Info Law Group : Technology Lawyers & Attorneys : Information Law Group : Privacy, Security & Intellectual Property Law

When I was a kid in Las Vegas, I had a “pen pal” in France. We exchanged the occasional letter, painfully translating into each other’s languages and then trying to figure out how much postage to stick on the envelope. It seems quaint now.

Thanks to Facebook, LinkedIn, and Twitter, I’ve enjoyed meeting people with similar interests and reconnecting with people I knew socially or professionally in years past, in several countries. It’s usually pretty easy to look up people as you think of them, and there’s no postage and little delay.
Those services, and an array of other social media, have become truly international. Some 15% of the world’s Internet users are American, so even successful social media operators in the US naturally look abroad to expand their increasingly monetized networks. Competing with national and regional social networks throughout the world, leading social networking providers in the US, Europe, China, and India have turned social media into a global phenomenon. To take one prominent example, US-based Facebook now translates into more than 100 languages and reported this month at InsideFacebook.com that nearly 70% of its hundreds of millions of users reside outside the United States.

Facebook aggregates users’ self-reported demographic data and sells the information to advertisers, who are understandably eager to tap the advertising possibilities of social media.  In several developed countries, a third or more of the population uses Facebook, many on a daily basis.

Facebookers and other social networkers often end up sharing a large amount of personal and professional information over time with friends . . . and friends of friends, and friends of friends of friends, and ultimately with a lot of people they wouldn’t recognize across a restaurant. By some estimates, roughly a third of Facebook users ultimately divulge their home address and current employment to an unknown number of people who are perhaps not all really their friends. New York Senator Charles Schumer recently called on the Federal Trade Commission to develop guidelines for social networking sites, and the FTC has already had occasion to investigate the extent to which identity theft and fraud are attributable to bad hygiene, or bad policies, in social media.

Most of the social networking groups I belong to are professional ones, linking lawyers, business people, inventors, IT managers, academics, and government officials who share certain interests and follow developments in particular fields. Those who participate often share ideas and some personal and career information, and they sometimes comment about their own companies or organizations or the offerings of their competitors.

So, as a lawyer, it strikes me that some social networkers may be exposing themselves not only to embarrassment and unwanted solicitations but also to fraud or identity theft. They also may be setting themselves up for trouble with prospective employers, or with their current employers or business partners who feel the talkative social networker has violated confidentiality policies or nondisclosure agreements (in surveys, many large US employers acknowledge that they have fired or disciplined employees for the contents of their posts or blogs). Advertising thinly disguised as a Tweet or post may not conform to advertising rules in all the relevant states, provinces, or countries. An intemperate rant or sly aside, broadcast to a few hundred of the user’s “closest friends,” raises the potential of liability for defamation or commercial disparagement. Comments about associates or coworkers, especially in the context of social media that blur the lines between personal and professional life, may trigger sanctions under privacy and data protection laws. And thanks to the global nature of social media, the hapless social networker could conceivably run afoul of laws in multiple jurisdictions.

It’s not only the FTC that has started worrying about the dark side of social media. The Article 29 Data Protection Working Party (comprised of EU authorities and European national data protection commissioners) issued a statement this month declaring that Facebook’s new default privacy settings are dangerous. The group has also warned social media applications developers (such as FarmVille) to be careful in their handling of user data. Regulators on both sides of the Atlantic have expressed concern as well about behavioral marketing applications based on gathering information about an individual’s participation in social media.

It’s easy to over-react to the hazards of social media, of course. Some parents forbid their children from joining in (and some teens have created a “safe” MySpace page that their parents can see, while secretly maintaining a more dubious version to share with their peers). Some users decide to drop out entirely, finding the risks, or just the implied obligation to post and respond frequently, unmanageable; there is even a “Quitting Facebook” Community Page on Facebook itself. Reasonably careful social networkers simply look at the privacy policies and options and adjust their settings appropriately to their intended use – and then watch what they say about employers, competitors, and other sensitive types. Some corporations have blocked access to social networking sites from company computers and adopted policies against their employees saying, well, pretty much anything about the company or its competitors or regulators. But other companies have already designated a “director of social media” to help the organization make effective use of social networking, internally and externally.

