Perfect for Practice CLE:
Privacy and Data
Protection in Business
Prof. Jonathan I. Ezor
Director, Center for Innovation i...
Privacy Has Dual
Meaning In Business
World

• Freedom from having behavior monitored
– In person
– Over the Internet

• Pr...
Consumer Privacy:
Value Versus Value
• Consumers may benefit from information use
– Regular customers’ preferences known
–...
E-Commerce Case Study:
Who’s Involved in
Online Retailing?
• One major challenge for accurate privacy policy is
online ret...
A N E-COMMERCE ROA DMA P

$

$

$

$

CHECKING
ACCOUNT

ISSUING
BANK

CREDIT
CARD
PROCESSOR

CREDIT
CARD
PAYOR

BUYER

ISP...
Fair Information
Practice Principles
• Evolving set of best practices &
recommendations
• Arose at outset of information a...
Fair Information
Practice Principles:

FTC 1998 Privacy Online Report
•
•
•
•
•

Notice/Awareness
Choice/Consent
Access/Pa...
•
•
•
•
•
•
•

2012 White House
Consumer Privacy Bill of
Rights
Individual control over what personal data organizations c...
Self-Regulation vs. Legal
Mandate
• U.S. default generally self-regulation
– Organizations responsible for own practices
–...
Privacy Policy:
Primary Self-Regulatory
Method
• Consumers must be informed to make proper
decisions regarding use of thei...
Privacy and Electronic
Communications:
Three Major Statutes
• Privacy of electronic communications generally
protected
• T...
CA “Shine The Light”
Law Adds Requirements
to Policies
• California Civil Code § 1798.83 went into effect
1/1/05
• Gives C...
EU Data Protection
Directive Another
Major Factor
• Restrictive rules covering collection, export of
data about EU residen...
COPPA: The
Children’s Online
Privacy Protection
Act of 1998
•
•
•
•
•

Web sites targeting or appealing to children
Covers...
COPPA Case Study:
Ohio Art Company
• Ohio Art is the maker of Etch-A-Sketch
• Site collected information, suggested parent...
2012: FTC
Revision to COPPA Rule
• FTC evaluated, revised COPPA rule in 2012
• Sought input on changes due to
– New online...
Gramm-Leach-Bliley:
Financial Information
Disclosure Requirements
• GLB mandates disclosure of information use by
those en...
HIPAA Privacy Rules:
Wide-Reaching and
Burdensome
• Rules enacted by HHS under Health Insurance Portability
and Accountabi...
http://ezor.org/nai8d
Data Breach:
Prevention and
Disclosure

• Increasing number and severity of data breaches
has encouraged legislative and r...
FTC Red Flags Rule
• Covers all businesses that maintain ongoing
billing accounts
• Requires ongoing audits of potential “...
Self-Regulation
and Trade
Assocations
• PCI Security Standards
(https://www.pcisecuritystandards.org/)
• NAIC draft propos...
Privacy Law
Enforcers
•
•
•
•

Federal Trade Commission
Industry Regulators
State Attorneys General
Class Action Lawsuits
...
FTC Promotion of
Consumer Privacy
•
•
•
•

Enforcement actions
Education
Support for privacy legislation
Encouragement of ...
FTC Enforcement
Authority
• Section 5 of the Federal Trade Commission Act,
15 U.S.C. § 45
• “[U]nfair or deceptive acts or...
2011 Google and
Facebook
Settlements
• Requires obtaining consumers’ affirmative express consent
before materially changin...
Other Recent
Enforcement Targets
• Online advertising networks that failed to honor consumer
opt out of tracking by advert...
2012 FTC Privacy
White Paper

http://ezor.org/bbdjq
Purpose and Scope
of
White Paper

• Articulate best practices
• Assist Congress
• Limitations

– Not intended to extend ex...
“Best Practices”
Promoted by White
Paper
• Privacy by Design
• Simplified Choice
• Greater Transparency

jezor@tourolaw.ed...
Initiatives Promoted
by FTC
•
•
•
•

“Do Not Track”
“Short, meaningful mobile service disclosures
Address consumers’ “lack...
Privacy by Design
• “Companies should promote consumer privacy
throughout their organizations and at every stage
of the de...
Implementing
Privacy by Design
•
•
•
•
•

Data Security
Reasonable Collection Limits
Sound retention
Disposal Practices
Da...
Simplified Choice
• “Companies should simplify consumer choice.”
• Practices that do not require choice
– Data uses consis...
What Constitutes
“Choice”
• Opt-in v. opt-out?
• Pre-checked boxes?
• Clear and conspicuous disclosure?

