Privacy & Information Security Law Blog

On December 5, 2013, the Federal Trade Commission announced a proposed settlement with mobile app developer Goldenshores Technologies, LLC (“Goldenshores”) following allegations that Goldenshores’ privacy policy for its popular Brightest Flashlight Free app deceived consumers regarding how the app collects information, including geolocation information, and how that information may be shared with third parties. Brightest Flashlight Free, developed for the Android operating system, allows its users to use their cell phones as flashlights.

On November 22, 2013, New Jersey’s Acting Attorney General announced that the State had entered into a settlement agreement with Dokogeo, Inc. (“Dokogeo”), a California-based company that makes mobile device applications, regarding allegations that one of the company’s mobile apps violated the Children’s Online Privacy Protection Act of 1998 (“COPPA”), the recently amended Children’s Online Privacy Protection Rule (the “Rule”) and the New Jersey Consumer Fraud Act.

On November 15, 2013, the U.S. Government Accountability Office (“GAO”) released a report (the “Report”) finding that the current federal statutory privacy scheme contains “gaps” and “does not fully reflect” the Fair Information Practice Principles (“FIPPs”). The Report focused primarily on companies that gather and resell consumer personal information, and on the use of consumer personal information for marketing purposes.

On November 19, 2013, the Federal Trade Commission held a workshop in Washington, D.C. to discuss The Internet of Things: Privacy & Security in a Connected World. FTC Chair Edith Ramirez and FTC Senior Attorney Karen Jagielski provided the opening remarks. Chairwoman Ramirez raised three key issues for workshop participants to consider:

On November 4, 2013, the data protection authority (“DPA”) of the German state of Rhineland-Palatinate announced two sets of recommendations for mobile payment systems, including contactless payments. The recommendations were prepared in conjunction with the state consumer protection agency, the Ministry of Justice for Rhineland-Palatinate, the mobile payment industry and research organizations.

On October 8, 2013, a Royal Decree was published completing the transposition of the EU Data Retention Directive 2006/24/EC (the “Data Retention Directive”) into Belgian law. The Royal Decree was adopted on September 19, 2013.

On September 23 and 24, 2013, a declaration and eight resolutions were adopted by the closed session of the 35th International Conference of Data Protection and Privacy Commissioners and have been published on the conference website. This blog post provides an overview of the declaration and the most significant resolutions.

On July 16, 2013, the Ministry of Industry and Information Technology of the People’s Republic of China (the “MIIT”) issued a new rule entitled Provisions on the Registration of Real Identity Information of Telephone Users (the “Provisions”), which will take effect on September 1, 2013. The Provisions were issued pursuant to the Resolution of the Standing Committee of the National People’s Congress Relating to Strengthening the Protection of Information on the Internet (the “Resolution”) and the Telecommunications Regulations of the People’s Republic of China. In April 2013, the MIIT issued a draft of the Provisions and solicited public comment.

On July 25, 2013, the U.S. Department of Commerce’s National Telecommunications and Information Administration announced the release of the Short Form Notice Code of Conduct to Promote Transparency in Mobile App Practices, which was developed through the Privacy Multistakeholder Process: Mobile Application Transparency convened by the Department of Commerce. The voluntary Code of Conduct provides guidance regarding short-form notices about the collection and sharing of consumer information with third parties. Short-form notices that comply with the Code of Conduct generally must contain the following content:

On June 5, 2013, the United States District Court for the Northern District of Ohio denied an employer’s motion to dismiss, holding that the Stored Communications Act (“SCA”) can apply when an employer reads a former employee’s personal emails on a company-issued mobile device that was returned when the employment relationship terminated. The defendants, Verizon Wireless (“Verizon”) and the manager who allegedly read the plaintiff’s emails, argued that the SCA applies only to computer hacking scenarios, and that the plaintiff authorized the reading of her personal emails. The court rejected both of the arguments, finding:

On June 13, 2013, the Food and Drug Administration (“FDA”) published a safety communication and guidance regarding the vulnerability of medical devices to cyberattacks. The safety communication, Cybersecurity for Medical Devices and Hospital Networks, is intended for “[m]edical device manufacturers, hospitals, medical device user facilities, health care IT and procurements staff; and biomedical engineers.” The safety communication notes that because medical devices can be connected to other devices and the Internet, such devices are exposed to cyber attacks that might result from malware infections, the exploitation of weak password protections, a lack of updated security patches and security vulnerabilities in software installed on medical devices.

