Privacy & Security Law Report: Index-Summary

DAMAGES

– Attorney's faxed malpractice reports not unsolicited ads, no TCPA violation (N.Y.), 967; FCC comments on when faxes informational messages, 967
– Cal., Pasadena police department entitled to qualified immunity, privacy invasion award nixed (Cal. Ct. App.), In Brief, 806
– Cell phones calls unsolicited, telemarketer agrees to pay Verizon Wireless to settle suit (D.N.J.), 500
– Data breaches

– – Hannaford Bros. Co., bulk of claims dismissed, only narrow negligent damages action survives (D. Me.), 749; hacker indicted in record breaking case (D.N.J.), Special Report, 1244; hacker pleads guilty (D. Mass.), 1272; judge certifies damages question to state court (D. Me.), 1495
– – VA medical center hard drive lost, putative class cannot demonstrate actual damages, APA claims remanded (11th Cir.), 929

– Drug testing, employer failed to comply with testing law but no damages awarded when second test confirmed positive results (Iowa), 83
– E-mail, alleged disclosure or spam receipt not injury or damage for contract or fiduciary claims (S.D.N.Y.), 559
– Equifax report errors, damages affirmed (4th Cir.), 499
– FACT Act

– – Mexican Specialty Foods, statutory damages provision constitutional, credit card receipt class suit revived (11th Cir.), 710
– – 233 Skydeck, permissible statutory damage ranges does not violate due process (N.D. Ill.), 334

– Google Street View, failure to seek trespass nominal damages no basis to reopen case (W.D. Pa.), 591
– India clears amendments to IT Act to protect personal information, 16; bill includes damages provision, 17; bill contains broad data security standards, rules not yet drafted, 248; industry self-regulatory council sends recommendations for new rules, 739; amended law takes effect but implementing rules incomplete, 1574
– License plate surveillance of Cintas employees, union liable (U.S., rev den), 497; In Brief, 505; union not liable for punitive damages (E.D. Pa.), 1203
– Mortgage company had duty to redact sensitive data from filed court documents but no damages (D.S.C.), 1238
– Nude cell phone photo viewing by police prompts lawsuit (W.D. Va.), In Brief, 599; lacked objectively reasonable expectation of privacy, 1349
– Polygraph testing, failed bank robbery led to firing of manager not disclosure of polygraph, no evidence of damages (D.S.C.), 625
– Prerecorded messages, Ass'n Health Care Mgmt. case dismissed, failed to meet amount-in-controversy requirement (S.D. Ohio), 442
– Pretexting claim in confidential business information dispute, jury award to former saleswoman (Ill. Cir. Ct.), 1528
– Stored Communications Act, former marketing executive claims boss accessed personal e-mail, actual damages proof required for statutory award (4th Cir.), 467; actual damages, Analysis and Perspective, 571
– USPS co-branding efforts, worker unjust enrichment challenge on alleged personal data disclosure dismissed (W.D. Wash.), 1277
– Video monitoring of police employee locker room, class settlement approved (C.D. Cal.), 1271

DATA BREACH NOTIFICATION

– Ala., companion bills added to docket, 592
– Alaska, law enacted, 834
– Alberta proposed amendments include government notification, 1574
– American Recovery and Reinvestment Act

– – Implementation

See AMERICAN RECOVERY AND REINVESTMENT ACT

– – Legislation

See LEGISLATION, FEDERAL, HR 1, HR 598

– Australia to develop privacy principles, 1500
– California

– – Amendment proposed, 5; amendments under review, 507; bill clears the state Senate, 679; state AG notification requirement bill clears legislature, 1310; governor vetoes, 1498
– – Health data amendment, over 800 breaches reported since Jan., 1053

– Duty of care standard still evolving, 449
– EU adequacy

– – New Zealand, privacy chief urges quick enactment of amendment to secure approval, 1026
– – South Africa, bill includes breach notice and marketing limits, Special Report, 1317; omnibus data protection bill draws business criticism and requests for more time, 1567

– European Union E-Privacy Directive

– – Article 29 Working Party calls for broad breach notice, 306
– – Broad requirements, European Parliament instructs EC to consider, 742; Council of the EU adopts legislative changes on Universal Service and ePrivacy directives, still discussing internet cutoff provision, 1568
– – Hustinx issues opinion, 86
– – Seminar highlights need for incentives, sharing, and planning, 1570

– Federal legislation

– – Data Accountability and Trust Act

See LEGISLATION, FEDERAL, HR 2221

– – Data Breach Notification Act

See LEGISLATION, FEDERAL, S 139

– – FTC and DOJ call for standard to fight ID theft, House hearing held, 923
– – Hill Watch, status of significant bills, chart, 1333
– – HITECH Act HIPAA amendments

– – – Analysis and Perspective, 417; 649
– – – Contract changes needed, ABA panelists also say changes will increase enforcement, 558
– – – Implementation

See AMERICAN RECOVERY AND REINVESTMENT ACT

– – Medical records

See LEGISLATION, FEDERAL, HR 1

– – Outlook, 51
– – Personal Data Privacy and Security Act

See LEGISLATION, FEDERAL, S 1490

– Federal regulatory trends, Special Report, 682
– France

– – Analysis and Perspective, 484
– – Senate report on privacy in age of digital memory, quick action unlikely, 936

– German data protection amendments include, officials support, 537; Analysis and Perspective, 1003; lower house of Parliament amends and adopts bill, 1015; new law takes effect, Analysis and Perspective, 1443; consequences for service and outsourcing contracts, Practice Aid, 1625
– Haw. credit monitoring amendment died, 507
– Heartland Payment Sys.

