What is a Dynamic IP address?

An Internet Protocol (IP) address is a series of digits assigned by an Internet Service Provider (ISP) such as Time Warner or Verizon, to each computer that accesses the internet.

Static IP addresses are permanent IP addresses, usually assigned to organizations with large networks.

Most individuals however get assigned “dynamic” IP addresses, which are IP addresses that may potentially be changed by the ISP provider when they experience a need for it, but which in practice do not change that often. Individual ISP subscribers may maintain the same dynamic IP address for long periods of time, such as eight to twelve months. Individual subscribers usually also have their dynamic IP address changed when they travel, move to a different home or a different city, or if they change their routers, or anytime they access the Internet with their device from a different network.

Dynamic IP addresses, just as static IP addresses, do not enable a link to be established between the IP address and a given computer or user. Only the ISP has access to the additional subscriber information required to establish that link.

Why is this a privacy issue?

Many websites collect and store static and dynamic IP addresses of the computers that visit their sites, together with the time and date of visit and use this information for marketing or other purposes, such as fraud and security monitoring.

If dynamic IP addresses are Personal Data, then all applicable laws and regulations regarding the collection and processing of personal data apply to the collection and processing of dynamic IP addresses as well.

Unique identifiers and Combined Identifiers

Most global privacy/data protection laws and regulations define personal data as data that not only uniquely identifies a person, such as the name of a person, but also data that, while on its own may not uniquely identify an individual, but when combined with other data, may render an individual identifiable. A simple example would be a phone number (landline and/or mobile). A phone number, on its own, does not identify an individual. However, with the use of reverse lookup tools , a phone number can be used to identify an individual, by associating a name and address with that phone number.

In other words, most information collected by an organization about an individual is likely to be considered personal information if it can be attributed to an identified or “identifiable” individual, whether by one unique identifier or by a combination of two or more data elements.

The special case of dynamic IP addresses

If a user of the website concerned has revealed his/her identity during the website consultation period, e.g. by creating a profile, then the operator of that website is able to identify the website user by linking his/her name to his/her computer’s IP address. In that case, even a dynamic IP address will most probably qualify as personal data.

What if the website user has not revealed his/her identity when visiting a website?

Is access to the IP address alone enough to identify that user?

An IP address, whether static or dynamic, can be traced back to an individual when combined with Internet subscriber information held by the ISP provider.

In case of a static IP address, the subscriber information remains the same, regardless of the date when the access to the website by that subscriber occurred.

In the case of dynamic IP addresses, one needs to know the date of access to the website in addition to the IP address of the subscriber, since dynamic IP addresses of internet connected devices tend to change over time.

The fact that additional information on date of access is needed for the identification of dynamic IP addresses renders dynamic IP addresses a tad more “unidentifiable” than static IP addresses.

However, most websites collecting IP addresses also collect time and date of access, so that the distinction between static and dynamic IP addresses from a privacy perspective is not all that significant. All one needs to identify a dynamic IP address, in addition to the subscriber data that connects it to it, is the desired time frame of the subscriber data.

Should your organization treat dynamic IP addresses as “Personal Information”?

The answer to this question, from a privacy/data protection compliance perspective, depends first of all on which privacy/data protection laws and regulations your organization is subject to. Usually, there has to be some connection between a country’s privacy/data protection laws and the organization in question.

Here are some questions, which may help determine these connections:

• In which countries does your organization have a seat of business? These might be the countries whose privacy/data protection laws apply to your organization.
• To individuals from which countries does your organization market its business? Some countries make their laws applicable to businesses that are targeting their country’s residents or citizens or both, even if the business in question has no physical presence in that country.

For example, if your organization has a seat of business in one or more of the 28 EU member states, and processes personal data in the context of that business, the EU Data Protection Directive 95/46 (the Directive) and the Member State’s national data protection laws based upon it will apply to your organization.

Under the expanded territorial applicability of the General Data Protection Regulation (GDPR), which will replace the Directive and all the Member States’ national privacy/data protection laws as of May 2018, your organization will also be subject to the GDPR if it markets to or monitors data subjects of EU Member States, even if the organization in question has no physical presence in a EU Member State.

Are dynamic IP addresses “personal data” under the EU Data Protection Directive? Under the GDPR?

Until recently, there was no legal clarity or certainty whether dynamic IP addresses, collected and processed by websites or third parties were Personal Data under the Directive.

However, the recent ruling of the Court of Justice of the European Union (CJEU) of October 19, 2016 in the Patrick Breyer v. Bundesrepublik Deutschland case removed all doubt: The CJEU ruled that a dynamic IP address of a website user is personal data with respect to the website operator, if that website operator has the legal means allowing it to identify the user in question with the help of additional information about that user which is held by that user’s ISP. For example, most countries allow for law enforcement (with or w/o a court order) to approach the ISP for more detailed information about who an IP address was assigned to at the time of access in case of a criminal investigation.

If for example, a website is the victim of a cyber attack, the website operator is usually able to contact the competent authorities, so that the latter can take the necessary steps to obtain the relevant IP address subscriber information from the ISP and to bring criminal proceedings.

That mere possibility for a data subject to potentially become identified through his/her device’s IP address renders the IP address into personal data. Controllers must ask themselves the following question: Is it reasonably likely that they or a third party might be able to identify an individual through the IP addresses which they collect and process, even if recourse to data held by a third party (here, the ISP) is required in order to obtain identification? If the answer is yes, the IP address is personal data and must be handled accordingly.

Since the GDPR has retained the same basic, broad definition of “personal data” as the definition of the Directive, it is reasonable to predict that the Breyer decision of the CJEU will apply to the GDPR and that dynamic IP addresses will be considered personal data under the GDPR.

What are the practical implications of dynamic IP addresses being considered personal information?

 Once an organization has established that it is subject to the EU Directive and/or, in a short while, to the GDPR, it must ensure that all requirements applicable to the collection and handling of personal information of data subjects are applied to the collection and handling of dynamic IP addresses of these data subjects. Some examples include notice and consent requirements, use limitations of the collected dynamic IP addresses, the provision of adequate information security to this data set, the restriction of retention periods and the restriction of cross-border transfers of and cross-border access to dynamic IP addresses.

This past month saw another batch of large data breaches, with “Heartbleed” considered by some the largest data security breach in the history of the internet; a flurry of legislative efforts by the States to regulate the use of drones, student privacy and government surveillance; a landmark victory for the FTC’s authority to regulate commercial data security practices; important privacy legislation in Australia, Brazil, and Canada; the EU Art 29 WP was busy as a bee publishing Opinions on EU Data Protection, and the European Parliament voted in favor of the proposed General Data Protection Regulation, leaving the next step up to the Council of Ministers.

Big Data

• FTC to Examine Effects of Big Data on Low Income and Underserved Consumers at September Workshop

Biometrics

• Facial Recognition: Talks resume at NTIA (National Telecommunications and Information Administration) to craft a privacy-enhancing code of conduct for commercial uses of facial recognition technology

COPPA

• FTC Staff Updates Guidance on “COPPA and Schools” Through Revised FAQs

• FTC Concludes Review of iVeriFly’s Proposed COPPA Verifiable Parental Consent Method

• FTC: COPPA Does Not Preempt State Teen Online Protections

Data Breaches

. ‘Heartbleed’ Bug Exposes Passwords, Web Site Encryption Keys

• Experian: U.S. States Investigate Breach at Experian/Court Ventures

• Tax Fraud: D.C. physicians swept up in tax ID theft scam ; Spike in Tax Fraud against Doctors

• Michaels, Aaron: 3 Million Customer Credit, Debit Cards Stolen in Michaels,Aaron Brothers Breaches

• Paper Breaches (Don’t dump those papers, shred them!)

OR: Employment applications found in Little Caesars Pizza dumpster in Salem

UT: Client files with personal information found in Dumpster

• Legislation: Kentucky has become the 47th state to enact a data breach notification law

• Holder calls for federal law on data breaches

• Court approves first-of-its-kind data breach settlement. AvMed agrees to set aside $3 million for breach victims, whether they suffered direct harm or not.

• 
FTC Deputy Director Daniel Kaufman Backs Civil Penalties for Large Breaches

• Two Congressional Hearings on Data Security

• http://science.house.gov/hearing/subcommittee-oversight-and-subcommittee-research-and-technology-joint-hearing-can-technology

• http://financialservices.house.gov/calendar/eventsingle.aspx?EventID=371096

Data Brokers/FCRA

• Two Data Brokers Settle FTC Charges That They Sold Consumer Data Without Complying With Protections Required Under the Fair Credit Reporting Act (FCRA)

Drones (Unmanned Areal Systems or UAS)

• According to the American Civil Liberties Union, 43 states are considering 96 bills related to domestic drone usage. Wisconsin is the ninth state to regulate drone usage, joining Florida, Idaho, Illinois, Montana, Oregon, Tennessee, Texas and Virginia.

• The Kansas Senate Committee passed SB 409, which would limit the use of drones with recording devices

• Wisconsin governor signs bill restricting drone use

• Utah governor signs bill that puts limits on police use of drones

• On the other hand: New Hampshire Drone Bill Shot Down in Senate

EU Data Protection

• Many Art 29 WP Opinions this past month. Eduardo Ustaran sums it up: Art 29WP – Something old, something new, something borrowed, something blue. http://www.linkedin.com/today/post/article/20140425061231-24251273-something-old-something-new-something-borrowed-something-new

• Art29 WP Working Document on contractual clauses from EU processors to non-EU sub processors.

• Article 29 WP Opinion 03/2014 on “Data Breach Notification”

. Art 29 WP Opinion 04/2014 “on surveillance of electronic communications for intelligence and national security purposes

• Art 29 WP Opinion 05/2014 on “Anonymisation Techniques”

• Article 29 WP Opinion 06/2014 on “Legitimate Interests”

• EU Court of Justice invalidates the Data Retention Directive

• ECJ upholds independence of data protection authorities in case against Hungary

. The New EDPS’ Opinion Privacy and Competitiveness in the Age of Big Data

. DPAs, FTC Unveil Cross-Border Data Transfer Tool (APEC CBPRs and EU BCRs Referential)

• Council of Europe launches a human rights guide for internet users

. Italy: Garante imposes ‘landmark’ €1 million fine on Google

• France: New French Law Authorizes the CNIL to Conduct Online Inspections

 . Germany’s DPAs Adopt Resolutions on Employee Privacy, Facial Recognition and EU Draft Regulation

• Microsoft can now transfer data from its EU cloud servers to its non-EU servers via EU approved model contracts

EU Data Protection Reform

• EUROPEAN PARLIAMENT VOTES IN FAVOR OF PROPOSED DATA PROTECTION

• Article 29 WP Issues Statement on One-Stop-Shop Within Proposed EU General Data Protection Regulation

• Member States unveil positions on proposed “One-stop-shop [complaint] mechanism”

EU-US Safe Harbor

• Art WP 29 has many additional recommendations to strengthen personal data protection under the Safe Harbor Decision

• In a Joint Statement at the EU-US Summit on 26 March 2014 EU and U.S. officials announced a commitment to strengthening the Safe Harbor framework by this coming summer

FACEBOOK

• Facebook admits users are confused about Privacy, will show more on-screen explanations, in an effort to practice “surprise minimization” or “minimize the surprise to the consumer”.

