Upcoming Lunch Seminar – HIPAA Privacy: Current Developments, Friday, April 4, 2014





Financial Privacy

Hackers Steal Credit Card Data From Up to 40 Million Target Customers, 12/19/2013, mashable.com
Cybercriminals have hit retail store Target with a massive data breach that may have affected 40 million of customers’ credit and debit cards accounts. The breach started around Black Friday, the busiest shopping day of the year in America, and has reportedly affected roughly 40,000 card devices at registers in Target locations around the country. … In its press release acknowledging the breach, Target said “40 million credit and debit card accounts may have been impacted between Nov. 27 and Dec. 15, 2013.”

Identity Theft

The PII Problem: Privacy and a New Concept of Personally Identifiable Information, 12/06/2011_www.pogowasright.org_
Personally identifiable information (PII) is one of the most central concepts in information privacy regulation. The scope of privacy laws typically turns on whether PII is involved.

Reporters’ Roundtable: Who owns your online identity?, www.cnet.com
Today, we’re talking about identity. You own your identity, right? That’s why we talk about identity theft. Identity is clearly personal, and it can be stolen from us

12 reasons why we’re losing the identity theft battle, 09/14/2010, www.echanneline.com
1. Zero Liability has made consumers feel they have nothing to lose….

Heartland breach expenses pegged at $140M — so far, 5/10/2010, www.databreaches.net
The costs to Heartland Payment Systems Inc. from the massive data breach that it disclosed in January 2009 appear to be steadily adding up.

International Privacy

FTC Settles with Twelve Companies Falsely Claiming to Comply with International Safe Harbor Privacy Framework, 01/21/2014, _www.ftc.gov
Twelve U.S. businesses have agreed to settle Federal Trade Commission charges that they falsely claimed they were abiding by an international privacy framework known as the U.S.-EU Safe Harbor that enables U.S. companies to transfer consumer data from the European Union to the United States in compliance with EU law.

Ie: High Court orders Quinns to reveal passwords to receiver, 11/10/2012, www.pogowasright.org
In an interesting decision the High Court (Kelly J.) yesterday ordered that members of the Quinn family must provide passwords to personal email accounts and other information to the receiver appointed over their assets by the Irish Bank Resolution Corporation.

Government of Malta proposes inclusion of digital rights in Constitution, 10/11/2012, www.pogowasright.org
The government has presented a White Paper proposing the inclusion of digital rights in the Constitution as a means of introducing new rights to internet access, accessing information online, online freedom of expression, and the right to informational self-determination.

EU court: Social networks can’t be forced to monitor users, 02/16/2012, news.cnet.com
The European Union’s highest court says social networks cannot be forced to monitor users just to stop piracy.

FTC Welcomes a New Privacy System for the Movement of Consumer Data Between the United States and Other Economies in the Asia-Pacific Region, 11/16/2011, www.pogowasright.org
The Federal Trade Commission welcomed the approval by the forum on Asia-Pacific Economic Cooperation (APEC) of a new initiative to harmonize cross-border data privacy protection among members of APEC.

Where in the world are there data protection laws?, www.pogowasright.org, 10/30/2011
I stand in awe of how much some folks accomplish. Dave Banisar alerts me that he has updated the global map showing which countries have comprehensive data protection laws. The number is now up to 70.

Privacy commissioner of British Columbia issues guidelines on using social media for background checks, 10/14/2011, www.pogowasright.org
The Information and Privacy Commissioner of British Columbia has issued guidelines to assist organizations and public bodies using social media sites to conduct background checks of prospective employees, volunteers and candidates.

Medical Patient Security

Fourth Annual Benchmark Study on Patient Privacy and Data Security, 3/22/2014, www.bespacific.com
Ponemon Institute: “…we are releasing our Fourth Annual Benchmark Study on Patient Privacy and Data Security. We hope you will read the report sponsored by ID Experts that reveals some fascinating trends. Specifically, criminal attacks on healthcare systems have risen a startling 100 percent since we first conducted the study in 2010. This year, we found the number and size of data breaches has declined somewhat. Employee negligence is a major risk and is being fueled by BYOD.”