See DATA BREACHES

– Hong Kong proposes ordinance changes including voluntary notice rules, 1281
– Idaho bill requires state attorney general notification, 507; bill approved, sent to governor, 592; governor vetoes, 637
– Identity theft, future risk claim insufficient despite standing to sue (N.D. Cal.), Special Report, 569
– India, amendments to IT Act do not require notice, 248; industry self-regulatory council sends recommendations for new rules, 739; amended law takes effect but implementing rules incomplete, 1574
– Ireland, interim guidance recommends notice to data protection office, 630; annual report says breach reporting viewed as best practice, 745
– Maine bill seeks time limit, 507; state House approves, 721; legislature clears bill, 752; governor signs bill, 786; law takes effect, 1387
– Mass. data security rules, regulators urged to extend compliance deadline, 165; Mass. delays rules, drops vendor written certification mandate, 276; panelists concerned about impact, 588; future of rules uncertain, 1049; Mass. amends rules and extends deadline, 1225; public hearing held, 1386; officials discuss at IAPP Privacy Academy and give compliance advice, 1399; Mass. files final amendments, 1565
– Medical records

– – ABA annual meeting session addresses privacy and security for health data, 1200
– – AMA approves ethical guidance to physicians including notice, 926
– – E-health, personal records services, FTC proposes rule, 581; FTC to release temporary breach notice rule in August, 732; FTC urged to align rules with HHS approach, Special Report, 850; additional comments urge broad coverage, 866; FTC and HHS issue rules, attorneys praise HHS risk of harm threshold, 1227; IAPP Privacy Academy, firms warned about possible stronger HIPAA enforcement, 1401; House leaders ask HHS to revise harm provision, 1463; HHS under pressure to strengthen rules, 1524; comments received on interim rule, model notice documents sought, 1556
– – Securing patient information, HHS guidance offers safe harbor, 584; HHS receives comments, 767
– – Stakeholders disagree on whether provision positive, 329; correction, 446
– – State AG enforcement of health data breach provisions, attorney in audio briefing, 778
– – Stimulus bill

See LEGISLATION, FEDERAL, HR 1

– Miss. introduced bill, Special Report, 177
– Mo. bill pre-filed, includes criminal penalties, 5; Special Report, 177; state Senate passed, 592; new law includes health data, 1085
– Mont. bill expands law to government agencies, 5; state may finally pass breach notice law, 507; governor signs bill, 592; law to take effect, 1387
– N.H. e-health bill enacted, 1195
– N.J. bills include retailer liability to banks, 5; bills carried over to 2009 session, 6
– N.M. e-health bill considered, 256
– New York

– – Electronic transfer breach notice bill introduced, 215
– – Encryption, data security provisions, and AG notice included in new bill, 636

– N.C., bill to expand notification to attorney general clears legislature, 1096; governor signs, 1149; law to take effect, 1387
– Nova Scotia, omnibus health records privacy protection bill includes breach notice and marketing limits, 1617
– Obama's official cybersecurity agenda includes, 157
– Pa. bill seeks one week deadline, 257; bill sets state agency requirements, 507; Pa. Senate approves, 534
– Philippines, congressional working group to meet on revised data protection law, 435; bill progresses, changes include breach notice and penalties, 1239
– Securities broker, industry self-regulator levies fine for lax data protection, 706
– S.C., law enacted, 834
– South Korea, omnibus privacy law stalled, 988
– State legislation outlook, Special Report, 507; 786
– Tax preparer tossed client files in dumpster, damage showing needed for breach, tort, and tax class claims (E.D. La.), 82; state claim of loan brokering without license not added, In Brief, 678; motion for reconsideration dismissed, In Brief, 807; specific list of lax data security measures allows privacy policy breach claims to survive, 961; some discovery limited, requests overbroad, 1382
– Tex., amendment seeks extension to public sector, 507; legislature clears measure extending to public sector and health data, 787; governor signs bill extending breach notice to public and health sectors, 962; law takes effect, 1387
– Uruguay adopts rules, DPA recognizes EU adequacy decisions, 1479
– Va. bill would add health data to breach law, 256; amendment fails, 507
– Wash. amendment includes retailer liability, data retention prohibitions, and encryption requirements, 215

DATA BREACHES

– Aetna notifies individuals of breach of job application site, 798; class action filed (E.D. Pa.), 872
– Ameritrade customer e-mail accounts hacked, despite attorney fee concerns proposed class settlement approved (N.D. Cal.), 750; court rejects settlement, decertifies class, 1560
– AOL research database, most of class must file in Va. (9th Cir.), In Brief, 210
– Bank of America settlement, privacy class objectors' claims tossed (Cal. Ct. App.), 987
– Blue Cross and Blue Shield of Del. fined by state regulators for printing error disclosing personal data, 84
– Blue Cross Blue Shield Ass'n says stolen laptop held unencrypted information on doctors, 1469
– Canada

– – Accountant group publishes toolkit for small and medium-sized businesses, 1311
– – Alberta Health Services, failure to encrypt stolen laptops denounced, 964
– – Losses due to IT breaches nearly doubled this year, 1437
– – Saskatchewan annual report, In Brief, 993

– CardSystems data breach, bank negotiates with auditor that certified payment card processor before breach (D. Ariz.), 871
– Certegy Check Services, telemarketer settles claim it acquired stolen data, judgment sets new due diligence standard (Fla. Cir. Ct.), 591
– Cerved unable to use tax and voting records mistakenly posted on Italian government website, 170
– China, data privacy protection criminal law under review by People's Congress panel, 338; China enacts law, 403
– ChoicePoint, FTC announces order expounding data security accord (N.D. Ga.), 1527
– Colombian cybercrime law signed, 43
– Connecticut