FERPA/Student Privacy

• Kentucky enacts law Protecting Student Data In the Cloud

• Louisiana House Passes Student Privacy Bill

• Florida Senate Passes Student Privacy Bill, which would prohibit schools from collecting political and religious beliefs and biometric information from students

• Kansas House Passes Student Privacy Bill which would restrict access to student records and prohibit the state from collecting information relating to students’ and their families’ personal beliefs or practices on issues such as sex, family life, morality and religion.”

• The Colorado House Education Committee unanimously passed a bill that would put restrictions on the sharing of education data.

• South Dakota Passes Student Privacy Law

• California Sen. Proposes Student Privacy Bill

• Illinois House Committee Endorses Student Privacy Bill

• inBloom’s closure highlights dark side of privacy in sectors driven by data http://www.businesscloudnews.com/2014/04/25/inblooms-closure-highlights-dark-side-of-privacy-in-sectors-driven-by-data/

Fourth Amendment /Surveillance

• Idaho: New law limits DNA collection by law enforcement: only upon criminal conviction or by court order

• Utah: New law makes any electronic data obtained by law enforcement without a warrant, including location data, inadmissible in a criminal proceeding.

• Indiana:  Anti-Surveillance Bill signed into law- requires police to obtain search warrants before using drones, using cellphones to track individuals or demanding passwords for electronic devices among other restrictions

. The U.S. Supreme Court heard oral arguments in Riley v. California and United States v. Wurie, two cases involving the warrantless search of an individual’s cell phone incident to arrest and will decide on an important Fourth Amendment question: can the police search the entire contents of an individual’s cell phone incident to any lawful arrest. To be followed.

FTC, Section 5, Deceptive and Unfair Practices

· FTC Approves Final Order Settling Charges that Aaron’s Inc. Allowed Franchisees to Spy on Consumers via Rental Computers

FTC v. Wyndham

· Federal court denies Wyndham Hotels & Resorts’ motion to dismiss FTC’s complaint and upholds FTC’s authority to regulate commercial data security practices

GOOGLE

• Google has updated its terms of service to reflect that it analyses user content including e-mails

GLOBAL

• Australia: Reforms to the Privacy Act are in effect as of March 12, 2014

• Brazil: Brazil passes the “Internet Bill of Rights”, a law that protects online privacy and promotes an open Internet

• Canada: Canada’s anti-spam legislation (CASL), requiring express consent, becomes effective July 1, 2014.

HIPAA

• HHS is serious about HIPAA compliance, reveals audit plans

• HHS Releases Security Risk Assessment Tool

• OCR Announces $1,975,220 in Settlements Over Stolen, Unencrypted Laptops containing PHI

NSA/ GCHQ

• Yahoo webcam images from millions of users intercepted by GCHQ; 1.8m users targeted by UK agency in six-month period alone. Material included large quantity of sexually explicit images

• Introducing the ACLU’s NSA Documents Database. These documents stand as primary source evidence of our government’s interpretation of its authority to engage in sweeping surveillance activities at home and abroad, and how it carries out that surveillance.

• NSA Said to Exploit Heartbleed Bug for Intelligence for Years

• U.S. v Lavabit judgment: Fourth Circuit affirms district ruling: Lavabit in contempt. Lavabit tried giving the feds its SSL Key In 11 pages of 4-Point Type; Feds complained that it was illegible

Surveillance

• FBI Plans to Have 52 Million Photos in its NGI (next generation identification) Face Recognition Database by Next Year

Technology and Lifestyles, New Developments in

• Facebook unveils new “Nearby Friends” location feature

• Google Glass Etiquette https://sites.google.com/site/glasscomms/glass-explorers

• Conversnitch: a device that live-tweets private conversations.

TCPA

The FCC issued two rulings regarding exemptions to the “express consent” requirement under TCPA (The TCPA and associated FCC rules require parties to obtain “prior express consent” before transmitting autodialed or prerecorded informational calls or text messages to a wireless telephone number).

• The FCC exempted package delivery notifications from the “prior express consent” requirement when the called party is not charged for them by the wireless carrier. For example, under the exemption, FedEx or UPS will not need prior express consent of package recipients for automated shipment notification messages sent to their mobile telephone numbers.

• In the context of “text-based social networks” such as GroupMe, “prior express consent” to receive automated text messages can be obtained through an intermediary (in this case, the text message group creator), where the messages are administrative in nature and concern the use and cancellation of the service.

by Monique Altheim on February 23, 2014

Conferences

•  Powerpoint presentation of the closing plenary session on privacy @legaltechNY “Ripped from the Headlines: Cautionary Tales from the Annals of Data Privacy”        

COPPA

•  FTC Approves kidSAFE Seal Safe Harbor Program  

Data Breaches

•     
• Barclays’ Busted For Stealing, Selling Confidential Financial Data Of Thousands Of Clients
  
• UK: Barclays cybertheft involved cooperation of employee
  
• 2013 broke the previous all-time record for the number of exposed records caused by reported data breach incidents.  The 2,164 incidents reported during 2013 exposed over 822 million records, nearly doubling the previous highest year on record(2011) 
• Syrian Electronic Army hacks Forbes, steals and dumps employee and user data
  
• Email attack on vendor set up breach at Target
  
• Retailers Testify on Data Security at Senate Judiciary Committee Hearing, Express Support for Chip-and-PIN Technology
  
• Senate hearing on data breaches & cybercrime. Target and Neiman Marcus reps testify.
• New Federal Court Decision Affirms the Standing Doctrine as a Critical Hurdle to Data Breach Actions. Increased risk of becoming victims of fraud, identity theft, or phishing at some point in the future was insufficient to constitute “injury-in fact”.
•  http://www.insideprivacy.com/united-states/litigation/federal-court-dismisses-data-breach-suit-alleging-only-speculative-harms/
• Jay Cline: U.S. takes the gold in doling out privacy fines

Data Brokers/FCRA

•  Data Broker Accountability and Transparency Act Introduced By Senate Democrats

Data Security

• The White House released the National Institute of Standards and Technology’s (NIST) Final Cybersecurity Framework: a set of industry best practices and standards to help owners and operators of critical infrastructure develop better cybersecurity programs.
• Senate Democrats Introduce the Data Security and Breach Notification Act of 2014. The bill would require the Federal Trade Commission (FTC) to promulgate federal data security standards, establish federal data breach notification requirements, criminalize concealing breaches of security involving personal information, provide potentially harsh civil penalties, and preempt state data security and breach notification laws. 

• The FTC’s Data Security Guidelines
  

Drones

• WA: House Bill 2789, which was approved by an 83-15 vote, would limit the purchase and use of unmanned aircraft systems by state and local agencies.  House Bill 2178, passed by a vote of 92-6, would ban the unauthorized use of drones, or other unmanned aircraft with sensing devices, above private property. http://www.theolympian.com/2014/02/17/2990592/house-passes-drone-government.html

EU Data Protection

• Facebook must comply with German data protection law, the Higher Court of Berlin rules. The High Court of Berlin finds that Facebook’s data processing is handled by US parent company, not FB Ireland. If the court had found that the user data was processed by Facebook Ireland and not by Facebook US, the Irish Data Protection law would have applied; According to the EU Directive, the law of the EU Member State applies, where the company has an establishment and where the processing is carried out in the context of the activities of the establishment.(EU Directive 95/46/EC, Art.4,1(a)); In the absence of this condition (as was the case here, since the court decided that no processing was occurring in Ireland, but instead the processing happened through data centers in the US), the second rule of applicable law applies: the Member State on whose resident’s computers or other devices the data controller (FB here) sets cookies EU Directive 95/46/EC, Art.4,1(c)), in this case Germany;

•  The list of companies that have Binding Corporate Rules in place has been updated.
  

•  European Member States and ENISA Issue Standard Operational procedures (SOPs) to Manage Multinational Cyber Crises

• EU Commissioner Reding introduces her Eight Principles of Data Protection
  

EU Data Protection Reform

•  Merkel Backs Plan to Keep European Data in Europe. 

• Official declaration from Franco-German ministerial council: Adoption of #EUDataP not later than 2015.

• ICO has published comparative analysis of the EU Commission text and EP Justice Committee amendments.

EU-US Safe Harbor

• FTC Settles with Twelve Companies Falsely Claiming to Comply with International Safe Harbor Privacy Framework.
• Fantage: FTC settles with gaming site over privacy claims.

FCC

• Annual FCC CPNI Certification Due by March 1.

FCRA

• 9th Circuit Says Plaintiff Had Standing to Sue Spokeo for Fair Credit Reporting Violations.
  

• Judge Reduces Punitive Damages Against Equifax in FCRA Suit.

FERPA

• NY: Audit of charter school finds serious IT security deficiencies.
  

• New Laws Are Needed To Protect Student Privacy In The Digital Age. 

FTC

• FTC Announces Settlement with Medical Transcription Provider after Discovery of Patient Transcripts on the Internet.
  

• Dissection of a Twitter Chat on Privacy and Data Protection with @JulieBrillFTC .

HIPAA

• HHS Issues Guidance on Sharing Mental Health Information 

Q: Is a mental healthcare provider allowed to share psychotherapy notes with anyone?

A: NO, not even with another healthcare provider for treatment purposes, unless patient gives consent. As for sharing the notes with the patient, HIPAA leaves it to the discretion of the mental healthcare provider.

Q: What if patient threatens to blow up a school?

A: Yes, this is an imminent safety threat. Depending on the applicable State Law, there may even be a “duty to warn”.

Remember that in a State with stricter laws, the stricter State law prevails.

• Puerto Rico Hits Insurer with Record $6.8 Million Fine for HIPAA Breach.

•  The Workgroup for Electronic Data Interchange (WEDI) issues Guidance for Assessment of Potential Breaches under HIPAA.

IoT (Internet of Things)

•  Over 500,000 Belkin WeMo Home Automation Devices Vulnerable to Hackers’ Attacks.

NSA

•  AT&T has released its first transparency report, more than 300k government requests for data in 2013.
  

•  Transparency report from LinkedIn. 
  

• Transparency reports  from Google and Yahoo.

•  An American law firm was monitored while representing a foreign government (Indonesia) in trade disputes with the United States.

• Sen. Paul announces ‘historic’ class-action suit over NSA spying.
  

• How App Developers Leave the Door Open to NSA Surveillance.
  

•  Watchdog Report Says N.S.A. Program Is Illegal and Should End.
  

•  Obama’s Changes to Government Surveillance.
  

Technology and Lifestyles, New Developments in

• Dropbox’s new Privacy Policy, effective March 24, includes a Government Surveillance “Manifesto”. Its new Terms of Service include an arbitration clause, which you have 30 days to opt out of.

• Dutch telecom operator KPN has struck a deal with encrypted communications provider Silent Circle to start offering its Dutch, German and Belgian customers encrypted phone calls and text messages.
  

•  Apple promises fix “very soon” for Macs with failed encryption.
  

• Cryptolocker scrambles US law firm’s entire cache of legal files.
  

