CIPP Information Privacy & Security News

Privacy and civil liberties advocates are urging lawmakers working on the forthcoming economic stimulus package to ensure that any language to spur adoption of electronic medical records includes meaningful security safeguards. The American Civil Liberties Union, Consumer Action, the National Association of Social Workers, Patient Privacy Rights and others sent letters to House Speaker Nancy Pelosi, Senate Majority Leader Harry Reid and President-elect Barack Obama Wednesday asking them to ensure individuals can control the use of their medical records and protect them from what they believe is a thriving industry of firms that share and sell medical data. "We all want to innovate and improve health care, but without privacy our system will crash as any system with a persistent and chronic virus will," Patient Privacy Rights executive director Ashley Katz said at a Capitol Hill briefing. Katz said her group has been pleased with progress that the House Energy and Commerce, and Ways and Means committees made last year.

The National Institute of Standards and Technology (NIST) this month released preliminary recommendations that federal agencies -- and their contractors -- should follow to protect the confidentially of personally identifiable information (PII). U.S. government agencies should take a number of precautions when dealing with personal information residing in their organizations, according to the NIST document. The recommendations are intended to be for U.S. federal government agencies, and companies with which they work, but NIST said that other verticals may also find value in it. The report states that organizations should store only PII necessary to conduct business, develop an incident response plan for the event of a breach and encourage coordination for data-loss incidents among CIOs, information security officers and legal counsel.

Identity theft concerns are focused on the security and necessity of the collection process. Collecting personal information just because you can is unsafe. Organizations can reduce privacy risks by not collecting unnecessary personal info. Once the data gets into the data life cycle pipeline, the cost of managing and destroying it escalates. The Federal Trade Commission estimates that as many as 9 million people have their identities stolen every year. According to the Privacy Rights Clearinghouse, more than 200 million instances of data breaches have occurred since the beginning of 2005, and they show no signs of letting up. In the first quarter of 2008 alone, more than 85 million incidents were reported. The causes of data breaches run the gamut: Hackers get unencrypted, transmitted data and data at rest; laptops are stolen or lost; storage Relevant Products/Services devices are lost by third-party shipping companies; flash drives or PDAs are left lying around; Social Security numbers are accidentally printed on envelopes; or data is found on discarded computers. This article examines the organizational risks to CPAs and their clients or corporate employers of improperly managed data throughout the data life cycle. It also discusses best data management practices and proper procedures for responding to a data breach. Data breaches, whatever the cause, are costly. According to a study by the Ponemon Institute, the average cost of a data breach in 2007 was $6.3 million. The average cost to an organization per record compromised is about $197, which is typically spent on phone calls for customer notification, providing free credit monitoring, discounts on membership fees, or discounts on merchandise to make up for the security Relevant Products/Services breach. Some organizations also experience an increase in customer turnover. The organization typically spends additional money in data protection Relevant Products/Services enhancements. Companies sanctioned by

I. INTRODUCTION The globalization revolution is undeniably well underway. Some of the primary leaders of the revolution are the off-shoring outsourcers of the world in search of readily available talent at prices below what is available in the traditional geographical outsourcing centers. Certainly, U.S. companies seeking information technology resources--as well as those looking for human resources to support the ever-growing customer care requirements of their business--are at the forefront of the movement. Some of those companies are seeking their own solutions, but many have turned to business process outsourcing companies for assistance. Business process outsourcing is, generally speaking, the contracting of a specific business task to a third party service provider. Processes that are best suited to be outsourced are those that a company requires but does not depend upon to maintain its position in the marketplace. There are two primary categories of business process outsourcing. One category is commonly referred to as "back office outsourcing" which includes internal business functions such as billing or purchasing. The other category is commonly referred to as "front office outsourcing" which includes customer-related services such as marketing, customer contact management, and technical support. The globalization of business in general has resulted in the need for companies to be able to provide support to their customers in many different languages. At the same time, developments in technology have provided the ability for business process outsourcers to provide a cost effective global delivery platform. The convergence of the need for a portfolio of services to be sourced globally with the ability of business process outsourcers to do so on a cost effective basis has driven the outsourcers to geographic locations previously ignored by most business sectors. By many estimates, there are currently off-shore outsourcing vendors in more than 175 different