– – Audit report on stolen tax agency laptop concludes failure to properly manage and protect data, 1499
– – Bank of N.Y. Mellon agrees to pay state, already paying for credit protection, 241
– – Countrywide owner Bank of America to cover data breach freeze costs, consumer class action settlement proposed (W.D. Ky.), 205

– Costs

– – Hannaford breach response, Maine bank regulators release survey results, many affected, 37
– – Heartland Payment Sys., 8-K filing shows costs of breach, 719
– – Ponemon report finds costs 2008 increase, customer turnover big factor, 233

– Economic crisis and offshoring raise threat of insider breaches and trade secrets theft, McAfee reports, 234
– FTC Leibowitz to enforce requirements, 461
– Geeks.com, online computer retailer agrees to settle allegations (FTC), 235
– Germany

– – Daimler worker health data breached, DPA probes retention of diagnosis data, 597
– – Landesbank Berlin credit card customer data breach caused by couriers' stolen stollen cover up, 21

– Hacking

See HACKING

– Hannaford Bros. Co., one consumer suit remanded due to CAFA home state exception (1st Cir.), 720; bulk of claims dismissed, only narrow negligent damages action survives (D. Me.), 749; hacker indicted in record breaking case (D.N.J.), Special Report, 1244; hacker pleads guilty (D. Mass.), 1272; judge certifies damages question to state court (D. Me.), 1495
– Health care, AMA approves ethical guidance to physicians including notice, 926
– Heartland Payment Sys.

– – Announcement, unknown number of accounts compromised, 161
– – Consumer class action filed (D.N.J.), 203; two more class actions filed, 237; banks file class action for card replacement costs, new consumer suits filed, 299; oral arguments set (J.P.M.L.), 775; panel consolidates consumer and bank claims, 873; banks and credit unions file class suit seeking damages (S.D. Tex.), 1470
– – Costs so far in 2009 reach $32M, 1168
– – 8-K filing shows costs of breach, 719
– – Fallout will be its biggest challenge this year, 336
– – Hacker indicted in record breaking case (D.N.J.), Special Report, 1244; hacker pleads guilty (D. Mass.), 1272
– – PCI DSS

– – – CEO pushes for total encryption to supplement, 204
– – – Recertified as compliant, 719

– – 10-K annual report details multiple government probes, loss of PCI DSS certification and more lawsuits, 466

– Homeland security annual report discusses, 1375; groups tell Congress that Privacy Office not living up to mandate, 1558
– IT cybersecurity warning, DHS issues baseline risk assessment, 1264
– Italy DPA releases guidelines, 170
– Japan

– – Brokerage firm, data manager stole client data and sold to marketers, 566; worker arrested, Japan financial regulators release data security guidelines, 991; no ID theft shown yet, 1097
– – Insurance unit reports breach, customer data misuse reported, 1097

– Kaiser Permanente

– – Employee records, notifying workers that PII may have been stolen, 278; breach traced to terminated employee of union, 403
– – Hospital employee inappropriately accessed patient's medical records, Cal. agency fines hospital, 738; new Cal. patient privacy statute and tabloid legislating, Analysis and Perspective, 943; agency issues another fine for second violation, 1054

– Liability

– – Duty of care standard still evolving, 449
– – L.A. City Council internet services moves Google Cloud, breach cost concerns remain, 1565
– – Mich. bill grants immunity to firms with specified safeguards, 1168
– – Multifactor identification measures

– – – Citizens Fin. Bank, failure to adopt may create liability (N.D. Ill.), 1268
– – – People's United Bank, transfer from construction company's account allowed due to lax measures (Me. Super. Ct.), 1431

– – N.J. bills include retailer liability to banks, 5; bills carried over to 2009 session, 6; bill has most expansive liability provision in country, 215; no committee action on retailer liability, 507; bill sits in committee, unlikely to pass, 835
– – State legislation outlook, Special Report, 507
– – Tex. considering reintroduced bill, 507; state house approves extending notice to public sector and adds health data, 679; retailer liability bills stalled, 787; bill dies in committee, 835
– – Wash. bill to add retailer liability, 215; bill sent to Rule Comm., 507; bill dies in committee, 835

– Mass. releases reports on notification statistics, 1614
– Mental health records accessed by fellow workers, insufficient evidence to support emotional distress damages (Iowa), 777
– Merchants ID Theft Advisory Bd. to create best practices guidance, In Brief, 1175
– Notification

See DATA BREACH NOTIFICATION

– Ohio Univ., breach of alumni database, schools and fired IT managers settle claim, audit report to be released (Ohio Ct. C.P.), 561
– Okla. Human Services Dep't laptop with client data stolen from employee's car, 670
– Patient data sold to lawyer, hospital employee indicted (S.D. Fla.), In Brief, 1175
– PayChoice discovers website security breach when phishing e-mails spotted, 1469
– People's United Bank laptop lost, post-breach fear of identity theft satisfies standing but not compensable without loss (D. Conn.), 1348
– Recession, data security risks, Practice Aid, 998
– Rocky Mountain Bank, probe of customer data improperly attached to e-mail, unable to seal complaint (N.D. Cal.), 1378; dismissal approved, 1433
– Starbucks laptop stolen, workers file class action (W.D. Wash.), 336
– Statistics

– – ID Theft Resources Center reports 2008 increase, 40
– – U.K., ICO reports significant increase in last 3 months, 282

– Taxation, N.Y. tax department discloses breach, former worker charges with identity theft (N.Y. City Ct.), 628
– 10-K annual reports, Hiscox report says many firms fail to tell SEC of risk to finances and reputation, 619
– TJX Cos.

