CIPP Information Privacy & Security News

Recent hacking attacks on Sony Corp. and Lockheed Martin Corp. grabbed headlines. What happened at City Newsstand Inc. last year did not. Unbeknownst to owner Joe Angelastri, cyber thieves planted a software program on the cash registers at his two Chicago-area magazine shops that sent customer credit-card numbers to Russia. MasterCard Inc. demanded an investigation, at Mr. Angelastri's expense, and the whole ordeal left him out about $22,000.

Hospital CIOs, chief information security officers, and privacy officers are working diligently to keep their names off that wall. But they are dealing with a regulatory environment that is still in flux. A final rule that will strengthen HIPAA privacy and security safeguards is due out before the end of the year. HHS also has proposed a rule for the accounting of disclosures from electronic records. The biggest shift under way may be a new enforcement regime as the HHS Office for Civil Rights (OCR) shifts gears from only reacting to data breach reports to begin random audits of the privacy and security safeguards of large and small providers and their business associates. Another new wrinkle under the HITECH Act is that state attorneys general can file civil lawsuits for HIPAA violations.

The rise and fall of PRBC is a case study of the growing market for our personal financial data, where the incentives for helping consumers and making profits don't always align.

Congress already has more than 40 committees and well over 100 subcommittees. Does it really need one more? How about another task force? Or a working group? Yes, says Sen. John McCain: A new panel is needed to cope with a relatively recent and unquestionably grave threat - hacking.

With increasing dependency on information systems and advances in cloud computing, the smart grid and mobile computing, maintaining the confidentiality and integrity of citizens' personally identifiable information is a growing challenge. A new draft document from the National Institute of Standards and Technology (NIST) addresses that challenge by adding privacy controls to the catalog of security controls used to protect federal information and information systems.

Police in the US may soon be getting an iPhone add-on that will equip them with a facial recognition technology called MORIS (Mobile Offender Recognition and Information System). The device attaches to an iPhone like a case and allows the police to take a photo of a person to determine if they are a suspect or have a criminal history.

The arrangement between the U.S. and the EU - for which both continents vary a great deal on data protection and citizen privacy - were shot down when the Patriot Act was rushed through Congress in October 2001.

it is important to recognize that patient privacy was not at issue in Sorrell v. IMS Health because the data at question did not identify patients.

We paused, we talked, and even though we were in a scary situation with imperfect information, we made a thoughtful decision fast." That's as good a description of powerful leadership - and powerful living - in the twenty first century as I can imagine.

What constitutes unfair -- unethical -- aggregation? In the absence of a clear legal framework (the "fair use" doctrine in the U.S. is notoriously mushy), a lot of media people tend to use the "I know it when I see it" standard, echoing U.S. Supreme Court Justice Potter Stewart's wry 1964 declaration about what constitutes hard-core porn.

Despite ominous reports of cyberbullying and "Facebook depression" among young people, the number of parents who are cool with their children - between the ages of 10 and 12 - having a social media account has doubled in a year.

Dropbox's efforts are so potentially meaningful because the FTC states that, among its chief priorities for any federal rules, are clear, reader-friendly contractual language and privacy policies. While Google is fighting such efforts with lobbyists, Dropbox is giving an example of how to cut legalese from a contract and let users know exactly what they're signing up for.

Contrary to initial reports, Social Intelligence doesn't store seven years worth of your social data. Rather it looks at up to seven years of your history, and stores nothing.

In the old days of storing information in filing cabinets, subpoena power was constrained because people didn't save everything and investigators had to know where to look to find incriminating evidence. Today, Gruenspecht writes, "mass digital storage ... has significantly increased the chances that records of any given document exist and is increasingly unifying the locations in which those records can be found."

Near field communication (NFC) seems to become the rising technology enabling us to pay with our mobiles in the future. Startups like Square and some programs from brands like Starbucks and Google Wallet kick off a new era where mobile payments becomes popular today.

Now, you can either use Collusion to shock and appall yourself, or you can use it to show friends and family just how rampant behavioral tracking is. Once your mother sees that no less than five companies track her behavior when she visits MSNBC.com, and six when she visits FoxNews.com, she might be a little more cautious. She might also ask if there's a way to block the tracking cookies - at which point you promptly install Ghostery and BetterPrivacy on her computer.

Federal regulators will be able to take back two years of pay from executives held responsible for a large bank's failure. Executives deemed "negligent" and "substantially responsible" for a big bank's failure can lose all their compensation from the previous two years under a rule approved Wednesday by the board of the Federal Deposit Insurance Corp.

While most banking institutions focus their anti-skimming attention on unattended ATMs, such as those located at off-site locations like convenience stores or islands, these recent schemes prove that ATMs in plain sight, at the branch, could be the fraudster's best target.

These were developed for boards, but they would probably be a good basis for questions auditors could ask as well.

The industry coalition says it is enlisting the ISPs in its effort to "curb online theft" but critics say the ISPs are invading their customers' privacy and turning themselves into the Internet Secret Police.