law when the employee copied his own personal data from a hard drive owned by the employer after the employee quit his job. This case was originally filed by the employee, John Mendez (“Mendez”) when his former employer, Piper Environmental Group (“PEG”) and Mendez’s former wife, Jane Piper (“Piper”) (also the CEO of Piper), told Mendez’s prospective employers that he was barred from divulging trade secrets and could not take employment without violating his marital settlement agreement with Piper.

Mendez sought a judicial declaration and an injunction against PEG while PEG filed a cross-complaint based on allegations that Mendez breached a fiduciary duty and that he violated a confidentiality agreement with PEG. Both the trial court and appellate court dedicated a substantial portion of its analysis to the question of whether Mendez’s alleged copying, using and altering of confidential information stored on PEG computer equipment violated the Uniform Trade Secrets Act, Penal Code section 502.

Section 502 provides in relevant part:

CHAPTER 5. Larceny [484 – 502.9]

( Chapter 5 enacted 1872. )

(a) It is the intent of the Legislature in enacting this section to expand the degree of protection afforded to individuals, businesses, and governmental agencies from tampering, interference, damage, and unauthorized access to lawfully created computer data and computer systems. The Legislature finds and declares that the proliferation of computer technology has resulted in a concomitant proliferation of computer crime and other forms of unauthorized access to computers, computer systems, and computer data.

• Mendez’s Employment And Termination

Mendez testified that during his employment he would have been considered PEG’s “computer system administrator.” PEG allowed employees, including Mendez, to store personal and business data on PEG’s computer system. As part of his duties, Mendez testified that he set up an external drive at his residence and backed up PEG data to a company laptop which he brought home and copied the data to the external drive at his residence. Mendez further testified that his backups included all files, including Mendez’s personal and business data.

At some point, PEG hired a chief financial officer and it quickly became clear that Mendez’s service was no longer needed at PEG. The chief financial officer testified at trial that he believed it was his responsibility to find out as much as possible about PEG’s computer system in order to prepare for Mendez’s departure from PEG. After applying “pressure” on Mendez, Mendez ultimately quit his position at PEG.

• Dispute Over Backup Data

While at a hearing concerning Mendez’s unemployment benefits, PEG’s attorney asked Mendez to return the laptop that Mendez used in the backup process. Shortly after his discussion, Mendez purchased a new computer and transferred the files from the laptop to his new computer. Mendez “wiped” his personal information from the hard drive of the laptop and left only the operating system because he originally planned on donating the laptop. However, after PEG was able to prove that it paid for the laptop, Mendez returned the laptop to PEG after it Mendez had removed his information.

• PEG’S Insufficient Evidentiary Support

The trial court found that PEG failed to carry its burden to prove Mendez had violated section 502 by accessing, copying, using or altering PEG’s data without permission. The California Court of Appeals affirmed the trial court’s findings on the following basis:

o   PEG failed to show Mendez copied data belonging to PEG

The trial court found PEG failed to meet its burden when it provided no evidence that Mendez knowingly copied files belonging to PEG. Rather, Mendez testified that the only data he copied was data he owned. Further, the court rejected testimony proffered by PEG’s forensic computer expert to the extent this expert was “an expert in identifying which files were present on a computer and when files had been accessed, copied, or deleted, but he was not an expert on which files contained PEG’s data.” The Court of Appeals found evidence to support the trial court’s finding that “Mendez accessed the hard drive in order to retrieve his personal information (which was properly on the computer).”

o   PEG failed to show Mendez acted without permission in retrieving his data.

The court also rejected PEG’s assertion that Mendez needed its permission to retrieve personal data of the laptop after his employment was terminated. In support of its findings, the court held that “[f]or the purposes of storing documents and photos, a computer is akin to a filing cabinet or desk.” In support of its decision, the court further noted:

We believe that when an employer expressly or implicitly authorizes an employee to personalize his or her workspace with personal property, the employee has implicit authority to remove such personal property upon separation from employment (within any parameters reasonably needed to protect coworkers and the employer’s property). The employer does not acquire ownership of the employee’s personal property by some kind of adverse possession. We see no reason why the same principle should not apply to an employee’s personal information when it is stored on a work computer system. As the trial court implicitly concluded, Mendez had permission to retrieve his personal data from the external drive. In any event, it was PEG’s burden to prove Mendez acted without permission, not his burden to prove he had permission.

Based on this reasoning, the Court of Appeals affirmed the trial court’s decision that PEG failed to meet its burden of proof and that the data stored by the employee belonged to the employee.

•  Employee Training Is Key

This is not the first time we have seen disputes arise over data when an employee is terminated. For example, we have seen disputes involving account passwords where, after being terminated, the sole person that has possession of important workplace passwords demands money to provide the passwords to his former employer.  These situations are avoidable if employees and employers take the time before the stress of employee’s departure to determine how personal and business data and equipment should be treated.  Further, these issues could be addressed during quarterly meetings employers should have with employees to address data and privacy issues in the workplace. Even though the Mendez court found a computer is similar to a filing cabinet or a desk, the proper use of an employer’s computer should receive more discussion than the use of a filing cabinet.

The Illinois Personal Information Protection Act requires “Data Collectors” to take “reasonable measures” to protect data.  Contact Todd M. Rowe at Tressler LLP to discuss how employee meetings can be used to further ensure you are protecting data.

The post Take This Job And Shove It—Oh, But First Can I Get My Family Pictures and iTunes Off My Work Phone? appeared first on Privacy Risk Report.