www.bna.com Privacy & Security Law Report
HomeIndexTable of CasesFeedbackwww.bna.com

Printable version (PDF) 

INDEX
Vol. 8, Nos. 1-44, pp. 1-1640
Jan. 5 -- Nov. 9, 2009

A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z

    E-COMMERCE
    E-GOVERNMENT ACT
      – DHS annual report, privacy office outlines expansion, PIAs, and security incidents, 1375; groups tell Congress that Privacy Office not living up to mandate, 1558
    E-HEALTH
      – ABA annual meeting session addresses privacy and security for health data, 1200
      – Adoption, report says penalties not incentives may be more persuasive, 587
      – Article 29 Working Party, annual report for 2007 gives overview of enforcement and documents issued, 166
      – Barriers include state law differences and liability fears, 1232
      – Children need to be considered in development, especially with lifelong collection of data, 1051
      – Coding system, HHS technical rule establishes and extends deadline, 159
      – Consent, privacy advocates urge new approach to patients' control of medical records, 214
      – Consumer preferences, ONC publishes draft document outlining, comment sought, 1467
      – Data breach notification
        – – N.H. bill enacted, 1195
        – – N.M. bill considered, 256
        – – Personal records services, FTC proposes rule, 581; FTC to release temporary breach notice rule in August, 732; FTC urged to align rules with HHS approach, Special Report, 850; additional comments urge broad coverage, 866; FTC and HHS issue rules, attorneys praise HHS risk of harm threshold, 1227; IAPP Privacy Academy, firms warned about possible stronger HIPAA enforcement, 1401; House leaders ask HHS to revise harm provision, 1463; HHS under pressure to strengthen rules, 1524; comments received on interim rule, model notice documents sought, 1556
        – – Va. bill would add health data to breach law, 256
      – Data security, information at risk, Ponemon survey, 1579
      – Database of federal and state privacy laws, Fla. launches website, In Brief, 1394
      – De-identified information, state regulation, Analysis and Perspective, 544
      – Economic stimulus package, HIT provisions
        – – American Recovery and Reinvestment Act
        – – Business Roundtable calls for HIT provisions, 79
        – – Criticism of some provisions expressed, 329; correction, 446
        – – Fla. agency unveils first in nation e-records system for Medicaid patients, 1565
        – – Grants
          See GRANTS, subheading: E-health, stimulus package
        – – Health care groups spar over privacy provisions, 10
        – – HHS National Coordinator for HIT, office and committees created by stimulus bill, 297; Obama appoints Blumenthal, 496; Blumenthal predicts e-records interstate sharing by 2011, 735; Blumenthal expresses concern about timetable, 772
        – – House committees approve provisions, 175
        – – National Business Group on Health outlines its priorities, 79
        – – Policy implications and requirements, Analysis and Perspective, 344
      – FDA postmarket risk analysis system, GAO needs details on Sentinel Initiative, In Brief, 841
      – Health information exchanges, number of fully operational HIEs grown, In Brief, 1104
      – Health information technology (HIT)
        – – Adoption levels abysmally low, Am. Hosp. Ass'n annual membership survey, 495
        – – Booz Allen Hamilton white paper says HIT must focus on communication and not just data, 80
        – – Digital divide, costs barrier to adoption at hospitals serving poor, In Brief, 1577
        – – Economic stimulus package
          See Economic stimulus package, HIT provisions, this heading
        – – Pharmacy group urge Congress to consider interoperability, 273
        – – SBA loans
          See LEGISLATION, FEDERAL, HR 3014
        – – Vendor contracts shift liability to medical personnel, JAMA article, In Brief, 568
        – – White papers, ONC to address various issues including exchange permissions, 1348
      – House Cybersecurity Coordination and Awareness Act, bill increases NIST authority, House Sci. and Tech. panel passes, 1603
      – IAPP Privacy Academy, firms rushing to e-records warned not to forget privacy and security rules, 1401
      – IAPP Privacy Summit, panelists say security and privacy must proceed adoption to mitigate error propagation, 481
      – Incentives, America's Affordable Health Choices Act
        See LEGISLATION, FEDERAL, HR 3200
      – Italian DPA issues draft rules to protecting records, 502
      – Medical identity theft, stakeholders need to address problem before e-records shared, IAPP Privacy Summit, 482
      – National eHealth Collaborative (NeHC) launches and aims to keep HIT leadership, 40; leaders say current private sector structure the best way forward, 273; stimulus bill replaces NeHC with HIT Policy Comm. and HIT Standards Comm. at HHS, 297; NeHC seeks standards role, says goals complementary with new HIT Standards Comm., 440
      – National Research Council says providers not using for patient care, In Brief, 93
      – N.H. laws include privacy, marketing, and breach notice, 1195
      – N.M. law signed to create EMR system, 534
      – Rural areas, Sebelius praises Columbia Basin Health Ass'n in Success Story report, 1468
      – Taxation, IRS approves 30 regional networks for tax exemption, In Brief, 1507
      – Transactions standard, HHS updates technical rule to accommodate expanded code sets, 159
    E-MAIL
