Enforcement | Privacy and Information Security Law Blog

Connecticut AG Announces Agreement with MetLife over 2009 Breach Incident

Posted on January 27, 2012 by Hunton & Williams LLP

On January 24, 2011, Connecticut Attorney General George Jepsen and Consumer Protection Commissioner William Rubenstein announced that they had reached an Assurance of Voluntary Compliance (“AVC”) with Metropolitan Life Insurance Co. (“MetLife”) in connection with an incident involving the disclosure of customer personal information on the Internet. In November 2009, a MetLife employee posted the personally identifiable information of current and former MetLife customers, including their Social Security numbers, on the Internet. Following the discovery of the posting, MetLife acted to mitigate possible harm by providing credit monitoring and identity theft insurance to the affected customers.

Tags: Connecticut, Consumer Protection, Credit Monitoring, Personally Identifiable Information, Social Security Number, State Attorneys General

Hunton Hosts Webinar on Current Trends in Global Privacy Enforcement

Posted on January 27, 2012 by Hunton & Williams LLP

On January 12, 2012, Hunton & Williams hosted an hour-long webinar on the current enforcement environment in the U.S. and EU. The webinar, Current Trends in Global Privacy Enforcement, covered issues ranging from the Federal Trade Commission’s tougher approach to investigations to increased monitoring of corporate privacy practices by European data protection authorities. Hunton & Williams speakers included Lisa J. Sotto, partner and head of the Global Privacy and Data Security practice, London partner Bridget Treacy, London senior attorney Rosemary Jay and Brussels associate Dr. Jörg Hladjk.

Listen to the webinar now.

Tags: Bridget Treacy, Data Protection Authority, Federal Trade Commission, Germany, Jörg Hladjk, Lisa Sotto, Rosemary Jay, State Attorneys General, United Kingdom

UK ICO Outlines the Year Ahead

Posted on January 26, 2012 by Hunton & Williams LLP

On December 28, 2011, UK Information Commissioner Christopher Graham outlined the ICO’s agenda for 2012 in a post on the ICO blog, highlighting the European Commission’s proposals for reviewing the EU data protection framework, the post-legislative scrutiny process with respect to the UK Freedom of Information Act (“FOIA”) and the ICO’s Information Rights Strategy. The Commissioner cautioned against allowing data protection compliance to fall by the wayside in the current, tough economic climate, especially given the inevitable reputational damage caused by big data breaches and the ICO’s power to impose fines.

Tags: Christopher Graham, EU Data Protection Directive, Freedom of Information Act, Information Commissioners Office, Ireland, United Kingdom

Concerns over Independence of Hungary’s DPA Prompt Infringement Proceedings

Posted on January 24, 2012 by Hunton & Williams LLP

On January 17, 2012, the European Commission initiated expedited infringement proceedings against Hungary over recent changes to its Constitution which are considered incompatible with EU law. The proceedings follow a number of changes made to the Hungarian Constitution that came into effect on January 1, 2012. Of particular concern to the Commission are amendments affecting the independence of the national data protection authority. The Hungarian government has one month to comply, or face enforcement proceedings in the European Court of Justice.

Tags: Data Protection Authority, EU Data Protection Directive, European Commission, Hungary, Legislation, Penalty

FTC Settles with Alleged Stealth Behavioral Advertising Targeter

Posted on January 9, 2012 by Hunton & Williams LLP

On January 5, 2012, the Federal Trade Commission announced a proposed settlement with Upromise, Inc., a membership reward service that gives cash rebates for college savings accounts to members who purchase products and services from its partner merchants. The FTC alleged that the “Personalized Offers” feature on the Upromise TurboSaver Toolbar (1) collected far more information about users’ browsing behavior than was disclosed at the time of installation, and (2) contrary to representations in the company’s privacy notice, transmitted that information, which included data such as Social Security numbers and financial account numbers, in clear text.

