Tag Archives: Social Security Number

Japan May Hold Individual Employees Liable for Violations of Data Protection Law

Posted on April 26, 2011 by Hunton & Williams LLP

As part of an effort to increase penalties for violations of the country’s Personal Information Protection Act, officials in Japan plan to extend liability under that law to individual employees, according to recent reports in The Yomiuri Shimbun and The Japan Times.  Currently, a company that violates the law may be fined or ordered to take remedial steps, and the company head may be imprisoned.  The law revision would come as part of changes to the legal framework accompanying a proposed national identification number system.

Tags: , ,

Representative Stearns Introduces Consumer Privacy Protection Act

Posted on April 15, 2011 by Hunton & Williams LLP

On April 13, 2011, Representative Cliff Stearns (R-FL) introduced the Consumer Privacy Protection Act of 2011 (the “Act”), which seeks to “protect and enhance consumer privacy” both online and offline by imposing certain notice and choice requirements with respect to the collection and use of personal information.

Continue reading…

Tags: , , , , , , ,

Senators Kerry and McCain Introduce the Commercial Privacy Bill of Rights Act of 2011

Posted on April 12, 2011 by Hunton & Williams LLP

On April 12, 2011, U.S. Senators John Kerry (D-MA) and John McCain (R-AZ) introduced the Commercial Privacy Bill of Rights Act of 2011 (the “Act”) to “establish a regulatory framework for the comprehensive protection of personal data for individuals under the aegis of the Federal Trade Commission.”  The bill applies broadly to entities that collect, use, transfer or store the “covered information” of more than 5,000 individuals over a consecutive 12-month period.  Certain provisions of the bill would direct the FTC to initiate rulemaking proceedings within specified timeframes, but the bill also imposes requirements directly on covered entities. Continue reading…

Tags: , , , , , , , , , , , ,

Email Marketing Service Provider’s Data Breach Likely to Affect Millions

Posted on April 4, 2011 by Hunton & Williams LLP

On April 1, 2011, Epsilon Data Management, LLC (“Epsilon”), a leading marketing services provider based in Irving, Texas, issued a press release announcing that its clients’ customer data had been “exposed by an unauthorized entry into Epsilon’s email system” that took place on March 30, 2011.  In the press release, Epsilon indicated that the information acquired as a result of the incident was limited to email addresses and customer names.  Several major retailers, credit card issuers, financial institutions and other companies that use Epsilon as a service provider have since notified their customers of the incident.  According to the various company statements and emails to customers distributed as a result of this incident, no other personal information (such as bank account information, credit card numbers or Social Security numbers) was compromised.  Potentially affected customers are being warned of possible “phishing” attacks that could be linked to the information acquired as a result of this incident.  Epsilon’s breach has the potential to be one of the largest in U.S. history.

Tags:

Legislation Aims to Expand Breach Notification Obligations

Posted on January 27, 2011 by Hunton & Williams LLP

In the past two months, lawmakers in three states have introduced legislation that would expand the scope of certain security breach notification requirements.

Virginia SB 1041

On January 11, 2011, Virginia lawmakers introduced SB 1041, which would amend the state’s health breach notification statute to impose notification requirements on businesses, individuals and other private entities, in the event unencrypted or unredacted computerized medical information they own or license is reasonably believed to have been accessed and acquired by an unauthorized person.  The law currently applies only to organizations, corporations and agencies supported by public funds.  In addition to broadening the scope of the law’s applicability, the amendment would permit the Virginia Attorney General to impose a civil penalty of up to $150,000 per breach (or series of similar breaches that are discovered pursuant to a single investigation), without limiting the ability of individuals to recover direct economic damages for violations.

Update: On February 11, 2011, BNA’s Privacy Law Watch reported that SB 1041 had failed and would not be carried over to the next legislative session.

