Archives: Privacy

FTC strikes back against virtual Peeping Tom

By Jay Levine and Donna Ruscitti on March 12, 2014

Okay, folks, we won’t beat around the bush. This is just plain creepy! On Monday, the FTC finalized its order against Aaron’s, one of the country’s largest rent-to-own (RTO) stores, charging that its franchisees were spying on its customers.1 By the way, by spying, we mean to include taking webcam pictures every two minutes that the rented computer was connected to the Internet until directed to stop.

Background

Many of Aaron’s franchisees licensed and installed PC Rental Agent, a privacy-intrusion software, on computers rented to consumers. Unbeknownst to the renters, the software allowed the franchisees to collect private, confidential and personal information about them. Ostensibly, the information was to be used to gather data to assist franchisees in collecting on past-due accounts and recovering computers after default. Nonetheless, the software allowed much more. When in “Detective Mode,” the software logged keystrokes, captured screenshots and activated a computer’s webcam. The program also allowed franchisees to track the physical location of rented computers using WiFi hotspot information.

Quite obviously, the franchisees’ use of this software, without notice to computer users, compromised the renters’ personal, financial and medical information, not to mention the untoward “invasion into the peaceful enjoyment of their homes.” The consumers were also harmed, according to the FTC, by the surreptitious capture of the private details of their lives, including images of visitors, children, family interactions, partially undressed individuals and, as the FTC delicately put it, “people engaged in intimate conduct.” As Walter Dartland, a former deputy attorney general of …

Top 10 e-discovery developments and trends in 2013: Part 2

By Jay Yurkiw on January 15, 2014

Following is Part 2 of my third annual list of the top 10 e-discovery developments and trends from the past year. Read Part 1.

6. “It is malpractice to not seek a 502(d) order from the court before you seek documents.” U.S. Magistrate Judge Andrew Peck began last year at Legal Tech providing his thoughts on the importance of orders entered pursuant to Federal Rule of Evidence 502(d). He said: “I’ll give you a fairly straight takeaway on 502(d). In my opinion it is malpractice to not seek a 502(d) order from the court before you seek documents. That doesn’t mean you shouldn’t carefully review your material for privileged documents before production, but why not have that insurance policy?” Other judges echoed these sentiments as the year progressed.

As if hearing federal judges say malpractice and Rule 502(d) orders in the same sentence were not enough to convince federal court litigants to use them, cases throughout the year further highlighted the importance of securing these orders. Magistrate Judge Waxse enforced a Rule 502(d) order over the objection of the party that originally requested it in Rajala v. McGuire Woods, LLP, 08-2638 (D. Kan. Jan. 3, 2013). Earlier in the case, the defendant moved for a protective order that contained a clawback provision pursuant to Rule 502(d). Magistrate Judge Waxse entered the order which included language stating that “[t]he inadvertent disclosure or production of any information or document that is subject to an objection on the basis of attorney-client …

Top 10 e-discovery developments and trends in 2013: Part 1

By Jay Yurkiw on January 14, 2014

Here is my third annual list of the top 10 e-discovery developments and trends from the past year.

1. The growth of Bring Your Own Device (BYOD) policies and work-related text messaging is creating litigation hold challenges. A Cisco survey found that 89% of companies are currently enabling employees to use their own electronic devices for work. Gartner predicts that by 2017 a half of all employers will require employees to provide their own devices. The growing prevalence and convenience of personal devices in the workplace is leading more employees to use text messaging for work-related purposes.

With these trends, it is no wonder that there were a number of decisions last year addressing whether an employer must produce ESI (mainly text messages) from its employees’ devices (mainly cell/smart phones). One of the key issues in these cases is whether the employer has “possession, custody, or control” over the devices. To decide this issue, courts have looked at whether the employer provided the devices, whether the employees used the devices for work-related purposes, and whether the employer otherwise had any legal right to obtain ESI from the devices on demand. Other issues that have been raised are the privacy rights of the employees and the employer’s obligations if its employees refuse to turn over their devices during discovery.