·

• Facebook Unveils New Tool to Read Posts and News, via @nytimes
  

•  Facebook to Buy WhatsApp for $19 Billion in Cash, Stock.

A study commissioned in Australia by the National Association for Information Destruction (NAID), published on Feb.19, has found significant amounts of sensitive personal information left on recycled computers. The researchers purchased  52 computers randomly  on sites such as eBay, and hired a reputable forensic investigator to find out whether any personal information was left on the drives. Out of the 52 devices, 15 still contained highly confidential personal information, including health and financial information, as well as personal photos and videos. Those devices had been “recycled” by individuals, law firms and government agencies and the forensic evidence showed that all the files in question had been subjected to attempted deletion.

Clearly, many still believe that pressing the “delete” button will permanently delete a file and/or have never heard of forensic retrieval of digital data. Whether one operates in a jurisdiction that mandates secure disposal of personal data or not, improper removal of personal data on computers, smartphones or tablets is certainly bad practice. It is not only bad practice in the case of recycling of a device, as was the case in this study, but also when disposing of a device. Even when simply deleting personal files that have reached the end of their lifecycle, one needs to ensure their professional and final disappearance. Otherwise, these files may easily come back to life through a simple forensic examination of the computer in question, as was the case with the famous incriminating documents in the Enron case. The incriminating files, the needles in the haystack, had all been “deleted” by Enron employees and later retrieved by forensic experts during the investigation of the Enron scandal.

At the 34th International Conference of Data Protection and Privacy Professionals  in Punta del Este, Uruguay (2012), a panel I moderated dealt in depth with the issue of deletion of digital data and forensic retrieval of personal information. You can watch the entire panel here: (Some of the presentations are in Spanish).

My panel consisted of, from left to right,  Oscar Puccinelli, an attorney and professor of Constitutional Law at the National University of Rosario in Argentina, Jeimy Cano, CIS at Ecopetrol and professor at the Univesidad de Los Andes in Bogota, Colombia, Gustavo Betarte, CTO at Tilsor and researcher and professor at the Engineering School of the Univesidad de la Republica in Montevideo, Uruguay, Yoram Hacohen, at the time, head of the Israeli Law, Information and Technology Authority (ILITA), and William C. Barker, associate director and chief cyber security advisor at the National Institute of Standards and Technology (NIST).

William Barker’s Slides:

Gustavo Betarte’s Slides:

FTC Comissioner Julie Brill recently held her first Twitter chat on the topic of privacy and the FTC.

TWITTER LINGO FOR BEGINNERS:

Those who are regular twiteratti can skip the following paragraph, but for those still not familiar with Twitter lingo, I have included a short introduction to Twitter shorthand:

• @JulieBrillFTC: This is Julie Brill’s twitter handle, or twitter user name. Tweeters need to create a twitter handle in order to tweet.
• RT: Re Tweet; When @JulieBrillFTC tweets: RT@soandso, she re-tweets @soandso’s tweet; in other words, she repeats that person’s tweet.
• MT: Modified Tweet; When @JulieBrill tweets: MT@soandso, she retweets @soandso’s tweet, but with a slight modification, usually in order to remain within the 140 character limit.
• In the Twitter chat, @JulieBrillFTC RT’d or MT’d participant’s questions (Q). She preceeded her answers with an A.
• #: Hashtag. A hashtag on Twitter is the pound sign, followed by an acronym or word to group all tweets related to a particular topic. If you click on that particular hashtag link, you will see all tweets that were posted with that hashtag included in their tweets. In @JulieBrillFTC’s Twitter chat, the chosen hashtag was #FTCpriv
• Tweets have a limit of 140 characters. A lot more can be crammed into a tweet by the use of a link to an article, something which @JukieBrillFTC avails herself of in her answers to tweeters’ questions. There are even several ways of shortening the links, to leave more characters free for use in the tweet.

I reposted @JulieBrill’s Twitter chat in a user friendly way. Tweets that were not directly relevant to the Q&A were omitted. Tweets by those who posted the questions were omitted as well to avoid unnecessary duplication of the questions, since @JuliBrillFTC re-tweeted them anyway. Since Twitter operates as a live feed, later tweets appear before earlier tweets. Therefore, for someone not used to Twitter, it might be disconcerting to read the answers before the questions. I therefore reversed the order of the tweets, and posted the earlier ones before the older ones.

@JULIEBRILLFTC’s TWITTER CHAT:

• JulieBrillFTC ‏@JulieBrillFTC  Feb 5 Welcome to my 1st Twitter chat! Happy to answer your questions about big data, data security, internet of things, & privacy. #FTCpriv
• I’ll try to answer as many questions as I can in the next 60 minutes. So, what do you want to know? #FTCpriv
• Q1 MT @alexanderhanff can u explain why links to so many privacy papers on FTC web site are broken? Hard 2 cite studies that vanish #FTCPriv
• A1 FTC recently went through redesign of its website to improve functionality. Please send problematic links to ftcgovweb@ftc.gov. #FTCpriv
• Q2 RT @hfienberg What is the definition of a data broker, according to the @FTC ? #FTCpriv
• A2 We set out definition of data broker in its 2012 Privacy Report http://go.usa.gov/BKNk  . 3 categories: FCRA, eligibility, or marketing.
• Q3 RT @PaulNemitz #ftcpriv How important is the US – EU #Safeharbour arrangment for the protection of #privacy of americans?
• A3 Our enforcement of Safe Harbor protects both U.S. & EU consumers through our casework. #FTCpriv
• Q4 MT @JeramieScott Do u have thoughts on how to ensure integrity of big data algorithms that make decisions that impact people? #FTCpriv
• A4 Consumers need more access to data sets to see impact of these decisions, and to reclaim their names http://go.usa.gov/BKjh  #FTCpriv
• Q5 MT @ lexanderhanff In Jan 2013, Brussels ou stated FTC ready to work w/EU on mutual enforcement prog. has discussion evolved? #FTCPriv
• A5 The FTC remains committed to improving mutual enforcement cooperation with EU partners. #FTCpriv
• Q6 MT @CWLiedtke #FTCpriv EU Comm. Reding threatens to end US-EU safe harbor if US doesn’t implement legislation until summer. Thoughts?
• A6 VP Reding acknowledged imprtnce of cntining U.S.-EU Safe Harbor. USG & EU Commission discussing helpful ways to improve SH. #FTCpriv
• Q7 RT @TouroLawIBLT How does the FTC differentiate between cos that sell #bigdata and those that use and amass it? #FTCpriv
• A7 Same principles apply: PBD, effective transparency, simplified choice. Co.’s shd give careful thought to data collection & use. #FTCpriv
• Q8 MT @MHJCarlson Does @FTC see proliferation of mobile devices in hospitals as a threat to patient data security? Solutions? #FTCpriv
• A8 Doc-controlled mobile devices present opps for innovation in HC; but patient #datasecurity & #privacy must be protected. #FTCpriv
• Q9 MT @PogoWasRightQ Does FTC rec national #datasecurity standard that incl encryption 4 data at rest 4 all entities storing SSN? #FTQ9 
• A9 1/2 We support fed leg on data security & breach notice. Stds for security should require reasonable and appropriate practices. #FTCpriv
• Q10 RT @StuartLevi Dont recent FTC actions discourage companies from saying anything about their security practices to the public? #FTCPriv
• A10 FTC examines co statements & underlying data security practices. We consider both potentially deceptive and unfair activity. #FTCpriv
• Q11 RT @ajamietalbot Among all the data issues facing FTC, which do you think are the most pressing and deserve FTC focus? #FTCpriv
• A11 Pressing issues: health, financial, & other sensitive data; data broker practices; #IoT; mobile; facial recognition & #COPPA. #FTCpriv
• Q12 RT @sharemindfully #ftcpriv – What steps is the #FTC taking to increase consumer awareness of #privacy issues?
• A12 1/2 FTC has very robust consumer education program, including blogs, publications, staff outreach. See http://consumer.ftc.gov  #FTCpriv
• A12 2/2 Also, lots of Commission outreach on emerging issues. I speak a lot too. :>) #FTCpriv
• We are at 60 minutes. You all have asked lots of great questions. I’ll take a few more minutes to answer a few more. #FTCpriv
• Q13 RT @Vitiell0 When will the data standards outlined in the 2012 consumer privacy BOR be enforceable? #FTCpriv
• A13 I support baseline consumer privacy legislation and am eager to work with Congress, the Administration, and others to that end. #FTCPriv
• Q14 MT @Abine Has FTC been in communication w/FB, Google, the DAA, on their plans for post-cookie consumer tracking tech? #FTCpriv
• A14 We all need to focus on tracking that will take place in post-cookie world. Talking with lots of stakeholders. Welcome input. #FTCpriv
• Q15 RT @Cellular1988 Do u think that the Safe Harbor give to all EU citizens good protection of their fundamental rights (redress)? #FTCpriv
• A15 Safe Harbor gives FTC effective tool for protecting privacy of EU consumers. On redress, I support reducing ADR fees. #FTCpriv
• I’m going to answer one final question. #FTCpriv
• Q16 RT @Cellular1988 How many processor[s] can process data for one Safe Harbor certified company? #FTCpriv
• A16 1/2 There’s no set number of permissible processors, but all agents have to apply privacy protections. #FTCpriv
• A16 2/2 Mechanisms for agents incl. being in SH, being subject to the directive or under adequacy finding, or by contract. #FTCpriv
• JulieBrillFTC ‏@JulieBrillFTC  Feb 5 Thanks so much for participating in my Twitter chat. Sorry I couldn’t answer all of your great ?s. Let’s do this again soon. #FTCpriv

IS TWITTER CHAT AN EFFECTIVE WAY OF COMMUNICATION ON IMPORTANT ISSUES SUCH AS PRIVACY?

This Twitter chat is a perfect example to illustrate the advantages, as well as the pitfalls of communication through Twitter.

A few examples where Twitter works well:

• The practical question:
•  Q1 MT @alexanderhanff can u explain why links to so many privacy papers on FTC web site are broken? Hard 2 cite studies that vanish #FTCPriv
• A1 FTC recently went through redesign of its website to improve functionality. Please send problematic links to ftcgovweb@ftc.gov. #FTCpriv
• Practical solution to a concrete question. Bravo!

•  The clarification question:
•  Q9 MT @PogoWasRightQ Does FTC rec national #datasecurity standard that incl encryption 4 data at rest 4 all entities storing SSN? #FTQ9 
• A9 1/2 We support fed leg on data security & breach notice. Stds for security should require reasonable and appropriate practices. #FTCpriv
• The FTC, as well as many other U.S. regulatory and enforcing agencies have always stayed away from imposing specific technologies for ensuring data security, since technology changes at the speed of light and the type of technology to be applied is always contextual and depending on the type of data handled and the type of company handling the data. “Reasonable and appropriate practices” it is. And @JulieBrillFTC managed to squeeze in the FTC’s opinion on the need for FEDERAL legislation on data security and data breach notification, since the U.S. doesn’t have one yet. (Most of the States have data security and data breach notification laws, but they are all different from each other and create an impossible patchwork of laws). All this in 140 characters. Hats off! On the other hand, in order to make any sense of those <140 characters, one does need to have some background knowledge of the topic.

