Data Points: Privacy & Data Security Blog

One of the earliest U.S. privacy laws applicable to private entities was the Fair Credit Reporting Act (FCRA), enacted in 1970.  The FCRA placed substantial requirements on the use of background checks and credit information for consumer and employment purposes.  Those requirements included the two universal tenets of privacy protections—notice (that information will be collected and used) and consent (to the collection and use).  In 2003, the Fair and Accurate Credit Transactions Act (FACTA) provided further protections for credit information, including proper disposal of ...

Uber Technologies Inc., the internet-based taxi service, was recently hit with a putative class action lawsuit over a data breach involving the personal information of about 50,000 current and former drivers.  Uber develops, markets and operates a mobile app-based transportation network.  Its app allows consumers to submit a trip request that is then routed to crowd-sourced taxi drivers.  In March 2014, a hacker gained access to a database containing the names and driver's license numbers of tens of thousands of Uber drivers.  Uber knew of the data breach as early as September 2014 ...

LIMITING LEGAL LIABILITY FOR POTENTIAL PRIVACY AND DATA SECURITY ISSUES: PRACTICAL APPROACHES TO A COMPLEX PROBLEM (APRIL 29, 2015):  You know that privacy and data security issues pose a huge risk for your company.  Regulatory penalties, litigation costs and recovery, and even just the cost of analyzing a data breach and sending out required notices can hurt a company’s bottom line not to mention its reputation.  Target’s breach cost the company over $148 million.  Fortunately, there are practical steps that your company can take now to limit liability when the inevitable ...

Will the brave new world of automobiles include talking vehicles?  According to a plan by the National Highway Traffic Safety Administration (“NHTSA”), the answer is yes.  NHTSA has provided advanced notice that it intends to propose a rule http://www.nhtsa.gov/About+NHTSA/Press+Releases/NHTSA-issues-advanced-notice-of-proposed-rulemaking-on-V2V-communications  that all passenger cars and light trucks must have vehicle to vehicle (“V2V”) communication capability by 2019.  Many automakers are already incorporating some V2V technology in their ...

2014 was the year of the data breach as several large, high profile breaches occurred, including EBay, Target, and Home Depot, that affected the personal data of millions of Americans.  On January 12, 2015, President Obama announced his intention to introduce legislation (by way of Congress) to require notification to consumers when their personal data has been compromised by a data breach.  This proposed law, the Personal Data Notification & Protection Act, is part of a more comprehensive legislative agenda by the White House, including a consumer privacy bill of rights and a law to ...

by Privacy & Data Security Members Karin McGinnis & Robert Sumner

Cyber-Monday sales weren’t the only good thing that happened for consumers this week.  Later in the week a federal judge in Minnesota thwarted Target’s attempt to dismiss a lawsuit brought by banks and credit unions arising out of the massive data breach last year.  Although the breach and access to the credit card information of some 40 million consumers resulted from hackers obtaining the password of a Target vendor who was accessing an unrelated subsystem, the banks and credit unions claimed that Target was liable ...

Apple recently changed its privacy policy which has made headlines – it will no longer unlock iPhones and iPads for law enforcement.  Prior to this change, Apple would assist law enforcement in unlocking Apple devices when presented with a valid subpoena or court order.

According to Apple’s CEO, Tim Cook, the company attempts to avoid collecting user data when it designs new technology and services.  The most recent version of Apple’s mobile device operating system, iOS 8, encrypts the data for all iOS 8 applications, such as email, call records, and iMessage, and this data is ...

A Pew Foundation study earlier this year found that 87% of all adults in the United States access the Internet or email, either through computers or mobile devices.  The same study found that of those adults, as many as 74% are using some form of social media, including Facebook, Instagram, Twitter and LinkedIn.  Given those numbers, it’s no wonder that many employers are concerned with managing their employees’ use of social media at work.

The conventional wisdom among many employers has long been that access to social media can be harmful to worker productivity.  Visions of ...

In just two years, social media password protection has gone from a privacy advocate’s dream to an employer’s harsh reality in many states.  Maryland became the first state (in 2012) to enact legislation that prevented employers from requesting the user names or passwords to an employee’s or applicant’s personal social media accounts.  Two states quickly joined Maryland in 2012 by passing similar password privacy laws, and nine more states added privacy protections in 2013.

So far in 2014, six states – Louisiana, New Hampshire, Oklahoma, Rhode Island, Tennessee and ...

[On June 27, 2014, Charlotte Privacy & Data Security Member Karin McGinnis and Senior Counsel Todd Taylor published the following update regarding the U.S. Supreme Court decision in Riley v. California, 573 U.S. ___ (2014)]   On June 25^th, the Supreme Court brought the Fourth Amendment into the digital age with its ruling in Riley v. California.  The case presented the question of whether a warrant was required in order for law enforcement to search a cell phone found on a suspect during the course of an arrest.  Chief Justice Roberts, writing for a unanimous court, stated clearly “[o]ur ...