It seems that the trend is for employers to expand their “acceptable use” policies on email and web browsing to encompass blogging and social media as well. This is a necessary step, but it is also fraught with concerns arising from labor law, privacy law, and rights of association and free expression, and the rules differ across the many jurisdictions that may be at issue.

It is possible to set some boundaries that will pass muster just about anywhere and articulate policies that guide employees toward safe and sensible use of social media. There is much to be learned in the way of evolving best practices, especially among large multinational employers. Just don’t forget to check with a knowledgeable lawyer when crafting such policies and determining how to enforce them.
 

The Definitions of "Creditor" and "Credit"

"Creditor" and "credit" are defined terms under the FACTA Red Flags Rule. The Fair and Accurate Credit Transactions Act (FACTA) (15 U.S.C. § 1681a(r)(5)) incorporates by reference the definitions of "creditor" and "credit" found in the Equal Credit Opportunity Act (ECOA). The ECOA defines "creditor" as "any person who regularly extends, renews, or continues credit; any person who regularly arranges for the extension, renewal, or continuation of credit; or any assignee of an original creditor who participates in the decision to extend, renew, or continue credit." 15 U.S.C. § 1691a(e). The ECOA defines "credit" as "the right granted by a creditor to a debtor to defer payment of debt or to incur debts and defer its payment or to purchase property or services and defer payment therefor." 15 U.S.C. § 1691a(d).

The FTC's Position

As noted in the AMA complaint, the FTC's position on the application of the Red Flags Rule to physicians (and to attorneys) was first spelled out on April 30, 2009 in a footnote of its "Extended Enforcement Policy: Identity Theft Red Flags Rule":

In FACTA, Congress imported the definition of creditor from the [ECOA] for purposes of the [FCRA]. This definition covers all entities that regularly permit deferred payments for goods or services. The definition thus has a broad scope and may include entities that have not in the past considered themselves to be creditors. For example. creditors under the ECOA include professionals, such as lawyers or health care providers, who bill their clients after services are rendered.

(Emphasis added.)

In May 2009, the FTC published another document on its website entitled "'The ‘Red Flags’ Rule: What Health Care Providers Need to Know About Complying with New Requirements for Fighting Identity Theft.”  That document stated as follows:

Health care providers may be subject to the Rule if they are “creditors.” Although you may not think of your practice as a “creditor” in the traditional sense of a bank or mortgage company, the law defines “creditor” to include any entity that regularly defers payments for goods or services or arranges for the extension of credit. For example, you are a creditor if you regularly bill patients after the completion of services, including for the remainder of medical fees not reimbursed by insurance. Similarly, health care providers who regularly allow patients to set up payment plans after services have been rendered are creditors under the Rule. Health care providers are also considered creditors if they help patients get credit from other sources — for example, if they distribute and process applications for credit accounts tailored to the health care industry.

In a press release dated July 29, 2009, the FTC referenced a document that provided answers to frequently asked questions (FAQs), which reiterated its position that attorneys and health care providers are required to comply with the Red Flags Rule when their billing arrangements qualify them as creditors under FACTA and the ECOA:

the definition of "creditor" is broad, and includes businesses or organizations that regularly provide goods or services first and allow customers to pay later. . . . Examples of groups that may fall within this definition are utilities, health care providers, lawyers, accountants, and other professionals, and telecommunications companies.

The AMA's Position

The AMA argues that physicians are not creditors under the Rule and that the practice of allowing deferred payment by patients, particularly in emergency circumstances, serves a number of purposes unique to the profession:

. . . The practice of not demanding payment at the time care is provided serves several purposes. It gives a benefit to patients who are often under stress when receiving care. It underscores that the physician has a fiduciary relationship with the patient and thereby furthers the patient-physician relationship. Where the patient is insured, the practice enables the insurer to determine what portion of the bill is covered and what amount should be billed to the patient. Because the amount that the patient will owe the physician is not certain at the time that services are provided, the physician does not defer payment of a “debt” by billing after the patient is treated. In many cases, a physician is not entitled to bill patients immediately upon providing services under contracts with health insurance carriers.

