CIPP Information Privacy & Security News

The global business community is faced with an unprecedented level of uncertainty and risk. Are you prepared? The BCI announces Business Continuity Awareness Week, a week-long global event that is aimed at raising awareness of business continuity, disaster recovery and resiliency around the globe and bringing to the forefront the escalating significance of Business Continuity Management (BCM) as a critical management tool for corporations and government groups of all sizes and industries. We have aligned with other industry leaders in the Business Continuity education, development and standards fields to support The Business Continuity Institute (BCI) in its production of a series of 9 FREE webinars and virtual meetings throughout the world which will include surveys, case studies, analysis processes and much more. We would strongly urge you to mark the dates on your calendar and take advantage of all of this great knowledge! Please feel free to forward this announcement to anyone that you feel would benefit from this event. For the most up to date information and event schedule please visit: www.businesscontinuityawarenessweek.org

On November 1 and 2, 2007, the Federal Trade Commission will host a Town Hall entitled "Ehavioral Advertising: Tracking, Targeting, and Technology." The event will bring together consumer advocates, industry representatives, technology experts, and academics to address consumer protection issues raised by the practice of tracking consumers' activities online to target advertising - or "behavioral advertising." The Town Hall is a follow-on to a dialogue on behavioral advertising that emerged at a November 2006 FTC forum, "Tech-Ade," which examined the key technological and business developments that will shape consumers' core experiences in the coming ten years. In addition, several consumer privacy advocates, as well as the State of New York, recently sent letters to the FTC asking it to examine the effects of behavioral advertising on consumer privacy. The Town Hall will explore how the online advertising market, and specifically behavioral advertising, has changed in recent years, and what changes are anticipated over the next five years. Among other things, it will examine what types of consumer data are collected, how such data are used, what protections are provided for that data, and the costs and benefits of behavioral advertising to consumers. The Town Hall will also address what companies are disclosing to consumers and what consumers understand about the online collection of their information for use in advertising. In addition, the Town Hall will look at what regulatory and self-regulatory measures currently govern the practices related to online behavioral advertising, as well as anticipated changes in the behavioral advertising space in the future. The Commission invites interested parties to submit requests to be panelists and to recommend other topics for discussion. The requests should be submitted electronically to behavioraladvertising_requests@ftc.gov by September 14, 2007. The Commission asks interested parties to include a stat

Federal regulators on Tuesday met to hear about whether the benefits of cloud computing justify increased regulation, as privacy activists claim, or whether such an approach would do more harm than good. "We need to be smarter about dealing with technology, and cloud computing is posing (a) risk for us," said Hugh Stephenson, deputy director for international consumer protection at the Federal Trade Commission's Office of International Affairs. The FTC convened the two-day meeting in its offices here, which follows a series of similar workshops held in previous years on topics like spam, privacy, and behavioral advertising. The agency may file lawsuits to halt "unfair or deceptive acts or practices," meaning that if cloud computing is not unfair or deceptive, the FTC would likely not have jurisdiction. To secure personal information on the cloud, regulators may have to answer questions such as which entities have jurisdiction over data as it flows across borders, whether governments can access that information as it changes jurisdiction, and whether there is more risk in storing personal information in data centers that belong to a single entity rather than multiple data centers. The current panoply of laws at the state, national, and international level have had insufficient results; FTC Commissioner Pamela Jones Harbour cited a 2008 PricewaterhouseCoopers information security survey (PDF) in which 71 percent of organizations queried said they did not have an accurate inventory of where personal data for employees and customers is stored. With data management practices that are not always clear and are subject to change, companies that offer cloud-computing services are steering consumers into dangerous territory, said Marc Rotenberg, executive director of the Electronic Privacy Information Center. Already, problems of identity theft are skyrocketing, he said, and without more regulation, data management services may experience a collapse analogous to that