• The policy question:

• • Q6 MT @CWLiedtke #FTCpriv EU Comm. Reding threatens to end US-EU safe harbor if US doesn’t implement legislation until summer. Thoughts?
  • A6 VP Reding acknowledged imprtnce of cntining U.S.-EU Safe Harbor. USG & EU Commission discussing helpful ways to improve SH. #FTCpriv
  • The future of U.S.-EU Safe Harbor is on every privacy professional’s mind these days. Here, with a tweet, @JulieBrillFTC has indicated that Safe Harbor is the subject of negotiations between the US Government and the EU Commission in order to tweak it into a viable solution. The end of Safe Harbor? Not.
  • Another good policy exchange was the following one, assuming one knows that IoT stands for “Internet of Things”:
    • Q11 RT @ajamietalbot Among all the data issues facing FTC, which do you think are the most pressing and deserve FTC focus? #FTCpriv
    • A11 Pressing issues: health, financial, & other sensitive data; data broker practices; #IoT; mobile; facial recognition & #COPPA. #FTCpriv
  • This is a clear question, with a very clear answer.

A few examples where Twitter doesn’t work as well:

• The avoiding the question answer:

• • Q14 MT @Abine Has FTC been in communication w/FB, Google, the DAA, on their plans for post-cookie consumer tracking tech? #FTCpriv
  • A14 We all need to focus on tracking that will take place in post-cookie world. Talking with lots of stakeholders. Welcome input. #FTCpriv
  • So, has the FTC been in communication with FB, Google and the DAA?

• The diplomatic answer:

• • Q13 RT @Vitiell0 When will the data standards outlined in the 2012 consumer privacy BOR be enforceable? #FTCpriv
  • A13 I support baseline consumer privacy legislation and am eager to work with Congress, the Administration, and others to that end. #FTCPriv
  • Ah, we all know that the FTC supports legislation to implement the 2012 Privacy Bill of Rights, but when will it become law? When?

• The simplistic answer:
•              Q4 MT @JeramieScott Do u have thoughts on how to ensure integrity of big data algorithms that make decisions that impact people?   #FTCpriv
• • A4 Consumers need more access to data sets to see impact of these decisions, and to reclaim their names http://go.usa.gov/BKjh  #FTCpriv
  • Well, yes, having access to one’s data and having the ability to correct wrong information is a very good start, but it is far from sufficient to ensure the integrity of the algorithms that are used to make important decisions about an individual. For example, how do we ensure that the algorithm itself is not based on some illegal discriminatory premises? Clearly, Twitter is not an adequate channel to discuss such deep and granular issues.

• The incorrect answer?

• • Q3 RT @PaulNemitz #ftcpriv How important is the US – EU #Safeharbour arrangment for the protection of #privacy of americans?
  • A3 Our enforcement of Safe Harbor protects both U.S. & EU consumers through our casework. #FTCpriv
  • Safe Harbor protects U.S. consumers? Really? And I thought that it only protected personal data originating from the EU. Who knew? Maybe the lightning speed at which one must react on Twitter can be faulted for such seemingly erroneous statements. I have no doubt that @JulieBrillFTC did not make a mistake in her area of expertise, but short tweets are conducive to ambiguous meanings and maybe incorrect interpretations.

CONCLUSION

A Twitter chat is the democratic communication tool par excellence. Every Jo/Jean Shmo with a twitter handle can instantly communicate with an authority figure, regardless of where in the world he/she resides, as long as he/she has an internet connection.

The format works well for simple, concrete questions that require simple and concrete answers.

As soon as the question requires a more granular response, Twitter fails to deliver. It is simply impossible to convey nuance, cover grey areas and explain complex matters with a 140 character tweet. Inserting a link to an article that deals with the issue at hand is a good way of introducing more nuance and information in a tweet or Twitter chat.

Please follow me on Twitter at @AltheimLaw and at @MoniqueAltheim!

On the occasion of the Federal Trade Commission’s (FTC) 50th data security settlement, it issued a statement, giving businesses guidelines for their data security practices.

Under Section 5 of the Federal Trade Commission Act (FTCA), the FTC must protect consumers from “deceptive and unfair” commercial practices in the economic sectors under its jurisdiction. One of those deceptive or unfair practices is the lack of data security to protect a wide variety of sensitive consumer data, such as social security numbers, health data etc… Over the years since its first settlement in 2002, the FTC has developed certain principles.

The FTC’s standard for appropriate data security is “reasonableness”, which is a flexible standard that varies according to a.o. the sensitivity of  the data or the size and complexity of the business. In other words, the security requirements of a large financial institution will be greater than the security requirements of a small grocery store.

Despite the fact that the FTC allows for such elasticity in the application of appropriate security standards, it proposes five basic data security practices that should be followed by every business:

1. Data Mapping: Know what data the company has, where it is and who has access to it. This knowledge will help expose possible vulnerabilities.
2. Data Minimization: A company should only collect and retain data that it really needs for its legitimate business purposes. (eg. no need to retain pin numbers of payment cards after the payment has been made).
3. Risk assessment and remediation in key areas: physical security, electronic security, employee training, and vendor oversight.
4. Secure Disposal: Once data is not needed anymore, make sure to dispose of it in a secure fashion. (eg. once paper files are not needed anymore, don’t throw them in a garbage dump. Shred them instead).
5. Security Breach Preparedness: Companies should have a plan in place to respond to security incidents.

• the clmtrackr (cml=constrained local model): the app that reads your emotions on your face.
  

Conferences

•  LegalTech New York 2014 Sessions to Focus on eDiscovery Trends, Information Management and Emerging Data Security Challenges (on which latter topic I participate in a plenary panel).

Data Breaches

•  Target: Hacking Hit up to 110 million customers 
• Target admits “there was malware on our point-of-sale registers“
• New Hagens Berman Lawsuit: Target Was Informed of Data Vulnerability in 2007, but Ignored Danger 
• Hackers Steal Card Data from Neiman Marcus 
•  Ky. Lawmakers Unveil Breach Notification Bill

Drones

• Senate Hearing: The Future of Unmanned Aviation in the U.S. Economy: Safety and Privacy Considerations 
• Dianne Feinstein spots drone inches from face

EU Data Protection Reform

• Inventory and analysis of privacy certification schemes (290p.)
• ENISA’sreport on the security, usability and privacy of online seals

FCRA

• TeleCheck to Pay $3.5 Million for Fair Credit Reporting Act Violations
  

FERPA

• A US Senator is concerned about the commercialization of students’ data. The US Department of Education proposes new Guidelines on FERPA and the Senator proposes new legislation

IoT (Internet of Things)

•  The Internet of Things: Top 5 Threats to IoT Devices

Mobile Payments

• Starbucks mobile app caught storing mobile passwords in clear text 

Net Neutrality

•  Federal Appeals Court Strikes FCC’s Net Neutrality Rules  (editorial note: Isn’t it time to suspend the artificial distinction between broadband carriers and telecommunication services, and designate both as common carriers?)
•  Plain English Translation: The Nuts and Bolts of Network Neutrality

NSA

• NSA Devises Radio Pathway Into Computers 
• NSA collects millions of text messages daily in ‘untargeted’ global sweep 
• The new presidential policy directive on surveillance

Practical Tips

•  The House Commerce, Manufacturing, and Trade Subcommittee’s Data Breach Consumer Alert 

Privacy Management

•   Engineers and Lawyers in Privacy Protection: Can We All Just Get Along? 

TCPA (Telephone Consumer Protection Act)

•  The TCPA, Robocalls and a Meaningful Definition of Consent

Technology and Lifestyle s, New Developments in

• Google to Buy Nest Labs for $3.2 Billion 
•  Businesses Use Sensors to Track Customers, Build Shopper Profiles 
•  Blackphone 

  2014

•  Twenty Privacy Bills to Watch in 2014 

What constitutes “express consent” under the TCPA?

The TCPA does not define “express consent.” Congress delegated to the FCC  the authority to make rules and regulations to implement the TCPA.

The FCC has defined “express consent” as follows:

“any telephone subscriber who releases his or her telephone number has, in effect, given prior express consent to be called by the entity to which the number was released. “

and “persons who knowingly release their phone numbers have in effect given their invitation or permission to be called at the number which they have given, absent instructions to the contrary.”

A recent case, (Murphy v. DCI Biologicals Orlando, LLC) decided on 12/31/2013, illustrates this type of consent requirement.

Plaintiff, a blood donor gave his cell phone number on a new donor information sheet to the defendants, a blood bank. He subsequently got a few automated, telemarketing text messages from the defendants in 2012, suggesting he give more blood, which he found quite offensive. Plaintiff claimed he had not given defendant, the blood bank, express consent to “robocall” him, as required under the TCPA. He only shared his cell phone number as a contact number for the blood bank to reach him. The US District Court for the Middle District of Florida ruled that giving his cell phone on the new donor information constituted his express consent to the defendants to robocall him at that number through marketers. The Court granted defendant’s motion to dismiss the case. The Court followed the definition of “express consent”, as defined by the FCC. (see above).

The Court decided that when the blood donor shared his cell phone number with the blood bank, he thereby gave “express consent” to the blood bank to share his sensitive health data with marketers and to have those marketers “robocall” him.

Most courts have followed this interpretation of “express consent” under TCPA, while other courts have argued that If consent is not manifested by explicit and direct words, it is not express consent. Rather, it is merely “implied consent.”.

On February 15, 2012, the FCC adopted additional protections for consumers concerning unwanted robocalls. One of the changes concerned the “consent” issue.

Effective October 16, 2013, in order for marketers to call or text a telephone subscriber via autodialer or prerecorded messages (robocalls), the subscriber must have given the robocaller “prior UNAMBIGUOUS written express consent” to do so.

Gone is the “implied-express consent” as previously defined by the FCC.

Unambiguous consent means that the consumer must receive a “clear and conspicuous disclosure” that he will receive future calls that deliver autodialed and/or pre-recorded telemarketing messages on behalf of a specific marketer.

In other words, the consent form to be signed by the consumer should look something like this:

“ I hereby consent to receive autodialed and/or pre-recorded telemarketing calls and/or texts from or on behalf of [marketer] at the telephone number provided above. “

Under this new definition of consent, our blood donor might have won his case.

Or, if the blood bank had given him a clear and informed choice, he might very well have agreed to share his cell phone number with marketers in order to be notified of future blood donor opportunities. He would have made an informed choice and the overburdened justice system might have had  fewer time-wasting and costly class-action law suits to deal with.

This new consent requirement resembles very closely the requirement of “unambiguous consent” of the data subject that forms one of the most important legal grounds for processing personal data by data controllers under the EU Data Protection Directive. (Article 7. (a) Directive 95/46/EC).

Article 2 (h) of Directive 95/46/EC defines consent as “any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.”

The validity of consent as a mechanism to regulate privacy in our era of big data, predictive algorithms and internet of things has been a subject of debate for a while now, and more recently, the cause of a heated polemic in privacy circles.(see: “I Never Said That”—A Response to Cavoukian et al. by Viktor Mayer-Schönberger)

The latest FCC implementation of the TCPA is one example of how the concept of consent is still alive and well.  Whether consent by the consumer is meaningful often depends on whether the term “consent” is defined in a meaningful way or not.