Physicians also provide emergency medical care to patients whose identifying information may be unknown to them and who may even be unconscious. In some emergency situations, which may occur for certain physicians on a regular basis, there is no practical way for the physician to bill for his or her services at the time of those services. Further, it would violate the norms of human decency, not to mention principles of ethical conduct . . . , for a physician to demand payment at the time of service in such situations. Indeed, federal law requires a physician to provide services to a patient in an emergency condition without regard to the patient’s ability to pay. See 42 U.S.C. § 1395dd.

The AMA further argues that the Red Flags Rule would interfere with the patient-physician relationship and a physician's ethical responsibilities:

the FTC’s attempt to impose a duty upon physicians to investigate each patient’s identity in advance of treatment conflicts with basic precepts concerning the patient-physician relationship and physicians’ ethical responsibilities to safeguard that relationship. “From ancient times, physicians have recognized that the health and well-being of patients depends upon a collaborative effort between physician and patient.... The patient-physician relationship is of greatest benefit to patients when they bring medical problems to the attention of their physicians in a timely fashion, provide information about their medical condition to the best of their ability, and work with their physicians in a mutually respectful alliance.” AMA, Ethical Opinion 10.01 (“Fundamental Elements of the Patient-Physician Relationship”). Because the success of diagnosis and treatment depends on patients’ willingness to divulge often private and highly sensitive information to their physicians, the patient-physician relationship “is based on trust and gives rise to physicians’ ethical obligations to place patients’ welfare above their own self-interest and above obligations to other groups, and to advocate for their patients’ welfare.” AMA, Ethical Opinion 10.015 (“The Patient-Physician Relationship”). Contrary to these obligations, the FTC requires physicians to approach each new patient with skepticism concerning his or her identity. As a result, the FTC’s Extended Enforcement Policy compromises physicians’ ability to gain new patients’ trust, which is essential to the well-being of patients.

Finally, the AMA argues that, when Congress intends to regulate the practice of medicine, it does so expressly (e.g., in enacting the Health Information Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH).

The Court's Analysis in ABA v. FTC

Naturally, the analysis of the District Court in ABA v. FTC (currently on appeal) is of interest here.  In that case, the court applied the test for review of agency action set forth in Chevron, U.S.A., Inc. v. Natural Resources Defense Council, Inc., 467 U.S. 837 (1984), and concluded that the FTC's actions violated the Administrative Procedure Act and must be rejected "because the Red Flags Rule cannot be properly applied to attorneys in the overly broad manner in which the Commission seeks to enforce it."

First, the court found that "it was not 'the unambiguously expressed intent of Congress,' Chevron, 467 U.S. at 842-43, to bring attorneys within the purview of the FACT Act and thus subject them to regulation by the Commission's Red Flags Rule." Footnote 9 of the court's decision, while dicta, is particularly interesting for purposes of the new AMA lawsuit.  There, the court rejected the FTC's reliance on a particular Sixth Circuit case regarding medical providers:

The Court is not persuaded that the Commission's reliance on Barney v. Holzer Clinic, Ltd., 110 F.3d 1207 (6th Cir. 1997), is sound given that the Sixth Circuit expressly refused to address the question of whether a medical services provider was a creditor under ECO Act, id. at 1209 . . . and made findings to the contrary, id. at 1211 ("The provision of medical treatment under this program is not a credit transaction, either under the technical language of the ECO[ Act] or in the more common sense of the term, any more than is a court-appointed attorney's agreement to represent an indigent defendant.").

(Emphasis added.)

The court also rejected the FTC's reliance on the Federal Reserve Board's staff notes to Regulation B (which state that, if a doctor or lawyer allows the client or customer to defer the payment of a bill, that deferral of debt is credit for purposes of the “incidental credit” regulation, even though there is no finance charge and no agreement for payment in installments).  The court did so "because those interpretations were made in a context totally unrelated to identity theft, and therefore the Court is not convinced that it is proper to presume that Congress intended to adopt the Regulation B interpretations when it enacted the FACT Act. Accordingly then, absent any legislative history showing that the Federal Reserve Board's staff's interpretation of Regulation B was actually considered by Congress when enacting the FACT Act, and given that the purposes of the FACT Act and Regulation B do not square with one another, the Court cannot draw the inference the Commission urges."