      – Abusive marketing, French firms fined, need better way to opt-out or unsubscribe, 935
      – Access authorization
        – – Bloomington-Normal Seating claims under CFAA and CDA advance (C.D. Ill.), 830
        – – LVRC Holdings, authorization based on employer policies not misuse (9th Cir.), 1377; employers should revisit data misuse policy, Special Report, 1441
      – AOL, class argues embedded ads violate ECPA (C.D. Cal.), In Brief, 806
      – Authentication
        – – Banking best practices released, In Brief, 883
        – – Government and e-commerce sites, group says many fail to use, 589
      – Commodity futures trading, e-mail and IM subject to recordkeeping, CFTC says, In Brief, 287
      – Damages, alleged e-mail disclosure or spam receipt not injury or damage for contract or fiduciary claims (S.D.N.Y.), 559
      – Data breaches
        – – Ameritrade customer e-mail accounts hacked, despite attorney fee concerns proposed class settlement approved (N.D. Cal.), 750; court rejects settlement, decertifies class, 1560
        – – Rocky Mountain Bank, probe of customer data improperly attached to e-mail, unable to seal complaint (N.D. Cal.), 1378; dismissal approved, 1433
      – Discovery, firm seeking unsorted account search must pay costs (N.Y. Sup. Ct.), In Brief, 842
      – Divorce, e-mail stored in husband's account admissible by wife when he gave her his password (N.Y. Sup. Ct.), 778
      – Domestic violence, e-mail account accessed by ex-spouse may be abuse (Cal. Ct. App.), In Brief, 806
      – E-discovery, access to opposing party's servers to recover approved (S.D. Cal.), 41
      – Employment issues
        – – Compliance trends, Ponemon survey report, 892
        – – Computer use policy ambiguous, employer cannot copy worker's e-mail to lawyer sent from company laptop (N.J. Super. Ct.), 983
        – – Misconduct, no FMLA violation to fire executive on leave who refused to give up keys and passwords (7th Cir.), 1235
        – – Monitoring increasing, lawyers urge caution, Special Report, 1295
        – – Portugal workplace privacy code restricts surveillance and e-mail monitoring, 308
        – – Public employers need workplace privacy policies, attorney urges to avoid pitfalls, 1266
        – – Recession, data security risks, Practice Aid, 998
        – – Stored Communications Act
          – – – Actual damages proof required for statutory award, former marketing executive claims boss accessed personal e-mail, (4th Cir.), 467; actual damages, Analysis and Perspective, 571
          – – – Councilwoman may proceed on claim of unauthorized access by mayor (N.D. Ill.), 1055; damage not required for civil CFAA claim, 1275
      – Finland expected to permit limited surveillance of employee e-mail, 246; law allows employers surveillance of e-mail traffic data, 740
      – FOIA
        – – Contractor e-mails held exempt (S.D. Ohio), In Brief, 408
        – – County board must attempt to recover deleted e-mails (Ohio), 14
        – – Madoff scheme, personal identifying data redaction required to release victims' e-mails to media (S.D.N.Y.), 986
        – – White House Office of Administration exempt from FOIA (D.C. Cir.), In Brief, 784
      – Health care reforms, free speech chilled by White House requests for public to forward “fishy” e-mail, suit also alleges Privacy Act violation (D.D.C.), 1274
      – L.A. City Council approves moving e-mail and internet services to Google Cloud, 1565
      – N.Y. harvesting ban introduced, 258
      – Printouts preserved instead of digital copies, no sanctions in spam case (S.D. Ohio), 1204
      – Scams, attorneys who fall for may face discipline, In Brief, 678
      – Spain no-mail registry list expanded to calls, texts, and e-mails, 987
      – Spam
      – Spoliation, routine backup tape deletion, no bad faith (M.D. Fla.), In Brief, 1176
      – Stored Communications Act
        – – Boss allegedly accessed personal account, actual damages proof required for statutory award (4th Cir.), 467; actual damages, Analysis and Perspective, 571
        – – Search and seizure, opened user e-mail held by ISP is not “backup” subject to SCA warrant rule (C.D. Ill.), 1148
      – Sweden, cross-border communications surveillance law amendments to add court and privacy review, 804; Parliament approves, 1535
      – Terror suspect, NSL nondisclosure continues after in camera review (S.D.N.Y.), In Brief, 1578
      – Threats must be sent across state lines (4th Cir.), In Brief, 940
      – Union-related e-mail, discipline for one message violated NLRA (D.C. Cir.), 1019
      – Utah child protection e-mail registry, adult entertainment group drops suit (D. Utah), 1473
      – Wash., personal e-mails about city business not exempt from public records law (Wash. Ct. App.), 1612
    ECPA
    EDUCATION
    EGYPT
      – Operation Phish Phry, FBI, DOJ, and Egyptian authorities break up large operation (C.D. Cal.), 1472
    ELDERLY PERSONS
      – E-ZPass agency collection of SSNs breaches Privacy Act (D.N.J.), 1023
      – Identity theft, nursing home residents' stolen tax data used fraud scheme, four more sentenced (W.D. Mo.), In Brief, 174
      – Medical identity theft, HHS releases new tools for seniors, 1493
      – Spain, DPA releases privacy primer, In Brief, 884
    ELECTRICITY GRID
    ELECTRONIC COMMERCE
      – Ed. Note: This heading covers electronic sales of goods and services and their regulation. Electronic mail is covered under E-MAIL. All other references to the web or the internet are found at INTERNET.
