Privacy and Information Security Law Blog | Privacy Lawyer & Attorney

Connecticut AG Announces Agreement with MetLife over 2009 Breach Incident

Posted on January 27, 2012 by Hunton & Williams LLP

On January 24, 2011, Connecticut Attorney General George Jepsen and Consumer Protection Commissioner William Rubenstein announced that they had reached an Assurance of Voluntary Compliance (“AVC”) with Metropolitan Life Insurance Co. (“MetLife”) in connection with an incident involving the disclosure of customer personal information on the Internet. In November 2009, a MetLife employee posted the personally identifiable information of current and former MetLife customers, including their Social Security numbers, on the Internet. Following the discovery of the posting, MetLife acted to mitigate possible harm by providing credit monitoring and identity theft insurance to the affected customers.

Tags: Connecticut, Consumer Protection, Credit Monitoring, Personally Identifiable Information, Social Security Number, State Attorneys General

Hunton Hosts Webinar on Current Trends in Global Privacy Enforcement

Posted on January 27, 2012 by Hunton & Williams LLP

On January 12, 2012, Hunton & Williams hosted an hour-long webinar on the current enforcement environment in the U.S. and EU. The webinar, Current Trends in Global Privacy Enforcement, covered issues ranging from the Federal Trade Commission’s tougher approach to investigations to increased monitoring of corporate privacy practices by European data protection authorities. Hunton & Williams speakers included Lisa J. Sotto, partner and head of the Global Privacy and Data Security practice, London partner Bridget Treacy, London senior attorney Rosemary Jay and Brussels associate Dr. Jörg Hladjk.

Listen to the webinar now.

Tags: Bridget Treacy, Data Protection Authority, Federal Trade Commission, Germany, Jörg Hladjk, Lisa Sotto, Rosemary Jay, State Attorneys General, United Kingdom

UK ICO Outlines the Year Ahead

Posted on January 26, 2012 by Hunton & Williams LLP

On December 28, 2011, UK Information Commissioner Christopher Graham outlined the ICO’s agenda for 2012 in a post on the ICO blog, highlighting the European Commission’s proposals for reviewing the EU data protection framework, the post-legislative scrutiny process with respect to the UK Freedom of Information Act (“FOIA”) and the ICO’s Information Rights Strategy. The Commissioner cautioned against allowing data protection compliance to fall by the wayside in the current, tough economic climate, especially given the inevitable reputational damage caused by big data breaches and the ICO’s power to impose fines.

Tags: Christopher Graham, EU Data Protection Directive, Freedom of Information Act, Information Commissioners Office, Ireland, United Kingdom

EU and U.S. Formulating a Privacy Framework Agreement

Posted on January 25, 2012 by Hunton & Williams LLP

As reported in BNA’s Privacy Law Watch, EU Member States are working on an overarching privacy framework agreement with the United States. The framework agreement, which may be used as a starting point for future negotiations, aims to reduce the amount of time and resources required to prepare new agreements between the European Union and the United States.

Tags: Article 29 Working Party, David Vladeck, EU Member States, Federal Trade Commission, Jon Leibowitz, OECD, Viviane Reding

European Commission Publishes Data Protection Law Reform Package

Posted on January 25, 2012 by Hunton & Williams LLP

On January 25, 2012, the European Commission published its long-awaited legislative package to reform EU data protection rules. The package includes a regulation that covers data processing in the private sector and by public authorities and a directive covering data processing for criminal justice purposes, as well as a communication, a report on the protection of personal data processed in the framework of police and judicial cooperation, and an impact assessment with a summary.

Tags: Article 29 Working Party, EU Data Protection Directive, European Commission

Minnesota AG Sues Debt Collection Agency for Health Privacy Violations

Posted on January 24, 2012 by Hunton & Williams LLP

On January 19, 2012, Minnesota Attorney General Lori Swanson announced a lawsuit against Accretive Health, Inc., (“Accretive”) for violations of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations, the Minnesota Health Records Act, Minnesota’s debt collection statutes and Minnesota’s consumer protection laws. The suit, which was filed in Federal District Court in Minnesota, alleges that Accretive failed to adequately safeguard patients’ protected health information (“PHI”). This failure contributed to a July 2011 information security breach when an Accretive employee left an unencrypted laptop containing information of approximately 23,500 patients in a rental car. The laptop was stolen and has not yet been recovered.

