The Privacy Foundation at the University of Denver Sturm College of Law

Financial Privacy

Hackers Steal Credit Card Data From Up to 40 Million Target Customers, 12/19/2013, mashable.com
Cybercriminals have hit retail store Target with a massive data breach that may have affected 40 million of customers’ credit and debit cards accounts. The breach started around Black Friday, the busiest shopping day of the year in America, and has reportedly affected roughly 40,000 card devices at registers in Target locations around the country. … In its press release acknowledging the breach, Target said “40 million credit and debit card accounts may have been impacted between Nov. 27 and Dec. 15, 2013.”

Identity Theft

The PII Problem: Privacy and a New Concept of Personally Identifiable Information, 12/06/2011_www.pogowasright.org_
Personally identifiable information (PII) is one of the most central concepts in information privacy regulation. The scope of privacy laws typically turns on whether PII is involved.

Reporters’ Roundtable: Who owns your online identity?, 02/11/2011, www.cnet.com
Today, we’re talking about identity. You own your identity, right? That’s why we talk about identity theft. Identity is clearly personal, and it can be stolen from us

12 reasons why we’re losing the identity theft battle, 09/14/2010, www.echanneline.com
1. Zero Liability has made consumers feel they have nothing to lose….

Heartland breach expenses pegged at $140M — so far, 5/10/2010, www.databreaches.net
The costs to Heartland Payment Systems Inc. from the massive data breach that it disclosed in January 2009 appear to be steadily adding up.

International Privacy

FTC Settles with Twelve Companies Falsely Claiming to Comply with International Safe Harbor Privacy Framework, 01/21/2014, _www.ftc.gov
Twelve U.S. businesses have agreed to settle Federal Trade Commission charges that they falsely claimed they were abiding by an international privacy framework known as the U.S.-EU Safe Harbor that enables U.S. companies to transfer consumer data from the European Union to the United States in compliance with EU law.

Ie: High Court orders Quinns to reveal passwords to receiver, 11/10/2012, www.pogowasright.org
In an interesting decision the High Court (Kelly J.) yesterday ordered that members of the Quinn family must provide passwords to personal email accounts and other information to the receiver appointed over their assets by the Irish Bank Resolution Corporation.

Government of Malta proposes inclusion of digital rights in Constitution, 10/11/2012, www.pogowasright.org
The government has presented a White Paper proposing the inclusion of digital rights in the Constitution as a means of introducing new rights to internet access, accessing information online, online freedom of expression, and the right to informational self-determination.

EU court: Social networks can’t be forced to monitor users, 02/16/2012, news.cnet.com
The European Union’s highest court says social networks cannot be forced to monitor users just to stop piracy.

FTC Welcomes a New Privacy System for the Movement of Consumer Data Between the United States and Other Economies in the Asia-Pacific Region, 11/16/2011, www.pogowasright.org
The Federal Trade Commission welcomed the approval by the forum on Asia-Pacific Economic Cooperation (APEC) of a new initiative to harmonize cross-border data privacy protection among members of APEC.

Where in the world are there data protection laws?, www.pogowasright.org, 10/30/2011
I stand in awe of how much some folks accomplish. Dave Banisar alerts me that he has updated the global map showing which countries have comprehensive data protection laws. The number is now up to 70.

Privacy commissioner of British Columbia issues guidelines on using social media for background checks, 10/14/2011, www.pogowasright.org
The Information and Privacy Commissioner of British Columbia has issued guidelines to assist organizations and public bodies using social media sites to conduct background checks of prospective employees, volunteers and candidates.

Medical Patient Security

The Latest Privacy Risk? Looking Up Medical And Drug Information Online, 02/24/2015, www.phiprivacy.net
Neil Ungerleider reports: If you have cancer, HIV, diabetes, lupus, depression, heart disease—or you simply look up health-related information online—advertisers are watching you. A new paper on what happens when users search for health information online shows that some of our most sensitive internet searches aren’t as anonymous as we might think.

A new sheriff in town: Federal Trade Commission enforcement of medical information security=, 09/17/2014, _www.lexology.com
A recent court decision found that the Federal Trade Commission (FTC) has authority to enforce the requirements for security of Protected Health Information, or PHI, as defined under the Health Information Portability and Accountability Act (HIPAA), against a defense asserted that the FTC has no authority under that statute.

Fourth Annual Benchmark Study on Patient Privacy and Data Security, 3/22/2014, www.bespacific.com
Ponemon Institute: “…we are releasing our Fourth Annual Benchmark Study on Patient Privacy and Data Security. We hope you will read the report sponsored by ID Experts that reveals some fascinating trends. Specifically, criminal attacks on healthcare systems have risen a startling 100 percent since we first conducted the study in 2010. This year, we found the number and size of data breaches has declined somewhat. Employee negligence is a major risk and is being fueled by BYOD.”