      – Accessibility, Target settles web access claims of blind consumer class (N.D. Cal.), In Brief, 447
      – Apparel marketer agrees to FTC fine to settle data collection on children and privacy notice claims (S.D.N.Y.), 1521
      – Behavioral targeting
      – Boilerplate contract clauses, Analysis and Perspective, 1629
      – Cal. credit card sales data collection ban inapplicable online (C.D. Cal.), 302
      – Consumer privacy protections, Boucher (D-Va) plans to move forward with draft measure, 616; Boucher tells conference that privacy bill priority for him, 702; Boucher's bill may sharpen opt-in, opt-out web consent debate, 827; House hearing, Google and other leading firms questioned, Boucher seeks baseline protections, 921
      – Consumer rights guide, EC launches, In Brief, 717
      – E-mail authentication, group says many government and e-commerce sites fail to use, 589
      – eBay Canada must reveal PowerSellers data to revenue agency, 1470
      – FBI internet crime report for 2008, fraud and other activity complaints rose 33 percent, 529
      – Geeks.com, online computer retailer agrees to settle data breach allegations (FTC), 235
      – Identity management systems, Ontario unveils online tool, In Brief, 251
      – Location based services, EU data protection rules, Analysis and Perspective, 885
      – Offshore accounts merchants, IRS to summon payment card processor to identify (D. Colo.), 586
      – Personal data printed on credit and debit card receipts
      – Privacy policies
      – South Korea indicts two hackers for exploiting e-commerce sites and reusing passwords, 597
    ELECTRONIC COMMUNICATIONS PRIVACY ACT (ECPA)
      – AOL, class argues embedded e-mail ads violate (C.D. Cal.), In Brief, 806
      – Cloud computing, ECPA update needed, status of data unclear, 827
      – Keystroke logging too by employer (N.D. Cal.), In Brief, 805
      – Private detective, file sharing evidence allowed from firm without PI license (D. Minn.), 930
    ELECTRONIC RESOURCES
      – Ed. Note: For a list of selected articles, BNA products, and internet sources, see back page of each issue.
    ELECTRONIC SIGNATURES
      – Arbitration agreement, employer's lax data security leads to rejection of validity of worker's e-signature (D. Kan.), 469
      – E-health barriers include state law differences and liability fears, 1232
    ELECTRONIC SURVEILLANCE
    EMOTIONAL DISTRESS
      – Equifax credit report errors, damages affirmed (4th Cir.), 499
      – Health data post on MySpace held as publication, Minn. privacy law not preempted by HIPAA (Minn. Ct. App.), 960
      – Health Express allegedly disclosed personal health information, contract and tort claims belong in state court (W.D. La.), 1309
      – Mental health records accessed by fellow workers, insufficient evidence and lack of expert testimony (Iowa), 777
      – MySpace, no privacy expectation in posted diatribe against hometown (Cal. Ct. App.), 560
      – Nude cell phone photo viewing by police prompts lawsuit (W.D. Va.), In Brief, 599; lacked objectively reasonable expectation of privacy, 1349
      – VA medical center hard drive lost, putative class cannot demonstrate actual damages, APA claims remanded (11th Cir.), 929
    EMPLOYMENT ISSUES
      – ABA. Conf. warns caution on workplace monitoring and privacy policies, 1177
      – Aliens, worker eligibility for employment
      – Anonymous web commenters, privacy interest in ISP-stored identifying data held to depend on terms of service (W.D.N.Y.), 397
      – Arbitration agreement, employer's lax data security leads to rejection of validity of worker's electronic signature (D. Kan.), 469
      – Background checks
      – CFAA claims
      – Chile, government transparency law takes effect, data must be posted online, 632
      – Communication tools, ABA panelists warn employers and lawyers to keep up, 542
      – Compliance trends, Ponemon survey, 892
      – Credit checks banned in hiring
        – – Cal. bill prohibits use for employment purposes, governor vetoes, 1498
        – – Federal legislation
          See LEGISLATION, FEDERAL, HR 3149
      – Data breaches
        – – Aetna notifies individuals of breach of job application site, 798; class action filed (E.D. Pa.), 872
        – – Daimler worker health data breached, DPA probes retention of diagnosis data, 597
        – – Gap stores job applicant data on stolen laptop, future identity theft risk claim insufficient (N.D. Cal.), Special Report, 569
        – – Kaiser Permanente notifying workers that PII may have been stolen, 278; breach traced to terminated employee of union, 403
        – – PayChoice discovers website security breach when phishing e-mails spotted, 1469
        – – Payroll
          – – – British Council says disk with staff data lost in transfer, 209; ICO orders British Council to encrypt portable devices, 629
          – – – RBS WorldPay, U.S. processing arm of Royal Bank of Scotland improperly accessed with actual fraud detected on cards, 9; consumer class amends complaint (N.D. Ga.), 274; RBS WorldPay to process credit card tax payments despite recent breach, 667; oral arguments set (J.P.M.L.), 775; panel consolidates claims, 873
          – – – U.K. National Health Service (NHS) Trusts, ICO brings actions against entities for security lapses, 169
        – – Starbucks laptop stolen, workers file class action (W.D. Wash.), 336
        – – Twitter, Mich. mayor accidentally posted personal employee data, 962
        – – United Kingdom
          – – – Newspaper online jobs site admits to hacking incident, 1571
          – – – Pensions Trust reveals stolen laptop contains sensitive worker data, 802
          – – – UPS, stolen laptop contains sensitive worker data, 1206
      – Downsizing, data loss risks, Survey Report, 363
      – Drug disclosure policy, EEOC sues sheet metal manufacturer for ADA violation (D. Minn.), 1273