On June 6, 2013, a group of 300 gathered in Santa Marta, Colombia, the second oldest city in South America, for the First Latin America Congress on Data Protection. The Congress was organized by Colombia’s data protection authority, the Superintendency of Industry and Commerce, and the Centre for Information Policy Leadership at Hunton & Williams LLP. “Latin America is very important to Centre member companies, and education is a key element of the Centre’s Latin America Project. So, we were very pleased to help the Superintendent organize the program,” said Centre President Marty Abrams.

In April 2013, the Ministry of Industry and Information Technology of the People’s Republic of China (the “MIIT”) issued a new rule entitled the “Notice on Strengthening the Administration of Networked Smart Mobile Devices” (the “Notice”). This Notice, which will become effective on November 1, 2013, was issued in draft form in June 2012 along with a request for public comment.

On April 17, 2013, the Federal Trade Commission issued a press release seeking public input on “The Internet of Things” – the ability of numerous “everyday devices to communicate with each other and with people.” The FTC will accept comments through June 1, 2013, in advance of a public workshop to be held in Washington, D.C. on November 21, 2013.

On February 27, 2013, the Article 29 Working Party (the “Working Party”) adopted an Opinion (the “Opinion”) addressing personal data protection issues related to the development and use of applications on mobile devices. The Opinion identifies the key data protection risks associated with mobile apps and clarifies the legal framework and obligations applicable to the various parties involved in the development and distribution of mobile apps, including app stores, app developers, operating system and device manufacturers and advertisers.

On March 8, 2013, the Federal Trade Commission issued a staff report entitled Paper, Plastic… or Mobile? An FTC Workshop on Mobile Payments (the “Report”). The Report is based on a workshop held by the FTC in April 2012 and highlights key consumer and privacy issues resulting from the increasingly widespread use of mobile payments.

Although the FTC recognizes the benefits of mobile payments, such as ease and convenience for consumers and potentially lower transaction costs for merchants, the Report notes three areas of concern with the mobile payments system: (1) dispute resolution, (2) data security and (3) privacy.

On February 22, 2013, the Federal Trade Commission announced that it had settled charges against HTC America, Inc. (“HTC”) alleging that the mobile device manufacturer “failed to take reasonable steps to secure the software it developed for its smartphones and tablet computers, introducing security flaws that placed sensitive information about millions of consumers at risk.” This settlement marks the FTC’s first case against a mobile device manufacturer.

On February 4, 2013, the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik or “BSI”) published a paper (in German) providing an overview of the information technology risks inherent in consumerization and bring your own device (“BYOD”) strategies. The Paper responds to what the BSI views as a growing trend of employees making personal use of employer IT systems as well as using their personal IT devices for work purposes.

On February 1, 2013, the Federal Trade Commission issued a new report entitled Mobile Privacy Disclosures: Building Trust Through Transparency. The report makes recommendations “for the major participants in the mobile ecosystem as they work to improve mobile privacy disclosures,” offering specific recommendations for mobile platforms, app developers, advertising networks and other third parties operating in this space. The FTC’s report also makes mention of the Department of Commerce’s National Telecommunications and Information Administration’s efforts to engage in a multistakeholder process to develop an industry code of conduct for mobile apps.

On February 1, 2013, the Federal Trade Commission announced that Chairman Jon Leibowitz will step down from his role on February 15, 2013. Leibowitz, who has been with the Commission since 2004 and was appointed Chairman in 2009, leaves the agency with a much more aggressive privacy agenda than the one he inherited, having helped to shape “groundbreaking work on consumer protection and competition issues.” During what may be his final press conference as Chairman, Leibowitz announced a new staff report on mobile app privacy disclosures and an enforcement action against the operator of a social networking app stemming from allegedly deceptive information collection practices that violated Section 5 of the FTC Act and the Children’s Online Privacy Protection Act.