The court also noted that monthly billing by lawyers is driven by practical considerations:  "Invoicing clients for services previously rendered, instead of demanding immediate payment when service is provided is more likely an outgrowth of practicality and necessity, rather than an attempt to provide clients credit."

Although the court resolved the issue under the first prong of Chevron, it went on to determine that, "even if [it] were to reach question two of Chevron by finding that the FACT Act did not foreclose the Commission's regulation of attorneys, it would still find that the Commission's interpretation of the FACT Act and its resulting application of the Red Flags Rule to attorneys is unreasonable and therefore undeserving of deference." 

In its Chevron prong two discussion, the court took issue with the FTC's interpretation of what it means to "defer" payment, again noting the practicality of monthly billing by lawyers:

To invoice client at the end of each month is not delaying payment or giving a client a right to postpone payment. As a practical matter in the legal context, legal services are not the type of services that can in may instances be billed and payment received simultaneously with the occurrence of the services, as can be done, for example, when one's furnace is repaired or catering services are provided for a wedding.   . . . And as a practical matter, it would be unreasonable to expect attorneys to bill for services in any manner other than periodically, especially given the frequent unanticipated services attorneys have to perform for their clients or the practical reality that clients may lack the ability to immediately access funds when legal services unexpectedly have to be performed without delay. Not only would immediate billing and collection of fees and expenses be impractical, considering the unique nature of the practice of law, but contrary to the Commission's position, conducting a legal practice in that manner would be extremely costly and time consuming. It does not take much imagination to appreciate the added cost and burden attorneys would incur if they were required to immediately calculate, bill and collect their fees after each task is performed or else run afoul of the Commission's construction of the FACT Act through its adoption of the Red Flags Rule.

Query whether the same analysis should apply to physicians.  We shall see.

So, Must Physicians Comply with the Red Flags Rule by June 1?

Yes, for now.  Indeed, the BNA Privacy and Security Law Report reports that, pending resolution of the litigation, the AMA has encouraged physicians to comply with the rule, using online resources provided by the AMA.

That question might well be raised in many states that, like Maine, require some form of “economic loss” to sustain an action for negligence. The answer from the Maine Law Court could be an important precedent. So far, plaintiffs in the United States have generally been unsuccessful in pursuing claims against merchants based on fear of identity theft and incidental expenses to protect against it, following a security breach incident. “Lost time and effort” may not be worth a great deal in damages to any single cardholder, but if Maine allows such claims to proceed, a class action with millions of class members could make “time and effort” claims daunting, as well as allowing plaintiffs to sustain an action in which emotional distress can also be asserted as grounds for damages. 

This development should serve as an additional spur for retailers to take precautions against the kinds of attacks that resulted in Hannaford’s data losses. Adherence to applicable security guidelines, prominently the Payment Card Industry Digital Security Standard (PCI DSS), will go far to avoid such incidents and protect a company from fines and civil liability as well. The Hannaford hackers, one of whom is now in jail, used SQL injection to plant malware in the merchant’s servers. This is hardly a new technique, and it is one that retailers may be held accountable for neglecting. 

In 2008 Hannaford, which operates more than 150 grocery stores in New York and New England, announced that its payment card processing servers had been hacked for several months, exposing millions of payment card records and resulting in thousands of fraud investigations in the Northeast. In August this year, a federal grand jury in Newark, New Jersey indicted a 28-year-old Florida hacker named Albert Gonzalez (formerly an informant for the US Secret Service) and two unnamed persons living “in or near Russia” as conspirators who allegedly carried out the Hannaford hack and several others, including massive attacks on Heartland Payment Systems and the 7-11 retail chain. Gonzalez is already awaiting trial on charges in connection with the TJX hack in 2007. Altogether, the ring is accused of stealing data on more than 130 million credit cards and debit cards. According to the TJX and Hannaford/Heartland indictments, the hackers used several methods, but primarily SQL injection, to gain access to the target networks and install sniffer malware that intercepted card details and transmitted them to computers controlled by the hackers. 