The offshoring of business processes has become increasingly popular. Fueled by advancements in technology, the benefits of offshoring are primarily attributable to the savings from lower personnel costs at foreign locations. According to the Global Financial Services Offshoring Report 2007 by Deloitte & Touche U.SA LLP, over 75% of major financial institutions report offshoring a portion of their operations. Some economists estimate that up to one-third of total U.S. employment in services may ultimately be offshored (Steve Lohr, "At IBM, a Smarter Way to Outsource," The New York Times, July 5, 2007). Offshore entities often operate in developing countries such as India, China, Pakistan, the Philippines, and Vietnam. The offshoring of business processes generally takes two forms: outsourcing to an unaffiliated offshore entity (offshore outsourcing), or ownership and operation of an affiliated offshore entity (AOE). Many multinational companies have AOEs. For example, Accenture has more employees in India than in the United States; IBM is projected to have more than one-quarter of its workforce in India by 2010; and companies like General Electric, Eli Lilly, Google, and Microsoft are expanding their R&D centers in India and China (House Committee on Science and Technology, June 12, 2002). Offshoring and the Auditing Profession The potential benefits of offshoring have not been ignored by the accounting profession. In past years, several large public accounting firms began using AOEs to perform certain nonaudit procedures for their U.S.-based clients. For example, Ernst & Young uses AOE employees to prepare client tax returns (Vanessa Houlder, "E &Y Sends Compliance Work Offshore," Financial Times, July 11, 2007), and a number of accounting firms use AOEs to print documents for delivery to clients. The largest international public accounting firms have recendy begun testing the offshoring of certain auditing procedures on very large U.S. audit engagements to thei

For years, Attorneys General Roy Cooper of North Carolina and Richard Blumenthal of Connecticut have been leading a coalition of 49 states that were pushing MySpace to add technology to verify the age of its members. The attorneys general argue that age verification will help keep younger children off the site, and therefore prevent them from being contacted by sexual predators and other unsavory characters. Tomorrow, however, leading researchers in online child safety are expected to submit a report to the attorneys general stating that age verification technology is flawed and will not protect children from online dangers. Excerpts of separate interviews with Attorney Generals Roy Cooper of North Carolina and Richard Blumenthal of Connecticut, who led the charge for social networking safety standards.

There is no simple technology solution to protect children from bullying, pornography, sexual predation and other online threats, a new study says. The highly anticipated report -- results of a year-long study ordered by 49 state attorneys general -- found that "a combination of technologies, in concert with parental oversight, education, social services, law enforcement, and sound policies by social-network sites and service providers, may assist in addressing specific problems that minors face online," according to a draft of the report reviewed by The Wall Street Journal. The report also found that the risks that minors face on the Web -- notably bullying and harassment by peers -- aren't very different from those they face in the real world. The report is scheduled to be issued Wednesday by the Internet Safety Technical Task Force, led by Harvard University's Berkman Center for Internet and Society. Task-force members included representatives of several top Internet and security companies, including News Corp.'s MySpace, Google Inc., Time Warner Inc.'s AOL and Facebook Inc. (News Corp. also publishes the Journal.) The 278-page report is a boon for the Web companies, which have long argued that technology isn't the sole solution to the dangers kids face online. It is a disappointment for those in favor of stricter technological controls, such as age-verification and filtering tools.