jezor@tourolaw.ed...
Simplified Choice
and
“Do Not Track”
• Tracking technologies
• “Do Not Track” Tools
–
–
–
–

Browser settings
DAA’s Icon-b...
Transparency
• Companies should increase the transparency of
their data practices.”
• Privacy notices
– Clearer, shorter, ...
Transparency and
Data Brokers
• Regulation under FCRA
• FTC Recommendations for Legislation
• Senator Rockefeller’s Initia...
Olshan Frome Wolosky
Privacy Policy:
Questionnaire:
General Information
– Corporate or other official entity name:
– Busin...
More General Information
– Names and URL of Web site(s) for which policy is being
created (if any):
– Description of Web s...
More General Information
• Is/are the entity’s Web site(s) hosted by a third party?
• If so, what third party?
• Does the ...
Data Collection
– What specific categories of information are collected
from:
•
•
•
•
•
•
•
•
•

Forms filled in by the us...
More Data Collection
– Is the user’s age or birth date requested or
collected?
• If so, is it possible for the user to ent...
Use of Information
– How is the information currently used by the entity
collecting it? (Please provide details.)
– How ma...
More Use of Information
– Is the entity currently communicating with users on
behalf of a third party?
• If so, through wh...
User Access to
Information
– Can a user request information collected about
him/her?
• If so, through what method?
• In wh...
Regulatory and Legal
Compliance
– Is the entity a member of any trade
associations?
• If so, is there a policy about data ...
More on Compliance
– Has the entity been involved in any
legal compliance or enforcement
activity related to privacy or da...
Contact Information
– Does the entity have an automated list removal
process?
• If so, how does it work?
» Does it remove ...
More on Contact
Information
– Which person(s) at the entity are responsible
for managing removal requests?
– Please provid...
QUESTIONS?

Prof. Jonathan I. Ezor
jezor@tourolaw.edu
@ProfJonathan on Twitter
Privacy and Data Protection CLE Presentation for Touro Law Center
Privacy and Data Protection CLE Presentation for Touro Law Center
Privacy and Data Protection CLE Presentation for Touro Law Center
Privacy and Data Protection CLE Presentation for Touro Law Center
Privacy and Data Protection CLE Presentation for Touro Law Center
Privacy and Data Protection CLE Presentation for Touro Law Center
Upcoming SlideShare
Loading in...5
×

Privacy and Data Protection CLE Presentation for Touro Law Center

507

Published on

The 19 January 2014 presentation by Jonathan I. Ezor on Privacy and Data Protection for the Touro Law Center Perfect for Practice CLE series

0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total Views
507
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
25
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

