Alaska passed a breach notification law in June, making it state number 44 to do so. As most are aware by now, Alaska’s new law, Alaska Stat. § 45.48.010 et seq., includes breach notification requirements, restrictions on use of Social Security numbers, and allows consumers to place a security [deep] freeze on their credit reports. Notification of a breach is not required if, after an appropriate investigation and written notification to Alaska’s attorney general, the covered entity determines that there is not a reasonable likelihood that harm to consumers has resulted or will result from the breach. By popular demand, following is our updated list of security breach notification laws.
Proskauer Rose
“Cyber-Bullies” Potentially Face Hard Time
State governments and federal prosecutors are cracking down on individuals who use the internet to harass or threaten others. On June 30, Missouri Governor Matt Blount signed into law a measure that criminalizes online harassment. This new law represents a marked change in the legal treatment of this form of harassment, also known as “cyber-bullying.” Other states have enacted legislation to help stop cyber-bullies, but none has gone so far as to impose jail sentences on violators. The Missouri law, however, criminalizes the transmission of an electronic communication for the purpose of frightening or disturbing another. V.A.M.S. 565.091 (not yet chaptered). Adult violators of this new law face up to 4 years in prison if they perpetrate the offense against a child.
The legislation responds to the 2006 death of 13-year old Megan Meier, who committed suicide after being harassed repeatedly on MySpace. The harassment was allegedly perpetrated by Lori Drew, a 47-year old woman who falsely assumed the identity of a fictitious teenage boy on MySpace and posed as this character to develop an online relationship with Meier. The girl’s suicide was allegedly prompted by disparaging comments made by Ms. Drew disguised as the teenage boy. The tragedy outraged the Missouri community in which it occurred, but local authorities were unable to prosecute Ms. Drew because cyber-bullying was not illegal.
New Connecticut Law Threatens $500,000 Penalty for Privacy Violations
On June 10, Connecticut Governor M. Jodi Rell signed into law a bill to safeguard Social Security numbers and other personal information. The law imposes a civil penalty of up to $500,000 on violators. The new law takes effect October 1, 2008.
…
Wrath of Quon?
The June 18, 2008 Ninth Circuit panel decision in Quon et al. v. Arch Wireless et al., No. 07-55282 (9th Cir. June 18, 2008) has sparked a flurry of news reports and speculation regarding employers’ ability to monitor employees’ e-mails and text messages. In fact, the decision appears to change very little for private employers who wish to review employee communications stored on, or sent through, their own servers and computers. However, Quon does limit employers’ ability to request from third-party providers the contents of employees’ electronic communications.
Expiration Date Imminent for Many FACTA Class Actions
New amendments to the Fair and Accurate Transactions Act (“FACTA”) (itself an amendment to the Fair Credit Reporting Act (“FCRA”)) bar consumers from alleging willful violation and seeking statutory damages based on the printing of credit card expiration dates on receipts where the account number is otherwise properly truncated in accordance with FACTA. This development means the end is near for scores of class action lawsuits filed last year.
…
Texas Attorney General Settles One of First State COPPA Enforcement Actions
In December 2007, Texas became the first state to file COPPA enforcement actions, by separately suing the entities behind Gamesradar.com and TheDollPalace.com in the United States District Court for the Western District of Texas. The complaints are available as an attachment to the press release on the Texas Attorney General’s website. The defendants in those cases are California and New York – and not Texas – entities.
…
U.K. ICO May Impose Fines for Data Breaches
A new Act of Parliament gives the United Kingdom’s Information Commissioner’s Office (ICO) the authority to impose monetary penalties for misuse of personal data in violation of section 55 of the Data Protection Act of 1998 (DPA).
…
No Shopping Spree for Plaintiffs Under California’s Song-Beverly Credit Card Act
On May 22, 2008, the California Court of Appeal narrowed the scope of claims available under California’s Song-Beverly Credit Card Act of 1971, California Civil Code § 1747.08, ruling that the statute is subject to the one-year statute of limitations of Code of Civil Procedure section 340 and does not apply to merchandise returns.
…