      – Drug testing
      – E-discovery, conference speaker talks about risks and benefits, 440
      – E-mail
      – Executive bonus data subpoenaed, no shield from publication (N.Y. Sup. Ct.), In Brief, 568
      – Extortion threat to computers, laid off worker pleads guilty (D.N.J.), In Brief, 677
      – Family Medical Leave Act
        – – Computer misconduct, no FMLA violation to fire executive on leave who refused to give up keys and passwords (7th Cir.), 1235
        – – Medical certification rule
          – – – HIPAA privacy rule still covers, attorneys warn, 78
          – – – Privacy rights
            See LEGISLATION, FEDERAL, HR 2161
      – Flu pandemic
        – – France CNIL approves privacy exemption, worker data may be used in continuity plans, 1323
        – – Response, Practice Aid, 1323
      – FOIA, many states amended laws in 2008 to protect worker information, 277
      – Genetic data, use by employers
      – Germany
        – – Health information, DPA fines retail chain for tracking, 1284
        – – Legislation and pending rules, Analysis and Perspective, 1003; new law takes effect, Analysis and Perspective, 1443; consequences for service and outsourcing contracts, Practice Aid, 1625
        – – Rail company screened personal data of workers, probe started, 245; Germany plans worker data protection bill, DPA supports, 304; Berlin DPA sets landmark fine, 1572
      – Goldman Sachs suffers proprietary computer code theft, FBI charges employee (S.D.N.Y.), 1025
      – HIPAA amendments, Practice Aid, 358
      – Hostile work environment probe, municipal court judge cannot prevent release of report (Wash.), 1383
      – Identity theft
        – – FAQ guide released by FTC and banking regulators, 865
        – – N.Y. omnibus law includes SSN use and personal data sharing restrictions, 8
        – – Red flag rules, some benefit plans may be “creditors,” 402
      – Improper disposal of worker information, CVS settles FTC and HHS cases (FTC), 295; pharmacist group asks FTC to continue probe citing concern about pharmacy benefits manager data, 464; CVS settles with Ind. AG (Ind. Pharm. Bd.), 1058
      – Keystroke logging, employer's use may violate Wiretap Act (N.D. Cal.), In Brief, 805
      – Lie detector tests
        – – Arbitration, worker may pursue EPPA claims despite agreement (E.D. Va.), 238; wrongful discharge suit may go to trial, In Brief, 884
        – – Failed bank robbery led to firing of manager not disclosure of polygraph, no evidence of damages (D.S.C.), 625
      – Mental health records accessed by fellow workers, insufficient evidence to support emotional distress damages (Iowa), 777
      – Metadata associated with official police department notes in discrimination suit not “public records” in state (Ariz. Ct. App.), 275; electronic public record includes metadata and must be produced (Ariz.), 1612
      – National Park Service, record destruction inference saves Privacy Act case (D.C. Cir.), In Brief, 939
      – NLRB, Obama names Liebman chair, In Brief, 211
      – Ob/gyn records, discrimination suit judge must approve relevance (Ohio Ct. App.), In Brief, 287
      – Payroll debits cards, cybercriminals targeting with more sophisticated methods, RSA Conf., 641
      – Physician disclosure to employer led to dismissal, breach of provider confidentiality not same to privacy tort (Pa.), 399
      – Pornography viewed on work computers
        – – Age bias, employee responsible for any misuse of computer password (5th Cir.), In Brief, 1393
        – – Sex bias, hospital worker loses suit (7th Cir.), 1057
      – Pretexting claim in confidential business information dispute, jury award to former saleswoman (Ill. Cir. Ct.), 1528
      – Recession, data security risks, Practice Aid, 998
      – Refinery worker who refused photo ID on religious grounds fails in bias suit (E.D. Pa.), 1277
      – School superintendent's contract must be disclosed (Ill.), In Brief, 884
      – Smoking workplace policies
        – – Legal challenges, Analysis and Perspective, 1540
        – – Off-duty conduct, smoker fired, no violation of privacy law (D. Mass.), 1201
      – Social networking websites
        – – Advice to employers on what to include in policies, 942
        – – Benefits and risks in employee use, IAPP Privacy Academy, 1398
        – – Facebook, survey says not all executives comfortable with, In Brief, 1312
        – – MySpace, verdict against restaurant for manager's access of private chat group (D.N.J.), 1474
        – – Tacit knowledge of workforce, sites gives employers new tool to collect, 1607
        – – Twitter raises concerns, Special Report, 941
      – Surveillance
        – – ABA Technology in the Practice and Workplace Comm. meeting, 712
        – – Madrid Conf. approves workplace privacy standards, 1621
        – – Monitoring policies, IAPP Privacy Summit speaker says companies must update to keep pace with technology, 480
        – – Portugal workplace privacy code restricts including e-mail monitoring, 308
        – – Text messages private due to informal policy of never auditing messages, rehearing denied (9th Cir.), 200
        – – Town officials have no qualified immunity for recording all calls from office for six years (7th Cir.), 1095
        – – Videotaping
        – – Web posts monitoring, Analysis and Perspective, 1039; correction, 1068; electronic monitoring increasing, lawyers urge caution, Special Report, 1295; survey says only 25 percent of firms formally monitor use of online social media, 1376
      – Sweden, workplace privacy bill draws data authority praise and industry objections, 1310
      – Telecommuting, NIST updates data security guidance, In Brief, 342; NIST releases final version, In Brief, 940
      – Tenn., false identification penalty law signed, In Brief, 785