A coalition of privacy groups today urged the Obama Administration to defend California's landmark financial privacy law against the banking industry's legal efforts to overturn it. The US Supreme Court is currently considering taking up the banks' appeal of a 2008 decision by the 9th Circuit Court upholding almost all provisions of the Financial Information Privacy Act of 2003 (SB 1 - Speier). On March 9th, the Supreme Court invited the Obama Administration to voice its opinion on the California privacy law. The case is American Bankers Association v. Brown, Supreme Court Docket Number 08-730. Letters to President Obama and Solicitor General Elena Kagan were signed by The Consumer Federation of California, Privacy Rights Clearinghouse, CALPIRG, Consumers Union, Consumer Action, The Older Women's League, The California Alliance for Retired Americans, and Chris Larsen, Propser Marketplace, and founder of Californians for Privacy Now, the organization that spearheaded a 2003 ballot initiative campaign that turned fierce banking industry opposition into acquiescence with SB 1. "This represents a defining moment for privacy rights" the letter states. We ask you to stand with consumers by telling the Supreme Court to reject the banks' appeal in Brown." Privacy advocates support the State of California's position in this legal matter, which is that there is no merit to the appeal filed by the American Bankers Association. At issue is whether federal laws preempt portions of California law that regulate the sharing of private consumer information within a financial institution's family of affiliates.

Those who are superstitious may believe that bad things happen on Friday the 13th, but we will leave it to each individual and entity to formulate conclusions regarding the Health Information Technology for Economic and Clinical Health Act (the HITECH Act), which Congress passed late on Friday, February 13, 2009, and President Obama officially signed into effect on February 17, 2009. The HITECH Act addresses various aspects relating to the use of health information technology (H.I.T.), including providing for federal funding by way of grants and incentive payments in order to promote H.I.T. implementation. This Alert focuses, however, on Subtitle D of the HITECH Act, which includes important, new and far-reaching provisions concerning the privacy and security of health information that will materially and directly affect more entities, businesses and individuals in more diverse ways than ever before. These changes are further elaborated upon below, but this Alert can only highlight certain prominent issues under the HITECH Act and is by no means a comprehensive review of this lengthy and complex Act. For questions and additional guidance on the HITECH Act, contact your Fox Rothschild attorney or the authors of this Alert. New Privacy and Security Requirements * Security Breach Notification Requirements: Security breach notification requirements under the HITECH Act go into effect 30 days after the date that interim final regulations are promulgated, which will be no later than 180 days after the date of enactment of the HITECH Act (August 16, 2009). Covered entities, business associates and vendors who handle personal health records are required to abide by breach notification requirements. Violations of this requirement by vendors would be treated as an unfair and deceptive act or practice in violation of the Federal Trade Commission Act. If a breach affects more than 500 individuals of a particular state, notice also must be provided to prominent media outl

Web sites that strip personally identifiable information about their users and then share that data may be compromising their users' privacy, according to researchers at the University of Texas at Austin. They took a close look at the way anonymous data can be analyzed and have come to some troubling conclusions. In a paper set to be delivered at an upcoming security conference, they showed how they were able to map out the connections on public social networks such as Twitter and Flickr. They were then able to identify people who were on both networks by looking at the many connections surrounding their network of friends. The technique isn't 100 percent effective, but it may make some users uncomfortable about whether they should allow their data to be shared in an anonymous format. Web site operators often share data about users with partners and advertisers after stripping it of any personally identifiable information such as names, addresses or birth dates. Arvind Narayanan and fellow researcher Vitaly Shmatikov found that by analyzing these "anonymized" data sets, they could identify Flickr users who were also on Twitter about two-thirds of the time, depending on how much information they have to work with. "A lot of the time people will share information online and they'll expect that they are anonymous," Narayanan said in an interview. But if their identity can be ascertained on one social network, its possible to find out who they are on some other network, or at least make a "strong guess," he said.

