Tag Archives: Payment Card

Lush Avoids ICO Fine After Website Data Breach

Posted on August 18, 2011 by Hunton & Williams LLP

Lush Cosmetics Ltd. (“Lush”) has avoided a monetary penalty for its breach of the UK Data Protection Act 1998.  Instead, the UK Information Commissioner’s Office (the “ICO”) has required Lush to sign an undertaking that obliges the company to “ensure that future customer credit card data will be processed in accordance with the Payment Card Industry Data Security Standard.”

Continue reading…

Tags: Consumer Protection, Enforcement, European Union, Information Commissioners Office, Payment Card, PCI DSS, Penalty, Security Breach, United Kingdom

PCI Data Security Standards Council Provides Cloud Compliance Guidelines

Posted on June 21, 2011 by Hunton & Williams LLP

On June 14, 2011, the PCI Security Standards Council’s Virtualization Special Interest Group published its “Information Supplement: PCI DSS Virtualization Guidelines”(the “Guidelines”) to Version 2.0 of the PCI Data Security Standard (“PCI DSS”).  The Guidelines provide context for the application of the PCI DSS to cloud and other virtual environments, and offer at least three critical reminders:

  • the PCI DSS applies to cloud environments without exception; 
  • critical analysis of the application of the PCI DSS to rapidly evolving cloud offerings is essential to compliance; and
  • cloud providers must be prepared to document and contract for necessary controls.

Continue reading…

Tags: Cloud Computing, Encryption, Financial Privacy, Information Security, Nevada, Payment Card, PCI DSS

Representative Mary Bono Mack Releases Discussion Draft of the SAFE Data Act

Posted on June 17, 2011 by Hunton & Williams LLP

On June 13, 2011, Representative Mary Bono Mack (R-CA) released a discussion draft of the Secure and Fortify Data Act (the “SAFE Data Act”), which is designed to “protect consumers by requiring reasonable security policies and procedures to protect data containing personal information, and to provide for nationwide notice in the event of a security breach.”  Representative Bono Mack is Chairman of the House Subcommittee on Commerce, Manufacturing and Trade.  In a press release, Representative Bono Mack remarked that “E-commerce is a vital and growing part of our economy.  We should take steps to embrace and protect it – and that starts with robust cyber security.”  She added that “consumers have a right to know when their personal information has been compromised, and companies and other organizations have an overriding responsibility to promptly alert them.”

Continue reading…

Tags: Consumer Protection, Credit Monitoring, Credit Report, Cybersecurity, Enforcement, Federal Trade Commission, Gramm Leach Bliley Act, HIPAA, Identity Theft, Information Security, Legislation, Online Privacy, Payment Card, Privacy Policy, Security Breach, Social Security Number, State Attorneys General, U.S. Federal Law

Another Sony Service Breached by Hackers

Posted on May 3, 2011 by Hunton & Williams LLP

On May 2, 2011, Sony Computer Entertainment America (“Sony”) disclosed that hackers had gained access to the personal information of 24.6 million customers who played games on the Sony Online Entertainment (“SOE”) network.  Sony stated that hackers may have accessed names, addresses and birth dates of SOE gaming customers, as well as credit card data of about 12,700 non-U.S. accounts and 10,700 bank account numbers from “an outdated database from 2007.”  Sony clarified that the SOE breach was not the result of a second attack, but rather occurred as part of the broad incursion against the company that affected 77 million PlayStation accounts, as the company previously disclosed on April 26. Continue reading…

Tags: Congress, Consumer Protection, Cybersecurity, Hacker, Information Security, Online Privacy, Payment Card, Security Breach, Sony

Sotto Discusses Epsilon Breach with Information Security Media Group

Posted on April 19, 2011 by Hunton & Williams LLP

On April 5, 2011, Lisa Sotto, partner and head of the Privacy and Data Security practice at Hunton & Williams LLP, discussed the Epsilon email breach in an interview with Tracy Kitten of Information Security Media Group.  The interview covered issues such as data protection requirements for sensitive consumer data, steps companies should take to protect data and lessons to be learned from the breach.  Listen to the interview or download the podcast now.