      – Time records of IRS agent, whether target of investigation may inspect (U.S., rev den), In Brief, 938
      – Title VII participation clause, employee giving patient file to EEOC legitimate reason for firing (U.S., rev den), 396; In Brief, 406; data copying not misappropriation of property (Okla.), 1386
      – Trade secrets
      – United Kingdom
        – – Construction worker database, ICO takes enforcement action against firm maintaining, 445; head of firm that unlawfully traded worker data to face criminal proceedings (U.K. Magis. Ct.), 801; database owner fined, enforcement action eyed against firms for use (U.K. Crown Ct.), 1064; ICO takes action against 14 firms for using, 1172
        – – Criminal data, job applicants may contest past conduct information, In Brief, 1619
        – – Data controller registrations, worker recruitment company failed to register (U.K. Magis. Ct.), 802
        – – Working from home, Mid Staffordshire NHS Found. Trust ordered to implement security policy, 1533
      – Va. Computer Crimes Act, no malicious prosecution for computer spying on coworkers (W.D Va.), In Brief, 1313
      – Warrant to search business premises for documents, corporate executives may lack standing to challenge (9th Cir.), 239; ruling amended, In Brief, 842
      – Web 2.0 technologies, RSA. Conf. panelists suggest setting standards for employees' online activities, 647
      – Wellness programs, GINA implementation
      – Whistleblowers
        – – San Quentin Univ. of Cal. research program, fired employee claims retaliation for reporting prisoner privacy violations (Cal. Super. Ct.), 1473
        – – UPS, data security issues voiced, ex-worker has triable retaliation claim (D.N.J.), 708
    ENCRYPTION
      – BSA reports, GAO says that agencies that receive could better guard financial data, 231
      – Cloud computing contract terms, companies should review and not move all sensitive data, RSA Conf., 646
      – Data breaches
        – – Alberta Health Services denounced for failure to encrypt stolen laptops, 964
        – – Blue Cross Blue Shield Ass'n says stolen laptop held unencrypted information on doctors, 1469
        – – Hiscox report says many firms fail to tell SEC of risk to finances and reputation, 619
        – – HSBC, U.K. regulator hits bank with record fine, 1099
        – – Notification, Data Accountability and Trust Act
          See LEGISLATION, FEDERAL, HR 2221
        – – Okla. Human Services Dep't laptop with client data stolen from employee's car, 670
      – E-File data security, IRS official says guidance won't result in rule, 867
      – Health information
        – – Breach notice risk trigger, comments received on interim rule, model notice documents sought, 1556
        – – Safeguards, HHS issues guidance on securing patient information, 584; HHS receives comments, including possible impact on medical devices, 767
      – Human factor, Ponemon laptop survey
        – – Canada, 132
        – – U.K., 114
        – – U.S., 96
      – IRS laptop data security, TIGTA reports improvements, 1347
      – Location data privacy, EFF urges services to protect, In Brief, 1208
      – Lost laptop cost survey, 685
      – Mass. data security rules, regulators urged to extend compliance deadline, 165; Mass. delays rules, drops vendor written certification mandate, 276; panelists concerned about impact, 588; future of rules uncertain, 1049; Mass. amends rules and extends deadline, 1225; public hearing held, 1386; officials discuss at IAPP Privacy Academy and give compliance advice, 1399; Mass. files final amendments, 1565
      – Mich. bill grants data breach liability immunity to firms with specified safeguards, 1168
      – Nev., amended personal information e-data transfer law includes mobile storage devices, 821
      – N.Y., new data breach notification bill includes encryption, data security provisions, and AG notice, 636
      – Payment Card Industry Data Security Standard (PCI DSS)
        – – Heartland Payment Sys. CEO pushes for total encryption to supplement, 204
        – – House Homeland Security panel questions effectiveness against cybercrime, 525; PCI DSS overview, 527
        – – Merchant group urges council to adopt risk-based approach and ease burdens, 928
      – Prescription drugs records. France CNIL approves limited use, In Brief, 173
      – Real ID Act, Napolitano says DHS rethinking, 528
      – Self-incrimination, production of unencrypted version of laptop's hard drive does not qualify (D. Vt.), 398
      – U.K. ICO orders for portable and mobile devices
        – – Billing Pharmacy, 1352
        – – British Council, 629
        – – Car repair trade group, 1287
        – – Highland Council, In Brief, 1103
        – – Home Office, 168
        – – Legal expenses insurance firm and contractors ordered to encrypt mobile devices after laptop theft, 878
        – – Leicester City Council nursery, In Brief, 785
        – – London Borough of Sutton government, 1288
        – – London Clubs Intl., 1151
        – – Manchester City Council, In Brief, 965
        – – National Health Service (NHS)
        – – Neath Port Talbot County Borough Council, In Brief, 1103
        – – UPS, 1206
        – – Wigan Council, 1288
      – Wash. data breach notification amendments include requirements, 215
      – Working from home, Mid Staffordshire NHS Found. Trust ordered to implement security policy, 1533
      – Workplace compliance trends, Ponemon survey report, 892
    ENGLAND
    EUROPEAN UNION (EU)
      See also individual member nations
      – Article 29 Working Party
        – – Annual report for 2007 gives overview of enforcement and documents issued, 166
        – – Binding corporate rules (BCRs)
          See Data protection, this heading
        – – Brussels meeting agenda set, In Brief, 1480
        – – Children, data rights second to child's best interest, In Brief, 343
        – – Data retention