As the National Security Council works on its comprehensive review of federal cybersecurity programs for President Obama, it is going to great lengths to consider privacy and civil liberty issues, some Congress members said Thursday. The House Cybersecurity Caucus on Thursday met with Melissa Hathaway, the acting senior director for cyberspace for the National Security and Homeland Security Councils, who is conducting for the administration a 60-day cybersecurity review. Rep. James Langevin (D-R.I.), co-chair of the House Cybersecurity Caucus, said Hathaway has been meeting with privacy and civil liberties groups to receive their input on how to reform cybersecurity. Those issues are "a forethought rather than an afterthought," he said. "Because these are such powerful tools (to grant federal authorities to regulate cyberspace), we're going to have to have the buy-in of the public and have their support." While the Senate is working on its own plan for White House-run cybersecurity efforts, Langevin said Hathaway's assessment may ultimately suggest a strategy with a stronger emphasis on inter-agency efforts. Langevin said it is still unclear whether Hathaway will recommend that a new office for cybersecurity should be created within the Executive Office of the President--a move some senators are pushing for. Certainly, though, policy will have to come from the White House. "This is going to have to be an ongoing strategy of collaboration and cooperation directed out of the White House," Langevin said. "But there won't be one king, so to speak, at the end of the day. The chief information officers at the departments and agencies are still going to have a role to play."

Top House and Senate Democrats are working on legislation that would prevent online marketers from sharing Web-surfing information unless Internet users allowed them to. That's according to House Communications, Technology and the Internet Subcommittee chairman Rick Boucher (D.-Va.), who told Multichannel News that such a bill was in the works and was one of his top legislative priorities. The issue of online behavioral marketing has gained traction recently, spurred by privacy concerns and by media companies' need to find new ways for advertisers to reach aggregated audiences at a time of fragmented viewing and multiplying delivery platforms. Boucher's predecessor atop the committee, Rep. Edward Markey (D-Mass.), held a hearing last fall on the issue and helped quash a test by ad-tracking company NebuAd and cable operator Charter Communications. In an interview, Boucher said he was teaming with Reps. Cliff Stearns (R-Fla.), ranking member of his subcommittee, and Joe Barton (R-Texas), ranking full committee member, on a bill that would apply "across the board" to behavioral advertising and data collection by Web sites. "The goal would be to give the Internet user a sense that information about him that is collected by Web sites is well understood by the user, so he has an opportunity to know what is collected," Boucher said. "He would then have an opportunity to act in a way that prevents that Web site using that information to market him personally, and an even broader opportunity to prevent the transfer of that information about him to third parties." Boucher envisions a combination of opt-in and opt-out requirements. "Opt-in would apply where the information is conveyed to third parties," he said, while "opt out would apply where the Web site that collects the information is using that information directly to market the customers from whom it is collected." Center for Digital Democracy executive director Jeff Chester was please

It's unclear whether a report being prepared for President Barack Obama on federal information security preparedness will support recent calls for the creation of a new cybersecurity office within the White House, two lawmakers said last week. Instead, the report may recommend a more collaborative and cooperative strategy among federal agencies on the issue of cybersecurity without a single agency or department in charge, they said. Members of the U.S. House Cybersecurity Caucus met with Melissa Hathaway, acting senior director for cyberspace for the National Security Council and Homeland Security Council. Hathaway, who is conducting a 60-day review of federal cybersecurity preparedness on behalf of the president, Thursday presented a status report to members of the caucus. Speaking with reporters after the briefing, Rep. James Langevin (D-R.I.), co-chair of the caucus, and Rep. Yvette Clarke (D-N.Y.), chairwoman of a subcommittee within the Committee on Homeland Security, said it was unclear yet what Hathaway might recommend. Rather than "include another structure" within the White House, there may be a call for an increase in staffing within the White House Office of Management and Budget (OMB) in a bid to improve its current role of overseeing government cyberaffairs, said Langevin. Chances are "there will not be one king," he said. Langevin co-chaired a commission at the Center for Strategic and International Studies, a bipartisan think tank, that has called for the creation of a centralized cybersecurity office in the White House to be named the National Office for Cyberspace. The new office could combine the National Cyber Security Center (NCSC) and the Joint Interagency Cyber Task Force, two existing agencies that are handing cybersecurity today. The U.S. Government Accountability Office (GAO) has also called for a new office dedicated to cybersecurity within the White House. Calls have been prompted by what is perceived as the inability of the U.S. De

