Canada, PIPEDA, Personal Information and Electronic Documents Act, Digital Privacy Act, consent, notice, breach notification, privacy policies, children, cross-border, transborder, extraterritorial jurisdiction
CANADA: Meaningful Consent, Inappropriate Data Practices, and Breach Notification
By W. Scott Blackmer on November 30, 2018
breach notification, California, data breach, Do Not Call Regulations, social security number, SSN
California Amends Data Breach Notification Law, Does Not Require Mandatory Offering of Credit Monitoring
By InfoLawGroup LLP on October 01, 2014
Breach, breach notification, California, data protection, data security, heartbleed, HIPAA, hipaa hitech, OpenSSL, passwords, Security, vulnerability
FAQs Concerning the Legal Implications of the Heartbleed Vulnerability
By InfoLawGroup LLP on April 14, 2014
Breach, breach notification, cyber insurance, cyberinsurance, heartland payment processor, litigation, PCI DSS, point of sale breach, Target, TJX
Payment Card Breaches: Time to Spread the Risk with Mandatory Cyber Insurance
By InfoLawGroup LLP on February 24, 2014
Breach, breach notification, California, Lawsuit
California Attorney General Files Lawsuit Based on Late Breach Notification
By InfoLawGroup LLP on January 29, 2014
anonymization, Big Data, breach notification, data breach, de-identification, Fair Information Practice Principles, FCRA, FTC, privacy
The Privacy Legal Implications of Big Data: A Primer
By InfoLawGroup LLP on February 12, 2013
Account Data Compromise Recovery Process, ADCR, GCAR, Global Compromised Account Recovery Program, payment card, PCI DSS, security breach, visa
VISA Phases Out the Account Data Compromise Recovery (ADCR) Process and Implements the Global Compromised Account Recovery (GCAR) Program
By InfoLawGroup LLP on January 09, 2013
damages, data breach, Hannaford, motion to dismiss Hannaford data breach payment card PCI DSS, payment card, PCI DSS
Federal Appeals Court Holds Identity Theft Insurance/Credit Monitoring Costs Constitute "Damages" in Hannaford Breach Case
By InfoLawGroup LLP on October 24, 2011
In a significant development that could materially increase the liability risk associated with payment card security breaches (and personal data security breaches, in general), the U.S. Court of Appeals 1st Circuit (the "Court of Appeals") held that payment card replacement fees and identity theft insurance/credit monitoring costs are adequately alleged as mitigation damages for purposes of negligence and an implied breach of contract claim. The decision in Hannaford could be a game changer in terms of the legal risk environment related to personal data breaches, and especially payment card breaches where fraud has been perpetrated. In this post, we summarize the key issues and holdings of the Court of Appeals.
damages, Hannaford, litigation, payment card, PCI DSS, security breach
"Damages" Last Stand - Maine Supreme Court Puts an End to the Hannaford Bros. Breach Suit
By InfoLawGroup LLP on September 22, 2010
The Maine Supreme Court has rendered its opinion on the "damages" issue in the Hannaford Bros. consumer security breach lawsuit. Again, the plaintiffs have been unable to establish that they suffered any harm as a result of the Hannaford security breach. Specifically, the Court ruled that "time and effort" alone spent to avoid or remediate reasonably foreseeable harm do not constitute "a cognizable injury for which damages may be recovered." In this blogpost we take a closer look at the Court's rationale.