Data Broker Removes Rape-Victims List After Journal Inquiry, 12/19/2013, www.pogowasright.org
If you missed Senator Rockefeller’s hearing on data brokers yesterday, Pam Dixon of the World Privacy Forum made a powerful point in her opening statement about how data brokers have no shame. She cited the fact that brokers were selling lists of rape victims’ names for 7.9 cents per name.

NZ privacy commissioner finds that physician properly mitigated harm following a breach, 09/18/2013, www.phprivacy.net
A doctor working in a suburban medical practice had his car broken into and bag stolen. The bag contained a USB stick holding the personal information of a number of patients, including the complainant.

PPR Releases Trust Framework© for Data Privacy, 04/03/2013, www.phiprivacy,net
Patient Privacy Rights (PPR) is pleased to announce the publication of its Privacy Trust Framework©, a set of 75+ auditable criteria based on 15 key privacy principles.

At long last, HHS unveils Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules, 01/17/2013, www.phiprivacy.net
The U.S. Department of Health and Human Services (HHS) moved forward today to strengthen the privacy and security protections for health information established under the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Other Privacy Concerns

Internet of Things (IoT) is transforming internet security, 04/21/2014
IoT means “potentially billions of devices will report data about themselves, making it possible to create new applications in areas as diverse as factory optimization, car maintenance, or simply keeping track of your stuff online” as reported in MIT Technology Review.

The Scoring of America: How Secret Consumer Scores Threaten Your Privacy and Your Future, 04/02/2014 www.pogowasright.org
This new report from Pam Dixon and Bob Gellman for the World Privacy Forum explores the issue of predictive scores that use information about your past to predict your future. How accurate are these predictions? What impact can they have on your life? What scores are predicting you?

Breaking: Documents Reveal Unregulated Use of Stingrays in California, 03/13/2014, www.pogowasright.org
Local law enforcement agencies across the Bay Area have so-called stingray devices, a powerful cellphone surveillance tool, and more are planning to acquire the technology, according to public records recently obtained by Sacramento News10.

State Supreme Court rules local cops wrong to use texts to get convictions, 02/28/2014, www.pogowasright.org
ppeals of two Longview drug convictions led to a far-reaching state Supreme Court decision Thursday that people have the right to privacy in sending and receiving text messages.

New Privacy Paper: Mass Surveillance as Privacy Pollution, 02/26/2014, www.pogowasright.org
ata collection in public (and in the home via public spaces) resembles an externality imposed on the person whose privacy is reduced involuntarily; it can also be seen as a market failure caused by an information asymmetry.

Got Malware? The FBI Is Willing to Pay For It, 02/06/2014, www.securityweek.com
The FBI has placed malware on its shopping list, and is turning to vendors to help the agency build a massive library of malicious software.

How a Family Tragedy Landed on a Retailer’s Mailing, 01/29/2014, online-wsj.com
When Mike Seay arrived home earlier this month and found his wife in the kitchen crying, he braced himself. The couple was still devastated by their daughter’s death in a car accident last February, and seeing his wife Shannon distraught, he prepared for the worst.

Keeping privates private: the legal landscape of revenge….=, 01/29/2014, www.lexology.com
Mark Zuckerberg famously stated that the purpose of Facebook is “to make the world more open and connected,” and indeed Facebook, other social media outlets and the Internet in general have brought worldwide openness and connection-through-sharing to levels unparalleled at any point in history.

Federal consumer bureau data-mining hundreds of millions of consumer credit card accounts, mortgages, 01/28/2014, www.phiprivacy.net
Officials at the Consumer Financial Protection Bureau are conducting a massive, NSA-esque data-mining project collecting account information on an estimated 991 million American credit card accounts.