The use of data in the online world is being governed by the rules of the "Wild West," the European Commission will argue this week, in the clearest warning yet to Internet companies to curb how they use the information they collect on users. With concern growing over the amount of data gathered by the biggest players on the Internet, the comments will challenge the industry to agree on new principles for its use - or face a clampdown. Meglena Kuneva, the European consumer affairs commissioner, will argue that basic consumer rights are being violated by companies that profile and target consumers, according to a draft of a speech seen by the International Herald Tribune. "From the point of view of commercial communications," the draft speech reads, "the World Wide Web is turning out to be the world 'Wild West."' Kuneva is to deliver the speech to a meeting of around 200 industry and consumer representatives on Wednesday. Her comments reflect the anxiety of regulators on both sides of the Atlantic about the commercial use of information garnered through online tracking made possible via "cookies" - small files dropped into users' computers by the Web sites they visit. These cookies help companies take note of users' habits and can be sold to advertisers to help them target their marketing efforts. But their use raises serious questions about who knows which sites we visit and what they do with that information. In the United States, the chairman of the Federal Trade Commission, Jon Leibowitz, warned recently that, if the industry does not show it can protect users' privacy, it will invite legislation from Congress and a more regulatory approach from the F.T.C.

Congress has been dithering over the adoption of a federal data security breach notice law for the last several years without coming to an agreement on a national standard for reporting breaches in the security of personal and financial data, but on February 17, data breach notice provisions applicable to health information were signed into law as part of the HITECH Act provisions of the massive economic stimulus legislation, H.R. 1 (111th Cong., 1st Sess. Feb. 17, 2009). Beginning no later than September 16 of this year, "covered entities" under the Health Insurance Portability and Accountability Act (HIPAA) will be required to give notice of breaches in the security of protected health information, and "business associates" of HIPAA-covered entities will be required to report such breaches to the covered entities. §13402(a) & (b). Currently, California and Arkansas are the only states that require that notification be given in the case of a breach in the security of medical or health insurance information. The HIPAA Privacy Rule currently does not contain a requirement that individuals be notified in the event of such as breach. However, some covered entities interpret the existing HIPAA Privacy Rule requirement that covered entities mitigate harmful effects of uses or disclosures of health information in violation of either the Privacy Rule or the entity's policies and procedures as suggesting that such notice be given, and many covered entities currently provide such notification.

NIST announces the release of the Initial Public Draft (IPD) of Special Publication 800-16, Revision 1, Information Security Training Requirements: A Role- and Performance-Based Model. This publication is now available for public comment. The comprehensive training methodology provided in this publication is intended to be used by federal information security professionals and instructional design specialists to design (1) role-based training courses or modules for personnel who have been identified as having significant responsibilities for information security, and (2) a basics and literacy course for all users of information systems. We encourage readers to pay special attention to the Notes to Reviewers section, as we are looking for feedback on the many changes we have made to this document.

Ah, social networking. It's become the fabric of today's Internet generation. Don't have a Twitter account? Heavens, even Sen. John McCain has a Twitter account. Signed up with Facebook? Only losers don't have a Facebook account. MySpace? Not bad, but it's so five minutes ago. But as lovely as social networking may be, there are a few problems. One of the biggest appears to be that you can kiss your privacy good-bye. Now, I'm not talking about the predilection of some people to share intimate details about themselves on social networking sites. I'm actually referring to the other things that might help contribute to your financial ruin. Those most enthusiastic about social networking are cybercriminals. They drool at the prospect of seeing the personal information of the 175 million people on Facebook. And they know how to use that information. For example, cybercrooks take great interest in the names of pets or grandparents on Facebook pages. That's the kind of information that banks and credit-card companies use to verify who you are when you bank online. "There are so many people on social-networking sites that it is becoming profitable for bad guys to go there," David Perry, global director of education at software security firm Trend Micro, recently told Agence France-Presse (AFP). "Bad guys can see all the things you post. You may be revealing personal information that is extremely valuable." Now Facebook has made revealing personal information even easier. This past week, it announced that users can change their privacy settings so everyone can see their profile. The company was actually responding to a request from many users who wanted the ability to share their information with even more people. As I said, cybercrooks are drooling.