Act, breach notification, CUTPA, data, HITECH, HIPAA
Health Net Agrees to $250,000 Fine and "Corrective Action Plan" to Settle Loss of PHI
By InfoLawGroup LLP on July 21, 2010
Breach, fiduciary duty, Heartland, litigation, negligence, payment card, PCI DSS, third party beneficiary
Heartland Bank and Keybank's Motion to Dismiss
By InfoLawGroup LLP on July 13, 2010
Accountability, Act, and, Breach, breach notification, brokers, Congress, data, Data Accountability and Trust Act, Data Privacy Law or Regulation, data security, H-R-2221, information, information brokers, Law, notification, or, privacy, Regulation, Security, Trust
The Breach Notification Obligations in the Data Accountability and Trust Act
By InfoLawGroup LLP on February 22, 2010
201 CMR 17-00, AES, anonymity, behavioral advertising, breach notification, California, cloud computing, contracts, DPA, Eavesdropping, encryption, EU Data Protection Directive, GLBA, HIPAA, HITECH, IAPP, Kearney, Massachusetts, personally identifiable information, pii, RFID, social networking, spam, SSN, TCPA, telemarketing, text messages, UK ICO, VPPA
Celebrating Data Privacy from A to Z
By InfoLawGroup LLP on January 28, 2010
In honor of Data Privacy Day and its spirit of education, I thought it might be appropriate (and fun) to celebrate some (but certainly not all) of the A, B, Cs of Data Privacy. Would love to see your contributions, too!
ADCR, BJ, BJ Wholesale Club, Breach, card, Club, damages, doctrine, economic, economic loss doctrine, fraud, Hannaford, litigation, loss, Massachusetts, mastercard, negligence, payment, payment card, PCI DSS, PCI DSS litigation, retailers, TJX, unfair practices, unfair practices Massachusetts visa mastercard ADCR, visa, Wholesale
Massachusetts's Highest Court Delivers BJ Wholesalers (and other Retailers) a Data Breach Liability Gift
By InfoLawGroup LLP on December 23, 2009
payment card, payment card security breach litigation, PCI DSS, PCI DSS heartland, security breach litigation
Quickhits: AMEX settles with Heartland Payment Systems for $3.6 Million
By InfoLawGroup LLP on December 22, 2009
breach notification, Congress, Data Accountability and Trust Act, data brokers, data security, H-R-2221, information brokers, Security, WISP
House Passes Data Accountability and Trust Act (DATA)
By InfoLawGroup LLP on December 10, 2009
litigation, payment, payment card, PCI DSS, PCI DSS Radiant Systems, Radiant, Savvis, security breach litigation, security breach litigation service provider, service provider, Systems
The Merchants Strike Back?
By InfoLawGroup LLP on December 03, 2009
210 CMR 17-00, breach notification, creditors, driver's license, FACTA, Fair Credit Reporting Act, FCRA, financial account, FIPS, FTC, generally accepted, health information, HIPAA, HITECH, key management, laptops, Massachusetts, medical data, Nevada, payment card, Payment Card Industry Digital Security Standard, PCI DSS, portable devices, public networks, Red Flags, Red Flags Rule, Security, social security number, SSN, wireless
Code or Clear? Encryption Requirements (Part 2)
By W. Scott Blackmer on October 01, 2009
In the last post, I talked about the role of encryption in fashioning a "reasonable" security plan for sensitive personal information and other protected data routinely collected, stored, and used by an enterprise. But lawmakers and regulators are getting more specific about using encryption and managing data that is risky from an ID-theft perspective. Here are some leading examples of this trend.
Binding Corporate Rules, breach notification, EU Data Protection Directive, Gramm-Leach-Bliley, HIPAA, model contracts, privacy, Safe Harbor
Legal Implications of Cloud Computing -- Part Two (Privacy and the Cloud)
By InfoLawGroup LLP on September 30, 2009
Last month we posted some basics on cloud computing designed to provide some context and identify the legal issues. What is the cloud? Why is everyone in the tech community talking about it? Why do we as lawyers even care? Dave provided a few things for our readers to think about -- privacy, security, e-discovery. Now let's dig a little deeper. I am going to start with privacy and cross-border data transfers. Is there privacy in the cloud? What are the privacy laws to keep in mind? What are an organization's compliance obligations? As with so many issues in the privacy space, the answer begins with one key principle -- location, location, location.
