Information, Technologies and Telecom – Page 16

September 14, 2016 by Sandra A. Jeskie

The Eighth Circuit Gives Defendants New Ammunition Against Data Breach/Misuse Cases

Since the Supreme Court’s decision in Spokeo v. Robins, courts have begun to ratchet back prior decisions on the minimum standard to plead an injury sufficient to establish Article III standing. The recent Eighth Circuit opinion in Braitberg v. Charter Communications adds to the growing number of cases defendants will rely upon to get data breach cases dismissed at the pleadings stage. Braitberg addressed standing in the context of the retention, use, and protection of personally identifiable information. Although the case did not involve a data breach, its holding is however instructive when defending against such cases.

In Braitberg, plaintiff alleged that he was required to provide personally identifiable information to purchase cable services and that the cable provider improperly retained his information long after he cancelled the services in violation of the Cable Communications Policy Act (“CCPA”).

Prior to Spokeo, such claims would have been sufficient to establish Article III standing because the Eighth Circuit permitted the actual injury requirement to be satisfied solely by pleading that there was an invasion of a legal right that Congress created. The Supreme Court in Spokeo held that Article III standing requires a “concrete injury” even in the context of a statutory violation.

With the benefit of Spokeo’s guidance, the Eighth Circuit acknowledged that Spokeo superseded its prior precedent. Accordingly, the panel affirmed the district court’s dismissal of the complaint for lack of Article III standing and failure to state a claim. In doing so, the panel rejected arguments that CCPA created standing to sue where the defendant merely retained the data in violation of the statute with no other injury. It further rejected an economic argument that retention of the data deprived plaintiff of the full value of the services received from the company.

This decision is important for two reasons. First, the Eighth Circuit further narrowed the scope of allegations that will give rise to Article III standing in a post-Spokeo world. Second, in denying the economic argument, the court cut off an alternative avenue by which plaintiffs have successfully alleged harm.

September 14, 2016 by Eric J. Sinrod

The Different Layers of the Internet

Most of us regularly use the surface level of the internet. But there are other deeper and darker levels. So, let’s briefly explore three levels of the internet.

First, there is the “surface web.” As you read this blog, you are operating on the surface web. When you access your email, when you tweet on Twitter, when you conduct Google searches, when you listen to Pandora, when you watch YouTube videos, when you buy and sell things on eBay, and when you shop on Amazon, you are utilizing the surface web.

This part of the internet probably is the most familiar to you, so you might think that it comprises the vast majority of the internet. Wrong! According to a recent blog by Vinay Kumar, the surface web comprises only 4 percent of the internet. Continue reading “The Different Layers of the Internet”

September 9, 2016 by Eric J. Sinrod

Got Drone? New FAA Regulations: To Infinity and Beyond!

Drones are coming down in price, and they no longer are confined for deployment by military officials and high-level business moguls. So, can you just go out and buy and use a drone, completely unfettered? Sorry, no. Not under new FAA rules. But where there is a will, there is a way.

If you have a business purpose for your drone, you could be fined for using your drone without obtaining FAA approval. However, beginning last week, you can apply for a license by taking a multiple choice exam and by paying a modest fee. Continue reading “Got Drone? New FAA Regulations: To Infinity and Beyond!”

August 30, 2016 by Eric J. Sinrod

How to Improve Your Computer Experience

It probably is fair to say that most of us are glued to our computers for a large part of each and every day. Accordingly, how can we improve our computer experience? A good start is to follow eight fairly simple tips, among a variety of other tips that also could be considered.

First, make sure periodically to restart your computer. A restart can cure computer sluggishness. We all have a need for speed, so reboot!

The second tip is not use your keyboard as a plate. You accidentally could spill something that could destroy your computer. Also, computer keyboards host all sorts of bacteria and thus are not sanitary. So, don’t compute where you eat! Continue reading “How to Improve Your Computer Experience”

August 26, 2016 by Sandra A. Jeskie

Is Your Business Prepared for a Ransomware Attack?

Ransomware attacks are on the rise and expected to reach epidemic proportions. The most publicized attack took place this year at the Hollywood Presbyterian Medical Center when it was forced to declare an “internal emergency” after a ransomware attack locked down its systems. Businesses that are viewed as offering a combination of valuable data and weak security may be seen as attractive to attackers. Some attackers have strictly financial motivations while others may simply be in it for “the data.”

According to Cisco’s Midyear Cybersecurity Report, email and malicious advertising are the primary ways ransomware infiltrates a system. Businesses often pay the ransom but even when paid, files may be lost or altered in ways that could be devastating to the business.

Cisco reports that companies entering into M&A deals often do not conduct enough due diligence on the risk posture of the acquired business and realize their shortcomings after the deal is done, when it is too late to remediate problems or when it’s harder to do so because the networks are intertwined.

What can you do? Robust security is clearly the first step to prevent attacks and that begins with the creation of a comprehensive privacy and security roadmap that addresses high risk areas, compliance gaps and specific tactics for incident preparedness. It is important to involve experienced counsel at the outset to not only advise on the array of federal and state privacy and cybersecurity laws and help develop the policy but also to direct any security investigation so that consultants can report potential vulnerabilities to outside counsel to protect potentially negative findings from discovery in future litigation.

On September 7th, the Federal Trade Commission will begin its series of seminars on new and emerging technologies with a workshop on ransomware.

August 24, 2016 by Eric J. Sinrod

The Ultimate Impact of Sex Robots

Technology continues to advance to help humans in so many countless ways. And now we are getting to the point that we are not simply dealing with cold machines, but we are dealing with features and contraptions that are becoming quite human.

