Privacy & Security Law Report: Index-Summary

P2P NETWORKS

PASSPORTS

PATRIOT ACT

– Cloud computing, World Privacy Forum issues report, 337
– National security letters (NSLs), FBI data collection

– – Gag order feature in ISP letters violates First Amendment (2d Cir.), 13; Judge Sotomayor named by Obama for Supreme Court, 808
– – National Security Letters Reform Act

See LEGISLATION, FEDERAL, HR 1800

– – Practice Aid, 511
– – Terror suspect's e-mail, NSL nondisclosure continues after in camera review (S.D.N.Y.), In Brief, 1578
– – 2008, Justice Dep't issues report to Congress on use, 797

– Reauthorization

– – Administration urges renewal, Senate and House Judiciary panels set hearings, 1345
– – USA Patriot Act Sunset Extension Act

See LEGISLATION, FEDERAL, S 1692

– Reforms

– – Foreign Intelligence Surveillance Act (FISA) Amendments Act

See LEGISLATION, FEDERAL, S 1725

– – House Judiciary panel chair Nadler (D-NY) urges broad look at law, 1396
– – Judicious Use of Surveillance Tools in Counterterrorism Efforts (JUSTICE Act)

See LEGISLATION, FEDERAL, S 1686

– – Outlook, 59

PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS)

See CREDIT CARDS

PEER-TO-PEER (P2P) NETWORKS

See FILE SHARING

PENNSYLVANIA

– Cell numbers on billing documents must be redacted before disclosure (Pa.), In Brief, 21
– Custody court may order mental health evaluation but not require disclosure of existing records (Pa. Super. Ct.), In Brief, 474
– Data breach notification bill seeks one week deadline, 257; bill sets state agency requirements, 507; Pa. Senate approves, 534
– E-ZPass agency collection of SSNs from seniors breaches Privacy Act (D.N.J.), 1023
– License plate surveillance of Cintas employees, union liable (U.S., rev den), 497; In Brief, 505; union not liable for punitive damages (E.D. Pa.), 1203
– Metadata embedded in electronic documents, lawyers may use, primary burden on sender (Pa. Bar Ass'n Comm.), 737
– Wiretapping, texting with arrestee's cell phone required warrant (Pa. Super. Ct.), In Brief, 939

PERSONALLY IDENTIFIABLE INFORMATION (PII)

– Behavioral advertising, FTC continues support for self-regulation but calls for stronger initiative, 267
– Cal. credit card sales data collection ban inapplicable online (C.D. Cal.), 302
– COPPA, FTC expedites rules review due to mobile marketing trends, 615
– Credit-based insurance score study, FTC approves data protection plan, In Brief, 677
– Data breaches

See DATA BREACHES

– Data broker concerns, Akaka (D-Haw) to study as part of Privacy Act review, IAPP Privacy Summit, 478
– Data retention

See DATA RETENTION

– Electronic commerce, boilerplate contract clauses, Analysis and Perspective, 1629
– File sharing, House Oversight and Gov't Reform Comm. launches new probe on efforts to reduce privacy risks, 617; lawmakers say industry has lost chance to self-regulate, 1140
– Identity theft, bank tellers allegedly stole account data for counterfeit check scheme (N.Y. Sup. Ct.), 801
– IP addresses not personal data, collection ban agreement not breached (W.D. Wash.), 1022
– NIST issues guidance, In Brief, 92
– Protections as 9/11 Commission recommendation, progress report on implementation, In Brief, 1104
– Recession, data security risks, Practice Aid, 998
– Taxation, N.Y. tax department discloses breach, former worker charges with identity theft (N.Y. City Ct.), 628
– Wis. annual public records report released, In Brief, 92
– Zip codes do not fall under Cal. law barring retailer collection of personal data (Cal. Ct. App.), 13

PHARMACEUTICALS

See generally PRESCRIPTION DRUGS

PHILIPPINES

– National data protection law, congressional working group to meet on revised version, 435; bill progresses, changes include breach notice and penalties, 1239