– – Banks, remaining plaintiffs may pursue some claims (1st Cir.), 532; final bank plaintiffs settle claims (D. Mass.), 1260
– – Hacker pleads guilty (D. Mass.), 1272
– – State investigations, agreement reached with state attorneys general (Mass. Super. Ct.), 957

– Too Much Media, blogger postings on porn software breach not covered by N.J. media shield law (N.J. Super. Ct.), 1095
– TowerGroup says financial institutions must assume personal data has been or will be compromised, 928
– Twitter, Mich. mayor accidentally posted personal employee data, 962
– United Kingdom

See UNITED KINGDOM (UK)

– UC Berkeley health services center computer systems hacked raising ID theft concerns, 751
– Verizon Business reports incidents rose in 2008, organized crime played increasing role, 586
– VA, theft of personal data, veterans settle Privacy Act class action (D.D.C.), 199; settlement approved, In Brief, 314; attorneys' fee award lowered, 1385
– Va. dangerous drug prescription reporting system data allegedly held for ransom, 751; Va. sending breach notices over exposure of SSNs, 836
– Va. Tech researcher loses flash drive with student data, 1499
– Zurich Ins. lost back-up tape with data on U.K., S. Africa, and Botswana customers, 1532

DATA MINING

– De-identified information, state regulation, Analysis and Perspective, 544
– Metadata embedded in electronic documents

– – N.H. lawyers may not mine e-documents from opposition (N.H. Bar Ass'n Ethics Comm.), 736
– – Pa. lawyers may use metadata, primary burden on sender (Pa. Bar Ass'n Comm.), 737
– – Vt., searching documents not forbidden (Vt. Bar Ass'n Prof'l Responsibility Section), 1434
– – W.Va., opinion sets out obligations (W. Va. State Bar Lawyer Disciplinary Bd.), 1025

– N.Y. introduces e-mail harvesting ban, 258
– Prescription information

See PRESCRIPTION DRUGS

– Surveillance and anti-terrorism issues, federal legislation, Outlook, 59

DATA RETENTION

– Argentine law giving secret service access to e-mails and calls unconstitutional (CSJN), 340
– Attorneys may keep client files in electronic form (Mo. Sup. Ct. Advisory Comm.), In Brief, 884
– Baseball player steroid use, search of computer files limited to scope of warrant, detailed guidance offered (9th Cir.), 1269; attorneys and academics discuss implications, Special Report, 1357
– Canada

– – Alberta, Personal Information Protection Act, amendments proposed, 1574
– – Nova Scotia, omnibus health records privacy protection bill includes breach notice and marketing limits, 1617
– – Telecommunication agency launches review of customer data use and privacy rules, 312

– Circuit City customer class action suit against Chase Cards Services dismissed (S.D.N.Y.), 1055
– Dutch amendment to set at 12-month limit, ministry may set lower 6-month limit, 1029; government agencies meet with ISPs on new obligations, 1535
– E-discovery, EU

– – Article 29 Working Party opinion, Special Report, 315
– – Data protection, Practice Aid, 409

– E-mails deleted

– – E-discovery, access to opposing party's servers to recover approved (S.D. Cal.), 41
– – FOIA request, county board must attempt to recover (Ohio), 14

– Electronic commerce, boilerplate contract clauses, Analysis and Perspective, 1629
– EU Directive

– – Challenge dismissed (E.C.J.), 284
– – France evaluating application, sees need to standardize amount of time data can be kept, 781
– – Irish bill to cut how long telephone and web user ID data kept, 1064
– – Social networking websites, U.K. proposes inclusion, 471

– Facebook

– – Italian DPA warns users that information never completely deleted, In Brief, 506
– – Terms of Use policy, company withdraws change on retention of personal data, EPIC planned FTC complaint, 299

– Flu pandemic, CNIL approves privacy exemption, worker data may be used in continuity plans, 1388
– Google Street View, Canadian officials welcome retention policy, 1479
– Health information

– – Daimler worker health data breached, DPA probes retention of diagnosis data, 597
– – HHS issues guidance on securing patient information, 584; HHS receives comments, 767

– Identity theft red flag rules, FAQ guide released by FTC and banking regulators, 865
– Improper disposal in dumpsters

– – Attorney left client files beside dumpster, results in public reprimand (Ohio), 592
– – CVS settles FTC and HHS cases (FTC), 295; pharmacist group asks FTC to continue probe citing concern about pharmacy benefits manager data, 464; CVS settles with Ind. AG (Ind. Pharm. Bd.), 1058
– – East Cheshire NHS Trust, U.K. ICO orders security measures, 1207
– – Fitness center's customer records, agrees to injunction (Tex. Dist. Ct.), 1239
– – Lo Cost Rx, settlement approved (Ind. Pharm. Bd.), 875
– – Mortgage loans, FTC alleges businessman failed to properly dispose of customers' information (D. Nev.), 162
– – R.I. lawmakers approve bill requiring record destruction, 1614
– – Tax preparer, damage showing needed for breach, tort, and tax class claims (E.D. La.), 82; state claim of loan brokering without license not added, In Brief, 678; motion for reconsideration dismissed, In Brief, 807; specific list of lax data security measures allows privacy policy breach claims to survive, 961; some discovery limited, requests overbroad, 1382
– – Walgreens cases pending (Ind. Pharm. Bd.), 875; Walgreens settles with Ind. AG, 1058
– – Woolworth's, U.K. ICO probes improper disposal of customer records, 282

– IRS, sensitive but unclassified waste disposal, TIGTA report suggests improvements, 773
– ISP requirements

– – Art. 29 Working Party to probe practices, 470
– – U.S.

