Privacy & Information Security Law Blog : Privacy Lawyer & Attorney : Hunton & Williams Law Firm : Personal Data, Information Security

As reported in BNA’s Privacy Law Watch, as a result of the FTC’s opposition to the transfer of the personal information, the parties entered into a consent order agreeing that the information will be destroyed before the magazine’s assets are sold.  The consent order called for the destruction to be carried out in a manner that will make the information “unreadable, undecipherable, or non-reconstructable through generally available means.”

This incident is a reminder of the legal significance of privacy promises made outside the context of an actual privacy policy.  It also highlights the need to anticipate changes in business circumstances (such as mergers or sales of assets) when making any privacy representations. Inappropriate commitments may prove damaging to the company, its investors and creditors.  Read more about emerging privacy issues in bankruptcy in an article published by GC New York.

Vladeck’s letter explained that, since its inception, the debtor’s website “Sign-up Confirmation Page” told potential members/subscribers: “Please note our amazing privacy policy. We never give your info to anybody.”  Another representation, which appeared on the website and was directed to magazine subscribers, stated: “[O]ur privacy policy is simple: we never share your information with anybody.”  Those submitting online profile information were told that such information “will not be published. [W]e keep it secret.”  The magazine catered to a young gay audience, including individuals whose sexual orientation was a secret.  The creditors have been seeking to acquire the magazine’s subscriber information, among other assets.  Under these circumstances, Vladeck argues, a transfer of the information to the creditors would contradict the privacy statements made to the subscribers, in possible violation of the FTC Act’s prohibition against “unfair or deceptive acts or practices.”

This incident is a reminder of the legal significance of privacy promises made outside the context of an actual privacy policy, and it highlights the need to anticipate changes in business circumstances (such as mergers or sales of assets) when making any privacy representations.  Inappropriate commitments may prove damaging to the company, its investors and creditors.  Read more about emerging privacy issues in bankruptcy in an article published by GC New York by Lisa J. Sotto, Scott H. Bernstein and Boris Segalis.

In the 1990’s, during the Clinton Administration, the Department of Commerce led U.S. efforts to develop policy related to privacy on the Internet and encouraged the development of online privacy policies and privacy seal programs.  Within the Department, the National Telecommunications and Information Administration (“NTIA”) authored numerous privacy position papers, and the International Trade Commission (“ITA”) negotiated the U.S.-European Union Safe Harbor Framework.  During the Bush Administration and the first year of Obama’s tenure, however, the Department was largely silent on privacy issues. 

Beginning last fall, the Department began holding sessions to investigate the effectiveness of privacy protections in the United States and the impact of privacy regulation on businesses.  The sessions were led by Marc Berejka, Senior Policy Advisor in the Secretary’s Office at the Department of Commerce, and Danny Weitzner, Associate Administrator for the NTIA’s Office of Policy Analysis and Development.  Over the past few months, the Department, in conjunction with NTIA and ITA, formed the Internet Policy Task Force and issued a notice of inquiry to discuss the “nexus between privacy policy and innovation in the Internet economy.” 

Last Friday’s day-long symposium included an introductory discussion on the global Internet economy and privacy that was followed by four panel discussions.  Professor Fred Cate, Senior Policy Advisor with the Centre for Information Policy Leadership and Distinguished Professor of Law at Indiana University Law School, set the stage for the first panel on “Privacy, Innovation and Global Trade.”  The participation of other Obama administration officials indicated that the Department is not alone in these efforts.  White House Deputy Chief Technology Officer Andrew McLaughlin led a panel on “Privacy Frameworks and Innovative Uses of Personal Information,” and Deputy Assistant Secretary of State and U.S. Coordinator for International Communications and Information Policy Phil Verveer spoke on the “Privacy on the Ground” panel.
 
The Department of Commerce will be receiving comments until June 7, 2010, on the notice of inquiry it issued on April 20, 2010.  A draft paper is expected in early October, ahead of the Organization of Economic and Cooperation and Development’s conference on privacy and technology, and the 32nd International Data Protection and Privacy Commissioners Conference, both of which will take place in Jerusalem during the last week of October.

The lack of meaningful consent has raised the possibility that privacy is moving beyond the advise-and-consent model toward a post-disclosure era.  It remains to be seen how the post-disclosure era will evolve and how the new paradigm will replace consumer notice and choice.  The FTC is examining the issue, and aims to publish a report by July 2010.  Although the final content of the report is yet to be determined, Chairman Leibowitz stated, “I have a sense, and it’s still amorphous, that we might head toward opt-in.”

For further information, view The New York Times blog post.

EPIC’s complaint, which was signed by nine other privacy organizations, alleges that Facebook’s privacy changes injure users by “invading their privacy; allowing for disclosure and use of information in ways and for purposes other than those consented to or relied upon by such users; causing them to believe falsely that they have full control over the use of their information; and undermining the ability of users to avail themselves of the privacy protections promised by the company.”  EPIC’s complaint further alleges that Facebook’s claim that users “have extensive and precise controls available to choose who sees what among their network and friends, as well as tools that give them the choice to make a limited set of information available to search engines and other outside entities” is deceptive because “Facebook’s changes to users’ privacy settings and associated policies in fact categorize as ‘publicly available information’ users’ names, profile photos, lists of friends, pages they are fans of, gender, geographic regions, and networks to which they belong.”