PHISHING

– Canadian spam ban bill creates private right to sue and include penalties, ISPs support, 671; bill includes clause to end marketer no-call list but not immediately, 713; Analysis and Perspective, 810
– Colombian cybercrime law signed, 43
– E-File conspiracy, man arrested (S.D. Cal.), In Brief, 717
– Facebook spammers hit with TRO, including “King of Spam” (N.D. Cal.), In Brief, 447
– FTC, strategic plan adopted that includes consumer and global privacy issues, 1466
– Google modifies data collection policy, In Brief, 252
– Investors, FINRA warns that targets of scam, In Brief, 1481
– IRS warns against new ID theft scams, In Brief, 1176
– Italian government creates task force to curb, 283
– Monster.com says passwords and IDs compromised but not SSNs, 205
– Natl. Credit Union Admin. issues fraud alert about bogus CD loaded with malware, 1264
– Operation Phish Phry, FBI, DOJ, and Egyptian authorities break up large operation (C.D. Cal.), 1472
– PayChoice discovers website security breach when phishing e-mails spotted, 1469
– Rogue ISP, FTC gains court shutdown of malware host (N.D. Cal.), 865
– Securities broker, industry self-regulator levies fine for lax data protection, 706

PHONE RECORDS

– Foreign intelligence, warrantless NSA surveillance

– – Islamic nonprofit's claim to proceed, motion set for summary judgment (N.D. Cal.), 828
– – Telecommunications records litigation, class action claims dismissed, FISA amendments constitutional (N.D. Cal.), 828

– FTC Act unfair practices claims, no CDA immunity for records sold (10th Cir.), 1020
– Wiretapping

See WIRETAPPING

PIAs

See PRIVACY IMPACT ASSESSMENTS (PIAs)

PII

See PERSONALLY IDENTIFIABLE INFORMATION (PII)

POLAND

– Lisbon Treaty, Ireland approved, Poland and Czech Republic still need to ratify, 1477

POLICE

– Cal., Pasadena police department entitled to qualified immunity, privacy invasion award nixed (Cal. Ct. App.), In Brief, 806
– Charity telemarketing scams, FTC and state agencies announce crackdown, 771
– Crime scene and investigative photographs, Fla. bills to restrict commercial use, 508
– Data retention

– – Argentine law giving secret service access to e-mails and calls unconstitutional (CSJN), 340
– – EU Directive challenge dismissed (E.C.J.), 284

– EU-U.S. information sharing lauded at international conference, 1624
– Finland, rule requiring bank PIN to file crime report online draws concern from DPA, 1099
– French investigation databases now comply with privacy law, 1534
– Fusion centers, DHS releases PIA, In Brief, 22
– Go Daddy site, registrar's preservation of site content for police no basis for civil rights claims (N.D. Cal.), 400
– GPS tracking of car for prolonged period of time, warrant required (N.Y.), 776
– Hotel register data collection, DHS reports on whether practice is in compliance with EU Data Protection Directive, In Brief, 173
– Japan, ISPs and carriers asked to retain communication logs for three months, 1537
– Jurors, Ontario investigating police checks, In Brief, 883
– Law enforcement data sharing, Swiss government proposes following EU Schengen rules, 1353
– Metadata associated with official notes not “public records” in state (Ariz. Ct. App.), 275; electronic public record includes metadata and must be produced (Ariz.), 1612
– Nude cell phone photo viewing prompts lawsuit (W.D. Va.), In Brief, 599; lacked objectively reasonable expectation of privacy, 1349
– Pawn shop customer data collection (Alberta Ct. of Queen's Beach), In Brief, 91
– Prescription records, police need warrant and not just subpoena (La.), 735
– Shooting investigation, blog post of Fla. prosecutor's work memo protected since copy came through records request (S.D. Fla.), 961
– Text messages private due to informal policy of never auditing messages, rehearing denied (9th Cir.), 200
– U.K. enforcement powers

See UNITED KINGDOM (UK)

– Union not liable for members' web comments when not acting as union agents (D. Nev.), In Brief, 678
– Video monitoring of employee locker room, class settlement approved (C.D. Cal.), 1271
– Wiretapping, texting with arrestee's cell phone required warrant (Pa. Super. Ct.), In Brief, 939