See LEGISLATION, FEDERAL, HR 1076, S 436

– Japan, police ask ISPs and carriers asked to retain communication logs for three months, 1527
– Jubilee Marketing Agency, ICO takes post-breach action against, In Brief, 1034
– Legislation must be flexible to allow internet innovation, industry asserts, 77
– Location based services, EU data protection, In Brief, 885
– Mass. data security rules, regulators urged to extend compliance deadline, 165; Mass. delays rules, drops vendor written certification mandate, 276; panelists concerned about impact, 588; future of rules uncertain, 1049; Mass. amends rules and extends deadline, 1225; public hearing held, 1386; officials discuss at IAPP Privacy Academy and give compliance advice, 1399; Mass. files final amendments, 1565
– Minn. genetic privacy law, proposed exemption for newborn screening program includes disposal requirements, 443
– Music file sharing, Usenet.com must preserve relevant data upon request, sanctions ordered (S.D.N.Y.), 236
– National Park Service, record destruction inference saves Privacy Act case (D.C. Cir.), In Brief, 939
– N.H. bill requires shredding medical records, 256
– Portugal

– – Consumer call centers, new law sets rules, 838
– – Credit prospectors, data authority issues data protection guidance, 444

– Search engines

– – Article 29 Working Party statement welcomes calls for standards, 278
– – Ixquick reduces data retention time to zero, 247

– South Korea lowers threshold for websites requiring poster identification verification, 598
– Spain, AEPD says some courts improperly threw out sensitive data, 934
– Sweden

– – EU Directive, EC begins legal steps for alleged non-implementation, 803
– – IP addresses of illegal file-sharers, law to force ISPs to reveal, 564; ISPs not retaining user protocols skirt new law but legal, DPA says, 715; ePhone ISP must hand over customer data, In Brief, 993; ISP to appeal, In Brief, 1069; order overturned (Sweden, Svea App. Ct.), 1503

– Telecommunications providers, Art. 29 Working Party to probe practices, 470
– United Kingdom

– – Camden Primary Health Care Trust disposed of computers without expunging personal data, In Brief, 506
– – Doctor must implement data destruction protocol after old computer found in parking garage, 1206
– – Internet traffic data, new rules take effect, guidance due soon, 565; comments sought, guidance include third party data comparison requirement, 674
– – Police

– – – Conviction data, police may retain (Eng. & Wales Ct. App. Civ. Div.), 1532
– – – DNA database to remove data from individuals who do not have criminal records, 1532

– Wash. data breach notification amendments include requirements, 215
– White House, comments submitted via social media to be saved and privacy protected, 1376

DATA SECURITY

See also CYBERSECURITY
– Banking self-regulatory groups merge efforts, In Brief, 883
– Behavioral advertising, FTC continues support for self-regulation but calls for stronger initiative, 267; FTC considers enforcement actions to support, 1466
– Biometric data, Irish report calls for greater privacy safeguards, 1616
– Breaches

See DATA BREACHES

– Business Forum for Consumer Privacy paper on U.S. approach, IAPP Privacy Summit, 477
– Canada

See CANADA

– China, certification rule dropped for foreign products sold in private security, 670
– ChoicePoint, FTC announces order expounding data security accord (N.D. Ga.), 1527
– Cloud computing

– – Analysis and Perspective, 425
– – Contract terms, companies should review and not move all sensitive data, RSA Conf., 646
– – FTC investigates practice, 701
– – IAPP Privacy Academy explores issues like risks and jurisdiction, 1398
– – IAPP Privacy Summit, risks exist but old safeguards still apply, 475
– – World Privacy Forum issues report, 337

– Colombia, cybercrime law signed, 43
– Comprehensive privacy legislation, Boucher (D-Va) predicts a bill in six weeks, 1140; advocacy groups call on Congress for tough data privacy rules, 1266
– Consumer Financial Protection Agency (CFPA)

– – Frank (D-Mass) bill

See LEGISLATION, FEDERAL, HR 3126

– – FTC chair assures lawmakers agency would maintain key powers, Consumer Union supportive, 1016
– – Obama financial regulatory reform proposal includes, FTC to share power, 977

– Consumer Sentinel Network Data Book, FTC reports that ID theft once again leading complaints, 329
– Corporate

See CORPORATE SECURITY

– Costa Rican Assembly to move on measure, 989
– Customer proprietary network information (CPNI), FCC seeks $13M in fines saying firms did not certify compliance, 327
– Cyberwar, Rand study discusses, In Brief, 1506
– Data Accountability and Trust Act

See LEGISLATION, FEDERAL, HR 2221

– Data broker concerns, Akaka (D-Haw) to study as part of Privacy Act review, IAPP Privacy Summit, 478
– DHS Secretary, Napolitano confirmed, issued directives on cybersecurity and critical infrastructure, 157
– E-health, information at risk, Ponemon survey, 1579
– Employee downsizing, data loss risks, Survey Report, 363
– Encryption

See ENCRYPTION

– Equipment disposal, IT survey cites as main concern, In Brief, 540
– EU data protection

See EUROPEAN UNION (EU); specific country names

– File sharing

See FILE SHARING

– FTC Act, Leibowitz calls for elimination of telecommunication company exemption, 705
– Global framework

– – FTC Leibowitz to enforce requirements and seek global common ground, 461
– – Madrid Resolution establishes non-binding minimum global privacy standards, 1620; conference speakers and sessions focused on global standards, 1623; keynote speakers focused on EU-U.S. information sharing, 1624
– – Self-regulatory guidance may be best model, FDIC analyst says, 462
– – Viewpoint, 62