Apps

• Data Breach 411 for iPhone

Conferences

• CPDP 2014 (Computer, Privacy & Data Protection), January 22,23 & 24, 2014, Brussels, Belgium. (Especially the panel on Privacy by Design, on 1/22/14, which will be moderated by me). 

COPPA

• FTC Approves New Method for Obtaining COPPA Verifiable Parental Consent (VPC): appropriately implemented “knowledge-based authentication”.

Data Breaches

• Too many; here’s a sample 
• ABA Report: 70% of Large Firm Lawyers Don’t Know If Their Firm Has Been Breached
• The Yahoo breach
• Target update: 70 million affected
• GAO Report: Federal Agency Responses to Breaches of Personally Identifiable Information Need to Be More Consistent  (In fiscal year 2012, Federal Agencies reported 22,156 data breaches.)

EU Data Protection

• How a bureaucrat in a struggling country at the edge of Europe found himself safeguarding the world’s data: Excellent overview of the factors that caused Ireland’s Data Protection Commissioner Billy Hawkes to become the “world’s privacy regulator”, and why your company should establish its EU headquarters in Ireland.
• The CNIL’s Sanctions Committee issues a 150 000 € monetary penalty to GOOGLE Inc
  
• EU Parliament draft report on NSA , in which the LIBE Committee declares that the fight against terrorism is but a “fig leaf” for political and economic espionage and in which same committee essentially recommends the Member States to end or suspend  all data flows to the U.S. and other such countries until they repent and mend their ways.
• Holland Privacy Outlook 2014 The Netherlands is expected to have a very busy privacy year.
  
• Ten Years and Two Terms Later, A Look at Peter Hustinx’s Legacy
  

EU Data Protection Reform

• The Proposed EU Data Protection Regulation Two Years Later: In depth analysis of the major legal issues by the Kuner team.
• Google’s Peter Fleischer: “Europe’s much-ballyhooed, and much-flawed, proposal to re-write its privacy laws for the next twenty years collapsed.  The old draft is dead, and something else will eventually be resurrected in its place.”  Yay or Nay?

First Amendment

• Virginia Court Scales Back Right to Online Anonymity: A Virginia company filed a defamation lawsuit against seven anonymous Yelp users who wrote critical reviews about it. After filing the suit, the company subpoenaed Yelp for information that would identify the seven reviewers. A Virginia statute requires a subpoena for the identity of an anonymous Internet users’ identity to identify communications “that are or may be tortious or illegal.”

FCRA

• Background Screening: Top 10 Trends : A very pleasant and informative talk on trends regarding the use by employers of criminal records, credit reports and more.
• Weathering the Sea Change in Fair Credit Reporting Act Litigation in 2014 
  

FTC

• FTC Commissioner @MOhlhausenFTC  hosted a Twitter chat on 1/6/14 about #privacy and #IoT – see #FTCpriv

IoT (Internet of Things)

• The Government Accountability Office (GAO) looked at 10 in-car location services such as  Garmin and Google Maps and says these firms need to do more to inform consumers how they use and share location data.

NSA

• France Enacts Law to Facilitate Real-Time Collection of Metadata.
•  Senator Rand Paul is suing the Obama administration over the NSA

Practical Tips

•  Top 10 Data Privacy Tips for 2014: practical and commonsensical advice from the IAPP

Technology and Lifestyles, New Developments in

• CES (Consumer Electronics Show) The ultimate review of CES related privacy news.
• #Jelly – the newest “it” app. Have you jellied yet? And how about some jellfies?
• #Confide – the new corporate Snapchat app.
•  iBeacons and time-of-purchase power

Year in Review

• International Privacy – 2013 Year In Review

  2014

• Check out the privacy “ins” and  “outs” 2014 predictions by, who else, The Future of Privacy Forum.

• One code to rule them all: How big data could help the 1 percent and hurt the little guy ‪http://www.salon.com/2014/01/03/one_code_to_rule_them_all_how_big_data_could_help_the_1_percent_and_hurt_the_little_guy/ …

Children Online Privacy

• Maryland AG Gansler Submits Children’s Online Privacy Workgroup Report ‪http://ow.ly/2Cyc8W 

Conferences

·      Watch All ‪#30c3 talks, without data retention or Google spyware ‪https://media.ccc.de/browse/congress/2013/ …

Data Breaches

·      WA: Sumner fires temporary court clerk for sending herself city data on 3,600 people ‪http://ow.ly/2Cu5Vo 

·      

The Briar Group discloses security breach affecting eight Boston bars and restaurants (updated) ‪http://ow.ly/2Cugb7 

·      South Carolina Health Insurance Pool reports breach after laptop stolen from independent auditor’s car ‪http://ow.ly/2CuDkc 

·      Social Security Customer Service Employee Indicted For Stealing Information And Money From Agency ‪http://ow.ly/2CuIyi 

·      Data breach cost $3.7m, claims report ‪http://ow.ly/2Cwxx9 

·      

Following hack, RegistratioNation discovers some customer data was inadvertently being stored on its server ‪http://ow.ly/2Cxs3e 

·      

T-Mobile USA customers to be notified of security breach at supplier’s ‪http://ow.ly/2CxyGw 

·      Actelis Networks reports theft of safes with Human Resources files ‪http://ow.ly/2Cycy8 

·      PA: Waiter skimmed customers’ cards ‪http://ow.ly/2CCyVK 

·      Office backup drive stored at home,stolen‪http://ow.ly/2CxbZO 

·      Senators Call for Hearing on Data Security in Wake of Target Data Breach ‪http://ow.ly/2CyN3S 

·      House Republicans Signal Push for Data Breach Legislation ‪http://ow.ly/2CBT6U 

·      Hackers Leaked 4.6 Million Snapchat Usernames and Phone Numbers http://ow.ly/sfL3K

·      Alleged Snapchat hackers explain how and why they leaked data on 4.6 million accounts ‪http://ow.ly/2CALVk 

·      

Omniquad Surf Wall Remote injects string into the browser user agent that identifies users – claim ‪http://ow.ly/2CymAG 

• Sandwich chain ‘wichcraft had two-months worth of its customers’ card information hacked http://ow.ly/sfKS7

ECPA

·      Facebook Sued For Scanning ‘Private’ Messages http://ow.ly/sfLE0

EU Data Protection

·      

Cookie harmonisation? Forget  it ‪http://www.mondaq.com/x/283672/Data+Protection+Privacy/How+The+Cookie+Crumbles …

·      French DPA Issues Guidance on Cookie Consent Allowing Flexibility ‪http://ow.ly/2CCPIh 

·      Privacy group reveals more than 1m pupils are fingerprinted – thousands without their parent’s consent ‪http://news.techworld.com/security/3495388/privacy-group-reveals-more-than-one-million-pupils-are-fingerprinted/ …

EU Data Protection Reform

·      The decisions on ‪#EUDataP will be made by Spring 2014. Get active now! says ‪@JanAlbrecht – ‪#30c3

·      

VIDEO Jan Phillip Albrecht at ‪#30C3 ‪#EUDataP: State of the Union ‪http://media.ccc.de/browse/congress/2013/30C3_-_5601_-_en_-_saal_2_-_201312281400_-_eudatap_state_of_the_union_-_jan_philipp_albrecht.html …

Fourth Amendment 

• Prediction: Fourth Amendment Evolves in 2014 ‪http://ow.ly/2CyJCV 
• City Employee Properly Alleged Fourth Amendment Violation for Unreasonable Search and Seizure by Ordering Drug Tes… ‪http://ow.ly/2CALDf 
• The Supreme Court Logic That Could Destroy Privacy in America (Smith v.Maryland)‪http://ow.ly/2CxbBq 
• Court Rules No Suspicion Needed for Laptop Searches at Border ‪http://ow.ly/2Cz539 


• Big Brother’s little siblings: How local police departments are spying on us now, too ‪http://ow.ly/2CCDLE 



FCRA

• Bill Prohibiting Pre-Employment Credit Checks Introduced in Senate ‪http://ow.ly/2Cym35 

FTC, Section 5

·      Accretive Health Settles FTC Charges That It Failed to Adequately Protect Consumers’ Personal Information ‪http://ow.ly/2Cz5c4 

FOIA (Freedom of Information Act)

• ACLU sues for details of U.S. surveillance under executive order ‪http://ow.ly/2Cxvwv 

HIPAA

·      Clinic Hit With $150,000 ‪#HIPAA Penalty ‪http://ow.ly/s9rk5 

·      ‪@MedPractices stories of 2013 ‪http://ow.ly/s9Isw 

·      HHS Announces First HIPAA Settlement Based on Lack of Breach Notification Policies and Procedures ‪http://ow.ly/2CxvOy 

·      

4-year long HIPAA breach uncovered ‪http://goo.gl/a6MQEM 

IoT (Internet of Things)

·      The Internet of Sharks sends tweets to alert swimmers of approaching sharks: ‪http://buzz.mw/b51ij_f 

NSA

·      MetaPhone: The NSA’s Got Your Number ‪http://ow.ly/2CuiKi 

·      Minnesota librarians push to curb NSA snooping ‪http://ow.ly/2CveC1 

·      

Documents Reveal Top NSA Hacking Unit, TAO ‪http://ow.ly/2CvlhG 

·      Snowden: “A child born today will grow up with no conception of ‪#privacy at all.” VIDEO ‪http://www.channel4.com/programmes/alternative-christmas-message/4od#3631700 …

·      

ACLU Appeals Decision Upholding NSA’s Mass Surveillance ‪http://ow.ly/2CCuqh 

·      NSA building quantum computer to crack all forms of encryption  ‪http://www.washingtonpost.com/world/national-security/nsa-seeks-to-build-quantum-computer-that-could-crack-most-types-of-encryption/2014/01/02/8fff297e-7195-11e3-8def-a33011492df2_story.html …

• Will the Supreme Court Review the NSA’s Telephony Metadata Program? ‪http://ow.ly/2CCUax 

Social Media

·      3 Social Media Trends You Should Know About ‪http://ow.ly/2CAckY 

Technology and Lifestyles, New Developments in

·      Bitcoin’s Incredible Year ‪http://ow.ly/2CyNTJ 

·      Amazon.com  Drones Raise Red Flags Regarding Privacy Rights ‪http://ow.ly/2CzuqE 

·      Bob Greenberg on advertising in 2014: Prepare to be disrupted. ‪http://economictimes.indiatimes.com/features/brand-equity/2014-advertising-industry-to-see-massive-disruptions/articleshow/28193622.cms …

·      9 technologies that can be game changers in 2014‪http://timesofindia.indiatimes.com/tech/slideshow/tech2014/9-technologies-that-can-be-game-changers-in-2014/itslideshow/28242184.cms …


·      Not sure what to expect at ‪#CES2014? Here’s a handy preview from ‪@verge: ‪http://ow.ly/sfq5B 

·       

Video Privacy Protection Act (VPPA)

·      Video Privacy Protection Act Plaintiffs Can Proceed Against Hulu Absent Showing of Actual Injury ‪http://ow.ly/2CzGVK 