Privacy and Data Protection CLE Presentation for Touro Law Center

  1. 1. Perfect for Practice CLE: Privacy and Data Protection in Business Prof. Jonathan I. Ezor Director, Center for Innovation in Business, Law and Technology jezor@tourolaw.edu @ProfJonathan on Twitter Perfect for Practice CLE Touro Law Center January 19, 2014
  2. 2. Privacy Has Dual Meaning In Business World • Freedom from having behavior monitored – In person – Over the Internet • Protection of “Personally Identifiable Information” – Any fact(s) that can identify a unique individual – Issues of use, misuse and disclosure • PII more often subject of laws, policies • Digital age added significant weight to privacy issues jezor@tourolaw.edu
  3. 3. Consumer Privacy: Value Versus Value • Consumers may benefit from information use – Regular customers’ preferences known – Sales linked to previous purchases • Businesses benefit from collecting, using information – PII – Behavior (purchases, etc.) • Issue is balancing value to consumer against value of consumer jezor@tourolaw.edu
  4. 4. E-Commerce Case Study: Who’s Involved in Online Retailing? • One major challenge for accurate privacy policy is online retailing • Many third parties involved • Need to consider all ways information will be shared, used when creating or modifying policy jezor@tourolaw.edu
  5. 5. A N E-COMMERCE ROA DMA P $ $ $ $ CHECKING ACCOUNT ISSUING BANK CREDIT CARD PROCESSOR CREDIT CARD PAYOR BUYER ISP HOST CUTEFUZZYBEARS. COM COURIER RECIPIENT WAREHOUSE VISA/MC/ AMEX SUPPLIER ©2003 Jonathan I. Ezor
  6. 6. Fair Information Practice Principles • Evolving set of best practices & recommendations • Arose at outset of information age (early 1970s) • Revised, restated over time • Inform both self-regulatory and legislative approaches • Key concept: consumer empowerment jezor@tourolaw.edu
  7. 7. Fair Information Practice Principles: FTC 1998 Privacy Online Report • • • • • Notice/Awareness Choice/Consent Access/Participation Integrity/Security Enforcement/Redress jezor@tourolaw.edu
  8. 8. • • • • • • • 2012 White House Consumer Privacy Bill of Rights Individual control over what personal data organizations collect from them and how they use it Transparency that allows consumers to easily understand information about privacy and security practices Respect for the context in which consumers provide data Security and responsibility in the way companies handle personal data Access to personal data in usable format and an ability to correct errors Reasonable limits on the personal data that companies collect and retain Accountability as to how companies handle personal data jezor@tourolaw.edu
  9. 9. Self-Regulation vs. Legal Mandate • U.S. default generally self-regulation – Organizations responsible for own practices – Enforcement under consumer protection authority (e.g. FTC Act) • Call for legislation when self-regulation fails or inappropriate – Vulnerable populations – Overly sensitive information • FTC monitors self-regulation, reports to Congress • 1999 FTC call for general online privacy law unheeded jezor@tourolaw.edu
  10. 10. Privacy Policy: Primary Self-Regulatory Method • Consumers must be informed to make proper decisions regarding use of their information • As with securities, information provided through disclosure, via privacy policy • Privacy policies should conform to Fair Information Practice Principles • Accuracy a key requirement • FTC, others may penalize inaccurate privacy policies jezor@tourolaw.edu
  11. 11. Privacy and Electronic Communications: Three Major Statutes • Privacy of electronic communications generally protected • Three major statutes cover these issues: – Wiretap Act: 18 USC §§ 2510-22 – Pen Register statute: 18 USC §§3121-27 – Stored Communications Act: 18 USC §§2701-11 • Each covers different part of communications • Note that these are separate from constitutional protections jezor@tourolaw.edu
  12. 12. CA “Shine The Light” Law Adds Requirements to Policies • California Civil Code § 1798.83 went into effect 1/1/05 • Gives CA residents control of how information is shared • Requires disclosure to CA residents of recipients of information • Mandates language in privacy policies • Recently revised • MA also has data privacy-related laws requiring encryption jezor@tourolaw.edu
  13. 13. EU Data Protection Directive Another Major Factor • Restrictive rules covering collection, export of data about EU residents • Could prevent transfer to US – Problem for multinational companies – Many Web site owners affected • US Dept. of Commerce worked with EU to create Safe Harbor • Other countries also have major privacy laws jezor@tourolaw.edu
  14. 14. COPPA: The Children’s Online Privacy Protection Act of 1998 • • • • • Web sites targeting or appealing to children Covers information from children under age 13 Requires clear and frequent disclosure Mandates verifiable parental consent FTC has enforcement jurisdiction jezor@tourolaw.edu
  15. 15. COPPA Case Study: Ohio Art Company • Ohio Art is the maker of Etch-A-Sketch • Site collected information, suggested parent permission rather than requiring prior parental consent • Fined $35,000 in April 2002 by FTC for COPPA violations in “Etchy’s Birthday Club” Web site • Mrs. Fields Cookies fined $100,000, Hershey Foods $85,000 in 2003 • Universal Music (owners of Motown and others) fined $400,000 in 2/2004 (lilromeo.com) • Xanga.com fined $1,000,000 in 9/06 • Imbee.com fined $130,000 1/30/08 • Sony BMG Music fined $1,000,000 12/11/08 jezor@tourolaw.edu
  16. 16. 2012: FTC Revision to COPPA Rule • FTC evaluated, revised COPPA rule in 2012 • Sought input on changes due to – New online technologies – Multiple parties (e.g. advertisers) collecting from single resource • Published two RFCs: – http://ftc.gov/os/2011/09/110915coppa.pdf – http://ftc.gov/os/2012/08/120801copparule.pdf • Published final rule in December 2012 (effective 7/1/13): http://ezor.org/paq3z • Continues enforcement: $1 million penalty against Artist Arena (http://ftc.gov/opa/2012/10/artistarena.shtm) jezor@tourolaw.edu