In ordering the production of business-related text messages on employees’ cell/smart phones, a court rejected the argument that the failure to preserve text messages should not be sanctioned because they are …

Forensic computer examination is where the rubber hits the (off) road

By Porter Wright on January 9, 2014

Forensic computer examinations can be expensive and therefore may prompt the question during litigation – are they worth it? A recent decision from the Southern District of Ohio illustrates why the answer is “yes” in many trade secret cases. In H&H Industries, Inc. v. Miller, the court relied heavily on the results of the forensic examination of the defendant’s computers to enter a preliminary injunction that prohibited the defendant, the plaintiff’s former employee, not only from divulging or using the plaintiff’s trade secrets but also from working for his new employer.

The plaintiff, H&H Industries, retreads and repairs off-the-road (“OTR”) tires and sells used OTR tires. The defendant, Erik Miller, began working for H&H in 2006, and since 2007 had worked as a salesperson of OTR tires. Miller had access to H&H’s confidential information, including pricing information, and, as such, H&H required him to sign a confidentiality agreement. On July 26, 2013, Miller notified H&H that he was leaving the company to join one of H&H’s direct competitors, Polar Rubber Products.…

Key e-discovery cases in December

By Jay Yurkiw on January 6, 2014

The end of the year brought another decision that impacts Bring Your Own Device (BYOD) policies as well as another Court of Appeals decision addressing the recoverability of e-discovery costs under 28 U.S.C. § 1920(4), which permits a court to award “the costs of making copies of any materials where the copies are necessarily obtained for use in the case.” In addition to these decisions, there were key cases in December involving document preservation letters, search terms and clawback provisions.

Bring your own device (BYOD)

In Re Pradaxa (Dabigatran Etexilate) Products Liability Litigation, MDL No. 2385 (S.D. Ill. Dec. 9, 2013). The court fined the defendants $931,500 for various e-discovery failures and ordered them to produce additional documents and ESI, including business-related text messages on their employees’ cell/smart phones. “The defendants raised the issue that some employees use their personal cell phones while on business and utilize the texting feature of those phones for business purposes yet balk at the request of litigation lawyers to examine these personal phones.” The court rejected that concern and made clear that “[t]he litigation hold and the requirement to produce relevant text messages, without question, applies to that space on employees’ cell phones dedicated to the business which is relevant to this litigation.” The court further stated that employees refusing to provide their phones to the defendant-employer would be subject to a show cause order to appear personally before the court to explain why they should not be held in contempt.…

Key e-discovery cases in November

By Jay Yurkiw on December 10, 2013

Last month, Magistrate Judge David J. Waxse decided an issue that we likely will see more of in the age of big data. He rejected a defendant’s undue burden argument even though even though the “data warehouses” at issue contained over 100 terabytes of data and the production would take several months to develop a process to extract and pull the data in the manner requested by the plaintiffs. In addition to that case, there were key cases in November involving BYOD issues, cooperation, the form of production, and spoliation.

Bring your own device (BYOD)

Ewald v. Royal Norwegian Embassy, No. 11-cv-2116 (D. Minn. Nov. 20, 2013). In my summary of key October cases, I discussed how the magistrate judge in this case denied the plaintiff’s motion to compel discovery, including a request for forensic images of certain laptops, phones, memory cards and tablets. The district court judge largely affirmed the magistrate judge’s order but reversed the order as it related to the discovery of text messages and voice messages contained on two work-provided mobile phones. The court held that the plaintiff was entitled to receive responsive text messages and voice messages contained on the mobile phone the defendant-employer provided to her and another employee. Accordingly, the court ordered the parties to meet and confer and agree on a protocol to conduct a search for responsive text messages and voice messages contained on their work-provided mobile phones used between Nov. 1, 2008 and Nov. 1, 2011. Interestingly, the …

LabMD joins Wyndham in challenging FTC’s data privacy authority

By Jay Levine on December 5, 2013

Section 5 of the Federal Trade Commission Act — the Act that established the FTC in the first place — makes it unlawful to engage in “unfair methods of competition … and unfair or deceptive acts or practices…” Though the words seem simple enough, its application in today’s world is anything but simple, particularly when you talk about data privacy. Two companies — Wyndham Worldwide Corp. and LabMD Inc. — are publicly, and independently, challenging the FTC’s authority over their data security policies (and subsequent lapses). This post is a quick update about LabMD’s challenge.

