Privacy Law Blog : Privacy Lawyers & Attorneys : Proskauer Rose Law Firm : CAN-SPAM, FCRA, FACTA

On February 16, 2010, the EU Article 29 Working Party published Opinion 1/2010, in which it clarified the definitions of “data controller” and “data processor” as those designations are used within the European Data Protection Directive (the “Directive”). The Working Party’s opinion is welcome guidance, not only because the designations determine who is responsible for compliance with data protection rules and how data subjects can exercise their rights, but also because the European Commission recently updated its Standard Contractual Clauses (which we blogged about here). Additionally, such designations are often difficult to apply in practice, especially given the increasing complexity of globalization, organizational differentiation, and information and communication technologies.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Calling an alleged data breach victim’s assertion of injury-in-fact as “far too speculative,” a Pennsylvania federal district court recently dismissed a class action suit filed against Aetna, Inc. for lack of standing. In Allison v. Aetna, the court indicated that while a plaintiff in a data breach case may assert an increased risk of harm to satisfy the injury-in-fact requirement for standing, the threat of harm must be credible rather than a mere possibility of future harm.

• Email This
• Print
• Comments
• Trackbacks
• Share Link

On March 9, 2010, the Federal Trade Commission and 35 state attorneys general announced a negotiated settlement with LifeLock, Inc. and its co-founders, Richard Todd Davis and Robert J. Maynard. The settlement, which will require the identity theft protection services provider to pay $11 million to the FTC and an additional $1 million to the group of participating state attorneys general, resolves charges that LifeLock misrepresented the nature and effectiveness of the identity theft protection services it offers, and made false claims about its own data security practices. Specifically, the FTC alleged that LifeLock promised its customers complete protection against all types of identity theft, but the fraud alerts that LifeLock placed on its customers’ credit files protected only against certain forms of identity theft, which did not include medical identity theft, employment identity theft or the misuse of existing accounts – the most common form of identity theft. Moreover, the FTC alleged that even with respect to new account fraud, the type of identity theft for which fraud alerts are most effective, they do not provide absolute protection. LifeLock therefore deceived consumers by making statements like “LifeLock protects against [identity theft] ever happening to you. Guaranteed.”

In the words of FTC Chairman Jon Leibowitz, “While LifeLock promised consumers complete protection against all types of identity theft, in truth, the protection it actually provided left enough holes that you could drive a truck through it.”

• Email This
• Print
• Comments
• Trackbacks
• Share Link

• Email This
• Print
• Comments
• Trackbacks
• Share Link

On February 3, 2010, Chief Judge Gary L. Lancaster of the U.S. District Court for the Western District of Pennsylvania preliminarily approved a class action settlement between Aramark Sports, LLC and a class of approximately 5,000 customers who made credit or debit card purchases from stores at PNC Park in Pittsburgh, Pennsylvania between March 24, 2009 and April 23, 2009. If approved at a final class action fairness hearing scheduled for April 5, 2010, the proposed settlement filed in Hanlon v. Aramark Sports, LLC, No. 09-cv-465 (W.D. Pa. Feb. 3, 2010), would resolve allegations made by the plaintiffs that Aramark violated the Fair and Accurate Credit Transactions Act’s (“FACTA”) truncation requirements by electronically printing receipts that contained (a) more than the last 5 digits of the plaintiffs’ credit or debit card numbers and/or (b) the expiration date of such cards. See our posts here and here for information about cases alleging similar violations of FACTA’s truncation requirements.

• Email This
• Print
• Comments (1)
• Trackbacks
• Share Link