Year in Review

·      The Year in Privacy 2013 and the Year to Come ‪http://lnkd.in/dS7H6Br 

  2014

• 2013 a big year for privacy? You ain’t seen nothing yet! ‪http://ow.ly/2Cym5Y 
• Some ‪#Privacy Thoughts for 2014 ‪http://bit.ly/190aJC0 
• 13 Experts Reflect on 2013 ‪#HealthIT Progress, Frustrations & Hopes for 2014
• Three Big Privacy Changes to Plan for in 2014 – ‪http://adage.com/article/datadriven-marketing/big-privacy-plan-2014/290885/ …
• Iowa View: The biggest threats to our privacy ‪http://ow.ly/2CvhXU 

• The E-Books Are Reading You #EUdataP http://www.nytimes.com/2013/12/25/technology/as-new-services-track-habits-the-e-books-are-reading-you.html …
• Retailers, Supermarkets, Medical Markets Dive In To Extract Information From And About Consumers http://ow.ly/rYTdJ 

California Privacy

• California’s New Do-Not-Track Law Goes Into Effect January 1, 2014, Remember To Check Your Privacy Policy For … http://ow.ly/2Clqu3 

CAN-SPAM

• Court Accepts Narrow View of CAN-SPAM Preemption but Ultimately Dismisses Claims – Davison Design v. Riley http://ow.ly/2CjRsh 

COPPA

• FTC Approves Knowledge-based Identification for COPPA Verifiable Parental Consent Method http://1.usa.gov/19me2UC 

Data Breaches

• Target confirms encrypted debit PIN data was stolen during hack http://ow.ly/2CsYMy 
• Who’s Selling Credit Cards from Target? http://ow.ly/2CokRQ 
• Better understanding of the Target breach through Credit Card anatomy http://ow.ly/2CnxOx 
• Stolen Target Credit Cards Are Selling For $20 $100 Each http://ow.ly/2CiIXr 
• Non-US Cards Used At Target Fetch Premium http://ow.ly/2Clf3p 
• Creator of Mariposa Botnet sentenced to 58 months in jail http://ow.ly/2CsBOL 
• TX: Former Cuero city secretary charged with intercepting police emails http://ow.ly/2CpWSh 
• CN: Gang selling personal information busted http://ow.ly/2CnbRu 
• WoW Hacker Group Mastermind Sentenced To Two Years In Chinese Prison http://ow.ly/2CmrSD 
• Washington University in St. Louis notifies business partners after laptop with unencrypted PII stolen http://ow.ly/2Cka9D 
• Cruises Inc. notifies customers after booking system accessed by compromised login credentials http://ow.ly/2Ck5S2 
• UK: Men who obtained personal data from West Ham officials during Olympic Stadium bid fined thousands of pounds http://ow.ly/2CjQuL 
• TechMedia Network to start notifying customers of hack involving credit card data http://ow.ly/2CiIXq 
• Update on the Clark & Anderson, P.A. breach http://ow.ly/2Ckeb2 
• Affinity Gaming announces breach affecting all 11 casinos; fraudulent charges reported http://ow.ly/2Cj2QN 

Data Brokers/FCRA

• What Surveillance Valley knows about you http://pando.com/2013/12/22/a-peek-into-surveillance-valley/ …

EU Data Protection

• PT: ANACOM adopts security breach notification procedures http://ow.ly/2ColbT 

Fourth Amendment 

• Senders’ Fourth Amendment Rights in E-mails Seized from the E-mail Accounts of Recipients http://ow.ly/2CqSvz 
• Hotels Don’t Have to Hand Over Guest Records, Appeals Court Says http://ow.ly/2CpLf5 

IoT (Internet of Things)

• Les hôpitaux sont en passe de devenir des agrégateurs d’objets connectés http://si-management.blogspot.fr/2013/11/les-hopitaux-sont-en-passe-de-devenir.html …
• Fantastic analysis (3 parts) on #IoT .@qz http://buff.ly/1hwf3cD  Well on our way to having sensors on us, around us, and inside us.

NSA

• U.S. judge says NSA phone data program is lawful http://ow.ly/2CsYcP 
• N.S.A. Phone Surveillance Is Lawful, Federal Judge Rules http://ow.ly/s67rm 
• How to Evaluate Whether the NSA’s Telephony Metadata Program Makes Us Safer (and What Proponents and Opponents… http://ow.ly/2CsHc4 
• Obama’s NSA Phone Spying Reforms Might Make Things Worse http://ow.ly/2Csw7d 
• Edward Snowden’s Christmas Message http://ow.ly/2CpEpx 
• Edward Snowden, after months of NSA revelations, says his mission’s accomplished http://ow.ly/2CnBN7 
• Liberals and Conservatives Switch Positions on NSA Surveillance http://ow.ly/2CoaNb 
• RSA Response to Media Claims Regarding NSA Relationship http://ow.ly/2ClJir 
• President’s Review Group will appear before the Senate Judiciary Committee January 14th http://ow.ly/2ClmJ4 
• EFF Statement on Government’s Release of Documents in EFF’s NSA lawsuit http://ow.ly/2CkuPB 
• The Corporate Keep-My-Data-Out-of-the-U.S. Clause http://www.bloomberg.com/news/2013-12-24/a-new-twist-in-international-relations-the-corporate-keep-my-data-out-of-the-u-s-clause.html …

Social Media

• Financial Regulators Finalize Social Media Guidance and Address Industry Questions http://ow.ly/2CmT68 
• AAUP Says Kansas Regents’ New Faculty Social Media Use Policy Violates Academic Freedom (Guest Blog Post) http://ow.ly/2Cmz2D 

Technology and Lifestyles, New Developments in

•   Consumers Will Pay $5 for an #App That Respects Their Privacy – Atlantic Mobile http://www.theatlantic.com/technology/archive/2013/12/study-consumers-will-pay-5-for-an-app-that-respects-their-privacy/282663/ …
• People Are More Freaked Out by Hacking Than Tracking, Survey Finds http://ow.ly/2CmOOt 
• Justine Sacco’s Nightmare Before Christmas, Twitter-Version http://ow.ly/2Cka9E 

Video Privacy Protection Act (VPPA)

• Hulu must face privacy lawsuit, U.S. judge rules http://ow.ly/2Cn2Kl 

Year in Review

• The Year in BigData: http://t.co/tERoQzq9LV
• My five big data FAQs of 2013 http://ift.tt/1dGWJdZ 
• IAPP : The Year’s Top 10 Stories in The Privacy Advisor https://www.privacyassociation.org/publications/the_years_top_10_stories_in_the_privacy_advisor …
•  2013 REVIEW Top 10 IT #privacy stories of 2013 http://www.computerweekly.com/news/2240210682/Top-10-IT-privacy-stories-of-2013 …
• The Biggest Privacy Stories of 2013 http://ow.ly/2CmPpS 
• More than 1,400 Financial institutions in 88 Countries targeted by Banking Trojan in 2013 http://ow.ly/2ClqIf 

  2014

• 12 big data predictions on BigData http://bit.ly/1fM0yAc 
• 7 BigData Trends for 2014 http:/ http://ow.ly/s6gIv
• Mobile Devices Biggest Business Security Threat in 2014 http://ow.ly/2CsRii 
• The Internet Of Things In 2014: Steady As It Goes http://ow.ly/s6bWE 
• Top Technology Trends for 2014: From Internet of Things to Web of Things. http://www.computer.org/portal/web/membership/Top-10-Tech-Trends-in-2014
• Big Bang Disruption: The “Internet Of Things” Takes Off, Gradually And Then Suddenly – Forbes http://ift.tt/1dHrMq7 
• How the “internet of things” will replace the web http://ow.ly/rZkxq 
• 2014 is the year of the internet of things—no, seriously, we mean it this time – Quartz http://ift.tt/1bjeYr4 

• Should We Cheer The California Attorney General’s Revenge Porn Arrest Or Find It Alarming? (Forbes Cross-Post) http://ow.ly/2CgHsk 
• California’s New Do-Not-Track Law Goes Into Effect January 1, 2014, Remember To Check Your Privacy Policy For … ow.ly/2CimTG

    Conferences

• IAPP Daily Dashboard ‏@DailyDashboard17 Dec Coverage of last week’s #DPCongress #NSA panel w/ @ioerror @stewartbaker @bendrath & Vodafone (recording included) bit.ly/1kSpreu
  
  
• “Yes, Consent Is Dead. Further, Continuing To Give It A Central Role Is Dangerous” http://ow.ly/rTGNP 
  //bit.ly/1kSpreu 
• CPDPconferences ‏@CPDPconferences19 Dec Register now! Only a few days left for early-bird registration http://www.cpdpconferences.org/Register.html  #privacy #eudatap #surveillance #CPDP2014

    Data Breaches

    Data Brokers/Big Data/FCRA

• Data Mining to Recruit Sick People for Clinical Trials http://ow.ly/rTq3z  #privacy

    EU Data Protection

    EU Data Protection Reform

    EU-US Safe Harbor

    Practical Tips

• 5 More Incredibly Simple Things You Should Do To Protect Your Privacy http://ow.ly/2CfhhR 

    Technology and Lifestyles, New Developments in

    Year in Review

    2014

• Privacy a Top Agenda Item for FTC, NTIA Entering 2014 – With the new year fast approaching, the Federal Trade Comm… http://ow.ly/2BXSFj 
• JPMorgan Chase breach update: pile on… – The JPMorgan Chase Ucard breach reported previously on this blog affe… http://ow.ly/2BXSFk 

• Thorsten Ihler ‏@DataProtecThor1h @VivianeRedingEU “Disappointing day” for #EUdataP reform. “Still no workable solution” for One Stop Shop. http://lnkd.in/dFNwPet 

• IAPP Daily Dashboard ‏@DailyDashboard21h Some of our coverege from yesterday’s #PracticalPrivacy Series. Where the FTC is Headed in 2014. #privacy http://bit.ly/18FL7ur 

  IAPP Daily Dashboard ‏@DailyDashboard21h FTC settles w/ #Android flashlight app for allegedly sharing users’ location & UDIDs w/o consent. #mobile #privacy http://1.usa.gov/18FLNzY 

•  Viviane Reding ‏@VivianeRedingEU1h On #EUDataP Ministers moved backwards. The Council has been hibernating. Let’s hope for an early spring in Greece http://europa.eu/rapid/press-release_SPEECH-13-1027_en.htm …
• Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @conductorebrio
• U.S. Spy Rocket Launching Today Has Octopus-Themed ‘Nothing Is Beyond Our Reach’ Logo. Seriously. http://ow.ly/2BXuw3 

•  California Assembly Hearing, “Balancing Privacy and Opportunity in the Internet Age,” SCU, Dec. 12 http://ow.ly/2BXpRN 

•  Google Gets Dismissal of Lawsuit Over Privacy Policy IntegrationIn re Google Privacy Policy http://ow.ly/2BXg2f 

•  Insider breach at NYC Bed Bath & Beyond: cashier stole customers’ credit card information http://ow.ly/2BX67z 

•  Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @PaulNemitz @danielg280

•  Louisiana Agencies Notified of Breach Across Certain JPMorgan Chase Systems; Breach Not Confined to Louisiana http://ow.ly/2BWM0z 
• NJ: Drew University notified some employees and dependents after employee’s e-mail account was hacked http://ow.ly/2BWK0m 