In August 2013, the FTC filed an administrative complaint against LabMD, alleging that it lacked appropriate data security and unreasonably exposed the health and personal data of its consumers. LabMD conducts clinical laboratory tests on patients and reports its finding to patients’ health care providers. In performing the needed tests, LabMD typically obtains personal information, including names, addresses, dates of birth, SSNs, bank account or credit card information, laboratory tests, test codes and results, diagnoses, clinical histories, and health insurance company names and policy numbers. LabMD possesses such data for approximately 1 million consumers.

The FTC charged that LabMD “failed to provide reasonable and appropriate security for personal information on its computer networks.” Among other things, the complaint states that LabMD failed to:…

Defensible deletion: No spoliation where defendant destroyed emails and documents pursuant to its records retention policies

By Jay Yurkiw on October 1, 2013

When I present on e-discovery, I often use EDRM’s Electronic Discovery Reference Model to explain how decisions made about the creation, storage and deletion of electronically stored information (ESI) can affect how e-discovery is conducted in a lawsuit. The EDRM model illustrates how a company’s records and information management policies can impact the volume of ESI that may be relevant in a case, and how this volume can impact the overall cost of e-discovery.

Records retention policies that are carefully thought out and followed by a company can lower the volume of ESI that needs to be preserved, collected and reviewed during litigation, and also can reduce the risk of keeping records that the company no longer needs and carry inherent risks, such as documents with personally identifiable information. If a company is not making decisions about records retention at the organizational level, then it is leaving it up to individual employees to make ad hoc decisions about what is kept and deleted, and is likely increasing its long-term legal risks and costs.

Defensible deletion

An essential part of an effective records retention policy is the defensible deletion of data. Defensible deletion refers to the process of disposing of information that is no longer needed for business or legal reasons within the framework of an overall information governance strategy.…

Privacy on the go: California’s recommendations for the mobile ecosystem

By Christina Hultsch on September 18, 2013

Privacy policies are often lengthy, difficult to read and even more complicated to understand. Facebook’s data use policy, for instance, fills 16 pages and contains more than 9,000 words. The idea of reading through an entire privacy policy on the small screen of a mobile device exemplifies the need for a different, more user-friendly approach. In addition, mobile devices pose unique privacy challenges such as GPS tracking, text messages and call logs.

California, a state with consumer protection laws that are among the strongest in the country, has had explicit legislation governing online privacy since 2004 when the California Online Privacy Protection Act1 (“CalOPPA”) was enacted. CalOPPA § 22575(a) forces all operators of websites or online services to post their privacy policies in a conspicuous manner assuming they target individuals residing in California.

The California Attorney General, Kamala Harris, concluded in 2012 that, with regard to mobile devices and the apps they employ, the “conspicuous” display of privacy notices required an app-specific version and that a mere link to the company’s website was insufficient to meet the posting requirements referenced above. Harris sent notices to mobile developers Oct. 30, 2012, warning that they were not in compliance with California privacy law if their apps did not contain a conspicuously posted privacy notice. Shortly thereafter, California filed suit against Delta Airlines Inc., alleging the airline’s “Fly Delta” app lacked the requisite privacy notice despite collecting extensive personally identifiable information (PII) of its customers.…

Implementing cloud strategies

By Donna Ruscitti on August 16, 2013

As companies struggle with how to develop cloud strategies that are both cost effective and protect sensitive consumer and corporate data, the National Institute of Standards and Technology (NIST) can provide hands-on information to the private sector to help implement a reasonable cloud computing solution. Though NIST provides guidelines to the U.S. Government, the private sector can learn, too. Recently, NIST has stressed that the three major challenge areas for adoption of cloud computing are security, portability and interoperability.