          – – – Search engine standards, plenary session statement welcomes calls for, 278
          – – – Telecommunications providers and ISPs, probe of practices, 470
        – – E-Privacy Directive opinion calls for broad breach notice, 306
        – – Plenary session, BCRs, anti-doping agency standard, and SWIFT discussed at Spring meeting, 594
        – – Social networking websites opinion, users may need to comply with privacy mandates, 932
        – – Standard contractual clauses, opinion released on proposed update, especially with regards to sub-sub processors, 457
      – Asylum-seeker data rights, EDPS releases opinion, In Brief, 313
      – Behavioral targeting
        – – EC Kuneva warns online firms to improve or risk regulations, to research existing practices, 535
        – – Phorm online advertising technology trials, EC wants protection details, threatens formal action against U.K., 310; EC launches legal action against U.K. for failure to regulate online behavioral ads, 593; EC legal action, Analysis and Perspective, 757; U.K. Prime Minister dismisses petition to review use by ISPs, 781; plans delayed as two ISPs back off, 1066; EC continues proceedings against U.K. over interception laws, 1569
      – Data protection
        – – Australian Dodo case as example of accountability model, Analysis and Perspective, 180
        – – Binding corporate rules (BCRs)
          – – – Article 29 Working Party updates FAQs, 167; third party beneficiary rights listed, 241; discussed at 70th plenary session, 594; latest guidance covers EU privacy law compliance and burden of proof, 672
          – – – Blueprint for global privacy compliance, Practice Aid, 27
          – – – eBay, U.K. ICO set to approve, 1616
          – – – Hyatt Hotels, U.K. ICO approves BCR, first under new mutual recognition policy, 1374
          – – – U.K. approves BCRs for two U.S. firms signaling start of speedier process, 699
        – – Compliance by institutions and agencies improving, Hustinx reports, In Brief, 966
        – – Cookies, online ad firms object to amendments to require user consent, 536
        – – Costa Rican Assembly to move on measure, 989
        – – Country Reports 09, ENISA releases report, 311
        – – Data breach notification, European Parliament instructs EC to consider broad requirements, 742; Council of the EU adopts legislative changes, still discussing internet cutoff provision, 1568; seminar highlights need for incentives, sharing, and planning, 1570
        – – Data retention
          – – – Directive challenge dismissed (E.C.J.), 284
          – – – Dutch search engine Ixquick reduces time to zero, 247
          – – – Social networking websites, U.K. proposes inclusion, 471
        – – DHS Napolitano to meet with Europeans, In Brief, 634
        – – E-discovery, Practice Aid, 409
        – – E-Privacy Directive, Hustinx issues opinion, 86; Council of the EU adopts legislative changes, still discussing internet cutoff provision, 1568
        – – EC Data Protection Conference 2009, officials eyeing new strategy to improve coherence, 781
        – – Electronic identification (eID) cards, ENISA urges careful look at privacy features, 248
        – – Expert privacy group, EC decided to disband, 306; French complaints about number of Americans on panel, 562
        – – Framework, EC seeks comments on new challenges, In Brief, 1034; Hustinx seeks comprehensive framework, sets priorities for next five years, 1063
        – – Global framework, Viewpoint, 62; European officials to continue work, 779; Spanish DPA sees progress at Bilbao meeting, 934; Madrid Resolution establishes non-binding minimum global privacy standards, 1620; conference speakers and sessions focused on global standards, 1623; keynote speakers focused on EU-U.S. information sharing, 1624
        – – Hotel register data collection, DHS reports on whether practice is in compliance, In Brief, 173
        – – Hustinx named to second term, releases 2009 agenda, 17; Hustinx updates inventory of priorities, In Brief, 1577
        – – Intelligent transport systems, top officials urge better privacy safeguards, 1101
        – – Lisbon Treaty, Hustinx says it will strengthen but new law for enforcement needed, 876; Irish approval may boost data protection, Poland and Czech Republic still need to ratify, 1477; to accommodate concerns, EU may move up effective date, 1616
        – – Location based services, In Brief, 885
        – – New Zealand, privacy chief urges quick enactment of amendment to secure EU adequacy approval, 1026
        – – Online profiling, Council of Europe seeks comments on draft guidelines, 1475
        – – Prior checking notice registry published, In Brief, 718
        – – Rand review of directive proposes updates, cites weakness in area of global data transfers, 741; Analysis and Perspective, 853
        – – Reform overdue, EU telecommunications official warns of threats in video message, 596
        – – RFID, consumer opt-in emphasized in new privacy guidelines, privacy impact assessments urged, 743
        – – Safe harbor standards, Practice Aid, 1211; FTC enforcement, Practice Aid, 1328
        – – South Africa, bill includes breach notice and marketing limits, Special Report, 1317; omnibus bill draws business criticism and requests for more time, 1567
        – – Spam, European Comm'n urges more dedicated resources and cooperation, 1476
        – – Study and initiative increase, CNIL says shows momentum to revise Directive, 562
        – – Terms glossary published, In Brief, 210
        – – Transfers to third countries, FAQ released, 471
        – – U.K. ICO discusses improvements and previews Rand Europe report, 675; Rand report released, 741; Analysis and Perspective, 853
        – – Universal Service and Framework Directive, Hustinx praises intellectual property amendments but asks lawmakers for more, 305; Council of the EU adopts legislative changes, still discussing internet cutoff provision, 1568