The private correspondence of millions of people who use social networking sites could be tracked and saved on a "big brother" database, under new plans being drawn up by the UK government. Ministers revealed yesterday that they were considering policing messages sent via sites such as MySpace and Facebook, alongside plans to store information about every phone call, e-mail and internet visit made by everyone in the United Kingdom. There was immediate uproar from opposition parties, privacy campaigners and security experts who said the plans were over-the-top and unworkable. There have long been proposals, following an European Union directive in the wake of the July 2005 bombings in London, for emails and internet usage to be tracked in order to guard against future terrorist attacks.

Profile Optimization True Story: I'm at a party a few months ago - not the usual raucous affair that us search and social media types get into but a full on wine and cheese extravaganza. The kind of shindig Republicans go to and then accuse Democrats of loving when they get up in front of a "Joe the Plumber" type crowd. But I digress… After far too much wine the discussion turned to crazy work environments and I naturally brought up the Fortress of Googletude and it's predilection for hallway scooter parking and riding. A fellow party-go-er who I'll call "Natasha" to protect her identity, nodded and said, 'Yes it's true, I've been there too!" This led to a long, room-clearing talk about search and social media, the kind of talk that true geeks engage in while their spouses go off to chat about politics and religion. Somewhere between bottles Natasha said to me "Have you seen Google People Search?" "Google what now?" I replied. She went on to describe an internally searchable database that the Google folks showed her of people sorted by interests and web habits, ready to be rolled out to advertisers at some point in the future. Thank goodness for the red wine clause in their NDA. Well the future arrived today, at least partially, with Google's announcement that behavioral targeting is being rolled out to the AdWords content network. As the Googlelords put it: "With interest-based advertising, you will be able to reach users based on your past interactions with them, such as their visits to your website. We'll also provide interest categories, such as "sports enthusiasts," so you can reach the audience of your choice. Whether your goal is to drive brand awareness or increase responses to your ads, these capabilities can help expand the success of your campaigns." This is a most effective riposte to the OPA's announcement of new, ludicrous banner ad standards - why futz around with annoying crap no-one will clic

Educating consumers about what behavioral targeting is and is not up to, deep within the cookies of their browser, seems to be a bit like alternative energy development. Pretty much everyone says the industry should be doing more about it, and yet it is hard to see where and with whom it starts. Most online materials related to BT are pitched to one end of the value chain, marketers. It's not clear to me that most of the companies in this space are even comfortable talking directly to consumers, let alone taking the time to develop an accessible language to describe their process. Specific Media controls the BehavioralTargeting.com domain and uses it to educate marketers about its methods. Even the Wikipedia entry for this field is really an explanation for advertisers. This is understandable, since most people who are familiar with the term likely come from the industry. But it seems to me the industry misses an opportunity to practice more often, and in more places, what it knows ultimately needs to be done. You guys need to find better, clearer, simpler ways to explain what it is you are doing in our browsers -- and why you are doing it. And what are the real benefits and risks a consumer incurs by tacitly agreeing to your presence? Isn't every possible point of contact with a suspicious consumer a teachable moment? In an earlier post, I recounted how I struck some retargeting gold when FetchBack tagged and remarketed me during my travels online. An opt-out option is clearly available at the front page of the FetchBack site. Unfortunately, from there you either opt-out (kick over to the Network Advertising Initiative site) or click into a long scrolling privacy policy that doesn't actually get around to explaining retargeting until a few screens down.

A defunct payment gateway has exposed as many as 19,000 credit card numbers, including up to 60 Australian numbers. The discovery by a local IT industry worker was made by mistake and appears to be caused by a known issue with the Google search engine, in which the pages of defunct web sites containing sensitive directories remain cached and available to anyone. The cached data, viewed by iTnews, includes 22,000 credit card numbers, including CVVs, expiry dates, names and addresses. Up to 19,000 of these numbers could be active. Most are customers in the US and Britain although some are Australian. The credit card numbers are for accounts held with Visa, Mastercard, American Express, Solo, Switch, Delta and Maestro/Cirrus. Within the address bars of the cached pages are URLs of companies, including UK retailers of laboratory supplies, sports and health goods, apparel, photo imaging and clothing.