In an interview with Tom Field of BankInfoSecurity, Lisa J. Sotto, partner and head of the Global Privacy and Data Security practice at Hunton & Williams LLP, discussed the top privacy trends and threats for 2013. Lisa predicts that security vulnerabilities will remain the biggest threat to privacy, particularly with the move toward mobile computing. She also talked about key issues to watch in 2013, such as online behavioral advertising, big data and evolving privacy legislation and regulation, especially in the EU and other countries around the globe.

Listen to Lisa’s ...

In a January 13, 2013 blog post, the Federal Trade Commission’s Bureau of Consumer Protection’s Business Center Blog highlighted the FTC’s recent groundbreaking settlement for violations of the Fair Credit Reporting Act (“FCRA”) in the mobile app context. The settlement with Filiquarian Publishing, LLC, Choice Level, LLC, and Joshua Linsk (the owner of Filiquarian and Choice Level, collectively, the “Companies”), is the first FCRA enforcement action against a mobile app developer. Filiquarian offered mobile apps to consumers for purposes of conducting criminal background checks in numerous states, and Choice Level provided the criminal background checks used by the apps to Filiquarian.

Reporting from Washington, D.C., Hunton & Williams associate Andrew Walsh writes:

Data embedded in photos can make a picture worth far more than a thousand words. To provide an example rich in irony, a well-known figure in Internet security who was wanted for police questioning recently inadvertently pinpointed his location for the authorities with an online posting of a photo containing Exchangeable Image File (“EXIF”) data. EXIF data is saved with JPG files on digital cameras and, if the camera has GPS, the EXIF data may include geolocation information such as the date, time, longitude, latitude and altitude of the photo.

On December 10, 2012, the Federal Trade Commission issued a new report, Mobile Apps for Kids: Disclosures Still Not Making the Grade, which follows up on the FTC’s February 2012 report, Mobile Apps for Kids: Current Privacy Disclosures are Disappointing. The FTC conducted a follow-up survey regarding pre-download mobile app privacy disclosures, and whether those disclosures accurately describe what occurs during use of the apps.

On November 29, 2012, the Federal Communications Commission (“FCC”) issued a declaratory ruling finding that certain text messages businesses send to confirm a consumer’s request to opt out of text message programs do not violate a federal prohibition on sending text messages without prior express consent. This prohibition has spawned class actions against companies that have followed the provisions in the Mobile Marketing Association’s U.S. Consumer Best Practices and other industry guidelines that require companies to send a confirmatory text message in response to a consumer’s opt-out request. The FCC’s finding is limited to sending confirmatory text messages under the following conditions:

In late October 2012, California Attorney General Kamala D. Harris began sending letters to approximately 100 mobile app operators, informing them that they are not in compliance with the California Online Privacy Protection Act (“CalOPPA”). Pursuant to CalOPPA, “an operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service” must post a privacy policy that contains specified elements. A mobile app arguably could be an “online service” under CalOPPA, which provides that an online service operator that collects “personally identifiable information” and “fails to post its policy within 30 days after being notified of noncompliance” is in violation of CalOPPA. The law affects a wide range of mobile app operators because of its very broad definition of “personally identifiable information,” which includes any “individually identifiable information about an individual consumer collected online by the operator from that individual and maintained by the operator in an accessible form,” such as a name, an email address or any other identifier “that permits the physical or online contacting of a specific individual.”