Beyond PCI: Other Regulations to Look For in 2009 Just a few days ago, the Federal Reserve, the Office of Thrift Supervision and the National Credit Union Administration announced the enactment of comprehensive new rules regarding card practices. These rules, which will not take effect until July 1, 2010, impose restrictions on a number of controversial issuer practices, including interest rate increases, late fees and double-cycle billing. Many industry observers predict that the rules will result in less credit being made available, and on stricter terms, than has been the case over the last several years. These rules may not be the end of the matter. Rep. Carolyn Maloney (D-NY), who in 2008 introduced the Credit Cardholders' Bill of Rights Act of 2008 (which sought to regulate many of the same practices as the then-proposed Fed rules), stated that she was disappointed in the delayed effectiveness of the Fed rules and promised to revive the Credit Cardholders' Bill of Rights in 2009 to, as she put it, "bridge the gap" between now and the effective date of the Fed rules.

How does technology affect my privacy? Most of us have things we want to keep private - from our parents and teachers, from our siblings, from our friends. We all know that it's important not to leave a personal journal or a student card lying around in plain view. But have you ever wondered about how technology affects your privacy? Think about the technology that you use every day - to connect with your friends, to chat online, to download your favourite music. Did you know that technologies like these can be used to monitor your behaviour online? And that this private information can be stored and sold, often without you ever knowing about it? Why should I care? Because all these new technologies can have a significant impact on your personal privacy. And if you know how to use them properly you can control your private information - and make it more difficult for others to use your information without your permission. What do I really know about my privacy? Check out this privacy quiz and find out!

Facebook's developer platform has been used for a zillion marketing campaigns so far, but this one is actually dead-on hilarious. Fast-food chain Burger King has created "Whopper Sacrifice," a Facebook app that will give you a coupon for a free hamburger if you delete 10 people from your friends list. Burger King has put out some interesting campaigns as of late ("Whopper Virgin," "Subservient Chicken"), but this one piques our interest because of how gleefully it pokes fun at our social-networking obsessions. "Now is the time to put your fair-weather Web friendships to the test," the Whopper Sacrifice site explains. "Install Whopper Sacrifice on your Facebook profile, and we'll reward you with a free flame-broiled Whopper when you sacrifice ten of your friends. The funniest part: The "sacrifices" show up in your activity feed. So it'll say, for example, "Caroline sacrificed Josh Lowensohn for a free Whopper." Unfortunately, you can't delete your whole friends list and eat free (however unhealthily) for a week. The promotion is limited to one coupon per Facebook account. My Facebook friends had better appreciate the fact that I made a New Year's resolution to cut out red meat. Hint, hint.

On January 7, backers of California's Proposition 8 filed a federal lawsuit, asking that they be exempted from complying with California election laws that require disclosure of the names of people who give as much as $100 to a campaign for or against an initiative. The case is ProtectMarriage.com v Bowen, no. 2:09-cv-00058 (Sacramento). It was assigned to U.S. District Court Judge Morrison England, who was appointed in 2002. The case depends on the 1982 U.S. Supreme Court precedent Brown v Socialist Workers '74 Campaign Committee, which said that disclosure is not compelled if there is a reasonable possibility that campaign contributors, if identified, will be subject to harassment. Besides the Socialist Workers Party, other groups that have won freedom from disclosure include the Freedom Socialist Party, Socialist Action, and the Communist Party.

One of my predictions for last year was that privacy would be a growing concern among mainstream users. I didn't repeat that prediction this year, but perhaps I should have. The reason? Apparently, younger web users seem to care more about privacy controls. Or at least, they use them more. According to Facebook chief privacy officer Chris Kelly, more teenagers than adults use privacy controls on the social network, at a rate of 60% to about 25-30%. That's surprising given the conventional wisdom that younger Internet users tend not to care about the privacy of their data. A recent study from Computer Associates confirms that many teens are at least somewhat concerned with online privacy. That study showed that 79% of teens aged 13-17 who are members of a social networking site like MySpace or Facebook protect their profiles from the general Internet in some way (i.e., only allow friends or friends of friends to view their information). Profiles on Facebook, of course, are automatically protected from viewing by the Internet at large, but protecting them from the rest of your network requires additional steps. That teens are more likely to utilize Facebook's granular privacy controls points to one of two things that lead to the same conclusion: 1. Teens care more about online privacy than adults, or, 2. Teens are simply more aware of social networking privacy controls than adults.

