Proskauer Rose

Subscribe to Proskauer Rose's Posts
Contact:Read more about Proskauer Rose

On October 9, in the case R v. S and A [2008] EWCA Crim 2177, the Criminal Division of the England and Wales Court of Appeal held that requiring criminal defendants to disclose an encryption key allegedly protecting criminal materials does not violate the privilege against self-incrimination under U.K. law or Article 6 of the European Convention of Human Rights.  The U.K. court’s ruling is at odds with Magistrate Judge Jerome J. Niedermeier’s ruling on a similar issue in the District of Vermont, In re Boucher, No. 06-mj-91, 2007 WL 4246473 (D. Vt. Nov. 29, 2007).

Effective September 1, 2009, companies subject to FTC jurisdiction will not be able to make interstate prerecorded telemarketing calls to EBR consumers absent the prior express written agreement of the consumer. Effective December 1, 2008, any company that continues to make such calls must comply with new restrictions that will continue even after September 1, 2009 when prior express written consent of the consumer is mandatory.
…

 The Third Circuit recently ruled that a labor union violated the federal Driver’s Privacy Protection Act (“DPPA”) when it accessed the motor vehicle records of Cintas employees for an improper “labor-organizing” purpose. In Pichler v. UNITE, the divided court affirmed the district court’s grant of summary judgment to the plaintiffs whose home addresses were obtained as part of the Union of Needletrades, Industrial & Textile Employees’ (“UNITE”) drive to organize Cintas employees. In reaching its conclusion, the court held that punitive damages may be awarded for violations of the DPPA. The court also concluded that the union’s assertion that it collected and used personal information from motor vehicle records for litigation — a permissible purpose under the DPPA — did not overcome the lower court’s finding that it collected and used the information for impermissible labor-organizing activities.

Behavioral tracking of consumers online in order to deliver relevant advertising is a privacy issue that is receiving a lot of attention, and one that has been the focus of Federal Trade Commission and consumer group scrutiny. On September 25th, the United States Senate Commerce Committee held a hearing on online privacy and received commitments from the three industry representatives (from AT&T, Verizon and Time Warner Cable) that if they do deploy technologies that are able to track consumer online behavior in order to tailor advertising, that consumers will have clear notice and a full opportunity to provide affirmative consent. None of the companies currently use such technologies in their roles as Internet Service Providers. The broadband providers challenged the rest of the online industry, including web site operators and application providers such as Google, to provide the same protections to consumers. Essentially, the witnesses called for an end to “opt out” when it comes to online advertising.
…

There have been 449 data breaches reported in media in 2008, according to the Identity Theft Resource Center’s 2008 Data Breach List.  That number exceeds the 2007 year-end total, and counts as only one breach even massive incidents such as the Hannaford Bros. breach.  Note that some of the breaches…

Proskauer on Privacy will never be confused with TMZ, but we would be remiss if we failed to report on the high profile privacy scandal unfolding in the backyard of our Los Angeles office. As we previously reported, California’s data breach notification law was amended effective January 1, 2008, to include breaches of medical and health insurance information. A number of recent incidents illustrate once again that it is not enough to have written policies and procedures in place for the handling of sensitive information – employee training is essential.
…

According to regulations published by the Federal Trade Commission and the federal banking agencies, covered companies that hold any customer accounts must implement identity theft prevention programs that identify and detect “Red Flags” signaling possible identity theft. Companies establishing such programs must create policies and procedures not only to recognize and detect Red Flags, but also to respond to Red Flags by preventing or mitigating potential identity theft. Furthermore, companies must develop reasonable policies and procedures to verify the identity of a customer opening an account, and must also periodically update their identity theft programs. The rules went into effect on January 1, 2008, and businesses must comply by November 1, 2008.
…