In June, NIST released draft Special Publication (SP 500-299) as part of its ongoing obligation to develop technical and security standards for federal agencies as they adopt cloud computing solutions. This draft has been undergoing further comment and review. While these standards will establish protocol for procurement of cloud services by the federal government, they are likely to impact the use of cloud services and contractual terms in the private sector.

Cloud computing — the big picture

Companies adopting cloud solutions may struggle with setting a framework for their analysis of how to adopt a cloud solution. Exactly what is the cloud? According to the NIST definition:…

Sanctions for spoliation of evidence

By Tracey Turnbull and Porter Wright on August 8, 2013

This article was published originally at InsideCounsel.com. The article is the final installment of a six-part series focusing on evidence spoliation. Read more here, here and here.

Spoliation of evidence occurs when an individual or entity violates its duty to preserve relevant evidence. A finding of spoliation will often result in the imposition of sanctions and can significantly impact a litigation. Understanding how courts determine the appropriate spoliation sanction to impose is essential when this issue arises.

Courts have two sources of authority for sanctioning spoliation of evidence. Under the rules of civil procedure, courts have broad discretion to impose a variety of sanctions against a party that fails to produce evidence in violation of the civil rules. The primary limitation on this authority is that the discovery rules apply only to acts of spoliation that occur during the pendency of a lawsuit or following a court order. Courts also rely upon their inherent power to control the administration of justice to sanction pre-litigation spoliation. This authority allows courts to preserve their independence and integrity, since the destruction of evidence inhibits a court’s ability to hear evidence and accurately determine the facts.…

New Jersey Supreme Court holds police must obtain warrants for cell-phone tracking data

By Jared Klaus on July 23, 2013

Today’s cell phones enable people to stay connected to work, family and friends in ways that would have sounded like science fiction to past generations. But even some of the savviest of cell-phone users are unaware of the ways in which their devices may be used against them. To police and prosecutors, a cell-phone, which registers its location with the nearest cell phone tower every seven seconds, is like an individual tracking device. And, as the landscape of cell-phone towers becomes denser, the radius served by each tower becomes smaller, allowing police to track cell-phone users with greater and greater precision. In some areas served by “micro cell sites,” police are able to track cell-phone users within buildings, and even within individual floors and rooms within buildings.

Not surprisingly, law enforcement across the country have made increasing use of cell-phone tracking data to nab criminal suspects as well as to compile evidence in the cases against them — showing exactly where they were when the crime in question was committed. A recent study by the American Civil Liberties Union found that police use of cell-phone tracking data is so widespread that wireless companies now provide police departments with a menu of “surveillance fees” for tracking data and other types of information. Police typically are able to obtain such tracking data without a warrant, but this is where the New Jersey Supreme Court, in State v. Earls, drew the line.…

Top three trends from the 2013 IAPP Global Privacy Summit

By Christina Hultsch on March 26, 2013

I find a certain irony in the current ubiquity of privacy-related topics when the concept was once defined (and not by current European thinking, but more than 120 years ago), as the “right to be let alone,” in “The Right to Privacy,” by Warren and Brandeis, 4 Harvard L.R. 193 (Dec. 15, 1890). Nonetheless, I could not wait to attend the IAPP Global Privacy Summit in Washington, D.C., for the first time this year.

The days were filled with snow chaos, certification training and CIPP testing (on Friday afternoon at 2pm-5pm!), an exciting reception and other great networking opportunities — including a group of about 15 brave individuals meeting up at 6:30am on Friday morning to go for a run. In between all these activities were plenty of good programs to attend, and there can be no doubt that privacy in M&A transactions, cloud computing, HIPAA and international data transfers, to name just a few, will all feature prominently in the privacy discussions of 2013. But my personal Top Three privacy trends are:

1. BYOD Is Here to Stay It is no longer a question of whether companies will permit their employees to use their personal devices for work purposes, the remaining issue is how to implement a BYOD (bring your own device) policy to strike the right balance between convenience for the employees and data security for the company. Employee education, beta testing, accurate recording of work time for non-exempt employees, company access to employees’ personal information …

One Year Later: An Update on the Proposed EU Privacy Regulation

By Christina Hultsch on January 29, 2013

On Jan. 25, 2012, the European Commission first published a proposed draft General Data Protection Regulation (the “Proposed Regulation”). Almost one year later, the Civil Liberties, Justice and Home Affairs (LIBE) Committee (the European Parliament’s lead committee considering the Proposed Regulation) issued suggested amendments to the original proposal (the "Draft Report") and reignited discussion and controversy both within the European Union and on a global scale.