Tags: Consumer Protection, HIPAA, HITECH Act, Minnesota, Privacy Rule, Protected Health Information, Social Security Number, State Attorneys General

Concerns over Independence of Hungary’s DPA Prompt Infringement Proceedings

Posted on January 24, 2012 by Hunton & Williams LLP

On January 17, 2012, the European Commission initiated expedited infringement proceedings against Hungary over recent changes to its Constitution which are considered incompatible with EU law. The proceedings follow a number of changes made to the Hungarian Constitution that came into effect on January 1, 2012. Of particular concern to the Commission are amendments affecting the independence of the national data protection authority. The Hungarian government has one month to comply, or face enforcement proceedings in the European Court of Justice.

Tags: Data Protection Authority, EU Data Protection Directive, European Commission, Hungary, Legislation, Penalty

Supreme Court Finds Warrantless GPS Tracking Unconstitutional

Posted on January 23, 2012 by Hunton & Williams LLP

On January 23, 2012, the U.S. Supreme Court issued its ruling in the landmark United States v. Jones case, holding 9-0 that attaching a GPS device to a suspect’s car to monitor the vehicle’s movements constitutes a Fourth Amendment search that requires a warrant. Writing for the Court, Justice Scalia found that it was not necessary to determine whether Jones had a “reasonable expectation of privacy” in the underbody of his Jeep parked on a public street because the search violated the Court’s traditional common-law trespass test. Scalia stated:

“It is important to be clear about what occurred in this case: The Government physically occupied private property for the purpose of obtaining information. We have no doubt that such a physical intrusion would have been considered a ‘search’ within the meaning of the Fourth Amendment when it was adopted.”

We reported on U.S. v. Jones in November of last year, when the Supreme Court heard oral arguments in the case.

Tags: Criminal Law, Geolocation, Supreme Court

Third Circuit Holds Data Breach Plaintiffs Lack Standing

Posted on January 20, 2012 by Hunton & Williams LLP

On December 12, 2011, the United States Court of Appeals for the Third Circuit affirmed a decision that employees of Ceridian Corporation’s (“Ceridian’s”) customers did not have standing to sue Ceridian after the payroll processing firm suffered a data breach.

In December 2009, a hacker may have gained access to personal and financial information of Ceridian’s customers, including names, addresses, Social Security numbers, dates of birth and bank account information. Although it is not known if the hacker read, copied or understood the data, Ceridian sent notification letters to affected individuals informing them of the breach and offering to provide one year of complimentary credit monitoring and identity theft protection.

Tags: Consent Order, Consumer Protection, Credit Monitoring, Cybersecurity, Federal Trade Commission, Hacker, Litigation, Social Security Number

French Court of Cassation Excludes Application of Data Protection Act to Competition Authority’s Investigation

Posted on January 20, 2012 by Hunton & Williams LLP

On November 30, 2011, the French Court of Cassation upheld a decision that excluded the application of the French Data Protection Act (Loi relative à l’informatique, aux fichiers et aux libertés) to an investigation conducted by the French Competition Authority (Autorité de la Concurrence) on the grounds that the search and seizure was authorized by an “freedoms and custody judge” (juge des libertés et de la détention).

Tags: CNIL, Data Protection Authority, Employee Monitoring, EU Member States, France, Olivier Proust

Privacy and Information Security Law Blog - Global privacy and information security law updates and analysis

Hunton Hosts Webinar on Current Trends in Global Privacy Enforcement

UK ICO Outlines the Year Ahead

EU and U.S. Formulating a Privacy Framework Agreement

European Commission Publishes Data Protection Law Reform Package

Concerns over Independence of Hungary’s DPA Prompt Infringement Proceedings

Supreme Court Finds Warrantless GPS Tracking Unconstitutional

French Court of Cassation Excludes Application of Data Protection Act to Competition Authority’s Investigation

Published By Hunton & Williams

Search

Subscribe

Topics

Recent Updates

Blogroll

Privacy News