Hulu hoops: standing & damages as threshold issues in privacy cases= , 01/22/2014, www.lexology.com
If A Tree Falls And No One Is Hurt By It, Can You Still Sue? Imagine you are in the mall, and you overhear an interaction between a clerk and another shopper.

How to Lose Your Data In 10 Days, 01/21/2014, www.privacyassociation.org
It’s no longer an “if” you’re the target of a data breach; it’s just a matter of “when.” Data loss incidents are becoming an unfortunate rite of passage.

The ‘Internet of Things’ will impact law and regulation in 2014, 01/16/2014, www.lexology.com
If 2013 was the year of “Big Data,” 2014 will be the year of the “Internet of Things.” The Internet of Things is the network of physical objects that contain embedded technology to communicate and sense or interact with people, things, and the external environment.

Judge: NSA phone program likely unconstitutional, 12/16/2013, www.politico.com
A federal judge ruled Monday that the National Security Agency program which collects information on nearly all telephone calls made to, from or within the United States is likely to be unconstitutional.
U.S. District Court Judge Richard Leon found that the program appears to run afoul of the Fourth Amendment prohibition on unreasonable searches and seizures. He also said the Justice Department had failed to demonstrate that collecting the so-called metadata had helped to head off terrorist attacks.
Related: Ruling (pdf).
Update: Orin Kerr finds Judge Leon’s analysis unpersuasive.

Privacy Homeland Security

New directives on border searches of electronic media, 09/27/09, www.pogowasright.org
Department of Homeland Security (DHS) Secretary Janet Napolitano today announced new directives to enhance and clarify oversight for searches of computers and other electronic media at U.S. ports of entry.

In Warrantless Wiretapping Case, Obama DOJ’s New Arguments Are Worse Than Bush’s, 4/09/09, www.pogowasright.org
Friday evening, in a motion to dismiss Jewel v. NSA, EFF’s litigation against the National Security Agency for the warrantless wiretapping of countless Americans, the Obama Administration’s made two deeply troubling arguments.

A First Principles Approach to Communications’ Privacy, 5/17/08, www.pogowasright.org
Under current doctrine, parties to a communication enjoy robust constitutional protection against government surveillance…

Student Privacy

Why Schools Are Flunking Privacy and How They Can Improve, 12/16/2012, www.safegov.org
Fordham School of Law’s Center on Law and Information Policy (CLIP), headed by Joel Reidenberg, has released an eye-opening and sobering study of how public schools are handling privacy issues with regard to cloud computing. The study is called Privacy and Cloud Computing in Public Schools, and it is well worth a read.

California passes legislation to protect college students’ social media privacy, 08/21/2012, www.pogowasright.org
California’s Senate on Tuesday unanimously approved legislation to bar colleges and universities from requiring students to provide administrators with access to theirsocial media usernames and passwords. Governor Jerry Brown now must sign or veto the bill by Sept. 30.

FTC Advises Parents How to Protect Kids’ Personal Information at School, 08/15/2012, www.bespacific.com
A new school year usually means filling out paperwork like registration forms, health forms, and emergency contact forms, to name a few. The Federal Trade Commission wants parents to know that many school forms require personal and sensitive information that, in the wrong hands, could be used to commit fraud in their child’s name.

Stepping Into the Breach, 10/25/2011, www.campustechnology.com
If you think your institution is immune to a security breach, perhaps you should have a chat with Brian Rust at the University of Wisconsin-Madison.

Student loan company: Data on 3.3M people stolen, 3/27/10, www.databreaches.net
A company that guarantees federal student loans said Friday that personal data on about 3.3 million people nationwide has been stolen from its headquarters in Minnesota.

Workplace Privacy

If you have information that would be of interest to the Privacy Foundation, please contact us at .(JavaScript must be enabled to view this email address)

HIPAA Privacy