Tags: Advertisement, Consent Order, Consumer Protection, Federal Trade Commission, Personally Identifiable Information, Social Security Number

Facebook Settles FTC Charges

Posted on November 29, 2011 by Hunton & Williams LLP

On November 29, 2011, the Federal Trade Commission announced that Facebook has settled charges that it deceived consumers by making false privacy promises. The settlement requires Facebook to (1) not misrepresent how it maintains the privacy or security of users’ personal information (2) obtain users’ “affirmative express consent” before sharing their information with any third party that “materially exceeds the restrictions imposed by a user’s privacy setting(s),” (3) implement procedures to prevent a third party from accessing users’ information no later than 30 days after the user has deleted such information or terminated his or her account, (4) establish, implement and maintain a comprehensive privacy program, and (5) obtain initial and biennial assessments and reports regarding its privacy practices for the next 20 years.

Tags: Consent Order, Consumer Protection, Electronic Privacy Information Center, Facebook, Federal Trade Commission, Jay Rockefeller, Jon Leibowitz, Social Media

Israeli Justice Ministry Announces Breakthrough in Information Theft Case

Posted on October 27, 2011 by Hunton & Williams LLP

On October 24, 2011, Israel’s Data Protection Authority, the Israeli Law, Information and Technology Authority in the Israeli Ministry of Justice (“ILITA”), announced significant developments in an information theft case affecting more than nine million Israeli citizens. In 2006, a contract worker hired by Israel’s Ministry of Welfare and Social Services downloaded a copy of Israel’s population registry to his home computer. The registry later fell into the hands of a software developer and a hacker before being disseminated on the Internet along with a program that allowed users to run searches and queries on the data. The stolen personal information included full names, identification numbers, addresses, dates of birth, dates of immigration to Israel, family status, names of siblings and other information.

Tags: Cybersecurity, Data Protection Authority, Israel, Service Provider

SEC Issues Disclosure Guidance on Cybersecurity Matters and Cyber Incidents

Posted on October 20, 2011 by Hunton & Williams LLP

On October 13, 2011, the Securities and Exchange Commission Division of Corporation Finance issued disclosure guidance (“Guidance”) regarding cybersecurity matters and cyber incidents. While the Guidance does not change existing disclosure requirements, it does add specificity to existing requirements. In some respects, that specificity is helpful, but the Guidance fails to take into account the uncertainty that inevitably accompanies efforts to assess and disclose cybersecurity matters and incidents.

Read a detailed summary of the Guidance and analysis regarding its effects, including its impact on disclosures both before and after a cyber incident, enforcement-related proceedings and potential litigation.

Tags: Cybersecurity, Litigation, Securities and Exchange Commission

UK Information Tribunal Rules Properly Anonymized Personal Data Can Be Disclosed Under FOIA

Posted on October 14, 2011 by Hunton & Williams LLP

On September 7, 2011, the United Kingdom Information Tribunal published a decision that appears to resolve the long-running uncertainty regarding the extent to which anonymized personal information may be disclosed under the UK’s Freedom of Information legislation. The UK’s FOIA was introduced and applicable to most of the UK in 2000, with equivalent law following for Scotland in 2002.

Tags: Anonymization, Data Controller, Freedom of Information Act, United Kingdom

Privacy and Information Security Law Blog - Global privacy and information security law updates and analysis

Hunton Hosts Webinar on Current Trends in Global Privacy Enforcement

UK ICO Outlines the Year Ahead

Concerns over Independence of Hungary’s DPA Prompt Infringement Proceedings

Israeli Justice Ministry Announces Breakthrough in Information Theft Case

SEC Issues Disclosure Guidance on Cybersecurity Matters and Cyber Incidents

UK Information Tribunal Rules Properly Anonymized Personal Data Can Be Disclosed Under FOIA

Published By Hunton & Williams

Search

Subscribe

Topics

Recent Updates

Blogroll

Privacy News