        – – Uruguay
          – – – Data breach notification rules adopted, DPA recognizes EU adequacy decisions, 1479
          – – – Data protection authority set up, EC certification process under way, 783; Uruguay finalizes rules, 1391
        – – Video surveillance, EU releases draft guide, asks for comments, 1030
      – Data sharing, conference speakers predict Obama to boost plans, 193
      – Digital consumer rights guide, EC launches, In Brief, 717
      – Electronic communications rules overhaul on hold due to dispute over illegal downloading crackdown, 562; file sharer web cutoff disagreement continues to stall overhaul, In Brief, 634; reform moving after Parliament drops court order for net cutoff demand, 673; European Parliament rejects compromise stalling approval of new rules, 714; European Parliament instructs EC to consider broad data breach notice law, 742; EU member states reject demands to require court order to cut off internet, 875; Council of the EU adopts legislative changes, still discussing internet cutoff provision, 1568; EU Parliament backs off court order demands for internet cut off law, 1569; EU agrees on new internet user rights with protection from arbitrary service cut off, 1615
      – European Central Bank, EU Council agrees to modify data collection provisions, 1242
      – European Commission president, Barroso chosen for second term, In Brief, 1356
      – Internet action plan covers wireless communication between objects, In Brief, 939
      – Law enforcement data sharing, Swiss government proposes following Schengen rules, 1353
      – Lisbon Treaty, Ireland approved, Poland and Czech Republic still need to ratify, 1477; to accommodate concerns, EU may move up effective date, 1616
      – Online freedom of speech, EU official calls for protections through trade agreements not legislation, 285
      – Passenger name record (PNR) data, EU pact with U.S., EU Parliament member's FOIA complaint seeking travel records dismissed (D.D.C.), 14
      – Social networking service companies sign self-regulatory pact, 279
      – Taxation, Swiss bank client names, EC wants same assistance that UBS gives IRS, 1285; Swiss judge orders UBS to notify clients before turning over account details, 1391
      – Telecommunications reform package, Hustinx opinion discusses data breach notification, 86
      – Terrorism financing, SWIFT network to monitor
        – – Temporary pact negotiations, EC seeks until Lisbon Treaty enters into force, 1062; EU to incorporate data protection recommendations into pact, 1283; European Parliament adopts resolution setting guidelines for new agreement, 1351
        – – U.S. Treasury respected privacy safeguards, EC-appointed judge concludes, 340
      – Visa Waiver Program country travelers, U.S. electronic travel authorization not visa requirements, 85
      – Voice over Internet Protocol (VoIP) wiretaps, EU organized crime body to examine legal and technical issues, 341; Eurojust corrects statement on Skype cooperation, In Brief, 407
    EVIDENCE
      – Abortion provided to minor, attempt to discover nonparty medical records rejected (Ohio), 1024
      – Anonymous internet postings
        – – Defamation
          – – – Canada, statements on bulletin board, disclosure ordered (Ontario Super. Ct.), 538
          – – – D.C., five-step test for unmasking speakers adopted (D.C.), 1235
          – – – First Amendment balancing needed to unmask speakers (Md.), 399
          – – – Jurisdiction, evidence needed for identification (D.D.C.), 301
          – – – “Skanks of NYC” blog, Google ordered to provide account data (N.Y. Sup. Ct.), 1234
        – – Retaliation, privacy interest in ISP-stored identifying data held to depend on terms of service (W.D.N.Y.), 397
      – Canada, health data use in foreign litigation, only domestic courts may approve, 251
      – CFAA
        – – Delay in returning laptops and deletions meet requirements but dismissed due to no evidence of unauthorized access (E.D. Mo.), 236
        – – Erasure program use supports issuance of ex parte TRO (D. Colo.), 1205
      – Child pornography
        – – Delay in getting computer search warrant unreasonable and requires suppression of evidence (11th Cir.), 669
        – – Paramedic, no evidence ban from co-worker's laptop search (8th Cir.), In Brief, 473
        – – Virus search consent does not extend to images (Ill. App. Ct.), In Brief, 747
      – Cloud computing, World Privacy Forum issues report, 337
      – Computers, breached order to not touch brings sanction (E.D. Va.), In Brief, 1293
      – Conn. FOI law trumps hospital peer review privilege for records (Conn.), In Brief, 1243
      – Drug test failure not linked to protected disability, no triable ADA claim (W.D. Ky.), 777
      – E-discovery
        – – ABA. Conf. panel advocates reasonability and upfront communication, 1180
        – – Article 29 Working Party opinion, Special Report, 315
        – – Attorney obligations discussed at symposium, 1494
        – – Commerce Undersecretary O'Neill, BNA interview, 94
        – – Digital forensics, Analysis and Perspective, 361
        – – Employers, conference speaker talks about risks and benefits, 440
        – – EU data protection, Practice Aid, 409
        – – France, guidelines issued on pretrial discovery, 1240
        – – Metadata preservation, Practice Aid, 1247
        – – “Native” format, party ordered to reproduce documents in searchable format with associated metadata (D. Nev.), 1171
        – – Usenet.com must preserve relevant data upon request in music file sharing case, sanctions ordered (S.D.N.Y.), 236
      – E-mail
        – – Breach of contract claim, firm seeking unsorted account search must pay costs (N.Y. Sup. Ct.), In Brief, 842