In partnership with SC Magazine, we are pleased to announce that on November 22-23, 2012, SC Magazine will host its 2012 Virtual Summit “Tackling the Big 3: Clouds, Consumerisation, Cybercrime,” featuring Hunton & Williams partner Bridget Treacy. Following a year of sharp increases in data breaches and regulatory fines, the SC Summit will explore and focus on cybercrime, mobile devices and cloud security – three key priorities for 2013. Bridget Treacy and Paul Swarbrick, Chief Information Security Officer and Head of Cybersecurity for National Air Traffic Services, will open the Summit with their keynote presentation, “Where’s the Danger? From Cybercrime to Consumerisation to the Cloud, Today’s Most Potent Threats Unmasked.” Paul will discuss the data security issues that keep him awake at night and Bridget will offer vital, current perspective on the ever-changing legal landscape.

On September 13, 2012, the PCI Security Standards Council (“PCI SSC”) issued new guidelines entitled “PCI Mobile Payment Acceptance Security Guidelines” (the “Guidelines”), which outline best practices for mobile payment acceptance security. As we reported in May, the PCI SSC Mobile Working Group published its “At a Glance: Mobile Payment Acceptance Security” fact sheet, detailing how merchants can more securely accept payments on mobile devices.

On September 12, 2012, Congressman Edward Markey (D-MA) released a bill that would require companies to tell customers about monitoring software installed on their mobile devices and obtain customers’ express consent before engaging in monitoring. These requirements would apply to mobile phone makers, network providers and application developers.

On September 5, 2012, the Federal Trade Commission issued guidelines for mobile app developers entitled “Marketing Your Mobile App: Get It Right from the Start.” The guidelines are largely a distillation of the FTC’s previously expressed views on a range of topics that have relevance to the mobile app space. They are summarized below:

On July 12, 2012, the National Telecommunications and Information Administration (“NTIA”) of the U.S. Department of Commerce initiated a multistakeholder process to develop guidance for transparency in the mobile environment. The NTIA has announced that they will schedule a second meeting in August, and encouraged small group discussions in the interim. This is not the first multistakeholder process to wrestle with transparency in the mobile environment, and those previous efforts – which date back almost a decade – may prove useful to such discussions.

On July 12, 2012, the National Telecommunications and Information Administration (“NTIA”) of the U.S. Department of Commerce convened the first meeting of its multistakeholder process to develop industry codes of conduct. As we reported in June, the stated purpose for this meeting, entitled “Seeking Common Ground Regarding Mobile Application Transparency,” was to establish “a working dialogue that will eventually lead to a code of conduct that is broadly adopted.” Lawrence Strickling, Department of Commerce Assistant Secretary for Communications and Information, opened the session, which he characterized as an effort to highlight the key issues and explore topics to be addressed. Strickling emphasized that the structure and approach to the work would likely differ from that with which participants were familiar, and that it would be important to arrive at a constructive process that encourages collaboration and open engagement.

On May 30, 2012, the Federal Trade Commission hosted a public workshop addressing the need for new guidance on advertising and privacy disclosures online and in mobile environments. During the workshop, the FTC announced that it hopes to release an updated version of its online advertising disclosure guidance this fall that would incorporate input from businesses and consumer advocates. Topics explored at the workshop included:

• Best practices for privacy disclosures on mobile platforms and how they can be short, effective and accessible to consumers;
• how to put disclosures in proximity to offers on mobile platforms;
• social media disclosures; and
• the placement of material information on webpages.

On June 15, 2012, the National Telecommunications and Information Administration (“NTIA”) announced that, in response to a substantial number of comments it received regarding mobile privacy issues, it will convene its first multistakeholder meeting on July 12 to begin the process of developing a code of conduct that promotes transparency in the mobile application context.

On May 16, 2012, the PCI Security Standards Council’s (“PCI SSC’s”) Mobile Working Group published its “At a Glance: Mobile Payment Acceptance Security” fact sheet (the “Guidance”), which outlines best practices for securely accepting payments via mobile devices. The Guidance offers merchants practical advice for partnering with a Point-to-Point Encryption (“P2PE”) solution provider and satisfying their PCI Data Security Standard compliance requirements in the context of mobile payment acceptance. The Guidance includes recommendations for maintaining data security throughout the payment lifecycle, including securing account data at the point of capture and using an approved hardware accessory in combination with a validated P2PE solution.