Identity Theft | Privacy and Information Security Law Blog

Massachusetts Attorney General Announces $15,000 Settlement with Property Management Firm

Posted on March 27, 2012 by Hunton & Williams LLP

On March 21, 2012, Massachusetts Attorney General Martha Coakley announced that Maloney Properties Inc. (“MPI”), a property management firm, executed an Assurance of Discontinuance and agreed to pay $15,000 in civil penalties following an October 2011 theft of an unencrypted company-issued laptop. The laptop contained personal information of more than 600 Massachusetts residents and was left in an employee’s car overnight. MPI has indicated that it has no evidence of unauthorized access to or use of the personal information in connection with this breach.

Tags: Consumer Protection, Massachusetts, Penalty, State Attorneys General

Connecticut AG Announces Agreement with MetLife over 2009 Breach Incident

Posted on January 27, 2012 by Hunton & Williams LLP

On January 24, 2011, Connecticut Attorney General George Jepsen and Consumer Protection Commissioner William Rubenstein announced that they had reached an Assurance of Voluntary Compliance (“AVC”) with Metropolitan Life Insurance Co. (“MetLife”) in connection with an incident involving the disclosure of customer personal information on the Internet. In November 2009, a MetLife employee posted the personally identifiable information of current and former MetLife customers, including their Social Security numbers, on the Internet. Following the discovery of the posting, MetLife acted to mitigate possible harm by providing credit monitoring and identity theft insurance to the affected customers.

Tags: Connecticut, Consumer Protection, Credit Monitoring, Personally Identifiable Information, Social Security Number, State Attorneys General

Third Circuit Holds Data Breach Plaintiffs Lack Standing

Posted on January 20, 2012 by Hunton & Williams LLP

On December 12, 2011, the United States Court of Appeals for the Third Circuit affirmed a decision that employees of Ceridian Corporation’s (“Ceridian’s”) customers did not have standing to sue Ceridian after the payroll processing firm suffered a data breach.

In December 2009, a hacker may have gained access to personal and financial information of Ceridian’s customers, including names, addresses, Social Security numbers, dates of birth and bank account information. Although it is not known if the hacker read, copied or understood the data, Ceridian sent notification letters to affected individuals informing them of the breach and offering to provide one year of complimentary credit monitoring and identity theft protection.

Tags: Consent Order, Consumer Protection, Credit Monitoring, Cybersecurity, Federal Trade Commission, Hacker, Litigation, Social Security Number

UK Parliament Calls for Prison Sentences for Data Theft

Posted on October 31, 2011 by Hunton & Williams LLP

Members of Parliament on the House of Commons Justice Select Committee have called for courts in the United Kingdom to be given greater powers to imprison and fine individuals who breach the Data Protection Act (“DPA”). The Committee stated in its October 18, 2011 report that the current penalties for unlawfully obtaining personal data (under Section 55 of the DPA) are an inadequate deterrent, and urged the government to exercise its power to introduce prison sentences without delay. Although currently a magistrates’ court can issue fines of up to £5,000 for breaches of Section 55 (and the Crown Court can impose unlimited fines), in practice, penalties often are limited to only a few hundred pounds.

Tags: Christopher Graham, Data Protection Act, Information Commissioners Office, Penalty, United Kingdom

Israeli Justice Ministry Announces Breakthrough in Information Theft Case

Posted on October 27, 2011 by Hunton & Williams LLP

On October 24, 2011, Israel’s Data Protection Authority, the Israeli Law, Information and Technology Authority in the Israeli Ministry of Justice (“ILITA”), announced significant developments in an information theft case affecting more than nine million Israeli citizens. In 2006, a contract worker hired by Israel’s Ministry of Welfare and Social Services downloaded a copy of Israel’s population registry to his home computer. The registry later fell into the hands of a software developer and a hacker before being disseminated on the Internet along with a program that allowed users to run searches and queries on the data. The stolen personal information included full names, identification numbers, addresses, dates of birth, dates of immigration to Israel, family status, names of siblings and other information.

Tags: Cybersecurity, Data Protection Authority, Israel, Service Provider

Representative Mary Bono Mack Releases Discussion Draft of the SAFE Data Act

Posted on June 17, 2011 by Hunton & Williams LLP

On June 13, 2011, Representative Mary Bono Mack (R-CA) released a discussion draft of the Secure and Fortify Data Act (the “SAFE Data Act”), which is designed to “protect consumers by requiring reasonable security policies and procedures to protect data containing personal information, and to provide for nationwide notice in the event of a security breach.” Representative Bono Mack is Chairman of the House Subcommittee on Commerce, Manufacturing and Trade. In a press release, Representative Bono Mack remarked that “E-commerce is a vital and growing part of our economy. We should take steps to embrace and protect it – and that starts with robust cyber security.” She added that “consumers have a right to know when their personal information has been compromised, and companies and other organizations have an overriding responsibility to promptly alert them.”

