Monthly Archives: June 2009

New Data Security Breach Laws in Alaska and South Carolina

Posted on June 26, 2009 by Hunton & Williams LLP

On July 1, 2009, new laws will take effect in Alaska and South Carolina that will require entities that have experienced data security breaches involving personal information to notify affected individuals of the breaches.  With these additions, a total of 44 states, plus the District of Columbia, Puerto Rico and the U.S. Virgin Islands, will have active breach notification laws in place.  There are no breach notification laws in Alabama, Kentucky, Mississippi, Missouri, New Mexico and South Dakota.

Continue reading…

Tags: ,

Nevada Updates Encryption Law and Mandates PCI DSS Compliance

Posted on June 17, 2009 by Hunton & Williams LLP

As of January 1, 2010, Nevada law will require businesses to use encryption when data storage devices that contain personal information are moved beyond the physical or logical controls of the business, in addition to continuing to require that personal information be encrypted if it is transferred outside the secure system of the business. The new law repeals the existing Nevada encryption law, which will remain in effect until January 1, 2010. (For more information on the existing Nevada encryption law, please see our previous Client Alert.) The new law also mandates compliance with the Payment Card Industry Data Security Standard (“PCI DSS”) for businesses that accept payment cards. The law applies to organizations doing business in Nevada and provides that compliance will shield such businesses from liability for damages from a security breach.  To read more, click here.

Tags: , , ,

Obama Proposes New Financial Services Consumer Protection Agency

Posted on June 17, 2009 by Hunton & Williams LLP

The Obama Administration today formally announced its sweeping proposal for new regulation of the financial industry.  The plan proposes the formation of a new watchdog agency that would seek to protect consumers’ interests.  The proposal raises a number of privacy and data security questions, such as the role of the new financial services consumer protection agency in protecting privacy and data security and the continued role of the Federal Trade Commission as the lead agency in this area.  The announcement is available here.  We will keep you posted as more details regarding the plan emerge.

Tags: , ,

Liability for Data Security Auditors

Posted on June 16, 2009 by Hunton & Williams LLP

A lawsuit that will soon commence in Arizona has the potential to alter the data breach liability landscape by making data security auditors liable for data breaches experienced by the companies they audit.  The case, Merrick Bank Corp. v. Savvis Inc., has its origins in events that began in 2003, when Merrick Bank (“Merrick”) offered to hire CardSystems Solutions (“CardSystems”) to process credit card transactions for its merchant customers.  The offer was contingent upon CardSystems achieving certification under VISA’s Cardholder Information Security Program (“CISP”), which is the predecessor to the Payment Card Industry Data Security Standard (“PCI DSS”).  Savvis audited CardSystems in 2004 and found that it had “implemented sufficient security solutions” and followed “industry best practices.”  VISA certified CardSystems shortly after receiving Savvis’ audit report.  In 2005, CardSystems revealed that it had experienced an information security breach that compromised forty million payment cards.

Continue reading…

Tags: , , , , ,

UK Information Commissioner Initiates Dialogue on Online Privacy

Posted on June 12, 2009 by Hunton & Williams LLP

The UK Information Commissioner is initiating a consultation to develop a code of practice that will help companies address online privacy issues. It is anticipated that the code will provide guidance on the following matters:

  • Operating a privacy-friendly website
  • Rights and protections for individuals
  • Privacy choices and default settings
  • Cyberspace and territoriality

The UK Information Commissioner’s Office has requested that interested parties host discussion sessions. Hunton & Williams’ London office, together with the firm’s Centre for Information Policy Leadership, will be involved. Companies that are interested in participating should contact Bridget Treacy at btreacy@hunton.com or Paula Bruening at pbruening@hunton.com.

Tags: ,

Sears Settles FTC Enforcement Action Regarding Consumer Tracking

Posted on June 11, 2009 by Hunton & Williams LLP

On June 4, 2009, the Federal Trade Commission (“FTC”) reported that Sears Holdings Management Corporation (“Sears”) agreed to enter into a settlement regarding the Commission’s allegations that the company violated Section 5 of the FTC Act in connection with a new online community application it had developed.  Participation in the community allowed Sears to track consumers’ online and, to some extent, offline activities.  The FTC’s action is notable as a potential precursor to future enforcement by the FTC in the areas of both transparency and tracking online behavior, the latter having been previously highlighted as an area of interest for the agency.  The settlement, discussed in more detail below, is notable in that its requirements make clear that substantial tracking of consumer behavior must be sufficiently transparent (not disclosed only in a lengthy privacy policy or agreement), consumers’ opt-in consent to such tracking must be obtained and, disclosures regarding the nature of the tracking must be made at a meaningfully early stage of the transaction.

Continue reading…

Tags: , ,

French Senate Issues Report on Right to Privacy in the Digital Age

Posted on June 11, 2009 by Hunton & Williams LLP

On June 3, 2009, the French Senate’s Commission on Laws issued a report on the right to privacy in the digital age (‘La vie privée à l’heure des mémoires numériques’) (the “Report”). The issuance of the Report is perhaps the most important legislative initiative in France in the field of privacy and data protection since the implementation of the EU Data Protection Directive in 2004.

Continue reading…

Tags: , , ,

FTC Publishes Identity Theft Program Template for Low-Risk Entities

Posted on June 8, 2009 by Hunton & Williams LLP

On May 13, 2009, the Federal Trade Commission ("FTC") published a compliance template designed to assist financial institutions and creditors "at low risk for identity theft " in developing the Identity Theft Prevention Program required by the FTC’s Identity Theft Red Flags and Address Discrepancies Rule (the "Rule").  The template is entitled "A Do-It-Yourself Prevention Program for Businesses and Organizations at Low Risk for Identity Theft."

Continue reading…

Tags: , ,

EU: New FAQs on Binding Corporate Rules

Posted on June 4, 2009 by Hunton & Williams LLP

On April 27, 2009, the Article 29 Working Party issued a new working document (WP 155 rev.04) on frequently asked questions relating to binding corporate rules ("BCRs").  Two new FAQs were adopted: (1) FAQ 10 deals with the relationship between EEA data protection laws and BCRs; and (2) FAQ 11 relates to the reversal of the burden of proof in the context of BCRs.  The Working Party reiterated that, although BCRs may offer an adequate level of protection to personal data being transferred within the same company, they do not exempt multinationals from complying with national data protection laws and taking local compliance steps.  The Working Document is available here.

To read more and for additional EU data protection updates, please click here.

Tags: , , , ,

French Data Protection Authority Issues 2008 Annual Activity Report

Posted on June 2, 2009 by Hunton & Williams LLP

On May 13, 2009, the French Data Protection Authority (“CNIL”) published its Annual Activity Report.  The Report highlights increasing enforcement activity, noting a record number of investigations, formal notifications and fines.  Having recently celebrated its thirtieth anniversary, the CNIL stated that it seeks to constantly evolve and meet the challenges of modern society by pursuing three key points: (i) diversifying its sources of financing; (ii) increasing the number of personnel; and (iii) including data protection and privacy rights in the French constitution in the near future.

Continue reading…

Tags: , , ,