Info Law Group : Technology Lawyers & Attorneys : Information Law Group : Privacy, Security & Intellectual Property Law

G is for the Gramm-Leach-Bliley Act and the new model privacy notice form

H is for HIPAA and the HITECH Act, which impose privacy and data security obligations on health care providers and their business associates

I is for the International Association of Privacy Professionals, IAPP

J is for John and Jane Doe, anonymity - is there any such thing?

K is for Kearney v. Salomon Smith Barney Inc, California Supreme Court (2006), requiring two-party consent for recording or eavesdropping on telephone conversations, even if only one of the participants is in a two-party consent state

L is for Legislation -- will there be a federal breach notification law in 2010 (other than HITECH) that will preempt the state data breach notification laws?

M is for Massachusetts and its new data security regulations, 201 CMR 17.00 et seq., effective March 1, 2010

N is for Nevada and its new encryption law, SB 227, effective January 1, 2010

O is for Outsourcing, and the need for due diligence and contractual provisions to safeguard personally identifiable information (and other kinds of sensitive information) shared with third parties.  See, e.g., Massachusetts 201 CMR 17.00 et seq. and California Civil Code section 1798.81.5.  Oh yes, and don't forget the Cloud in this context - are you putting data in the cloud?  Have you done your due diligence?

P is Personally Identifiable Information or PII -- what IS it anyway?  Depends where you live.

Q is for Questions, Q & A, and the Q in FAQ:  ASK QUESTIONS early and often about how your organization will use personal information of customers and/or employees in its business operations.

R is for Radio Frequency Identification or RFID and locational privacy issues - should organizations be able to use RFID to track customers/products?

S is for SO many things -- Social Networking, Social Security numbers, Surveillance, Spam, . . .

T is for Telemarketing, Text Messages, and the TCPA -- do you have opt-in for your mobile marketing campaigns?

U is for the UK ICO, which will order companies to pay up to £500,000 as a penalty for serious breaches of the Data Protection Act

V is for the Video Privacy Protection Act or VPPA, the basis for a recent privacy class action filed against Netflix in the Northern District of California

W is for Website Privacy Policies, required under California law for any website that collects information from California residents, Cal. Bus & Prof. Code section 22575 et seq.  When was the last time you updated yours?  Is it accurate?

X is for XXXXX -- Redact the information!

Y is for Yes, You can implement a successful data protection program in Your organization

Z is for Zango, the adware distributor that settled FTC charges that it used unfair and deceptive methods (FTC Act Section 5)  to download adware and block consumer efforts to remove it

Happy Data Privacy Day!

In the world of the cloud, location appears to be irrelevant.  In the cloud, data effortlessly flows around the globe, ignoring boundaries and time zones, and magically appears on demand.  Not surprisingly, the existing legal structure is far from prepared for the reality of existing technology.  Every jurisdiction has its own laws, and its own compliance requirements.  As that data instantaneously circumnavigates the globe, it may already be too late to comply with privacy laws in every jurisdiction.

You have undoubtedly heard that the laws of this country are like a patchwork quilt.  They have popped up in certain sectors (financial, health) and with respect to certain types of sensitive information (e.g., kids' data).  There are federal laws like Gramm-Leach-Bliley (applicable to financial institutions), HIPAA (applicable to health care providers and others dealing with health information and related entities), COPPA (applicable to data of children under 13 collected online), and the USA Patriot Act (may be applicable to foreign companies that work with cloud providers that allow data to reside in or flow through the US).  In addition, we have a panoply of state laws requiring notification in the event of a breach of sensitive information and, in some cases, requiring the implementation of safeguards to protect sensitive information and/or secure disposal of such information.

By contrast, the European Union has a comprehensive privacy framework, the EU Data Protection Directive.  Each member state has its own unique law implementing the Directive.  The most notable thing about the EU Directive and member state laws for purposes of cloud computing is this -- in the absence of specific compliance mechanisms, the EU prohibits (yes, you read correctly, prohibits) the transfer of personal information of EU residents out of the EU to the US and the vast majority of countries around the world.

What does this mean for cloud computing?  If you want to put data in the cloud that includes personal information of EU residents (and that might be something as simple as an email address or employment information), and the data will flow from the EU to almost anywhere in the world, you cannot simple throw the data in the cloud and hope for the best.  You need to have, at a minimum, one or more of the following:

• International Safe Harbor Certification (which allows data transfer from the EU to the US, but not from the EU to other countries);

• model contracts (which allow data transfer from the EU to non-US countries, but do not always work well with multi-tiered vendor relationships); or

• Binding Corporate Rules (which are designed for a multinational company and therefore may not function well for cloud provider relationships).

So what, what does this tell us?  All of the stakeholders within an organization should be part of the cloud discussion and due diligence -- IT, legal, information security, and all of the relevant business groups.  And those stakeholders, in investigating a potential cloud relationship and in negotiating the terms of a relationship with a cloud provider, should consider and pose the following questions internally and to the vendor long before any contract is signed: 

• What kind of data will be in the cloud?

• Where do the data subjects reside?

• Where will the data be stored? 

• Where are the servers? 

• Will the data be transferred to other locations and, if so, when and where?

• Can certain types of data be restricted to particular geographic areas?

• What is our compliance plan for cross-border data transfers?

Is that the end of the inquiry?  No, it is just the tip of the iceberg, but it is a good start.