Good data protection sense from the Brits

The UK's Information Commissioner's Office (ICO) has done what the Federal Trade Commission should do -- produced a no-nonsense Guide to Data Protection. This Guide is intended to provide small and medium sized enterprises with practical advice about the UK's Data Protection Act and takes a straightforward look at the data protection principles, using practical, business-based examples. It allows users to choose whether they need very basic, or more detailed compliance advice, depending on their needs.

Stephen Alambritis, Head of Public Affairs at the Federation of Small Businesses, said: “Small businesses do not have time for pages and pages of jargon and gobbledegook, but getting data protection right makes good business sense. Data protection lapses cost reputations and can affect the bottom line. But, many organisations tell us that data protection law is difficult to understand. This new no-nonsense guide will help the business community to understand and comply with the law.”

This Guide will also be helpful for non-UK companies to understand their data protection obligations when doing business in the UK with the data of UK citizens. Clear, straight-forward and unambiguous. Makes sense.

Privacy and Security Bits and Bytes

Our Friday afternoon feature --

Virginia Adds Medical Information Breach Law - The Commonwealth of Virginia has amended its data breach notification law to include breaches of medical information. For the text of the amendment, link here. Even if the data is encrypted, the law requires notice if the breach involved a person with access to the encryption key. The law requires notice to affected individuals (residents of Virginia) as well as Virginia's Office of Attorney General. The Attorney General can bring an action for violations of the law and impose civil penalties up to $150,000 per breach (or a series of similar breaches of a similar nature that are discovered in a single investigation). The law does not apply to persons or entities that must report the breach under the HITECH Act.

“Data Security – It’s a Responsibility, Not an Option” – interesting point of view from InfoSecIsland.


FTC Complaint Focuses on Tracking, Profiling of Consumers. -- Yesterday, the Center for Digital Democracy, the US Public Interest Research Group, and the World Privacy Forum filed a complaint with the FTC regarding two emerging trends in online advertising that they say pose growing threats to consumer privacy: auctioning of individual Internet users for targeted advertising opportunities and the combination of online and offline data about Internet users. The complaint describes what the group feels is a growing trend in online behavioral advertising that involves the real-time sale and trade of the right to target individual users with online ads through the use of data compiled about users via their Web surfing habits. The groups have asked the FTC to investigate the data and advertising exchanges operated by Google, Microsoft and Yahoo, as well as several firms that support the auctioning and data collection/targeting system, including AppNexus, BlueKai and Rubicon Project. Furthermore, the group has asked the FTC to require the firms involved in real-time online tracking and auction bidding to allow consumers to opt-in to participate in such activities; require firms to update their privacy policies so consumers are aware of these activities; and ensure consumers are compensated for the use of their data. Stay tuned.

Large UK Data Breach Penalty Takes Effect -- As we warned you in this space last month, this week marks the effective date of the new, substantially higher fines in the UK for data loss. Reports are that up to 65 percent of workers are unaware of the new penalties – which can quickly hit £500K for large scale breaches. If you’re operating in the UK, check out Data loss fines hit £500K from today • The Register or ICO vows to impose heavy fines for major data breaches - 07 Apr 2010 - Computing.

And Finally --

This item from Wired Magazine proves yet again that identity theft is not limited to computer hacking or interception of electronic messages. A 74-count indictment unsealed yesterday in Arizona details charges that a group of sophisticated identity thieves managed to steal millions of dollars by filing bogus tax returns using the names and Social Security numbers of other people, many of them deceased.

The Google Payload Data Fallout Continues

Written by Jillian Collins

Connecticut Attorney General Richard Blumenthal says he will lead a multistate investigation into Google Street View cars’ unauthorized collection of personal data from WiFi networks. The Connecticut AG said he expects a significant number of states to participate. More than 30 states participated in a recent conference call regarding the Connecticut investigation.
In a statement released yesterday, Blumenthal called Google’s data collection a “deeply disturbing invasion of personal privacy,” and said that consumers have a right to know what personal information, including potentially emails, web browsing habits and passwords, Google may have collected. “Google must come clean, explaining how and why it intercepted and saved private information broadcast over personal and business wireless networks,” he said. Google maintains that it did not collect the payload data intentionally and never used it , but the company may be facing not only domestic consequences but also investigations in the UK and other affected countries. Google says it stopped collecting Wi-Fi data from its Street View vehicles when it discovered the data collection problem last month following an inquiry by German regulators. The Google payload data incident is just one recent PR problem related to privacy concerns for the internet giant. Google took harsh criticism for the launch of Buzz because the feature initially revealed information about the names of users' email contacts. Google has significantly revised the service; now, it merely suggests followers, rather than automatically creating them.

Related links:http://www.mediapost.com/publications/?fa=Articles.showArticle&art_aid=130619http://www.foxnews.com/world/2010/06/22/uk-police-investigating-alleged-google-privacy-breach-public-wi-fi-networks/

Privacy and Security Bits and Bytes

There's a report out of the UK that a proposed (and highly controversial) mobile directory has so many people opting-out, that the system has crashed. I guess no one really wants those telemarketers to be able to find them via mobile....UK Mobile Directory Crashes

A good summary from the Edmonton Sun regarding the stunning breach of the Alberta Health Services database - lessons for the US race to electronic medical records....
Privacy breach shocker Alberta News Edmonton Sun

BusinessWeek had a real "heart-to-heart"with Heartland Payment Systems CEO Robert Carr on the data security breach his company experienced late last year. In the article, Carr details the series of events leading up to the breach, and those that followed--the board meeting, the disclosure, damage containment, and the drop in stock price, among others. It's a fascinating look at the inside of a massive data breach and what happens while the company is spinning the disclosure.

Big Fines Coming in UK for Data Breaches

By Susan Foster, Mintz Levin London

As of April 6, 2010, the UK’s Information Commissioner’s Office (ICO) can levy fines of up to £500,000 for breaches of the Data Protection Act 1998 that are:
• serious in nature
• deliberate or reckless, and
• likely to cause substantial damage or distress to an individual.

The standard for “reckless” non-compliance may take some by surprise: Did the data controller know, or should it have known, that there was a risk of a breach of a kind likely to cause substantial damage or distress? If so, were reasonable steps were taken to prevent the breach?

The ICO has given a specific example that may make IT and privacy officers flinch, but will come as no surprise to those in the U.S. who have been dealing with the likes of Massachusetts 201 CMR 17.00 or the HITECH Act: Does the company have appropriate policies and procedures in place such as the encryption of all laptops and removable media (such as flash drives) to avoid loss of personal data if an employee’s laptop or removable media is stolen? Failing to do so might be considered “reckless” depending on the likely consequences of the loss of personal data contained in the unsecured devices.

Further Information
For more information, see our our Mintz Levin Client Alert. Also, the ICO has published detailed guidance concerning when fines will be issued, the process for trying to get fines withdrawn or reduced, how to appeal, and payment.

Update from ComputerWorld on Denial of Service Attacks

Article says that likely source of last week's massive DDOS attacks was the U.K. and not North Korea.

Link here

Hotel Chain Hacked Again....

Wyndham Hotels and Resorts has apparently notified the U.S. Secret Service and several state attorneys that hackers stole customer names and payment card information from its computer system. Wyndham has since notified credit card companies so that affected cardholders' accounts may be monitored. It also has hired a firm to investigate the breach and assist in data security improvements. This is the company's third data breach in one year.

Related Links
Letter posted to Wyndham website
V3 UK - Wyndham Hotel Chain Hacked Again