  17. 17. Gramm-Leach-Bliley: Financial Information Disclosure Requirements • GLB mandates disclosure of information use by those engaged in “financial activities” • Customers have right to opt-out of planned disclosure to 3rd parties • FTC defines “financial activities” broadly – Any entity giving financial or related advice – Attorneys, CPAs have been exempted jezor@tourolaw.edu
  18. 18. HIPAA Privacy Rules: Wide-Reaching and Burdensome • Rules enacted by HHS under Health Insurance Portability and Accountability Act of 1996 (HIPAA) • Rules cover receipt and disclosure of “individually identifiable health information” by health plans, health care clearinghouses, and certain health care providers • Went into effect 4/14/03 for most covered entities • “Business Associates,” companies serving covered entities, must certify compliance with HIPAA privacy rules in written agreement • HITECH Act signed 2/17/09 revises HIPAA rules further jezor@tourolaw.edu
  19. 19. http://ezor.org/nai8d
  20. 20. Data Breach: Prevention and Disclosure • Increasing number and severity of data breaches has encouraged legislative and regulatory action • Focus on identifying and addressing potential risks before occurrences • Growing mandates for disclosing breaches when they occur jezor@tourolaw.edu
  21. 21. FTC Red Flags Rule • Covers all businesses that maintain ongoing billing accounts • Requires ongoing audits of potential “red flags” • Enforcement repeatedly delayed • http://ezor.org/redflagsrule jezor@tourolaw.edu
  22. 22. Self-Regulation and Trade Assocations • PCI Security Standards (https://www.pcisecuritystandards.org/) • NAIC draft proposals • Financial security statements in privacy policies • Internal controls jezor@tourolaw.edu
  23. 23. Privacy Law Enforcers • • • • Federal Trade Commission Industry Regulators State Attorneys General Class Action Lawsuits jezor@tourolaw.edu
  24. 24. FTC Promotion of Consumer Privacy • • • • Enforcement actions Education Support for privacy legislation Encouragement of industry self-regulation jezor@tourolaw.edu
  25. 25. FTC Enforcement Authority • Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45 • “[U]nfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful.” • Grants the FTC power to investigate and prevent • Judicial action – Injunctions – Restitution jezor@tourolaw.edu
  26. 26. 2011 Google and Facebook Settlements • Requires obtaining consumers’ affirmative express consent before materially changing certain data practices; • Requires adopting company-wide privacy programs that outside auditors will assess for 20 years. • 2012 enforcement of Google settlement – “misrepresented” to users of Safari Internet browser that it would not place tracking “cookies” or serve targeted ads to those users – agreed to pay a record $22.5 million civil penalty jezor@tourolaw.edu
  27. 27. Other Recent Enforcement Targets • Online advertising networks that failed to honor consumer opt out of tracking by advertisers. • Mobile applications that violated the Children’s Online Privacy Protection Act • Entities that sold consumer lists to marketers in violation of Fair Credit Reporting Act • Companies that fail to maintain reasonable data security • Applications that set default privacy settings in a way that caused consumers to unwittingly share their personal data jezor@tourolaw.edu
  28. 28. 2012 FTC Privacy White Paper http://ezor.org/bbdjq
  29. 29. Purpose and Scope of White Paper • Articulate best practices • Assist Congress • Limitations – Not intended to extend existing legal obligations – Not applicable to business that collect information from less than 5000 consumers a year and do not share with 3rd parties jezor@tourolaw.edu
  30. 30. “Best Practices” Promoted by White Paper • Privacy by Design • Simplified Choice • Greater Transparency jezor@tourolaw.edu
  31. 31. Initiatives Promoted by FTC • • • • “Do Not Track” “Short, meaningful mobile service disclosures Address consumers’ “lack of control over” data brokers Scrutinize “comprehensive” tracking of consumers online by “large platform providers” - e.g. ISPs, operating systems, browsers and social media • Promoting Enforceable Self-Regulatory Codes – FTC staff working with industry to develop codes – Promoting enforce compliance with codes through FTC Act enforcement jezor@tourolaw.edu
  32. 32. Privacy by Design • “Companies should promote consumer privacy throughout their organizations and at every stage of the development of their products and services” • “Companies should maintain comprehensive data management procedures throughout the life cycle of their products and services” jezor@tourolaw.edu
  33. 33. Implementing Privacy by Design • • • • • Data Security Reasonable Collection Limits Sound retention Disposal Practices Data accuracy jezor@tourolaw.edu
  34. 34. Simplified Choice • “Companies should simplify consumer choice.” • Practices that do not require choice – Data uses consistent with the context of the transaction – Data uses consistent with company’s relationship with consumer – Data uses specifically authorized by law • Practices that require “Affirmative Express Consent” – Using consumer data in a materially different manner than claimed when the data was collected – Collecting sensitive data for certain purposes jezor@tourolaw.edu
  35. 35. What Constitutes “Choice” • Opt-in v. opt-out? • Pre-checked boxes? • Clear and conspicuous disclosure? jezor@tourolaw.edu
  36. 36. Simplified Choice and “Do Not Track” • Tracking technologies • “Do Not Track” Tools – – – – Browser settings DAA’s Icon-based tool W3C Development of International Standards Impact of EU Cookie Directive • “Do Not Track” and the “Free Internet” jezor@tourolaw.edu