Data Broker Removes Rape-Victims List After Journal Inquiry, 12/19/2013, www.pogowasright.org
If you missed Senator Rockefeller’s hearing on data brokers yesterday, Pam Dixon of the World Privacy Forum made a powerful point in her opening statement about how data brokers have no shame. She cited the fact that brokers were selling lists of rape victims’ names for 7.9 cents per name.

Other Privacy Concerns"

When a Company Is Put Up for Sale, in Many Cases, Your Personal Data Is, Too, 06/28/2015, www.nytimes.com
The privacy policy for Hulu, a video-streaming service with about nine million subscribers, opens with a declaration that the company “respects your privacy.”

Facial Recognition Stalemate Convinces Privacy Groups To Walk Out Of Tech Industry Talks, 06/16/2015, www.ibtimes.com
Nine civil liberties and consumer groups have abandoned talks with trade associations after the two sides failed to find common ground over facial recognition technology.

Wetware: The Major Data Security Threat You’ve Never Heard Of, 05/14/2015, www.databreaches.net
Adam Levin reports: For the first time, according to a recent study, criminal and state-sponsored hacks have surpassed human error as the leading cause of health care data breaches, and it could be costing the industry as much as $6 billion. With an average organization cost of $2.1 million per breach, the results of the study give rise to a question: How do you define human error?

DOJ Issues Data Breach Guidance, 04/30/2015, www.databreaches.net
On Wednesday, April 29, 2015, the Department of Justice Computer Crime and Intellectual Property Section (CCIPS) Cybersecurity Unit issued new, detailed guidance on data breach incident response best practices.

What Is the Internet of Things?, 04/26/2015, www.bespacific.com
What Is the Internet of Things?, Mike Loukides and Jon Bruner, O’Reilly Media: “The Internet of Things (IoT) is a blending of software and hardware, introducing intelligence and connectedness to objects and adding physical endpoints to software.

Privacy Homeland Security

New directives on border searches of electronic media, 09/27/09, www.pogowasright.org
Department of Homeland Security (DHS) Secretary Janet Napolitano today announced new directives to enhance and clarify oversight for searches of computers and other electronic media at U.S. ports of entry.

In Warrantless Wiretapping Case, Obama DOJ’s New Arguments Are Worse Than Bush’s, 4/09/09, www.pogowasright.org
Friday evening, in a motion to dismiss Jewel v. NSA, EFF’s litigation against the National Security Agency for the warrantless wiretapping of countless Americans, the Obama Administration’s made two deeply troubling arguments.

A First Principles Approach to Communications’ Privacy, 5/17/08, www.pogowasright.org
Under current doctrine, parties to a communication enjoy robust constitutional protection against government surveillance…

Student Privacy

Why Schools Are Flunking Privacy and How They Can Improve, 12/16/2012, www.safegov.org
Fordham School of Law’s Center on Law and Information Policy (CLIP), headed by Joel Reidenberg, has released an eye-opening and sobering study of how public schools are handling privacy issues with regard to cloud computing. The study is called Privacy and Cloud Computing in Public Schools, and it is well worth a read.

California passes legislation to protect college students’ social media privacy, 08/21/2012, www.pogowasright.org
California’s Senate on Tuesday unanimously approved legislation to bar colleges and universities from requiring students to provide administrators with access to theirsocial media usernames and passwords. Governor Jerry Brown now must sign or veto the bill by Sept. 30.

FTC Advises Parents How to Protect Kids’ Personal Information at School, 08/15/2012, www.bespacific.com
A new school year usually means filling out paperwork like registration forms, health forms, and emergency contact forms, to name a few. The Federal Trade Commission wants parents to know that many school forms require personal and sensitive information that, in the wrong hands, could be used to commit fraud in their child’s name.

Stepping Into the Breach, 10/25/2011, www.campustechnology.com
If you think your institution is immune to a security breach, perhaps you should have a chat with Brian Rust at the University of Wisconsin-Madison.

Student loan company: Data on 3.3M people stolen, 3/27/10, www.databreaches.net
A company that guarantees federal student loans said Friday that personal data on about 3.3 million people nationwide has been stolen from its headquarters in Minnesota.

Workplace Privacy

If you have information that would be of interest to the Privacy Foundation, please contact us at .(JavaScript must be enabled to view this email address)

Privacy Law and Data Brokers