POLYGRAPH TESTING

– Arbitration, worker may pursue EPPA claims despite agreement (E.D. Va.), 238; wrongful discharge suit may go to trial, In Brief, 884
– Failed bank robbery led to firing of manager not disclosure of polygraph, no evidence of damages (D.S.C.), 625

PORNOGRAPHY

– Children

See CHILD PORNOGRAPHY

– Google and Yahoo held liable for model's photo on sites without her consent (Juzg. N.), 1151
– Probable cause, old porn site subscription enough to establish (6th Cir.), In Brief, 1506
– Rogue ISP, FTC gains court shutdown of malware host (N.D. Cal.), 865
– Scareware scheme, FTC reaches accord with defendants (D. Md.), 952; CEO's role in management of ads supports individual claims against him, 1381
– Utah child protection e-mail registry, adult entertainment group drops suit (D. Utah), 1473
– Work computer used

– – Age bias, employee responsible for any misuse of computer password (5th Cir.), In Brief, 1393
– – Hidden camera in office intruded on privacy but not invasion so tort liability (Cal.), 1170; Practice Aid, 1184
– – SCA claim inappropriate (E.D. Mich.), 1094
– – Sex bias, hospital worker loses suit (7th Cir.), 1057
– – Unauthorized computer access, dominatrix solicitation (Ohio Ct. App.), In Brief, 718

PORTUGAL

– Consumer call centers, new law sets data collection, retention, and privacy rules, 838
– Credit prospectors, data authority issues data protection guidance, 444
– Cybercrime, new statute to implement EU framework law, 1354
– DNA databases, regulations issued, In Brief, 474
– Vehicle e-tracking mandates, In Brief, 785
– Workplace privacy code restricts surveillance and e-mail monitoring, 308

POSTAL MAIL

See MAIL AND DELIVERY SERVICES

PRACTICE AIDS

– Employment compliance, HIPAA amendments, 358
– EU data protection

– – Binding corporate rules, 27
– – E-discovery, 409
– – U.S. safe harbor, 1211; FTC enforcement, 1328

– Germany, data protection issues for service and outsourcing contracts, 1625
– Health IT managers, triple threat, 602
– Metadata preservation, 1247
– National security letters (NSLs), 511
– Pandemic response, 1323
– Recession, data safeguarding practices, 998
– Video surveillance, workplace monitoring, 1184

PREEMPTION

– CAN-SPAM Act

– – California

– – – Deceptive e-mail subject claims not preempted (N.D. Cal.), 800
– – – False advertising claims survive (N.D. Cal.), 709
– – – Vonage e-mails from multiple domain names, whether state claim preempted (Cal.), In Brief, 252

– – Ohio law does not fall within exception (S.D. Ohio), 560
– – Pottery Barn point of sale request, suit not preempted (Cal. Ct. App.), 1384
– – Wash. e-mail law, “professional” plaintiff lacked standing to pursue claims (9th Cir.), 1204

– Copyright Act

– – P2P, no unauthorized access to shared folder when files accessible to general public (E.D. Pa.), In Brief, 407
– – SalesTraq Am., claims of wrongful copying and misuse continue (D. Nev.), 931

– Critical Infrastructure Information Act, Santa Clara County electronic map must be disclosed (Cal. Ct. App.), 469
– Data breach notification, FTC and DOJ call for federal standard to fight ID theft, House hearing held, 923
– Data security

– – Data Accountability and Trust Act

See LEGISLATION, FEDERAL, HR 2221

– – Personal Data Privacy and Security Act

See LEGISLATION, FEDERAL, S 1490

– Fair Credit Reporting Act affiliate information sharing preemption, whether completely overrides Cal. financial information privacy law (U.S., brief sought), In Brief, 447; Office of Solicitor General says petition should be rejected (amicus brief filed), 870; (rev den), 981; In Brief, 991
– FISA Amendments, NSA telecommunications records litigation, class action claims dismissed (N.D. Cal.), 828
– Gramm-Leach-Bliley Act preempts Wash. law on disclosure of non-public personal data in loan files (Wash. Ct. App.), 41
– HIPAA, health data post on MySpace held as publication, Minn. privacy law not preempted (Minn. Ct. App.), 960
– Immigration Reform and Control Act