You have an unlisted phone number, you guard your personal information, you shred your financial papers- so everything is private and safe, right? Would you be alarmed to know that even when you think things are private, a perfect stranger can look you up online, see your address, birth date, past addresses, and even see a photo of your home, down to the detail of your child's play set out in the back yard? Alarmed yet? You should be. Take a look at this website: www.zabasearch.com. Simply plug your name in, and you are likely to be surprised, and probably a bit distressed to see all the information that is readily available online. How could this happen? Easy. Virtually every major change in your life is recorded somewhere in a government document. When you are born, a birth certificate is issued. When you obtain a driver's license, get married, buy a house, file a lawsuit ' all of these events are recorded in public documents easily available to you and to others. Government records are intentionally public in order to enable citizens to monitor the government and to ensure accountability in our society. The challenge is to balance the public's right to information with the individual's right to privacy.

Naturally, privacy watchdogs answer the question in this post title with a resounding "Yes!" The answer is so emphatic, in fact, that the Center for Digital Democracy and U.S. Public Interest Research Group are filing a 52-page complaint with the FTC today alleging that mobile marketers collect so much "non personally identifiable information" that it infringes on users' privacy-and are "unfair and deceptive." Mobile devices, which know our location and other intimate details of our lives, are being turned into portable behavioral tracking and targeting tools that consumers unwittingly take with them wherever they go. (Shh! Don't tell them the FBI can remotely turn on the microphone of several cell phone brands and convert your phone into a roving bug, even when it's off!) But is the Internet private-and should it be? Is a profile that states that you are interested in outdoor rec and currently in the Santa Clara, CA, area an invasion of your privacy? And if so, should we ban all outdoor rec stores and centers in Santa Clara from collecting personally identifiable information like, say, a picture of you when you walk in their lobby? Should we prohibit all employees from asking your name and if you slip and mention it, make sure they never call you by it?

The suggestion comes after a 12 month period in which the Government has admitted losing millions of personal records, including the entire child benefit database. Richard Thomas, the information commissioner, will tell MPs that its annual tracking survey has found a big jump in the way that people view loss of personal data, excessive surveillance, privacy intrusions and identity theft. Its survey of 1,000 people found 94 per cent of people ranked "protecting personal information" as their top concern, ranked equal with concerns about crime. Public awareness of access to their personal information held by public bodies has also jumped, from 74 per cent to 86 per cent between 2007 and 2008. Mr Thomas will say that part of the reason has been the 277 data breaches by public bodies, since HM Revenue and Customs said it had lost the personal details of 25 million families on the child benefit database in October 2007.

President-elect Barack Obama has promised to computerize all of America's medical records within five years. He made the pledge last week in a speech at George Mason University. "This will cut waste, eliminate red tape and reduce the need to repeat expensive medical tests," he said. "But it just won't save billions of dollars and thousands of jobs, it will save lives by reducing the deadly but preventable medical errors that pervade our health care system." But the road to digitized medical records will be a tough and expensive one, CNN Money reported. Today, only about 8% of the country's 5,000 hospitals and 17% of its 800,000 physicians use electronic medical records. There is also the issue of patient privacy. Numerous hospitals have faced security issues since moving to electronic medical records. The Industry Standard reported on a security breach at a Los Angeles hospital last month. And then there is the cost. Studies done by Harvard, RAND and the Commonwealth Fund peg the cost of the digitization plan between at least $75 billion to $100 billion, according to the CNN article. However, the health care industry spends $2 trillion dollars a year, so the $100 billion may be well worth the long-term savings.

