Privacy Law Blog : Privacy Lawyers & Attorneys : Proskauer Rose Law Firm : CAN-SPAM, FCRA, FACTA

On December 17, 2009, a class action suit was filed against online movie rental giant, Netflix, Inc., in the United States District Court for the Northern District of California. Plaintiffs in the suit are claiming that Netflix has “perpetrated the largest voluntary privacy breach to date.”

• Email This
• Print
• Comments
• Trackbacks
• Share Link

The blogosphere has been abuzz lately about Facebook’s new privacy settings, but lost amid all the noise is Facebook’s implementation of a new user-friendly privacy policy.

• Email This
• Print
• Comments (3)
• Trackbacks
• Share Link

On December 7, 2009, a federal district court sitting in New Jersey dismissed a securities fraud class action lawsuit against Heartland Payment Systems arising from a massive breach of credit and debit card information and, in doing so, reinforced the difficulties private plaintiffs face in bringing data breach lawsuits under the federal securities laws.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

There is an inherent tension between an employee's right to privacy and an employer's right -- and obligation -- to maintain a safe, productive, and hostility free environment at the office. The California business community is perhaps all too familiar with this conflict. Article I, section 1 of the California Constitution guarantees all California residents a right to privacy, including in some instances in their capacity as employees. A patchwork quilt of statutes, regulations and common law decisions also carves out certain areas to which a right of privacy may attach. But these rights must be balanced against an employer's business needs and legal responsibilities.

Click here to listen to Proskauer partner Anthony Oncidi talk about privacy in the workplace with Mari Frank, the host of KUCI's Privacy Piracy radio show.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Lately we've been writing a lot about employers, and their ability to read their employees' e-mails. From New Jersey, to Idaho, to France, this is a hot topic and we are following new developments in this area closely. To read Proskauer partner Katharine Parker's take on the issues, please take a look at her comments to the Wall Street Journal, published on November 19, 2009.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

By a decision of October 21, 2009 (n°07-43877), the French Supreme Court ruled that files created by an employee on a computer issued by his employer for work purposes were presumed professional unless the employee identified them clearly as personal. This being said, the Court concluded that the employer was entitled to open these files in the employee’s absence and without having informed the employee in advance.

In this case, the employee was suspected by his employer to have competed unfairly with the employer’s business. To investigate these suspicions, the employer requested a bailiff to seek evidence from the employee’s work computer. In order to prevent the employee from erasing the evidence, the employer did not alert the employee that his work computer would be examined.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

In August, we wrote about the ruling of a New Jersey appellate court in Stengart v. Loving Care Agency, Inc., in which the court took a very narrow view of the ability of employers to monitor the e-mail communications of employees over its computer networks. In that case, which is now on appeal to the New Jersey Supreme Court, the appellate court held that an employee did not waive her attorney-client privilege with respect to e-mails that she sent to her attorney while using the employer's computer network, but via her personal Web mail account, despite the existence of a broadly worded communications policy giving the employer the right to access all communications occurring over its network. The appellate court court ruled that even if the employer's policy applied to the employee (she disputed its applicability), the employer's right to access to such communications pursuant to that policy was limited by the employer's "legitimate business interests." Such interests did not extend, the court concluded, to the employee's communications with her attorney.

In contrast to the New Jersey court's narrow view of the applicability of such policies, the district court judge in Alamar Ranch, LLC v. County of Boise, 2009 U.S. Dist. LEXIS 101866 (D. Idaho Nov. 2, 2009), held that knowledge of employer monitoring of employee communications over its network could be imputed, not only to the employee but to the employee's attorney as well. As a result, the court held, the attorney-client privilege had been waived with respect to messages sent by the employee to the attorney using her employer-assigned e-mail account, and to messages sent to the employee at her employer e-mail address by the attorney.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

If the European Commission has anything to say about it, starting about 18 months from now companies will have to start obtaining consent from Web site visitors to place cookies on their computers.

Last week, the European Parliament approved amendments to Europe’s e-Privacy Directive (see page 76, item 5) requiring, among other things, that operators of Web sites obtain a user’s consent before placing a cookie on the user’s computer.  “Cookies” are digital files that are routinely placed on a user’s computer when they visit a Web site.  These files are used for many purposes, including to save a user’s name and password so they can be pre-populated in a Web site’s log-in page; to enable Web sites to engage in behavioral marketing by displaying ads that are keyed to a user’s browsing history; to enable Web sites to perform analyses of the demographics of the site’s visitors and what areas of the site are most popular; and to save the contents of a user’s online shopping cart.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

On November 23, 2009, a federal court in Missouri bucked the recent trend in identity exposure lawsuits and refused to recognize Article III standing in a class action lawsuit that alleged simply an increased risk of identity theft resulting from a data breach. In Amburgy v. Express Scripts, Inc., Magistrate Judge Frederick R. Buckles of the U.S. District Court for the Eastern District of Missouri held that “plaintiff’s asserted claim of ‘increased-risk-of-harm’ fails to meet the constitutional requirement that a plaintiff demonstrate harm that is ‘actual or imminent, not conjectural or hypothetical.’ Plaintiff has therefore failed to carry his burden of demonstrating that he has standing to bring this suit.” Consequently, the Court dismissed the plaintiff’s action – which included claims for negligence, breach of contract, violations of state data breach notification laws and violations of Missouri’s Merchandising Practices Act ("MPA”) – in its entirety for lack of subject matter jurisdiction pursuant to Rule 12(b)(1) of the Federal Rules of Civil Procedure. In doing so, the court breathed new life into the lack of standing argument that had begun to fall out of favor in identity exposure cases.

• Email This
• Print
• Comments
• Trackbacks
• Share Link