In a year when behavioral advertising was already expected to be at the top of the hot button privacy issues list, on January 13, 2008, the Center for Digital Democracy (“CDT”) and U.S. Public Interest Research Group (“US PIRG”) filed a document with the Federal Trade Commission (“FTC”) urging the FTC to investigate online mobile marketing practices, to take new actions to stop mobile marketing activities that “abuse consumer rights,” and to recommend new federal legislation and enhanced enforcement power for the FTC in this area. The document expands on the groups’ concerns about online behavioral advertising generally – the delivery of ads tailored to consumers’ interests based on browsing habits and/or consumer demographics – to the mobile space. In doing so the groups cite the potential for even greater consumer harm because of the additional possibility of location-based targeting linked to a cell phone or other mobile device that is typically tied to a single consumer who uses it for multiple applications, including voice, video and data.
Proskauer Rose
Data Privacy Day, Privacy After Hours
For anyone who will be in Los Angeles on Data Privacy Day, January 28, 2009, please join me for IAPP’s Privacy After Hours at the X bar in Century CIty, 6-8 p.m.
…
New York Restricts Employer Use of Employee Social Security Numbers
New York now prohibits employers from publicly displaying employee Social Security Numbers (“SSNs”), printing employee SSNs on identification cards, and communicating to the general public employee SSNs or “personal identifying information.”
…
Zip Codes not “Personal Identification Information” under California’s Song-Beverly Act
On December 19, 2008, in Party City Corp. v. The Superior Court of San Diego County, the California Court of Appeal in the Fourth Appellate District held that zip codes are not “personal identification information” under California’s Song-Beverly Credit Card Act of 1971, California Civil Code Sec. 1747.08 (the “Act.”). The Act prohibits a retailer that accepts credit cards from, among other things, “request[ing], or require[ing] as a condition to accepting the credit card as payment in full or in part for goods or services, the cardholder to provide personal identification information, which the [retailer] writes, causes to be written, or otherwise records upon the credit card transaction form or otherwise.” Id. at § 1748.08(a)(2). Under the Act, “personal identification information” is “information concerning the cardholder, other than information set forth on the credit card, and including, but not limited to, the cardholder’s address and telephone number.” Id. at § 1747.08(b). Subdivision (e) of the statute provides that “[a]ny person who violates this section shall be subject to a civil penalty not to exceed two hundred fifty dollars ($250) for the first violation and one thousand dollars ($1,000) for each subsequent violation, to be assessed and collected in a civil action brought by the person paying with a credit card, by the Attorney General, or by the district attorney or city attorney of the county or city in which the violation occurred.”
Breach Litigation Developments Webinar
Early this month I discussed recent developments in data breach litigation at a webinar hosted by Debix.
…
MA Delays Implementation of Information Protection Standards
Businesses holding personal information of Massachusetts residents have at least one thing to be thankful for this holiday season. As reported here, Massachusetts earlier this year established strict standards for protection of personal information about Massachusetts residents. Those standards include encryption of electronic data when stored or transmitted and…
CAN of Worms?: New Decision Opens CAN-SPAM Private Right of Action to Non-ISPs
A recent decision in the Western District of Washington broadly defines the reach of the private right of action under the federal CAN-SPAM statute. In that case, Haselton v. Quicken Loans Inc., W.D. Wash., C-07-1777, 10/14/08, the court held that a company had standing to sue alleged spammers even though it is not an Internet service provider (ISP) and does not provide e-mail accounts to its customers.
…
NY State Releases Business Guide to Handling Personal Identifiable Information
The New York State Consumer Protection Board has released a guide for New York businesses regarding the handling of personal identifiable information and the avoidance of identity theft. The guide also includes a form for reporting breaches to NY state agencies.