– Government agencies

See GOVERNMENT OPERATIONS; specific agencies

– Identity theft

See IDENTITY THEFT

– India clears amendments to IT Act to protect personal information, 16; bill includes damages provision, 17; bill contains broad data security standards, rules not yet drafted, 248; industry self-regulatory council sends recommendations for new rules, 739; amended law takes effect but implementing rules incomplete, 1574
– Malaysia privacy bill update, 1239
– Mass. data security rules, regulators urged to extend compliance deadline, 165; Mass. delays rules, drops vendor written certification mandate, 276; panelists concerned about impact, 588; future of rules uncertain, 1049; Mass. amends rules and extends deadline, 1225; public hearing held, 1386; officials discuss at IAPP Privacy Academy and give compliance advice, 1399; Mass. files final amendments, 1565
– Merchants ID Theft Advisory Bd. to create best practices guidance, In Brief, 1175
– Morocco adopts data protection law, 563
– Mortgage lender agrees to add data security to halt FTC alleged GLB violations actions (FTC), 705
– NIST guidance updated

– – Federal agencies, In Brief, 286; NIST releases final revised framework standard and draft technical security protocol, 1167; Cyber Security Inst. analysis critical, 1231
– – Telecommuting guide, In Brief, 342; NIST releases final version, In Brief, 940

– N.Y., tax break for hires and purchased technology proposed for businesses, 636
– Obama's official cybersecurity agenda mirrors campaign promises, includes breach notice, 157; FY2010 budget proposal includes increased funds, 327; hearing witnesses urge House panel to avoid prescriptive mandates for private sector, 703
– Online user authentication lacking, allowed bank transfer from construction company's account (Me. Super. Ct.), 1431
– Personal Data Privacy and Security Act

See LEGISLATION, FEDERAL, S 1490

– Presidential transition, data protection proposals submitted to transition team, calls for senior CPO, 73
– Recession can create enhanced risks, Practice Aid, 998
– RSA Conf. says data security and privacy direction in flux pending Obama lead, 643
– Safe harbor standards

– – EU data protection, Practice Aid, 1211
– – FTC enforcement

– – – Practice Aid, 1328
– – – Settlements announced (FTC), 1459; comments urge further inquiry, 1604

– – Swiss DPA recognizes, officials create framework, 20

– Scotland, public sector non-binding privacy guidance, comments sought, 1285
– Securities broker, industry self-regulator levies fine for lax data protection, 706
– Self-regulatory framework, industry coalition drops effort to craft legislation, 331
– Singapore, review underway to consider need for omnibus bill, 250
– Social networking websites, U.K. study finds sites skimp on or downplay to attract new users, 1150
– South Korea expands privacy law to cover small businesses, 988; correction, 1068
– Taxation

See TAXATION

– Turkey, law remains stalled, 44
– Uruguay sets up data protection authority, EC certification process under way, 783; Uruguay finalizes rules, 1391
– Vietnam privacy bill update, 1239
– Workplace compliance trends, Ponemon survey report, 892

DATA STORAGE DEVICES

– Mass. data security rules, regulators urged to extend compliance deadline, 165; Mass. delays rules, drops vendor written certification mandate, 276; panelists concerned about impact, 588; future of rules uncertain, 1049; Mass. amends rules and extends deadline, 1225; public hearing held, 1386; officials discuss at IAPP Privacy Academy and give compliance advice, 1399; Mass. files final amendments, 1565
– United Kingdom

– – British Council says disk with staff payroll data lost in transfer, 209; ICO orders British Council to encrypt portable devices, 629
– – Encryption, ICO orders Home Office, 168
– – National Health Service (NHS)

See UNITED KINGDOM (UK)

– – Neath Port Talbot County Borough Council ordered to encrypt all portable devices after losing memory stick, In Brief, 1103
– – Prisoner data breach larger than first reported, In Brief, 1292
– – UPS, encryption ordered after laptop stolen, 1206

– VA, theft of personal data, veterans settle Privacy Act class action (D.D.C.), 199; settlement approved, In Brief, 314; attorneys' fee award lowered, 1385
– Va. Tech researcher loses flash drive with student data, 1499

DATABASES

– Access authorization, B13 director's alleged misuse not “without authorization” if he controlled database (N.D. Ill.), 1148
– AOL, most of data breach class must file in Va. (9th Cir.), In Brief, 210
– Asylum-seeker data rights, EDPS releases opinion, In Brief, 313
– ChoicePoint, FTC announces order expounding data security accord (N.D. Ga.), 1527
– Data mining

See DATA MINING

– Data retention

See DATA RETENTION

– DNA, prisoner's religious challenge rejected (D.C. Cir.), In Brief, 50
– E-discovery, ABA. Conf. panel advocates reasonability and upfront communication, 1180
– E-health

See E-HEALTH

– FDA postmarket risk analysis system, GAO needs details on Sentinel Initiative, In Brief, 841
– France, revised police databases now comply with privacy law, 1534
– Government transparency, website launched, In Brief, 806
– H1N1 virus, France posts vaccination campaign information, In Brief, 1577
– Italian telephone databases, DPA increases telemarketer fines, 472
– N.J. open records law, land records database firm must pay for SSN redaction of requested records (N.J.), 707
– Ohio, new law bars unauthorized searches by government employees, 43
– Student loan database, Fla. loan company workers plead guilty to misusing (M.D. Fla.), 1146
– Turkey, data protection law remains stalled, 44
– United Kingdom