Tags: Consumer Protection, Email, Identity Theft, Information Security, Lisa Sotto, Multimedia Resources, Payment Card, Security Breach

Massachusetts Attorney General Reaches $110,000 Data Breach Settlement with Boston Restaurant Group

Posted on March 28, 2011 by Hunton & Williams LLP

On March 28, 2011, the Briar Group, LLC, owner and operator of several Boston-area bars and restaurants, reached a settlement with Massachusetts Attorney General Martha Coakley regarding the breach of “tens of thousands” of consumers’ payment card information.  The settlement resolves a lawsuit filed in Massachusetts Superior Court alleging that in April 2009 hackers gained access to the Briar Group’s computer systems and misappropriated customer data by installing malcode which was not removed by the company until December of that year.  The complaint further alleged that the Briar Group’s lax data protection practices, such as allowing employees to share computer passwords and failing to secure network wireless connections, put customers’ personal information at risk.

Continue reading…

Tags: Consumer Protection, Information Security, Massachusetts, Payment Card, PCI DSS, Penalty, Security Breach, State Attorneys General, U.S. State Law, Wireless Network

China Issues New Measures to Protect Credit Card Holders

Posted on March 18, 2011 by Hunton & Williams LLP

On January 13, 2011, the China Banking Regulatory Commission issued Measures for the Supervision and Administration of the Credit Card Businesses of Commercial Banks (the “Measures”), which took effect that same day. The Measures are reported to be the first comprehensive regulations relating to the credit card business in China, and include a number of provisions on the protection of personal information by commercial banks, as detailed below.

Continue reading…

Tags: China, Financial Privacy, Information Security, International, Marketing, Payment Card, Penalty

California Supreme Court Finds that ZIP Codes Are Personal Identification Information Under Song-Beverly Act

Posted on February 14, 2011 by Hunton & Williams LLP

On February 10, 2011, the California Supreme Court ruled in Pineda v. Williams-Sonoma Stores, Inc. that ZIP codes are “personal identification information” under the state’s Song-Beverly Credit Card Act of 1971 (the “Credit Card Act”).  This finding effectively prohibits California businesses from requesting and recording cardholders’ ZIP codes during credit card transactions.

Continue reading…

Tags: California, Consumer Protection, Marketing, Payment Card, Song-Beverly Act, U.S. State Law

Addition to Washington Breach Law Imposes Retailer Liability in Payment Card Breaches

Posted on March 24, 2010 by Hunton & Williams LLP

Under a Washington law effective July 1, 2010, certain entities involved in payment card transactions may be liable to financial institutions for costs associated with reissuing payment cards after security breaches.  Designed to encourage the reissuance of payment cards as a means of mitigating harm caused by security breaches, Washington H.B. 1149 applies to three types of entities:  businesses, processors and vendors.  Under the law, a business is an entity that “processes more than six million credit card and debit card transactions annually, and who provides, offers, or sells goods or services to . . . residents of Washington.” A processor is any entity, other than a business, that “directly processes or transmits [payment card] account information for or on behalf of another person as part of a payment processing service.” A vendor is any “entity that manufactures and sells software or equipment that is designed to process, transmit, or store [payment card] account information or that maintains account information that it does not own.”

Continue reading…

Tags: Data Processor, Financial Privacy, Payment Card, PCI DSS, Safe Harbor, Security Breach, Washington

Nevada and New Hampshire Data Security and Privacy Laws Take Effect

Posted on January 6, 2010 by Hunton & Williams LLP

On January 1, 2010, two important state data security and privacy laws took effect in Nevada and New Hampshire.  The laws create new obligations for most companies that do business in Nevada and for health care providers and business associates in New Hampshire.

Continue reading…

Tags: Encryption, Health Privacy, Information Security, Marketing, National Institute of Standards and Technology, Nevada, New Hampshire, Payment Card, PCI DSS, Protected Health Information, U.S. State Law