EPIC is requesting the FTC compel Facebook to “restore its previous privacy settings” and “make its data collection practices clearer and more comprehensible and to give Facebook users meaningful control over personal information provided by Facebook to advertisers and developers.”  In response to EPIC’s complaint, Facebook released a statement that the company had “discussed the privacy program with many regulators, including the FTC, prior to launch and expect to continue to work with them in the future.”
 

According to the complaint, in December 2007, a group of hackers now under criminal indictment launched an attack on Heartland’s network, injecting malicious code into Heartland’s computers.  Heartland allegedly discovered this injection of malicious code and took remedial steps that failed to fully eradicate the threat.  Later, in 2008, the hackers used the injected code to steal millions of payment card numbers.  Heartland did not discover the theft until January 2009. 

The plaintiffs argued that Heartland had made various representations to investors that it maintained sufficient security to prevent such hacking.  For example, Heartland’s 2007 Annual Report discussed the company’s network security situation stating that Heartland “place[d] significant emphasis on maintaining a high level of security” and maintained a network configuration that “provides multiple layers of security to isolate our databases from unauthorized access.”

The court disagreed with the plaintiffs’ claim that these statements were untruthful, holding that “there is nothing inconsistent between Defendants’ statements and the fact that Heartland had suffered an … attack.”  The court explained that “[t]he fact that a company has suffered a security breach does not demonstrate that the company did not ‘place significant emphasis on maintaining a high level of security,’” because “[i]t is equally plausible that Heartland did place a high emphasis on security but that the Company’s security systems were nonetheless overcome.” 

With respect to a former Heartland IT employee’s statement that Heartland should have taken various additional steps to secure its network following the 2007 attack, the court found that “one former employee’s opinion that Heartland did not do everything it could have done to address the security breach does not render the statement ‘We place significant emphasis on maintaining a high level of security’ false.” 

In the end, the court dismissed the complaint against Heartland with prejudice, finding that, because the company “did not make any statements to the effect that the company’s network was immune from security breaches or that no security breach had ever occurred, …the statements in the 10-K were not false or misleading.”

The Washington court’s ruling diverges from other recent rulings in the United States and Europe. In 2008, New Jersey’s Supreme Court held that Internet Service Providers (“ISPs”) are forbidden from disclosing subscriber IP addresses without a subpoena. The court held that New Jersey citizens have a “reasonable expectation of privacy” in the “subscriber information they provide to Internet service providers – just as New Jersey citizens have a privacy interest in their bank records stored by banks and telephone billing records kept by phone companies.” State v. Reid, 954 A.2d 503 (N.J. 2008).

Similarly, the European Union’s Article 29 Data Protection Working Party has noted that ISPs should “treat all IP information as personal data” unless the ISPs can “distinguish with absolute certainty that the data correspond to users that cannot be identified.” The Working Party has recommended that search engines delete or anonymize IP addresses once they are no longer needed, and should not retain the data longer than six months.

The issue of whether IP addresses are considered PII as a matter of law has significant implications for companies that collect and use consumer online information. To the extent IP addresses are considered PII, companies that use IP addresses for business purposes would be required to comply with numerous legal requirements with respect to that data.

Pinero contended that sometime in early 2008, defendants disposed of her 2005 federal and state tax returns intact in a public dumpster.  An unrelated individual found Pinero’s tax returns, as well as those of over 100 other people, and alerted a local television news station.

Pinero brought a putative class action, asserting state law claims of fraud, breach of contract, negligence, invasion of privacy, violation of the Louisiana Database Security Breach Notification Law ("LDSBNA") and violation of the Louisiana Unfair Trade Practices Act (LUTPA).  She also alleged that Jackson Hewitt violated 26 U.S.C. § 6103, which restricts certain disclosures of tax returns.  Pinero sought general damages for fear, panic, anxiety, sleeplessness, nightmares, embarrassment, hassle, anger, lost time, loss of consortium, and other emotional and physical distress, as well as special damages for credit monitoring, credit insurance, reimbursement for all out-of-pocket expenses related to notifying creditors of the improper disclosure, and reimbursement for all out-of-pocket expenses related to identity theft.

Jackson Hewitt moved to dismiss all claims.  Highlights of the court’s decision include:

• Dismissal of the negligence claim because the increased risk of identity theft is too speculative to qualify as actual damage;
• dismissal of the LDSBNA claim, in part because it only applies to breaches of computerized data;
• dismissal of the contract claim, in part because expenses related to credit monitoring to guard against future identity theft are not compensable damages;
• dismissal of the fraud and LUTPA claims (with leave to re-plead) for failure to explain why the representations in the privacy policy were misleading, since the mere breach of those promises does not alone establish that they were fraudulent;
• dismissal of the claim under 26 U.S.C. § 6103, since that statute only prohibits disclosure of tax returns by persons to whom access to tax returns was granted by the IRS; and
• denial of the motion to dismiss the invasion of privacy claim, since the alleged facts supported a claim for unreasonable public disclosure of private facts.

In response to this decision, Pinero filed an amended class-action complaint, re-pleading the fraud and LUPTA claims and maintaining the invasion of privacy claim.