– – Construction worker database, ICO takes enforcement action against firm maintaining, 445; head of firm that unlawfully traded worker data to face criminal proceedings (U.K. Magis. Ct.), 801; database owner fined, enforcement action eyed against firms for use (U.K. Crown Ct.), 1064; ICO takes action against 14 firms for using, 1172
– – Conviction data, police may retain (Eng. & Wales Ct. App. Civ. Div.), 1532
– – Natl. DNA Database, Home Office to remove data from individuals who do not have criminal records, 1532

– Whois databases

– – Canadian Internet Registration Auth. seeks comments on privacy policy changes, 1062
– – Complaint process updated, In Brief, 23
– – Domain ownership not proved by listing

– – – Control of website evidence (D.N.H.), In Brief, 1243
– – – Corporate veil, not enough to pierce (D.S.D.), 711

– – Generic top-level domain names, ICANN reviews comments, some urge stronger Whois features, 19; new draft security plan published, In Brief, 842

– Worker eligibility, federal databases to verify

See ALIENS AND CITIZENSHIP

DEBIT CARDS

– Payroll debit cards targeted using increasingly sophisticated methods, RSA Conf., 641

DEFAMATION

– Anonymous internet postings

– – Canada, statements on bulletin board, disclosure ordered (Ontario Super. Ct.), 538
– – First Amendment balancing needed to unmask speakers (Md.), 399
– – Five-step test for unmasking speakers

– – – D.C., test adopted (D.C.), 1235
– – – Tenn., standard adopted (Tenn. Cir. Ct.), In Brief, 1578

– – Jurisdiction, evidence needed for identification (D.D.C.), 301
– – “Skanks of NYC” blog, Google ordered to provide account data (N.Y. Sup. Ct.), 1234
– – Topix.com ordered to disclose web speaker identities (Tex. Dist. Ct.), In Brief, 448
– – York Univ., internet users not entitled to chance to object to ID disclosure by ISPs (Ontario Super. Ct.), 1352

– Blogger postings on porn software data breach not covered by N.J. media shield law (N.J. Super. Ct.), 1095
– Facebook, claim dismissed despite data ownership claim (N.Y. Sup. Ct.), In Brief, 1577
– Google, video shows taunts of Down syndrome boy, court considers criminal defamation case against officials (Tribunale di Milano), 243; ombudsman for municipality files civil suit, 244; case remains before judge, jurisdictional issues not decided, 308; ruling postponed, In Brief, 474; Italy has jurisdiction, 502; Milan court retains criminal and privacy cases, sends related case to Rome, 631; Google says IT not available then to restrict video post, In Brief, 718; trial granted use of fast-track process, 782; trial postponed, closed to media and public, In Brief, 966; court date set, In Brief, 1440
– Nude cell phone photo viewing by police prompts lawsuit (W.D. Va.), In Brief, 599; lacked objectively reasonable expectation of privacy, 1349
– Opinion-based criticisms of summer school, no liability (N.Y. Sup. Ct.), In Brief, 1393
– Right to defame public official, Wis. identity theft statute survives First Amendment as-applied challenge (Wis.), 1056
– Single-publication rules applies to alleged online slur (W.D. Ky.), In Brief, 785

DEFENSE DEPARTMENT (DOD)

– Guantanamo detainees' and families' privacy protected under FOIA (2d Cir.), In Brief, 92
– Security clearances, GAO tells Congress timeliness has improved, 8; GAO says reports not complete, In Brief, 806

DELAWARE

– Blue Cross and Blue Shield of Del. fined by state regulators for printing error disclosing personal data, 84

DEPARTMENT OF

See specific department e.g., TREASURY DEPARTMENT

DHS

See HOMELAND SECURITY

DISABLED PERSONS

– ADA

See AMERICANS WITH DISABILITIES ACT (ADA)

DISCOVERY

See EVIDENCE

DISCRIMINATION

– Background checks, Dallas-based corporate events planner, EEOC files class suit over firm's use of credit and criminal histories in hiring (D. Md.), 1471
– E-discovery, conference speaker talks about risks and benefits for employers, 440
– Employer monitoring of web posts, Analysis and Perspective, 1039; correction, 1068
– Genetic information

See GENETIC INFORMATION; GENETIC INFORMATION NONDISCRIMINATION ACT (GINA)

– Hostile work environment probe, municipal court judge cannot prevent release of report (Wash.), 1383
– Metadata associated with official police department notes not “public records” in state (Ariz. Ct. App.), 275; electronic public record includes metadata and must be produced (Ariz.), 1612
– Ob/gyn records, judge must approve relevance (Ohio Ct. App.), In Brief, 287
– Pornography viewed on work computers

– – Age bias, employee responsible for any misuse of computer password (5th Cir.), In Brief, 1393
– – Sex bias, hospital worker loses suit (7th Cir.), 1057

– Religious beliefs

– – Prisoner DNA, challenge to collection and storage rejected (D.C. Cir.), In Brief, 50
– – Refinery worker who refused photo ID fails in bias suit (E.D. Pa.), 1277

– Secret recording of supervisor's comments no violation of Wiretap Act (D.N.M.), 1057
– Sexual harassment

– – Computer use policy ambiguous, employer cannot copy worker's e-mail to lawyer sent from company laptop (N.J. Super. Ct.), 983
– – Settlement agreement not protected from disclosure (N.J. Super. Ct.), In Brief, 473

– Smoking workplace policies

– – Legal challenges, Analysis and Perspective, 1540
– – Off-duty conduct, smoker fired, no violation of privacy law (D. Mass.), 1201

– Title VII participation clause, employee giving patient file to EEOC legitimate reason for firing (U.S., rev den), 396; In Brief, 406; data copying not misappropriation of property (Okla.), 1386
– Website access by blind consumers, Target settlement approved (N.D. Cal.), In Brief, 447