•  Survey Exposes Gaps in UK Companies’ Readiness for Cyber Threats http://ow.ly/2BWmUg 

•  “Analysis of the passwords by Trustwave showed … the most popular password, found in the database over 15,000… http://fb.me/2O8tUs6CE 
• Cedric Burton ‏@EUDataPrivacy4 Dec Article 29 Working Party calls for the swift adoption of the data protection reform package http://ec.europa.eu/justice/data-protection/article-29/press-material/press-release/art29_press_material/20131204_pr_dp_reform_package_en.pdf … #EUdataP #privacy
• TN: Bojangles fast food restaurant hacked, credit card info stolen http://ow.ly/2BWgyQ 

•  Look What I Found: Moar Pony! – Daniel Chechik and Anat (Fox) Davidi of Trustwave write: In our last episode o… http://ow.ly/2BWeo2 

•  Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @CHultsch_Esq @nlitzka

•  Previewing Lexmark vs Static Control, A Rare Supreme Court Case On False Advertising (Forbes Cross-Post) http://ow.ly/2BVKUw 

•  NTIA to Convene Multistakeholder Meetings On Facial Recognition Technology http://ow.ly/2BVtRM 

•  Privacy Maus ‏@PrivacyMaus27 Nov Eroding Trust: How New Smart TV Lacks Privacy by Design and Transparency https://www.privacyassociation.org/privacy_perspectives/post/eroding_trust_how_new_smart_tv_lacks_privacy_by_design_and_transparency … #iapp via @DailyDashboard
• Peter Schaar ‏@Peter_Schaar3 Dec Art. 29 WP will discuss today #EP #LIBE vote on #EU #DataProtection reform package #eudatap

•  IAPP Daily Dashboard ‏@DailyDashboard3 Dec Chris Kuner on why #privacy reform is needed on both sides of the Atlantic. #EUdataP #datenschutz http://bit.ly/1g2mIBv 

•  Witchery pulls mobile site after customer details exposed – Sarah Michael reports: Witchery has shut down its mobi… http://ow.ly/2BVm19 

•  Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @g_reichenbach

•  NYS Comptroller finds IT security deficits in towns of Babylon and Salina http://ow.ly/2BV19t 

•  Privacy Plaintiffs Lose Because They Didn’t Rely on Apple’s Privacy Representations In re iPhone App Litigation http://ow.ly/2BUX7R 
• FTC to Hold Seminars on Mobile Device Tracking, Alternative Scoring, and Consumer Health Information http://ow.ly/2BUVWu 
• Why Drone Delivery Will Be A Nightmare For Law Enforcement – Amazon ‘Prime Air’ could be the first step toward a p… http://ow.ly/2BUTXM 

•  UK ICO Suggests Preparations for Draft EU Data Protection Regulation http://ow.ly/2BURZx 

•  Seventh Circuit: Indiana Telemarketing Statute Not Preempted by TCPA http://ow.ly/2BUPmG 

•  The FTC’s Internet of Things Workshop in Perspective; 5 Key Takeaways for How it Could Affect Consumer Privacy Goi… http://ow.ly/2BUMPa 

•  Roundup of Recently Enacted Privacy Legislation in California; Some Measures Will Become Effective on January 1, 2… http://ow.ly/2BUExp 
• Vodafone Iceland breached, customer details, SMSes stolen – Michael Lee reports: Vodafone Iceland is now in the mi… http://ow.ly/2BUExq 

•  Christian W Svanberg ‏@WieseSvanberg2 Dec Not surprising. #EudataP Is now stalled in Council. Passage by May 2014 impossible (in German) http://www.spiegel.de/netzwelt/netzpolitik/deutsche-beamte-bremsen-europas-datenschutz-aus-a-936704.html … #privacy
• EU Justice ‏@EU_Justice2 Dec #LIBE hearing on the mass #surveillance of #EU citizens live at 15.00 CET http://bit.ly/1batzUG  #EUdataP #PRISM #NSA @Europarl_EN
• Dutch DPA: Google’s purposes of displaying personalised ads, personalisation of services, product development and… http://fb.me/2uIrP0aAL 

•  Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @chalkopyrit

•  Over half of Austin, Texas departments don’t even have policies on collecting, storing, or accessing PII –… http://ow.ly/2BUiDq 

•  Chicago Public Schools’ students’ health data accidentally posted online http://ow.ly/2BU0Qw 

•  Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @TechPolicyMPhil

•  Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @Ros_Imperiali
• Ediscovery, Data Privacy and Social Media Weekly Updates http://fb.me/6nnJVZ9x4 

•  It’s Illegal For Offline Retailers To Collect Email AddressesCapp v. Nordstrom http://ow.ly/2BT3sl 
• Your Weekly #Ediscovery, Data #Privacy and Social Media Updates are here http://ow.ly/riOtN  #EUDataP #safeharbor

• Google’s Forum-Selection Clause Upheld AgainRudgayzer v. Google http://ow.ly/2BGNkd
• Copyright and the JFK Assassination – Fifty years ago today, which was of course long before smartphones with came… http://ow.ly/2BGPrI 

•  Cybersecurity Seminar Tackles Business Risks from Cyber Attacks http://ow.ly/2BGMgo 

•  HiSoftware Inc. ‏@HiSoftware20 Nov Six Practical Tips for the Private Sector from the DHS Annual Privacy Report #iapp via @DailyDashboardhttps://www.privacyassociation.org/privacy_perspectives/post/six_practical_tips_for_the_privacy_sector_from_the_dhs_annual_privacy_repor …

•  Samantha Yorke ‏@samyor20 Nov IAPP : Are Notice and Consent Possible with the Internet of Things? https://www.privacyassociation.org/publications/is_notice_and_consent_possible_with_the_internet_of_things … #iapp via @DailyDashboard
• IAPP Daily Dashboard ‏@DailyDashboard21 Nov Thinking about cyber insurance? Experian’s Michael Bruemmer debunks some common myths in this #IAPP post: #infosec http://bit.ly/1h5oySb 
• IAPP Daily Dashboard ‏@DailyDashboard6h Here’s the hiring discrimination via social media study by Alessandro Acquisti and Christina Fong of @cylab. http://bit.ly/1g2j4EQ 
• Anna Buchta ‏@buchtan13h Hacker got “easy” access to thousands of emails of MEPs (in FR) http://www.rtbf.be/info/medias/detail_un-hacker-pirate-aisement-les-mails-des-deputes-europeens?id=8140533 … … #privacy #EUDataP cc @EU_EDPS
• AG Europa ‏@ag_europa11h Louis #Michel aanvaardt ontslag medewerker http://www.standaard.be/cnt/dmf20131122_00851011 … #Eudatap
• europe-v-facebook ‏@europevfacebook11h Our project @LobbyPlag delivered the data for another “scandal” around Louis Michel and the Privacy Reform: http://corporateeurope.org/publications/belgian-mep-lobby-amendments-scandal … #EUDataP
• PrivacyMatters ‏@Privacymatters10h By @BrusselsGeek EU Parliament could block data sharing http://www.cso.com.au/article/532280/eu_parliament_could_block_data_sharing_us/ … unless rights of redress given to EU citizens #EUDataP
• Ralf Bendrath ‏@bendrath21h The Belgian TV documentary by Peter Brems on #EUdataP, including the revelations on Louis Michel’s amendments: http://www.deredactie.be/cm/vrtnieuws/videozone/programmas/panorama/EP_131121_Panorama?video=1.1784300 …
• Christian W Svanberg ‏@WieseSvanberg9h #Google Data Privacy Rules Curb Users’ Rights, German Court Says http://www.businessweek.com/news/2013-11-20/google-data-privacy-rules-curb-users-rights-german-court-says … via @BW #eudataP #privacy
• BDIU Inkassoverband ‏@BDIU_inkasso_de8h EU General Data Protection threatens work by credit and collection agencies – a constitutional law opinion http://www.inkasso.de/presse/pressemeldungen/eudataprotection/index.html … #EUdataP
• Dominika Kupczyk ‏@KupczykDominika7h My colleague Olivier Proust has written an excellent article on draft Regulation #EUdataP – please see the link atta…http://lnkd.in/d45nYYR 
• http://nyti.ms/1bVg5gO  France Investigating Ikea on Spying Allegations, via @nytimes #privacy
• Cover Oregon mailing gaffe exposes personal information to others http://ow.ly/2BGdIo 

•  UK: Foyle Women’s Aid undertaking and follow-up – I guess the Information Commissioner&#8217;s Office (ICO) … http://ow.ly/2BGaQK 

•  Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @jrodwyer @grossides
• NJ: Two Defendants Admit Roles In $65 Million Stolen Identity Income Tax Refund Fraud Scheme http://ow.ly/2BG1LH 

•  Googlers Love Microsoft’s ‘Scroogled’ Gear. Mug and Shirts Sell Out. http://ow.ly/2BFo4x 

•  Flamingo Resort and Spa notifying employees after virus may have exposed payroll information http://ow.ly/2BFiva 

•  Kroll Background America hacked – Kroll Background America was hacked sometime between June and September of this … http://ow.ly/2BEWSH 
• Delaware tax preparer pleads guilty to multiple fraud charges http://ow.ly/2BEcxM 

•  Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @Der_Gregor

•  Anthem Blue Cross of California notifies doctors whose SSN were displayed in a .pdf file online http://ow.ly/2BD9e2 

•  Did Monster Energy Make A ‘Dope’ Contract With DJ Z-Trip? Nope (Forbes Cross-Post) http://ow.ly/2BCPp1 

•  GAO: Congress Should Consider Strengthening the Current Consumer Privacy Framework http://ow.ly/2BCwd3 

•  GitHub resets user passwords following rash of account-hijack attacks http://ow.ly/2BCb3R 

•  Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @Prinze484 @PiratNrw

• Where Next for the Draft Data Protection Regulation? – The EU’s Work on Data Protection Reform continues fol… http://ow.ly/2BBMt0 

   Brilliant But Evil: Gaming Company Fined $1 Million For Secretly Using Players’ Computers To Mine Bitcoin http://ow.ly/2BBiJg 

•  Augmented Reality & Computer Forensics: Notes from PFIC 2013 http://ow.ly/2BB7nu 

•  AZ: Former Sheriff’s Office IT employee indicted for computer tampering, ID theft http://ow.ly/2BB6kM 

•  No, You Can’t Donate Bitcoin To Politicians Yet – Bitcoin goes before the Senate again Tuesday after having been g… http://ow.ly/2BB2vB 

•  BofA anticipates biometric ID with ATM security patent application http://ow.ly/2BAKvk 

•  Another Keyword Advertising Lawsuit Unceremoniously DismissedInfostream v. Avid http://ow.ly/2BAyEa 

•  New Paper Considers Privacy Paradigm for Internet of Things – A new paper published by the Future of Privacy…

•  The Ramifications of a Security Breach – Another survey. Scott Koller writes: From hackers to stolen laptops, sec…

•  Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @eDiscoveryFlash

•  Google Settles Safari Tracking Charges Brought by State AGs for $17 Million

•  Analyst Predicts Bitcoin Will Go Over $1000 This Week: ‘This Is A Classic Bubble’

