Tag Archives: Penalty

UK Parliament Calls for Prison Sentences for Data Theft

Members of Parliament on the House of Commons Justice Select Committee have called for courts in the United Kingdom to be given greater powers to imprison and fine individuals who breach the Data Protection Act (“DPA”). The Committee stated in its October 18, 2011 report that the current penalties for unlawfully obtaining personal data (under Section 55 of the DPA) are an inadequate deterrent, and urged the government to exercise its power to introduce prison sentences without delay. Although currently a magistrates’ court can issue fines of up to £5,000 for breaches of Section 55 (and the Crown Court can impose unlimited fines), in practice, penalties often are limited to only a few hundred pounds.

Continue reading…

Tags: , , , ,

UK ICO Says Private Sector “Isn’t as Good as It Thinks It Is”

On September 14, 2011, UK Information Commissioner Christopher Graham said that the private sector “isn’t as good as it thinks it is” when it comes to data protection compliance, and that many of the compliance problems that arise originate in the private sector.  While giving evidence to the House of Commons Justice Select Committee, the Commissioner criticized the private sector and, in particular, banks and other financial services companies.

Continue reading…

Tags: , , , ,

Lush Avoids ICO Fine After Website Data Breach

Lush Cosmetics Ltd. (“Lush”) has avoided a monetary penalty for its breach of the UK Data Protection Act 1998.  Instead, the UK Information Commissioner’s Office (the “ICO”) has required Lush to sign an undertaking that obliges the company to “ensure that future customer credit card data will be processed in accordance with the Payment Card Industry Data Security Standard.”

Continue reading…

Tags: , , , , ,

FTC Announces First Privacy Settlement Involving Mobile Applications

On August 15, 2011, the Federal Trade Commission announced a settlement with W3 Innovations, LLC, doing business as Broken Thumbs Apps (“W3”) for violations of the Children’s Online Privacy Protection Act (“COPPA”) and the FTC’s COPPA Rule.  This marks the FTC’s first privacy settlement involving mobile applications. Continue reading…

Tags: , , , , , ,

Massachusetts Attorney General Announces $7,500 Data Breach Settlement with Belmont Savings Bank

On July 29, 2011, Massachusetts Attorney General Martha Coakley announced a $7,500 settlement with Belmont Savings Bank following a May 2011 data breach involving the names, Social Security numbers and account numbers of more than 13,000 Massachusetts residents.  The bank has stated that it has no evidence of unauthorized access to or use of consumers’ personal information in connection with this breach.

Continue reading…

Tags: , , , ,

HHS Announces $865,500 Settlement with UCLA Health System for HIPAA Violations

On June 7, 2011, the Department of Health and Human Services (“HHS”) announced a resolution agreement and $865,500 settlement with the University of California at Los Angeles Health System (“UCLA Health System”) for violations of the HIPAA Privacy and Security Rules.  UCLA Health System employees were accused of violating the Privacy Rule by improperly accessing the protected health information (“PHI”) of patients, including several high-profile celebrities who filed complaints with HHS.  A subsequent investigation by HHS’s Office of Civil Rights (“OCR”) revealed that in addition to neglecting to sanction the employees who had improperly accessed patient PHI, UCLA Health System had failed to train its employees on the HIPAA Privacy and Security Rules or implement security measures to “reduce the risks of impermissible access to electronic protected health information by unauthorized users to a reasonable and appropriate level.”

Continue reading…

Tags: , , , ,

Federal Trade Commission Announces Settlement with Teletrack, Inc.

On June 27, 2011, the Federal Trade Commission announced that it had reached a settlement with Teletrack, Inc. (“Teletrack”), a consumer reporting agency that sells consumer reports and other services to businesses that serve financially distressed consumers, after alleging that the company had sold information obtained through its consumer reporting business to marketers to create a marketing database. The FTC considered that the information sold by Teletrack, which included lists of consumers who applied for certain credit products, constituted “consumer reports” under the Fair Credit Reporting Act (“FCRA”) because it contained information about a consumer’s credit worthiness. The sale of such information by Teletrack to marketers violated the FCRA because marketing is not a permissible purpose by which consumer reporting agencies may furnish consumer reports to third parties. According to the FTC’s press release, the “settlement seeks to protect consumers’ privacy by ensuring that their sensitive credit report information is not sold for marketing purposes.”

The settlement order imposes a $1.8 civil penalty on Teletrack and certain reporting requirements to ensure Teletrack’s compliance with the order. In addition, Teletrack must “furnish credit reports only to those people that it has reason to believe have a permissible purpose to receive them under the FCRA, or as otherwise allowed by the FCRA.”

Tags: , ,

Court Issues Final Order and Approves Awards in Google Buzz Settlement

On May 31, 2011, an Order was filed in the District Court for the Northern District of California granting final approval of the Google Buzz class action settlement and cy pres awards for organizations focused on Internet privacy policy or privacy education. Pursuant to the Order, the court adopted the Google Buzz settlement agreement and certified the proposed settlement class, which includes “all Gmail users in the United States presented with the opportunity to use Google Buzz through the Notice Date.” The court also approved the following list of organizations and award amounts for distribution of the cy pres funds to be paid by Google as part of the settlement agreement:

  • American Civil Liberties Union – $7,000,000
  • Berkeley Center for Law & Technology – $500,000
  • Berkeley Law School, Samuelson Law, Technology & Public Policy Clinic – $200,000
  • Berkman Center for Internet & Society at Harvard University – $500,000
  • Brookings Institution – $165,000
  • Carnegie Mellon, Cylab Usability, Privacy & Security Lab – $350,000
  • Center for Democracy & Technology – $500,000
  • Electronic Frontier Foundation – $1,000,000
  • Indiana University, Center for Applied Cybersecurity Research – $300,000
  • Stanford, Center for Internet & Society – $500,000
  • YMCA of Greater Long Beach – $300,000
  • The Electronic Privacy Information Center – $500,000
  • The Markkula Center for Applied Ethics Santa Clara University – $500,000
  • Youth Radio – $50,000
Tags: , , , , ,

German DPAs Publish Comprehensive FAQs on Statutory Data Breach Notification Requirement

The German Data Protection Authorities of Berlin and North Rhine-Westphalia have issued a paper containing Frequently Asked Questions about the German statutory data breach notification requirement that went into effect on September 1, 2009.  The paper provides detailed information on key questions concerning the procedure for notification as required by Section 42a of the German Federal Data Protection Act.

Continue reading…

Tags: , , , , , , , , ,

California Bill Targets Social Networking Privacy

A new bill proposed in California, the Social Networking Privacy Act (the “Act”), would force social networking websites to establish default privacy settings for their users that prohibit such sites from publicly displaying most information about users without the users’ consent.  Given that many social networking websites currently have default settings that make user personal information and photos public unless the user changes those settings, the Act would represent a fundamental shift in social networking privacy. Continue reading…

Tags: , , , , ,