        – – Deleted e-mails, access to opposing party's servers to recover approved (S.D. Cal.), 41
        – – Divorce, admissible when husband gave wife password (N.Y. Sup. Ct.), 778
        – – Printouts instead of digital copies, no sanctions in spam case (S.D. Ohio), 1204
        – – Rocky Mountain Bank, probe of customer data improperly attached to e-mail, unable to seal complaint (N.D. Cal.), 1378; dismissal approved, 1433
        – – Spoliation, routine backup tape deletion, no bad faith (M.D. Fla.), In Brief, 1176
        – – Threats must be sent across state lines (4th Cir.), In Brief, 940
      – Facebook, discovery of plaintiff's postings allowed despite privacy settings (Ontario Super. Ct.), 406
      – Failed bank robbery led to firing of manager not disclosure of polygraph, no evidence of damages (D.S.C.), 625
      – File sharing, music downloading
        – – Continuous downloading and distribution allegations avoid “making available” inquiry (N.D.N.Y.), 398
        – – P2P shared folder, no unauthorized access when files accessible to general public (E.D. Pa.), In Brief, 407
        – – Personal knowledge justifies naming CEO in suit (S.D.N.Y.), In Brief, 1577
        – – Va. Polytechnic Inst. & State Univ., no sovereign immunity on subpoena for defendants' identities when not party in suit (W.D. Va.), 43
      – Funds transfer privacy law covers ordinary customer bank accounts (N.J.), 559
      – Go Daddy site, registrar's preservation of site content for police no basis for civil rights claims (N.D. Cal.), 400
      – Google Street View, homeowners' privacy not invaded by inclusion (W.D. Pa.), 303; failure to seek trespass nominal damages no basis to reopen case, 591
      – Junk faxes, Al Copeland Inv. class action, “manifestly erroneous” certification reversed (La. Ct. App.), 1380
      – Mental health records
        – – Divorce proceedings, claims reinstated that records improperly disclosed (Ill. App. Ct.), 1561
        – – Fellow workers accessed, insufficient evidence to support emotional distress damages (Iowa), 777
      – Ob/gyn records, discrimination suit judge must approve relevance (Ohio Ct. App.), In Brief, 287
      – Prescription records, police need warrant and not just subpoena (La.), 735
      – Private detective, file sharing evidence allowed from firm without PI license (D. Minn.), 930
      – Privileged communications
      – RemoteSpy software, FTC suit may proceed (M.D. Fla.), In Brief, 407; FTC properly invoked attorney-client privilege during deposition on agency's knowledge, In Brief , 1292
      – Secret recording of supervisor's comments for gender bias suit no violation of Wiretap Act (D.N.M.), 1057
      – Social networking sites provide ready source of information and possible problems, 1566
      – Software unauthorized use, sanction granted for post-notice deletion (W.D. Ky.), In Brief, 1152
      – Spam
        – – Project Honey Pot seeks assistance of banks and clearinghouse vendors to identify hackers (E.D. Va.), 1236
        – – Tampering claims inadequate (S.D. Ohio), 560
      – Stored Communications Act
        – – E-mail, former marketing executive claims boss accessed personal account, actual damages proof required for statutory award (4th Cir.), 467; actual damages, Analysis and Perspective, 571
        – – Location data from mobile phone provider, privacy groups file brief supporting ruling that U.S. needs warrant (3d Cir.), 499
        – – MySpace, verdict against restaurant for manager's access of employee's private chat group (D.N.J.), 1474
      – Swiss bank client names, U.S. petitions court to enforce summons, tax fraud alleged (S.D. Fla.), 301; TRO issued (Bundesverwaltungsgericht), 341; UBS official tells Senate panel of objections to IRS summons, 394; Switzerland says IRS summons violates tax treaty and threatens agreement (S.D. Fla., brief filed), 716; DOJ affirms it is not dropping summons, 954; DOJ files memorandum, In Brief, 993; DOJ files memorandum, summons is only means to gain UBS account data, In Brief, 1034; trial postponed, In Brief, 1069; U.S. and UBS announce settlement, 1205; settlement terms announced, 1241; IRS requests account details, EC wants similar assistance, 1285; Conn. AG seeks UBS names, 1285; Swiss judge orders UBS to notify clients before turning over account details, 1391
      – Tax preparer tossed client files in dumpster, some discovery limited, requests overbroad (E.D. La.), 1382
      – Trade secrets, attorney sanctioned for exposing protected papers (Cal. Ct. App.), In Brief, 23
      – Whois databases, domain ownership not proved by listing
        – – Control of website evidence (D.N.H.), In Brief, 1243
        – – Corporate veil, not enough to pierce (D.S.D.), 711
      – Wiretapping sealing requirement does not apply to data on origination, duration, and time (9th Cir.), 1237
    EXECUTIVE ORDERS
      – DHS E-Verify system, government contractor mandate
      – Freedom of Information Act, presumption in favor of disclosure, Obama calls for new guidelines, 159; DOJ rescinds Bush FOIA policy against disclosure, 459
      – Presidential records
        – – Access restored
          See LEGISLATION, FEDERAL, HR 35
        – – Executive privilege claims, 159
      – Security clearances, Bush E.O. requires reciprocal recognition, 232
      – Transparency, CTO directed to issue an “Open Government Directive,” 159
    EXTORTION
      – Express Scripts notifies all state attorneys generals of plot, 1435
      – German social networking site faces blackmail after theft of user data on millions of children, 1533
      – Va. dangerous drug prescription reporting system data allegedly held for ransom, 751; Va. sending breach notices over exposure of SSNs, 836

Contact the Webmaster at webmaster@bna.com
1801 S. Bell Street, Arlington, VA 22202 - Phone: 1-800-372-1033

Copyright © The Bureau of National Affairs, Inc. All Rights Reserved.