– – Ariz. E-Verify implementation upheld, rehearing denied (9th Cir.), In Brief, 448; U.S. Solicitor General invited to file brief on preemption (U.S., brief sought), 1608
– – Ill. law barring E-Verify use unconstitutional (C.D. Ill.), 468

PRESCRIPTION DRUGS

– ADA, applicant rejected due to failed drug test claims drug interaction cause false positive, lacks triable claim (W.D. Ky.), 777
– Baseball player steroid use, search of computer files limited to scope of warrant, detailed guidance offered (9th Cir.), 1269; attorneys and academics discuss implications, Special Report, 1357
– CVS-Caremark merger, unions urge FTC to review privacy risks, In Brief, 1313
– Data breaches

– – Billing Pharmacy, ICO enforcement action after computer theft, 1352
– – Express Scripts notifies all state attorneys generals of extortion plot, 1435

– Data mining of prescription information

– – Mass. says industry rules allowed for state opt-out law, In Brief, 1152
– – N.H. ban upheld (U.S., rev sought), 530; state regulation of de-identified health information, Analysis and Perspective, 544; (rev den), 982; In Brief, 991
– – State legislation slowed by N.H. challenge, Special Report, 680
– – Vt. ban upheld after commercial speech analysis (D. Vt.), 623; injunction denied pending appeal, 873

– Disclosure policy, EEOC sues sheet metal manufacturer for ADA violation (D. Minn.), 1273
– E-health

See E-HEALTH

– FDA postmarket risk analysis system, GAO needs details on Sentinel Initiative, In Brief, 841
– France CNIL approves limited use of patient records, In Brief, 173
– Improper disposal of personal information in dumpsters

– – CVS settles FTC and HHS cases (FTC), 295; pharmacist group asks FTC to continue probe citing concern about pharmacy benefits manager data, 464; CVS settles with Ind. AG (Ind. Pharm. Bd.), 1058; unions urge FTC to review CVS-Caremark privacy risks, In Brief, 1313
– – Lo Cost Rx, settlement approved (Ind. Pharm. Bd.), 875
– – Walgreens cases pending (Ind. Pharm. Bd.), 875; Walgreens settles with Ind. AG, 1058

– Marketing, state bills restrict data use, Analysis and Perspective, 256
– Sweden, guidance issued to address concerns from end of state-run monopoly, In Brief, 1069
– Va. dangerous drug prescription reporting system data allegedly held for ransom, 751; Va. sending breach notices over exposure of SSNs, 836
– Warrant needed and not just subpoena to access records (La.), 735

PRETEXTING

– Confidential business information dispute, jury award to former saleswoman (Ill. Cir. Ct.), 1528
– Customer proprietary network information (CPNI), FCC seeks $13M in fines saying firms did not certify compliance, 327
– Data Accountability and Trust Act

See LEGISLATION, FEDERAL, HR 2221

PRISONS AND JAILS

– Religious challenge to collection and storage of prisoner's DNA rejected (D.C. Cir.), In Brief, 50
– San Quentin Univ. of Cal. research program, fired employee claims retaliation for reporting prisoner privacy violations (Cal. Super. Ct.), 1473
– Sweden, workplace privacy bill draws data authority praise and industry objections, 1310
– U.K. prisoner data breach larger than first reported, In Brief, 1292

PRIVACY ACT

– Emerging technology trends, advisory board and CDT urge Congress to amend, 798
– National Guard unit not on active federal duty subject to Privacy Act (D.C. Cir.), In Brief, 174
– Partner Vetting System, USAID exempts, In Brief, 49
– Record systems covered, notice listing

– – Energy Dep't, In Brief, 93
– – NRC, In Brief, 92
– – PBGC IG office creates new system and seeks exemption, In Brief, 541; PBGC exempts IG data, In Brief, 883

PRIVACY IMPACT ASSESSMENTS (PIAs)