The Federal Trade Commission has publicly taken the position that SQL attacks are “commonly known or reasonably foreseeable” (see, for example, the FTC Complaint against Guess?, Inc., and the FTC’s press release concerning Life is good, Inc.). Thus, the FTC has fined retailers following such attacks and in some cases entered consent orders imposing additional sanctions and requirements. This makes it relatively easy to assert negligence in a civil action on behalf of a class of cardholders following a successful SQL attack.

From “Reasonable” to Specific

Legal and IT personnel are generally familiar with a traditional pattern in privacy laws: Security is always mandated, but the statutory language is usually limited to generalities, stating that a company must develop and implement “reasonable” or “appropriate” security measures proportional to the risk of harm if the information at issue is lost, altered, or obtained by unauthorized persons. This sort of language is found, for example, in HIPAA and GLBA, FTC guidance on fair trade practices, SEC internal control rules under Sarbanes-Oxley (SOX), the EU Data Protection Directive, and the personal information security laws of Canada, Japan, Australia, and other jurisdictions. Some laws (or regulations issued under those laws) emphasize that these safeguards must include technical, organizational, and physical security measures, but they typically do not specify what those measures must be.

This is because lawmakers are well aware that technology and criminal tactics are both constantly changing. There is an understandable reluctance to define appropriate security measures based on current technology and practices that may be outmoded within a year or two.
Nevertheless, the spate of personal information security breaches, some of them on a breathtaking scale, and the rise of identity theft as the fastest-growing criminal activity tracked by the FBI and several foreign law enforcement agencies, have pushed legislators and regulators to become increasingly specific in mandating security measures for especially sensitive or risky categories of personal data. That trend is reflected in the new generation of privacy and information security laws and regulations outlined below, with significant consequences for compliance practices.

Lawyers will appreciate that these increasingly specific security requirements have an impact not only in the compliance context but in civil litigation based on common-law doctrines of negligence, invasion of privacy, and breach of contract or on “unfair or deceptive trade practices” under FTC Act sec. 5 and parallel state laws. Many large-scale security breaches involving credit or debit card details or Social Security Numbers have resulted in civil litigation, much of it in the form of class actions, lawsuits filed by the attorneys general in several states, or “private attorney general” actions in California.

Companies increasingly deploy security measures such as encryption, strong passwords, and access logs to protect sensitive personal data in a wider range of IT applications, partly in response to litigation risks and new compliance obligations. But as they do so, public and judicial perceptions of “industry standard” safeguards and “reasonable” security practices change; the bar is set higher. It becomes harder to defend against an “unfair practices” or negligence complaint following a security breach by asserting that the plaintiff had no reasonable expectation of privacy or that the defendant acted as a “reasonable man” in storing and transmitting sensitive personal data without encryption, for example, or with unchanged, four-digit passwords.

Very few lawsuits involving consumer or employee privacy have proceeded to trial. They are usually settled – publicly, in the case of class actions and lawsuits brought by the FTC or a state attorney general. Settlements and FTC consent decrees have often included specific security undertakings, including encryption and password controls, to avoid future privacy violations.

The key, then, is not to focus solely on compliance within the scope of specific statutory requirements, but to look at the trends in these requirements as a guide to effective risk management in the litigation context as well.

There is clearly a trend toward requiring encryption of sensitive personal data (particularly the identifiers used commonly in ID theft, as well as medical information), especially when that information is transmitted over public networks or wirelessly, or when that information is stored on laptops, USB drives, smart phones, PDAs, and other portable devices. These are precisely the circumstances in which most large-scale personal data security breaches have occurred.
So far, companies have not normally been required to routinely encrypt all such data on secure servers or in data centers and storage media located on their premises (or those of their contractors), behind firewalls and internal network or VPN controls. Some companies have chosen to do so, however, to further reduce their risks of noncompliance or litigation exposure.

Sources of Legal Requirements

In the next installment, I’ll review recent US state and federal laws or regulations that push organizations to reconsider encryption, especially for data in transit and on portable devices. Then, we’ll look at the international scene, and finally at standards that are often incorporated in legal and regulatory decisions as well as in contracts.