Privacy and Data Security Risks in Cloud Computing

Cloud computing raises complex legal issues related to privacy and information security.  As legislators and regulators around the world grapple with the privacy and data security implications of cloud computing, companies seeking to implement cloud-based solutions should closely monitor this rapidly evolving legal landscape for developments.  In an article published on February 3, 2010, Lisa Sotto, Bridget Treacy and Melinda McLellan explore U.S. and EU legal requirements applicable to data stored by cloud providers, and highlight some of the risks associated with the use of cloud computing.

EU Approves New Standard Contractual Clauses for Transfers to Data Processors

On February 5, 2010, the European Commission adopted a new set of standard contractual clauses (“SCCs”) for transfers of personal data from data controllers in the EU to data processors outside the EU.  View the European Commission press release.  The clauses were negotiated over several years between the European Commission and a group of business associations led by Brussels-based Hunton & Williams partner Christopher Kuner, who is chair of the Task Force on Privacy and Data Protection of the International Chamber of Commerce.

Continue Reading...

Canadian Privacy Commissioner Investigates Facebook

Pursuant to a public complaint, on January 27, 2010, the Privacy Commissioner of Canada announced a new investigation into Facebook.  The investigation concerns the social networking site’s introduction of a tool that required its users to review their privacy settings in December 2009.  According to the complaint, Facebook’s new default settings allegedly made some users’ information more accessible than previously had been the case.  Elizabeth Denham, the Assistant Privacy Commissioner, indicated “[s]ome Facebook users are disappointed by certain changes being made to the site – changes that were supposed to strengthen their privacy and the protection of their personal information.”

The new complaint follows the Commissioner’s July 2009 release of findings resulting from an investigation into Facebook’s privacy policies and practices.  The findings highlighted concerns regarding Facebook, including a need for increased transparency and clarity.  The Office of the Privacy Commissioner will continue to follow up with Facebook as the company implements changes to its site.  

For further information, please see the Office of the Privacy Commissioner's News Release.

Hunton & Williams Prepares Study for the European Commission on the Interaction between Data Protection Law and Copyright Enforcement

On February 3, 2010, Christopher Kuner, a partner in Hunton & Williams’ Brussels office and head of the firm’s EU Privacy Practice, presented to the “Stakeholders’ Dialogue on Illegal Uploading and Downloading,” organized by DG Internal Market and Services of the European Commission.  Mr. Kuner presented a study which the Hunton & Williams Brussels team prepared for the Commission on the interaction of data protection law and copyright enforcement.  The study covers both the legal framework under EU law and the situation in six selected EU Member States (Austria, Belgium, France, Germany, Spain and Sweden).  The relationship between data protection and copyright enforcement was a point of contention in the recent amendment of the EU Directive on Privacy and Electronic Communications. 

Continue Reading...

German Federal Network Agency Imposes €500,000 in Fines for Telemarketing Violations

On January 29, 2009, the German Federal Network Agency (the “Agency”) stated in a press release that it has imposed fines for unauthorized telephone advertising in six cases.  This brings the total to nine procedures (resulting in €500,000 in fines) during the months of December 2009 and January 2010, and marks the first time the Agency has imposed sanctions for violations of the prohibition on unauthorized telephone advertising and for breach of the caller ID requirement for marketing calls.

Continue Reading...

FTC's Second Exploring Privacy Roundtable

The Federal Trade Commission’s second “Exploring Privacy” roundtable concluded Thursday, January 28, 2010.  The roundtable did not provide many firm conclusions, but it did help further refine some hard issues facing privacy protection.

Although Thursday’s hearing was intended to be devoted to technology issues, the role of regulation appeared to dominate the discussions.  “Everyone is dying to talk about regulation,” said Jessica Rich, Deputy Director of the Bureau of Consumer Protection, moderating a panel on Technology and Policy.

Continue Reading...

FINRA Issues Guidance on the Use of Blogs and Social Networking

On January 25, 2010, the Financial Industry Regulatory Authority (“FINRA”) issued Regulatory Notice 10-06, Guidance on Blogs and Social Networking Web Sites (the “Guidance”) for securities firms, investment advisors and brokers.  FINRA, which is the largest non-governmental financial regulator, previously had issued guidance on other issues pertaining to interactive web sites, such as participation by securities firms and their employees in Internet chat rooms discussing stocks or investments.  The goals of the Guidance are to “ensure that—as the use of social media sites increases over time—investors are protected from false or misleading claims and representations” as well as “to interpret [the] rules in a flexible manner to allow firms to communicate with clients and investors using” blogs and social networking.

Continue Reading...

British Columbia Information and Privacy Commissioner Resigns

On January 19, 2010, Information and Privacy Commissioner David Loukidelis resigned to accept the post of Deputy Attorney General of British Columbia.  Mr. Paul Fraser, the Conflict of Interest Commissioner, has been named interim Commissioner.  The appointment of a permanent successor is expected in the spring when the British Columbia legislature reconvenes.  
 
View the Commissioner Loukidelis' letter of resignation

Microsoft Calls for Legislative Action to Set Rules for Cloud Computing

Microsoft is urging Congress and the information technology industry to act now to ensure that cloud computing is guided by an international commitment to privacy, security and transparency for consumers, businesses and government.  A survey commissioned by Microsoft found that while the general population and senior business leaders are excited about the potential of cloud computing, most are concerned about the security, access and privacy of their information in the cloud and believe the government should establish laws, rules and policies for cloud computing.  Microsoft also has called for an international dialogue on data sovereignty to address users' desire that rules and regulations governing their data remain uniform regardless of the physical location of the information. 

Microsoft’s proposal includes reforming and strengthening the Electronic Communications Privacy Act to provide stronger protections for consumers and businesses; modernizing the Computer Fraud and Abuse Act to give law enforcement the tools to prosecute malicious hackers and deter online-based crimes; enacting legislation to ensure that consumers and businesses know whether and how their information is accessed and used by service providers and how it will be protected online; and pursuing a new multilateral framework to address data access issues globally.

View more information on Microsoft’s proposal.

Hunton & Williams LLP Privacy Head Appointed to IAPP Board of Directors

Lisa Sotto, head of the Privacy and Information Management practice of Hunton & Williams LLP, has been appointed to the Board of Directors of the International Association of Privacy Professionals (“IAPP”). The IAPP is the world’s largest association of privacy professionals and works to define, promote and improve the privacy profession through networking, education and certification.

Sotto also serves as a member and is a former vice chair of the U.S. Department of Homeland Security’s Data Privacy and Integrity Advisory Committee. She is co-chair of the International Privacy Law Committee of the New York State Bar Association and chair of the New York Privacy Officers Forum.

Archives