– Advertising, CDT releases threshold analysis tool to assess safeguards, 196
– Canada, airport security pilot projects, privacy office reviewing impact assessments, 1504
– Fingerprint data sharing agreement between Canada, U.K., and Australia concerns Canadian Privacy Comm'r, 1283
– Fusion centers, PIA released, In Brief, 22
– Guidance memo, DHS issues, In Brief, 48
– Homeland security, Privacy Office issues quarterly report to Congress on complaints and other actions, 774; quarterly report issued, In Brief, 1068; annual report released, 1375; groups tell Congress that Privacy Office not living up to mandate, 1558
– Identity management systems, Ontario unveils online tool, In Brief, 251
– RFID, consumer opt-in emphasized in new EU privacy guidelines, privacy impact assessments urged, 743
– Scotland, public sector non-binding privacy guidance, comments sought, 1285
– U.K. information office issues updated guidance, 877

PRIVILEGED COMMUNICATIONS

– Attorneys

– – Air Canada, right of individuals to access personal information in incident report (Fed. Ct.), 504
– – Client files left beside dumpster, results in public reprimand (Ohio), 592
– – Communication tools, ABA panelists warn employers and lawyers to keep up, 542
– – Computer use policy ambiguous, employer cannot copy worker's e-mail to lawyer sent from company laptop (N.J. Super. Ct.), 983
– – Domestic abuse charge, client secrets may include matters of public record (Iowa), In Brief, 1034
– – E-mail scams, attorneys who fall for may face discipline, In Brief, 678
– – Fiber Materials Inc. suit against former president, corporate counsel criticized for using sensitive memo found on company laptop (Me.), 1093
– – Internal investigations, counsel should heed ruling that nixed privilege once information voluntary shared with others (N.D. Tex.), 1022
– – Metadata embedded in electronic documents

– – – File name not metadata (N.D.N.Y.), In Brief, 1034
– – – N.H. lawyers may not mine e-documents from opposition (N.H. Bar Ass'n Ethics Comm.), 736
– – – Obligations discussed at symposium, 1494
– – – Pa. lawyers may use metadata, primary burden on sender (Pa. Bar Ass'n Comm.), 737
– – – Vt., searching documents not forbidden (Vt. Bar Ass'n Prof'l Responsibility Section), 1434
– – – W.Va., opinion sets out obligations (W. Va. State Bar Lawyer Disciplinary Bd.), 1025

– – Mo. attorneys may keep client files in electronic form (Mo. Sup. Ct. Advisory Comm.), In Brief, 884
– – Referral lawyer must protect information (D.C. Bar Legal Ethics Comm.), In Brief, 473
– – RemoteSpy software, FTC properly invoked attorney-client privilege during deposition on agency's knowledge (M.D. Fla.), In Brief, 1292
– – Sweden, cross-border communications surveillance law amendments to add court and privacy review, 804; Parliament approves, 1535

– Blog post of work memo protected since copy came through records request (S.D. Fla.), 961
– Cloud computing, World Privacy Forum issues report, 337
– Hospital peer review for records, Conn. FOI law trumps (Conn.), In Brief, 1243
– Medical records

– – Abortion provided to minor, attempt to discover nonparty records rejected (Ohio), 1024
– – AIDS patients, doctor must disclose records in misconduct suit (N.Y. App. Div.), In Brief, 1293
– – Physician disclosure to employer led to dismissal, breach of provider confidentiality not same to privacy tort (Pa.), 399

– Mental health records

– – Confrontation Clause, privilege extends to private therapist's records (Del.), In Brief, 718
– – Custody court may order evaluation but not require disclosure of existing records (Pa. Super. Ct.), In Brief, 474
– – Mother properly denied access, children's best interests trump parent's statutory right to release of such records (Iowa), 627
– – Therapist confidentiality breach lawsuit dismissed (Mich. Ct. App.), In Brief, 408

– White House and V.P. visitor records must be disclosed (D.D.C.), In Brief, 211; DHS agrees to settle FOIA suit, Obama announces new disclosure policy, 1307

PROCEDURE

– Class actions

See CLASS ACTIONS

– Criminal

See CRIMINAL LAW AND PROCEDURE

– Evidence

See EVIDENCE

– Google search of defendant by juror result in new trial (S.D.), In Brief, 1393
– Jurisdiction