Enterprise employees frequently use social networking tools, most notably Web-based applications. It's no surprise more organizations are wondering what happens if social networking data becomes relevant to an e-discovery investigation. How does an enterprise go about discovering and assessing Web 2.0 data? How responsible is an organization, legally speaking, for the information that's out there in the Web 2.0 world? What risks arise from e-discovery as it relates to Web 2.0 data, and how can you mitigate them? In this tip, we will look at e-discovery as it relates to Web 2.0 and consider the strongest options for minimizing risks to the organization. E-discovery basics We begin with a quick look at what e-discovery is and how it can create risk. Essentially, e-discovery is the electronic extension of the legal process of discovery, which Wikipedia defines as "the pre-trial phase in a lawsuit in which each party through the law of civil procedure can request documents and other evidence from other parties or can compel the production of evidence by using a subpoena or through other discovery devices, such as requests for production and depositions." If you're an IT person, not a lawyer, it's important to note that the rules governing the discovery process now require plaintiffs to address all electronically stored information or ESI. In other words, if your organization faces litigation, it will have to deal with the issue of e-discovery, which will entail a whole lot more than turning over some old emails. Depending upon your role in the organization, the first you may hear of this is a "notice of litigation" with perhaps a "litigation hold directive" containing a "preservation directive." Here is a generic e-discovery request below. Apart from a few limiting factors, such as subject matter, named persons and a specified time period, the scope of such a notice is likely to be broad; blame standard procedure, not some high-powered attorney pushing his or her lu

Consumer Sentiment rose up by 1.8 points in early January to 61.9%, compared with market expectations for a slight decline to 59.0%. Despite this surprising gain, sentiment is still 8.4 points below its September level and 21.0% below its year ago level. The current level remains well below its recessionary average of the past 50 years. Current Conditions slipped by 0.3 points to 69.2%. This is 5.8 percentage points below its September level and 26.7% below its year ago level. Consumer Expectations jumped by 3.2 points to 57.2%. Nevertheless, they are still 10.0 percentage points below their September level and 16.0% below their year ago level. Bottom Line: Consumer sentiment climbed in early January. However, sentiment had collapsed in October in reaction to the intensification of the financial and credit market turmoil. Overall assessments of the economy, as well as assessment of current conditions and consumer expectations, are still significantly below their September level and well below their year ago levels. Thus, despite this month's increase, household assessments of the economy are still mired at recessionary levels. The causes of consumers' pessimism are also dampening real consumer spending.

Heartland Payment Systems, the sixth-largest payments processor in the U.S., announced Monday that its processing systems were breached in 2008, exposing an undetermined number of consumers to potential fraud. Meanwhile, Forcht Bank, one of the 10 largest banks in Kentucky, told its customers it would begin reissuing 8,500 debit cards after being informed by its own card processor of a possible breach. In the case of Heartland, while the company continues to assess the damages inflicted by the attack, Robert Baldwin, the company's president and CFO, says law enforcement has already noted that the attack against his company is part of a wider cyber fraud operation. "The indication that it is tied to wider cyber fraud operation comes directly from conversations with the Department of Justice and the U.S. Secret Service," Baldwin says. The company says it believes the breach has been contained. Heartland, headquartered in Princeton, NJ, handles approximately 100 million transactions per month, although the number of unique cardholders is much lower. "It is still a question as to the percentage of the data flow they were able to get," Baldwin says, adding he would not speculate on the number of cards potentially exposed. Specifics surrounding when the breach occurred are still being analyzed. But Baldwin says two forensic auditing teams have been working on the breach analysis and investigation since late 2008, after Heartland received the notification from Visa and MasterCard. The investigation began immediately after the credit card companies told Heartland they saw suspicious activity surrounding processed card transactions. Described by Baldwin as "quite a sophisticated attack," he says it has been challenging to discover exactly how it happened.