Tags: Consumer Protection, Credit Monitoring, Credit Report, Cybersecurity, Federal Trade Commission, Gramm Leach Bliley Act, HIPAA, Legislation, Payment Card, Privacy Policy, Social Security Number, State Attorneys General

Sotto Discusses Epsilon Breach with Information Security Media Group

Posted on April 19, 2011 by Hunton & Williams LLP

On April 5, 2011, Lisa Sotto, partner and head of the Privacy and Data Security practice at Hunton & Williams LLP, discussed the Epsilon email breach in an interview with Tracy Kitten of Information Security Media Group. The interview covered issues such as data protection requirements for sensitive consumer data, steps companies should take to protect data and lessons to be learned from the breach. Listen to the interview or download the podcast now.

Tags: Consumer Protection, Email, Lisa Sotto, Payment Card

Update: Privacy and the Protection of Personal Information in China

Posted on February 16, 2011 by Hunton & Williams LLP

In our August 2009 blog post on data protection issues in China, we noted that there was no uniform Chinese law that specifically addresses the protection of personal data, and that it seemed likely that Chinese personal information protection law would continue to develop as a patchwork of piecemeal regulations. This remains true today, and developments since our previous article was published have in fact reinforced this assumption. In the past year and a half, new laws affecting personal information protection in China have arisen in various forms, including a consumer protection law and regulations, a tort law, a medical records regulation, a social insurance law, a credit reference regulation and even an anti-money laundering banking regulation. Our recent article provides updates on Chinese data protection law.

A Summary of Developments in Personal Information Protection in China was originally published on the DataGuidance website.

Tags: Anti-terrorism, China, Consumer Protection, Manuel Maisog

Legislation Aims to Expand Breach Notification Obligations

Posted on January 27, 2011 by Hunton & Williams LLP

In the past two months, lawmakers in three states have introduced legislation that would expand the scope of certain security breach notification requirements.

Virginia SB 1041

On January 11, 2011, Virginia lawmakers introduced SB 1041, which would amend the state’s health breach notification statute to impose notification requirements on businesses, individuals and other private entities, in the event unencrypted or unredacted computerized medical information they own or license is reasonably believed to have been accessed and acquired by an unauthorized person. The law currently applies only to organizations, corporations and agencies supported by public funds. In addition to broadening the scope of the law’s applicability, the amendment would permit the Virginia Attorney General to impose a civil penalty of up to $150,000 per breach (or series of similar breaches that are discovered pursuant to a single investigation), without limiting the ability of individuals to recover direct economic damages for violations.

Update: On February 11, 2011, BNA’s Privacy Law Watch reported that SB 1041 had failed and would not be carried over to the next legislative session.

Tags: Arnold Schwarzenegger, California, Consumer Protection, Legislation, Oregon, Social Security Number, Virginia

President Obama Signs Red Flag Program Clarification Act

Posted on December 20, 2010 by Hunton & Williams LLP

On December 18, 2010, President Obama signed into law the “Red Flag Program Clarification Act of 2010” (S.3987), which amends the Fair Credit Reporting Act with respect to the applicability of identity theft guidelines to creditors. The law limits the scope of the Federal Trade Commission’s Identity Theft Red Flags Rule (“Red Flags Rule”), which requires “creditors” and “financial institutions” that have “covered accounts” to develop and implement written identity theft prevention programs to help identify, detect and respond to patterns, practices or specific activities that indicate possible identity theft.

Tags: Congress, Consumer Protection, Federal Trade Commission, Legislation, Obama, Red Flags Rule, Social Security Number

Privacy and Information Security Law Blog - Global privacy and information security law updates and analysis

Massachusetts Attorney General Announces $15,000 Settlement with Property Management Firm

UK Parliament Calls for Prison Sentences for Data Theft

Israeli Justice Ministry Announces Breakthrough in Information Theft Case

Sotto Discusses Epsilon Breach with Information Security Media Group

Update: Privacy and the Protection of Personal Information in China

Published By Hunton & Williams

Search

Subscribe

Topics

Recent Updates

Blogroll

Privacy News