See JURISDICTION

– Standing

See STANDING

PUBLIC RECORDS

– Background checks, Dallas-based corporate events planner, EEOC files class suit over firm's use of credit and criminal histories in hiring (D. Md.), 1471
– Blog post of Fla. prosecutor's work memo protected since copy came through records request (S.D. Fla.), 961
– Campaign finance violations, FEC to reinstate staff reports disclosure policy, In Brief, 1619
– Canada, marketing list service using public data without consent did not violate PIPEDA, 881
– Cell numbers on billing documents must be redacted before disclosure (Pa.), In Brief, 21
– Cerved unable to use tax and voting records mistakenly posted on Italian government website, 170
– Chile, government transparency law takes effect, data must be posted online, 632
– Court records

– – Conn. FOI law trumps hospital peer review privilege for records (Conn.), In Brief, 1243
– – Domestic abuse charge, client secrets may include matters of public record (Iowa), In Brief, 1034
– – Expunged criminal record can never truly be private (3d Cir.), 1384
– – Identity theft, constitutional privacy right not implicated by SSN stolen off county clerk's website (U.S., rev den), 81; In Brief, 90
– – Madoff scheme, personal identifying data redaction required to release victims' e-mails to media (S.D.N.Y.), 986
– – Mass. sets personal data rule, In Brief, 1152
– – Mortgage company had duty to redact sensitive data from filed documents but no damages (D.S.C.), 1238
– – Rocky Mountain Bank, probe of customer data improperly attached to e-mail, unable to seal complaint (N.D. Cal.), 1378; dismissal approved, 1433
– – Spain, AEPD says some courts improperly threw out sensitive data, 934
– – SSN included in filing, no remedy against bank (Tex. Ct. App.), 1528

– Digitizing birth and death records, Providing for Additional Security in States' Identification (PASS ID) Act

See LEGISLATION, FEDERAL, S 1261

– E-mails

– – County board must attempt to recover deleted e-mails (Ohio), 14
– – Wash., personal e-mails about city business not exempt from disclosure (Wash. Ct. App.), 1612

– Equifax, class alleging firm failed to verify data in credit reports with public source certified (D.N.J.), 1529
– Fla., Blackberry messages, In Brief, 1392
– Freedom of information

See FREEDOM OF INFORMATION

– Geographic information, Santa Clara County electronic map must be disclosed (Cal. Ct. App.), 469
– Hostile work environment probe, municipal court judge cannot prevent release of report (Wash.), 1383
– Ill. access law amended, In Brief, 1356
– Loan files, GLB preempts Wash. law on disclosure of non-public personal data (Wash. Ct. App.), 41
– Mental hospital cemetery records, HIPAA does not bar release (Neb.), 985
– Metadata associated with official police department notes not “public records” in state (Ariz. Ct. App.), 275; electronic public record includes metadata and must be produced (Ariz.), 1612
– Motor vehicle records, The Recall Center settlement announced, allegedly illegally sold records (D. Kan.), 799
– NCAA disciplinary proceeding on improper faculty assistance to students, media request for documents (Fla. Dist. Ct. App.), 1529
– N.J. open records law, land records database firm must pay for SSN redaction of requested records (N.J.), 707
– Obama records and website policies draw early praise, concern remains over future issues, 191
– Ohio

– – Databases, new law bars unauthorized searches by government employees, 43
– – Ohio Univ., breach of alumni database, schools and fired IT managers settle claim, audit report to be released (Ohio Ct. C.P.), 561

– PBGC IG office creates new record system and seeks exemption from Privacy Act, In Brief, 541; PBGC exempts IG data, In Brief, 883
– Presidential records

– – Access restored

See LEGISLATION, FEDERAL, HR 35

– – Executive privilege claims, 159

– Sensitive Security Information designation system, House hearing, witness urges limits on use when blocks public disclosures, 621
– Sexual harassment settlement agreement not protected from disclosure (N.J. Super. Ct.), In Brief, 473
– Turkey, data protection law remains stalled, 44
– U.S. attorney not required to produce final report on criminal fraud probe (U.S., rev den), In Brief, 209
– Va. land records, injunction expanded protecting advocate's posting of officials' SSNs to protest failure to redact numbers (E.D. Va.), 833
– White House, comments submitted via social media to be saved and privacy protected, 1376
– Wisconsin

– – Annual report released, In Brief, 92
– – Bargaining agreement did not create exception to disclosure of state employee data (Wis.), In Brief, 1293