For example, we can talk to Siri on our Apple devices, and a human voice, programed to our liking by gender and accent, will talk back to us. And when we call all sorts of businesses, we are guided through various prompts by a human voice that is powered by voice activation software. Who knows, is it possible that some people can become smitten by these voices, like the protagonist in the movie “Her”? Continue reading “The Ultimate Impact of Sex Robots”

August 22, 2016 by Sandra A. Jeskie

Best Practices for Consumer Wearables & Wellness Apps

Last week the Future of Privacy Forum (FRF) issued “Best Practices for Consumer Wearables & Wellness Apps & Devices. The Best Practices are built on the five core principles of privacy protection, which form the foundation for privacy laws in the U.S.: (1) Notice/Awareness; (2) Choice/Consent; (3) Access/Participation; (4) Integrity/Security; and (5) Enforcement/Redress. They also seek to add protections for data that may not be covered by specific sector legislation and to add guidance in areas where general privacy statues are applicable.

While the Best Practices may appear easy to apply, in practice, they require businesses to develop a comprehensive approach to privacy and data security practices with the guidance of experienced counsel to avoid significant risks in this emerging area.

The Best Practices can be viewed at https://fpf.org/wp-content/uploads/2016/08/FPF-Best-Practices-for-Wearables-and-Wellness-Apps-and-Devices-Final.pdf

August 15, 2016 by Sandra A. Jeskie

Is Your Company Registered for the New EU-U.S. Privacy Shield?

Following the July 12, 2016, adoption by the European Commission of the EU-U.S. Privacy Shield (the “Privacy Shield”), companies engaging in trans-Atlantic data sharing can now register for the Privacy Shield. It replaces the prior Safe Harbor Program, which was invalidated by the European Court of Justice on October 6, 2015, when it ruled that the data of European citizens was not safe when stored on U.S. computer servers given the U.S. government’s ability to access information through its intelligence services.

The new Privacy Shield provides transparency in how companies use personal data, robust U.S. government oversight and increased cooperation with EU data protection authorities (the “DPA”). It includes more rigorous monitoring and enforcement by the U.S. Department of Commerce (the “Department”) and the Federal Trade Commission (“FTC”). Because the Privacy Shield is enforceable as U.S. law against a registered company, it is essential to ensure its compliance before registering.

Key provisions of the Privacy Shield include:

Informing Individuals About Data Processing: The Privacy Shield requires more heightened notice standards than under the Safe Harbor, including additional requirements for participants’ privacy policies.
Providing Free and Accessible Dispute Resolution: The Privacy Shield outlines several dispute resolution mechanisms and specific timelines for handling disputes.
Cooperating with the Department of Commerce: Participants should promptly respond to Department inquiries and requests for information relating to the Privacy Shield.
Ensuring Accountability for Data Transferred to Third Parties: Participants must enter into written agreements with third parties to ensure that data is processed for limited and specified purposes consistent with the consent provided by the individual, that the third party will provide the same level of protection and that the third party will provide notification if it can no longer meet its obligation.
Transparency Related to Enforcement Actions: The Privacy Shield seeks to create greater transparency for enforcement actions by making public any Privacy Shield-related sections of any compliance or assessment reports submitted to the FTC as a result of an FTC or court order based on non-compliance.
Potential Additions in the Future: The Privacy Shield is designed to be updated with time to address evolving issues and accommodate the General Data Protection Regulation (effective in 2018).

To join the Privacy Shield, a U.S.-based company must first develop a Privacy Shield-compliant privacy policy. Thereafter, a company can self-certify and publicly commit to comply with the Privacy Shield’s requirements. Once publicly committed, the provisions of the Privacy Shield are enforceable as U.S. law against the company. If a participant chooses to leave the Privacy Shield, it will be required to annually certify its commitment to apply the principles of the Privacy Shield to, or provide “adequate” protection for, any information it retains that was received while operating under the Privacy Shield.

The requirements of the Privacy Shield are different than its predecessor Safe Harbor. It may be prudent for companies engaging in the cross-border transfer of data to consult legal counsel experienced with the Privacy Shield to ensure compliance.

August 10, 2016 by Eric J. Sinrod

Internet Olympic Battles: USA’s King vs. Russia’s Efimova

The United States and Russia are superpowers and have potential and actual conflicts in various realms. And the Olympics are no exception when it comes to conflicts between the two countries. Let’s set the stage:

At first, it appeared the International Olympic Committee was going to ban all Russian athletes from competing in the Rio 2016 Olympic Games because of doping concerns. Indeed, the World Anti-Doping Agency issued a report that concluded that dozens of Russian athletes were doping during the Winter 2014 Sochi Olympic games, and on top of that, the Russian government had been complicit in a cover up of that doping scandal. Continue reading “Internet Olympic Battles: USA’s King vs. Russia’s Efimova”

August 4, 2016August 4, 2016 by Duane Morris

Seller Beware: Recent Lawsuits Under N.J. Truth-in-Consumer Contract, Warranty and Notice Act Target E-Commerce Businesses

Online retailers across the United States have one more issue to consider as they prepare for the next sale: a growing number of lawsuits under the New Jersey Truth-in-Consumer Contract, Warranty and Notice Act (TCCWNA) alleging that standard online terms of service agreements on websites violate the New Jersey bar on deceptive notices.

The TCCWNA—N.J.S.A. 56:12-14 et. seq.—was enacted in 1981 to prohibit businesses from using provisions that deceived consumers about their legal rights. The statute provides a private right of action that allows both actual customers and prospective buyers to bring suit against businesses. Businesses that violate the TCCWNA are liable to aggrieved consumers for $100, actual damages, or both, as well as reasonable attorneys’ fees and court costs.

To read the full text of the Alert, please visit www.duanemorris.com.