What is the difference between the Proposed Regulation and the Draft Report and how are both related to each other? In what is called the "ordinary legislative procedure," the Commission, one of the three legislative bodies of the Union and surely its most influential institution, publishes a first draft (i.e., the Proposed Regulation). This proposal is open to input and review (i.e., the Draft Report) by various Parliamentary committees and will — after two readings — be voted on by both the Parliament and the Council, the Union’s other legislative bodies. If the two readings are insufficient for the Parliament and the Council to come to an agreement, a conciliatory process will be conducted and result in a third reading. Ultimately, both Parliament and Council must agree before the text is signed into law and published. Other than a directive, which requires transposition by the individual member states, a regulation will be effective as of the date it comes into force.…

Canada’s Tough Anti-spam Legislation (CASL) Moves Closer to Being Effective

By Donna Ruscitti on January 22, 2013

If you are sending emails or other electronic communications to Canadian residents, you need to be aware that Canada is moving closer to finalizing the last set of highly anticipated regulations implementing Canada’s Anti-spam Legislation (CASL) . On Jan. 5, 2013, Industry Canada published regulations for a 30-day comment period, closing Feb. 4, 2013.

CASL is similar in concept to the U.S. CAN-SPAM law, but it is considered one of the strictest pieces of anti-spam legislation in the world. The Canadian Parliament passed the anti-spam legislation in December 2010, but the law and all accompanying regulations will not take effect until specified by an order of the federal cabinet (anticipated to occur later in 2013). CASL regulates the sending of commercial electronic messages (CEM), defined to include text, sound, voice and image messages, sent to an electronic mail account, an instant messaging account, a telephone account or any similar account. CASL also governs the installation of computer programs on another’s computer system (such as cookies). CASL applies to Canadian and non-Canadian companies or persons who transmit to Canadians. The law (i) prohibits sending CEM unless the person to whom the message is sent has consented to receiving it (unless it is an exempt communication), with consent being either express or implied under the law, and (ii) requires specific form and content for the message (the latter being similar to the U.S. CAN-SPAM law).…

State Tort and CFAA Claims Survive Motion to Dismiss In Ohio Employee Cyberhacking Case

By Donna Ruscitti on September 26, 2012

While we often think of cyber attacks as intrusions from external sources, companies are also vulnerable to insider attacks from their own employees. Current laws may not provide the best protection as demonstrated in a recent federal court decision out of the Southern District of Ohio, …

Information Privacy Regulation – What You Need to Know About Current Developments

By Donna Ruscitti on May 30, 2012

U.S. and EU approaches to privacy regulation have been very different, but recent developments in the U.S. may be narrowing the gap. Recently, we hosted a seminar regarding current developments in information privacy regulation. The subjects covered and a link to the materials are provided below. Our panelists included: Dennis Hirsch, Esq., Professor at Capital University Law School, Counsel to Porter Wright, and a scholar of information privacy law; Christina Hultsch, Esq., Porter Wright International Law attorney; and Donna M. Ruscitti, Esq., Chair, Porter Wright’s Information Privacy and Data Security Practice Group. They discussed:

How EU regulation impacts both U.S. and multi-national corporations and its practical implications to U.S. corporations
The White House Report Released February 23, 2012 – Consumer Data Privacy in a Networked World: A Framework for Protecting Privacy and Promoting Global Innovation in the Global Digital Economy
FTC Report Released March 26, 2012 – Protecting Consumer Privacy in an Era of Rapid Change
Current U.S. Legislative Initiatives
Compliance with the U.S. Safe Harbor Program and FTC enforcement actions

To download the materials from the seminar, click here.…