I have an open question for the people who complain about the potential of advertising networks to track your behavior on the Internet: What is a better way? Some might say that all behavioral targeting should simply be banned. But if you don't think that showing Chevy ads to people looking for cars is equivalent to poisoning the peanut butter, we need a middle ground that explains to people what's going on and lets them decide what is acceptable. This is much harder than it sounds: Any one Web page you visit can have a dozen advertisements and invisible bits of code that each send information about you to different companies, each with different ways of using that data. The privacy policy of the site you are looking at - not that anyone reads privacy policies - can't even try to explain this to you, because the site owner doesn't even know what all of its advertisers are doing. I'm coming to the conclusion that each advertisement on a page has to speak for itself. That's implicit in the approach Google is taking for its new behavioral targeting system. It puts the phrase "Ads by Google" on all its advertisements. Click that link and you'll get some limited information about Google's targeting system and an ability to adjust some of the interests that Google is tracking. But Google's approach is presented in a way that glosses over what they are doing and discourages people from reading the disclosure and exercising control, says Joseph Turow, a marketing professor at the Annenberg School for Communication of the University of Pennsylvania. Mr. Turow has developed a plan that is simpler and more comprehensive: Put an icon on each ad that signifies that the ad collects or uses information about users. If you click the icon, you will go to what he calls a "privacy dashboard" that will let you understand exactly what information was used to choose that ad for you. And you'll have the opportunity to edit the information or opt out o

The Federal Trade Commission had some sharp words for Internet advertising companies Thursday, saying that they simply are not disclosing how they collect information about users well enough. And the agency threatened that the industry had better get its act together - or else. Or else what? Well, that's a bit harder. The commission has limited ability to issue binding regulations on advertising practices, and the process is cumbersome. But if the agency were to say that its attempt over the last few years to have Internet companies voluntarily bolster their privacy standards has failed, it could encourage Congress to pass online privacy legislation. Indeed, two members of the commission - Pamela Jones Harbour, an independent, and Jon Leibowitz, a Democrat - issued statements saying that while they support the commission's action, they hope for further regulation and possibly legislation on the issue. What the commission issued Thursday was the final version of its principles for online behavioral advertising - that is, ads shown to you based on something you did in the past. The agency issued its first draft of these at the end of 2007 and spent more than a year digesting comments. These principles were meant to spur various Internet groups to create self-regulatory standards for their members. And one group, the Network Advertising Initiative, did publish new rules. The top recommendation was that users should be given clear notice about what information was collected and an easy way to tell sites to stop watching them. "What we observe is that, with rare exception, is not the rule for any Web sites," said Eileen Harrington, the acting director of the commission's bureau of consumer protection, in an interview Thursday. "It is far more commonplace to put the information in the midst of lengthy and hard-to-understand privacy policies."

Visa Inc.'s top risk management executive today dismissed what she described as "recent rumblings" about the possible demise of the PCI data security rules as "premature" and "dangerous" to long-term efforts to ensure that credit and debit card data is secure. Speaking at Visa's Global Security Summit in Washington, Ellen Richey, the credit card company's chief enterprise risk officer, insisted that despite recent data breaches at two payment processors, the Payment Card Industry Data Security Standard (PCI DSS) "remains an effective security tool when implemented properly." Richey added that breaches such as the ones at Heartland Payment Systems Inc. and RBS WorldPay Inc. were shaping public opinion and obscuring what otherwise has been "substantial progress" on the security front over the past year. "I'm sure that everyone in this room has read the headlines questioning how an event of this magnitude could still happen today," Richey said, referring to the Heartland breach. "The fact is, it never should have" - and indeed wouldn't have if Heartland had been vigilant about maintaining its PCI compliance, according to Richey. "As we've said before," she continued, "no compromised entity has yet been found to be in compliance with PCI DSS at the time of a breach." Pointing to Visa's decision last week to remove both of the breached payment processors from its list of PCI-compliant service providers, Richey said that Heartland would face fines and probationary terms that were proportionate to the still-undisclosed magnitude of the breach. "While this situation is unfortunate, it does not make me question the tools we have at our disposal," she said of the PCI rules.