Continue reading…

Tags: , , , , , ,

President Obama Signs Red Flag Program Clarification Act

Posted on December 20, 2010 by Hunton & Williams LLP

On December 18, 2010, President Obama signed into law the “Red Flag Program Clarification Act of 2010” (S.3987), which amends the Fair Credit Reporting Act with respect to the applicability of identity theft guidelines to creditors.  The law limits the scope of the Federal Trade Commission’s Identity Theft Red Flags Rule (“Red Flags Rule”), which requires “creditors” and “financial institutions” that have “covered accounts” to develop and implement written identity theft prevention programs to help identify, detect and respond to patterns, practices or specific activities that indicate possible identity theft.

Continue reading…

Tags: , , , , , ,

House Approves Social Security Number Protection Act

Posted on December 9, 2010 by Hunton & Williams LLP

On December 8, 2010, the U.S. House of Representatives approved the Social Security Number Protection Act of 2010 (S. 3789), which is aimed at reducing identity theft by limiting access to Social Security numbers.  The bill prohibits printing Social Security numbers, or any derivative of a Social Security number, on government-issued checks, and bars federal, state and local government entities from employing prisoners in jobs that would allow them to access Social Security numbers.  Although there are numerous state laws on the books to safeguard Social Security numbers, the Social Security Number Protection Act will provide federal coverage.  The bill was introduced by Senators Dianne Feinstein (D-CA) and Judd Gregg (R-NH) and passed in the Senate by unanimous consent on September 28, 2010.  It is now headed for signature by President Obama.

Tags: , , , ,

Massachusetts Information Security Regulations Take Effect on March 1, 2010

Posted on February 23, 2010 by Hunton & Williams LLP

After several delays and revisions, the Massachusetts information security regulations, entitled “Standards for the Protection of Personal Information of Residents of the Commonwealth,” will take effect on March 1, 2010.  The regulations apply to entities that own or license personal information about Massachusetts residents.  “Personal information” is defined as a combination of a resident’s first and last name and Social Security number, driver’s license or state ID number, or financial account number or payment card number that permits access to the individual’s financial account.

Continue reading…

Tags: , ,

Connecticut Attorney General Investigation Sheds Light on Meaning of “Unreasonable Delay” in Data Breach Context

Posted on November 13, 2009 by Hunton & Williams LLP

On November 9, 2009, Connecticut’s Attorney General, Richard Blumenthal, announced an investigation of whether Blue Cross and Blue Shield (“BCBS”) violated Connecticut’s data breach notification law by waiting until two months after a data breach had occurred to notify affected Connecticut residents.  The data breach, which Attorney General Blumenthal called “one of the most sizable and significant in Connecticut’s history,” involved the theft of a laptop containing confidential unencrypted data from the car of a BCBS employee in late August.  BCBS notified affected Connecticut residents of the breach in late October.

Continue reading…

Tags: , , ,

Data Breach: Identity Theft Risk Insufficient to Support Claims

Posted on April 13, 2009 by Hunton & Williams LLP

The mere increased risk of identity theft following a data breach is sufficient to give the data subjects standing to bring a lawsuit in federal court but, absent actual identity theft or other actual harm, claims against the data owner and its service provider for negligence and breach of contract cannot survive, a federal judge ruled this month.  Ruiz v. Gap, Inc., et al., No. 07-5739 SC (N.D. Cal. April 6, 2009).

Plaintiff Joel Ruiz brought a putative class action against Gap, Inc. and its service provider Vangent, Inc. after a thief stole a laptop computer from Vangent containing unencrypted Social Security numbers and other personal information of Ruiz and approximately 750,000 other Gap job applicants.  Shortly after the theft, Gap notified Ruiz and the other applicants of the breach and offered them 12 months of free credit monitoring and fraud assistance.  Ruiz sought damages under various theories, including negligence (failure to exercise due care to protect the data) and breach of contract (breach of the security provisions of Gap’s contract with Vangent, under the theory that Ruiz was a third-party beneficiary of the contract).

Continue reading…

Tags: , , , ,