•  Fake LinkedIn Profile May Cause Trademark Infringement – Avepoint v. Axceler http://ow.ly/2Bz7dz 

•  Bitcoin Surges To $600 Heading Into Senate Hearings – Bitcoin has two dates with lawmakers this week, and traders … http://ow.ly/2Bza59 

•  Western Union dismisses threat of data security breach at PrivatBank http://ow.ly/2Byl8e 

•  Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @KrollOntrack @bryn5545

• Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @Harriet731 @Yaremchuk8

•  Ediscovery, Data Privacy and Social Media Weekly Updates http://fb.me/32n035sP7 

• Concerned Citizen ‏@RightToBeForgot14 Nov SAP (an actual European company) backs #EUdataP data privacy & warns of economic consequences of failure to regulate http://www.zdnet.com/cloud-for-europe-launches-as-sap-backs-eu-rules-on-data-privacy-7000023205/ …
• Bart van Buitenen ‏@BartLorica14 Nov Interessant artikel over territoriale scope #eudatap vs 95/46 #privacy #eu http://privacylaw.proskauer.com/2013/11/articles/online-privacy/where-do-we-stand-on-the-territorial-scope-of-eu-data-protection-law-following-the-recent-european-parliament-vote/ …
• IAPP Daily Dashboard ‏@DailyDashboard15 Nov Pam Dixon’s testimony to House Committee on on & offline consumer data collection. @privacyforum #privacy http://bit.ly/1hLWmoG 
• Dr. Carlo Piltz ‏@CarloPiltz20h
• After users’ protest: #Facebook publishes new amended data use policy & terms of use https://m.facebook.com/notes/facebook-site-governance/thanks-for-your-feedback/10153503594325301/?refid=17 … #eudatap #privacy
• Christian W Svanberg ‏@WieseSvanberg10h “Belgian and Dutch data protection agencies to investigate Swift security” #eudataP #Privacy http://www.finextra.com/news/fullstory.aspx?newsitemid=25441&topic=sibos …
• Keyloggers found on 10 Nordstrom registers in Florida – Ten registers in Nordstrom stores in Aventura Florida repo… http://ow.ly/2BwklW 
• Employee Termination Based on Mistaken Belief of Facebook Post Authorship Upheld Smizer v. Community Mennonite Ea… http://ow.ly/2BvYlW 
• Warrant issued for Western Cape hacker – From News24: A warrant of arrest was authorised in the Bellville Speciali… http://ow.ly/2Bw15i 
• WI: Flash drive with personal information of thousands of City of Milwaukee employees stolen from contractor’s… http://ow.ly/2BvJsi 
• Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @ChainTheDogMa
• Experian reports yet another breach of its database via stolen or misused client login http://ow.ly/2Bv6DU 
• Clarity Media Group notifies current and former employees that stolen laptop held unencrypted PII http://ow.ly/2Bv00N 
• Triangulating Discovery Productions – Judge William Orrick summed up a basic truth of eDiscovery: In the age of… http://ow.ly/2Bv00O 
• FBI warns of U.S. government breaches by Anonymous hackers – The Department of Energy hack  noted previously on … http://ow.ly/2BuYTv 
• Hogan Lovells Partner Advocates for Privacy, Contributes Strawperson to US Cybersecurity Framework Process http://ow.ly/2BuRKQ 
• Bitcoin Companies and Entrepreneurs Can’t Get Bank Accounts – Bitcoin is booming, but start-ups can’t get or hold … http://ow.ly/2BuRKR 
• Criminal Defendant Entitled to Production of Metadata Related to Police Report http://ow.ly/2BuNHC 
• What the Google Book Search fair use decision means for innovators http://ow.ly/2Buu0h 
• DataGuidance ‏@DataGuidance15 Nov EU: #Employment & #Privacy 2013 – Key Takeaways http://ow.ly/qRbxA  | #EUDataP #compliance #conference
• Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @DeloitteUS
• IAPP Piece Sets Stage for Upcoming Internet of Things Workshop http://ow.ly/2BtcHh 
• Thanks, Snowden! Now All The Major Tech Companies Reveal How Often They Give Data To Government. http://ow.ly/2BtcHi 
• New York May Give ‘BitLicenses’ To Bitcoin Companies – Bitcoin’s milkshake brings all the regulators to the yard. http://ow.ly/2Bt3I9 
• FTC Denies First Request For More Flexible Parental Consent Methods http://ow.ly/2BsNl4 
• Authorities investigating cybersecurity incidents targeting Obamacare website http://ow.ly/2BswLh 
• UAE Muslim Brotherhood trial: ‘Secret data stolen from flash drive’ http://ow.ly/2BsqGr 
• Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @Sparty_Legal
• Drip drip dripping it out …. Loyaltybuild – Expect more clients of Loyaltybuild to be named tomorrow as victim… http://ow.ly/2BrDHg 
• MI: Tax preparer leaves clients’ tax records behind in foreclosed home, but so did Treasury agents sent in to … http://ow.ly/2Brzik 
• NY: Buffet employee pleads guilty to identity theft – While the big cybercriminal gangs make headlines, it&#8217;s… http://ow.ly/2BrnNU 
• Washington State U. notifies employees and students that SSN and financial info were on stolen drives http://ow.ly/2BrevN 
• Update: About 6,700 ESB customers affected by Loyaltybuild data breach http://ow.ly/2Br593 
• Your Phone Number Is Going To Get A Reputation Score – Telesign is one of those companies that you’ve probably nev… http://ow.ly/2BqW24 
• AFP v. Morel – Lawsuit Over Haiti Photos Taken From Twitter/Twitpic Goes to Trial http://ow.ly/2BqMwz 
• European Data Protection Authorities investigate bank data security http://ow.ly/2BqEFs 
• Sanitizing Bitcoin: This Company Wants To Track ‘Clean’ Bitcoin Accounts http://ow.ly/2BqEFt 
• Hack of MacRumors forums exposes password data for 860,000 users
• Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @AmedeoM @RVMEntInc
• Guy faces lawsuit for using another man’s Facebook pics to send sexually explicit communications to undercover… http://ow.ly/2Bpe4k 
• Amendments to China’s Consumer Protection Law Add Compliance Obligations when Handling Personal Information http://ow.ly/2Bpe4j 
• IE: Data breach on driver licence website investigated – Over on Twitter, Brian Honan just noted that two infosec … http://ow.ly/2Bpe4m 
• You Need a Duty to Preserve Before Issuing Sanctions – In a case where the Court called the Defendants’ disclosure… http://ow.ly/2Bpe4n 
• Video of the Patent Opera Is Now Online! – Last week, the High Tech Law Institute hosted a performance of “The Pas… http://ow.ly/2BprSD 
• Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @GlobalEDDGroup
• Omer Tene ‏@omertene10 Nov LIBE committee hearings on mass surveillance of EU citizens continue tomorrow. #privacy #EUdataP @JanAlbrecht http://www.janalbrecht.eu/themen/datenschutz-und-netzpolitik/massenueberwachung-spannende-anhoerung-am-montag-zwischenbilanz-ausblick.html …
• Fascinating! #GCHQ spies used fake #LinkedIn profiles to breach company network of telecoms firm #belgacom… http://fb.me/2t2U8D43Y 
• Giorgos Rossides ‏@grossides11 Nov #GCHQ spies used fake #LinkedIn profiles to breach company network of telecoms firm #belgacom http://www.spiegel.de/international/world/ghcq-targets-engineers-with-fake-linkedin-pages-a-932821.html … #eudatap #surveillance
• Antti Timonen ‏@AnttiTimonen11 Nov EU must renegotiate Safe Harbour Agreement with the US, says @ManfredWeber MEP of @EPPGroup http://tinyurl.com/p6phwm5  #EPinquiry #NSA #EUDataP
• SuperValu revises estimate of number of customers affected by breach http://ow.ly/2Bp4VD 
• Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @ChristianUncut
• Tool to determine if your email address was in the Adobe data dump http://ow.ly/2BoQsY 
• Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @Yvonne_Baas
• Predictable… – Following up on this, is there anyone who really didn&#8217;t see this one coming? http://ow.ly/2BoIRD 
• Most malware breaches not disclosed – survey – I generally avoid re-posting press releases as they tend to be … http://ow.ly/2BoDTU 
• Follow-up: NYPD Detective Pleads Guilty in Manhattan Federal Court to Computer Hacking http://ow.ly/2BoCUh 
• Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @JayYurkiw
• Ediscovery, Data Privacy and Social Media Weekly Updates http://fb.me/15FnFiUgn 
• College Students, Artists Drawn Into Mongo HQ Breach Via Application Manager http://ow.ly/2BotPU \Your Weekly #Ediscovery, Data #Privacy and Social Media Updates! #EUDataP http://fb.me/1ZNH8dciF 

• Jan Philipp Albrecht ‏@JanAlbrecht19h @FredericDonck Next meeting of EU Justice Ministers on #DataProtection reform will take place 5-6 Dec 2013 http://j.mp/1f5Jmpj  #EUdataP

  Anton Grashion ‏@doctor_know17h Proposed amendment to EU privacy regulations may force choice between violating US and EU law http://buff.ly/1aDrNvJ  @myen #EUDataP
• Paul Nemitz ‏@PaulNemitz8h #Google #Facebook ‘bigger risk to #privacy than snooping’: ‘harvesting #personaldata http://zite.to/1hyvXbq  #eudatap #datenschutz
• Djordje Djokic ‏@Djordje_Djokic4h #EU to push ahead on #EUdataP package despite #UK opposition http://twy.la/1aNLWPY  #privacy #dataprotection
• Paul Nemitz ‏@PaulNemitz7h “@washingtonpost: This is letter #tech giants sent to Congress asking reform #NSA programs http://wapo.st/HhNruz ” #fisa #privacy #eudatap

•  Eduardo Ustaran ‏@EUstaran31 Oct This is why ‘BCR for processors’ should be a crucial part of the new #EUdataP framework. http://lnkd.in/bTBU6ad 
• DataGuidance ‏@DataGuidance1h #Belgium: Decree fully transposes Data Retention Directive http://ow.ly/qo9d7  | #privacy #EUDataP #dataretention
• EuropeanPrivacySeal ‏@EuroPriSe30m Data Protection Regulation: Is it On or Off? (via SCL) – http://bit.ly/HvZ3uG  #EUDataP
• My updated slides on the #EUDataP Reform’s Effect on Cross-Border E-Discovery after last week’s LIBE Committee vote. http://ow.ly/qmPnR 

•  The latest sentiment-analysis app http://nyti.ms/1h40i3U  #privacy
• PA: Personal information of Rent-A-Center customers discovered in Port Richmond dumpster http://ow.ly/2BdLG2 

•  Ediscovery and DataProtection Daily is out! http://paper.li/EUdiscovery/1312257398 … Stories via @WolterKarss @Jhbdixon

•  NZ: Fidelity Life Insurance reports breach – A USB stick with sensitive information about 1200 clients of a life i… http://ow.ly/2BdJpL 
•  When you try to confirm or disconfirm a claimed hack, Thursday edition http://ow.ly/2Bdy1M