  37. 37. Transparency • Companies should increase the transparency of their data practices.” • Privacy notices – Clearer, shorter, more standardized? – Privacy icons? • Access – Companies should provide “reasonable access” to consumers – “Proportionate to the sensitivity of the data and the nature of its use” • Educate consumers about privacy practices jezor@tourolaw.edu
  38. 38. Transparency and Data Brokers • Regulation under FCRA • FTC Recommendations for Legislation • Senator Rockefeller’s Initiative jezor@tourolaw.edu
  39. 39. Olshan Frome Wolosky Privacy Policy: Questionnaire: General Information – Corporate or other official entity name: – Business address(es) of entity: – Does the entity have offices, facilities or remote workers based in other states? If so, which? – Does the entity have offices, facilities, remote workers or customers based in other countries? If so, which? jezor@tourolaw.edu
  40. 40. More General Information – Names and URL of Web site(s) for which policy is being created (if any): – Description of Web site(s): – Is/are Web site(s) part of offline business as well? • If so, describe offline business • Are data shared between online and offline operations? – Is this policy for a specific site/business unit or across the entire corporation? jezor@tourolaw.edu
  41. 41. More General Information • Is/are the entity’s Web site(s) hosted by a third party? • If so, what third party? • Does the third party provide any other services (e.g. e-mail transmission services) to the entity? • Is there a written agreement with that third party for the hosting service? • Does the written agreement protect the confidentiality of information shared by the entity (its own and/or user information collected by the entity)? – Are goods or other tangible products shipped to users through postal mail and/or couriers? – Are there any other third party service providers who may have access to the databases or transmission network through which data is collected and stored? jezor@tourolaw.edu
  42. 42. Data Collection – What specific categories of information are collected from: • • • • • • • • • Forms filled in by the user on the Web site? Purchases made by the user on the Web site? E-mail sent by the user? Analysis of server logs? Postal mail sent by the user? Telephone calls from the user? Faxes from the user? Third-party databases with which the user is matched? Other (specify)? jezor@tourolaw.edu
  43. 43. More Data Collection – Is the user’s age or birth date requested or collected? • If so, is it possible for the user to enter data indicating the user is under 13 years of age? • If the user indicates he/she is under 13, is that data collected, segregated or rejected? • If rejected, using what method? – What method(s) of data protection and access control (if any) are in place? • Physical • Electronic (detail on security measures) – Are backups of the data stored offsite with a third party? jezor@tourolaw.edu
  44. 44. Use of Information – How is the information currently used by the entity collecting it? (Please provide details.) – How may the information be used by the entity in the future? – Is the entity currently sharing the information with other corporate affiliates or business units within the same corporation? – Does it plan to do so in the future? jezor@tourolaw.edu
  45. 45. More Use of Information – Is the entity currently communicating with users on behalf of a third party? • If so, through what method(s)? • Is the third party provided with the user information? – Is the entity currently providing the information to a third party for marketing purposes? – Is the entity currently providing the information to a third party for internal services (e.g. list management or analysis)? jezor@tourolaw.edu
  46. 46. User Access to Information – Can a user request information collected about him/her? • If so, through what method? • In what form/format is the information provided? – Is there a method through which the user can correct errors? • If so, what is it? • How quickly is the correction done? jezor@tourolaw.edu
  47. 47. Regulatory and Legal Compliance – Is the entity a member of any trade associations? • If so, is there a policy about data collection and use mandated for association members? – Does the entity have a current privacy policy? • • • • • If so, please attach a copy of it to this response. How is it provided to users? If online, what is its URL? Is it currently accurate as to information collection? Does it provide for a method by which changes can be made and publicized? If so, what are they? jezor@tourolaw.edu
  48. 48. More on Compliance – Has the entity been involved in any legal compliance or enforcement activity related to privacy or data collection? • If so, please describe it. • Has the entity been involved in any other consumer protection legal compliance or enforcement activity? jezor@tourolaw.edu
  49. 49. Contact Information – Does the entity have an automated list removal process? • If so, how does it work? » Does it remove data from all databases? » Does it apply to 3rd parties to whom information may be shared? • If not, please provide: » An e-mail address to which users can address removal requests » A postal address to which users can address removal requests jezor@tourolaw.edu
  50. 50. More on Contact Information – Which person(s) at the entity are responsible for managing removal requests? – Please provide an address (e-mail or postal) through which California users can request information on how their information has been shared. jezor@tourolaw.edu
  51. 51. QUESTIONS? Prof. Jonathan I. Ezor jezor@tourolaw.edu @ProfJonathan on Twitter
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×