DISPOSAL OF DATA

See DATA RETENTION

DISTRICT OF COLUMBIA

– Defamation, five-step test for unmasking anonymous speakers adopted (D.C.), 1235

DIVORCE

– E-mail stored in husband's account admissible by wife when he gave her his password (N.Y. Sup. Ct.), 778
– Funds transfer privacy law covers ordinary customer bank accounts (N.J.), 559
– Mental health records disclosed during discovery, claims reinstated (Ill. App. Ct.), 1561

DNA

See GENETIC INFORMATION

DO-NOT-CALL REGISTRIES

– Access, fees to increase, 1229
– Australian Dodo case as example of data protection accountability model, Analysis and Perspective, 180
– Canada

– – Enforcement, regulator issues first notices, 1032; agency issues first fines, 1288
– – Extension increases list from three to five years but rejects permanent registration, 633
– – Insurance and real estate agents, bulletins clarify obligations, 783
– – Spam ban bill includes clause to end marketer no-call list but not immediately, 713; Analysis and Perspective, 810

– Charity scams, FTC and state agencies announce crackdown, 771
– Comcast agrees to settle FTC violations (E.D. Pa.), 590
– DirecTV agrees to settle FTC violations (C.D. Cal.), 590
– Dish Network and dealers, FTC and state AGs allege no call and state law violations (C.D. Ill.), 497; Dish Network settles with 46 states, In Brief, 1068; two dealers settle FTC charges (E.D. Mich.), 1381
– FCC FY2010 budget request, House Appropriations panel approves, In Brief, 993
– Global Mortgage Funding banned from telemarketing for five years (C.D. Cal.), 1169
– Italy moves to create, 283
– Missouri

– – Septic-system products, no-call settlement reached, In Brief, 1035
– – TVH Holdings settlement reached, In Brief, 883
– – Versadebt to pay penalty (Mo. Cir. Ct.), In Brief, 343

– Netherlands, beginning Oct. 1 all companies required to check or face fines, 1029
– Robocalls

See ROBOCALLS

– Spain

– – Consumer bill of rights recognized, new bill to address loopholes and ban calls, 836
– – No-mail registry list expanded to calls, texts, and e-mails, 987
– – Violations, DPA fines firm for unsolicited calls abroad, six more cases waiting, 340

– Time share marketers agree to FTC penalties (M.D. Fla.), 198

DOD

See DEFENSE DEPARTMENT (DOD)

DOJ

See JUSTICE DEPARTMENT (DOJ)

DOMESTIC VIOLENCE

– E-mail account accessed by ex-spouse may be abuse (Cal. Ct. App.), In Brief, 806
– MySpace, single message insufficient to convict for intimidation and privacy invasion (Ind. Ct. App.), 1275
– Stalking, spam e-mails need to threaten safety to meet level (Or. Ct. App.), In Brief, 635

DRIVER'S LICENSES

– Canada

– – British Columbia to use facial recognition biometric technology to enhance, 285
– – Hotel night club patron data collection, court to hear Privacy Comm'r of Canada challenge (Fed. Ct.), 170

– Driver's Privacy Protection Act (DPPA)

– – Fla. Cabinet approves fine to settle DOJ lawsuit over state's sale of personal data (S.D. Fla.), 1280
– – Pa., license plate surveillance of Cintas employees, union liable (U.S., rev den), 497; In Brief, 505; union not liable for punitive damages (E.D. Pa.), 1203

– Kansas announces The Recall Center settlement announced, allegedly illegally sold records (D. Kan.), 799
– Loan files, GLB preempts Wash. law on disclosure of non-public personal data (Wash. Ct. App.), 41
– Real ID Act

– – Napolitano says DHS rethinking, 528
– – Providing for Additional Security in States' Identification (PASS ID) Act

See LEGISLATION, FEDERAL, S 1261

– – Real ID Repeal and Identification Security Enhancement Act

See LEGISLATION, FEDERAL, HR 3471

– Tex. suits over improper disposal of customer records, fitness center agrees to injunction (Tex. Dist. Ct.), 1239
– Time Warner, court approves class settlement in cable firm sale of customer data (E.D.N.Y.), 1144

DRUG TESTING

– ADA, applicant rejected due to failed test lacks triable claim (W.D. Ky.), 777
– Anti-doping agency, EU Article 29 group discusses at plenary session, 594; World Anti-Doping Agency amends privacy standards, In Brief, 748
– Iowa, employer failed to comply with testing law but no damages awarded when second test confirmed positive results (Iowa), 83
– Smoking workplace policies

– – Legal challenges, Analysis and Perspective, 1540
– – Off-duty conduct, smoker fired, no violation of privacy law (D. Mass.), 1201

– Teacher random testing policy held unconstitutional (N.C. Ct. App.), 832
– Transportation workers, observed urination rule upheld (D.C. Cir.), 776; DOT reinstates rule for return-to-duty and follow-up drug testing, 1142

DRUGS

– Prescription

See PRESCRIPTION DRUGS

– Testing

See DRUG TESTING

DUE PROCESS

– Expunged criminal record can never truly be private (3d Cir.), 1384
– FACT Act permissible statutory damage ranges do not violate clause (N.D. Ill.), 334
– FISA Amendments, NSA telecommunications records litigation, class action claims dismissed (N.D. Cal.), 828
– FOIA reasonable search for documents by FBI (U.S., rev den), In Brief, 991
– HITECH Act class action filed, alleges law violates privacy by failing to protect data (S.D.N.Y.), 1026
– NebuAd deep packet inspection, no jurisdiction over out-of-state ISPs (N.D. Cal.), In Brief, 1506