Bank's "Commercially Unreasonable" Security Practices to Blame for Cyber Theft

The First Circuit earlier this month held that a bank could be liable for the theft of nearly $600,000 from a company’s bank account because the bank’s online security systems were not “commercially reasonable” under the Uniform Commercial Code.  This ruling, in Patco Construction Company v. People’s United Bank, indicates that banks cannot entirely shift risk to their customers through contractual provisions, and that courts will scrutinize a bank’s security practices to determine whether they are adequate


© Copyright 2012 Steptoe & Johnson LLP

French Court Narrows the Scope of Workplace Privacy

The Bordeaux Court of Appeals in France has ruled, in Pierre B. v. Epsilon Composite, that a company was justified in reviewing emails sent by an employee using a workplace computer, since the employee had not identified the messages as personal.  The employer was also justified in firing the employee when it discovered that he had emailed confidential work files from his work email to his personal email account, in violation of company rules and a confidentiality agreement he had signed.   As we previously reported, the Cassation Court’s 2001 decision in Nikon France SA v. Frédéric O. established that employees have a right to privacy in personal messages transmitted using a workplace computer, even where an employer has banned non-business use of the computer.  But, since then, French courts have refined the Nikon decision in ways that narrow employees’ privacy rights in the workplace in favor of employers.  This decision continues that trend.


© Copyright 2012 Steptoe & Johnson LLP

Launch of the ICC Cookie Guide

For all the website developers out there, see the useful cookie guide just released by the International Chamber of Commerce

FCC - landline robocalls to require prior written consent

The Federal Communication Commission (FCC) approved - on 15 February 2012 - changes to the Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991 (TCPA) - which will require telemarketers to obtain 'prior express written consent' from individuals before placing an autodialed or prerecorded marketing call ('robocall') to residential landline phones.

Threat from Loss of Personal Data Insufficient to Establish Standing

The U.S. District Court for the Eastern District of California has dismissed a class action lawsuit arising out of the loss of server drives containing the personal and medical information of over 800,000 California residents. The plaintiffs in Whitaker v. Health Net of California, Inc., alleged that they were likely to suffer future harm as a result of the loss of their information. The court, however, found the threat of future harm alleged by the plaintiffs to be “wholly conjectural and hypothetical,” and therefore held that the plaintiffs’ allegations were insufficient to establish standing under Article III of the Constitution.

© Copyright 2012 Steptoe & Johnson LLP

IP Address is protected personal data

The Court of Justice of the European Union (CJEU) clarified that IP addresses are 'protected personal data', on 24 November 2011, in Scarlet v SABAM (Case C-70/10), while ruling that internet service providers (ISPs) cannot be legally compelled to monitor the online activities of their customers.

Jurisdiction: Home Is Where The Money Is

Following a ruling last month by the European Court of Justice in eDate Advertising GmbH v. X and Olivier Martinez, Robert Martinez v. MGN Limited, plaintiffs who want to sue online publishers in Europe for damaging content are now in a better position than those going after offline media. In both the offline and online contexts, a plaintiff may sue publishers in any and all of the EU member states where the publication was distributed, but can recover only for the damage caused in the jurisdiction where suit is brought. Alternatively, plaintiffs in either context may sue in the state where the publisher is established, and can recover for all the damage caused by the publication in any jurisdiction. As a result of the ECJ’s ruling, plaintiffs in cases involving online content now have a third option: suing in the place where the plaintiff has her “centre of interests,” and recovering for all the damage caused anywhere. The plaintiff’s “centre of interests” may include not only where the plaintiff resides but also any other place to which the plaintiff has “a particularly close link,” such as where she pursues professional activity. This decision makes suing online publishers more convenient for plaintiffs, and thus may lead to more defamation suits against website operators.

© Copyright 2011 Steptoe & Johnson LLP

Privacy Law is No Excuse for Spoliation of Evidence...!!

European Union requirements to delete personal data once it is “no longer necessary” for business purposes do not excuse a company from U.S. law regarding spoliation of evidence. A decision last month by the U.S. District Court for the Northern District of California in IO Group Inc., et al. v. GLBT Ltd., et al., rejected a British website operator’s argument that its intentional destruction of emails relevant to copyright infringement litigation could not be considered spoliation of evidence because it was done per the requirements of the U.K. Data Protection Act 1998. This decision highlights the fact that U.S. courts often will not excuse noncompliance with U.S. law on grounds that complying would result in a violation of foreign law – a conundrum that is increasingly faced by companies that have data stored abroad but are subject to U.S. jurisdiction.

© Copyright 2011 Steptoe & Johnson LLP

eBay Can Be Liable for Trademark Infringements

The European Court of Justice (ECJ) has ruled that eBay can be held liable for the offer for sale by third parties of trademark-infringing goods on its site if it took steps to actively assist those third parties or if it knew or should have known of the infringing activity and did nothing. It also held that eBay could be liable for its own use of trademarks as keyword search terms to generate ads on search engines, if those ads do not allow an Internet user to easily determine whether the goods referred to in the ads are offered by the mark owner or someone else. And perhaps most importantly, the court held that national courts can issue injunctions requiring an online marketplace like eBay to alter their sites to make it easier to identify sellers in order to deter future infringements and give trademark owners an effective remedy. Though the courts of each member state will have to determine how to apply these principles in particular cases, it seems almost certain that Internet marketplaces may be exposed to significant potential liability unless they alter their approach to policing trademark infringements.

© Copyright 2011 Steptoe & Johnson LLP

Friends Don't Let Friends Eat Spam

US Law: Ask your average teenager if Facebook messages or wall postings are emails, and you will probably get a fair amount of eye-rolling. But according to a recent federal district court decision in Facebook v. MaxBounty, such communications may indeed be considered “electronic mail messages” within the meaning of the CAN-SPAM Act. The court’s interpretation of what constitutes email may mean that other forms of Internet advertisements directed at particular individuals may be subject to the Act.

© Copyright 2011 Steptoe & Johnson LLP

HHS Gets Serious About Privacy

The Department of Health and Human Services is getting serious about its privacy enforcement responsibilities, announcing that it has imposed big penalties on two medical centers that violated the Health Insurance Portability and Accountability Act (HIPAA). HHS imposed a fine of $4.3 million on Cignet Health Center for ignoring the requests of patients who wanted access to their medical records and then failing to cooperate with an investigation into the incident by HHS's Office of Civil Rights. And Mass General agreed to pay $1,000,000 to settle charges that it had violated the HIPAA Privacy Rule when an employee accidentally left on the subway documents containing protected health information of 192 patients.

© Copyright 2011 Steptoe & Johnson LLP

Generic Website Coding Does Not Remove CDA Immunity

A federal district court in Georgia, in Herman v. Xcentric Ventures, LLC, has granted summary judgment to a website in a case that emphasizes the “robust immunity” provided by the Communications Decency Act (CDA). Defendant Xcentric Ventures operates www.ripoffreport.com, which allegedly displayed an anonymous defamatory post about the plaintiff’s law firm. As we have previously reported, courts have interpreted Section 230(c)(1) of the CDA as providing broad immunity for websites that display third-party content, as long as the websites do not contribute to the content. The plaintiffs argued that the website had added “original content” by providing a title for the third-party report, metatags, and new content on the website itself, thus acting as an information content provider and voiding any immunity under the CDA. The court determined, however, that any content contributed by the website was “generic” and common to all the user-generated comments on the site, and that the website had not created any content specifically about the plaintiff.

© Copyright 2011 Steptoe & Johnson LLP

Denmark Says "Nej!" To Cloud Computing, For Now

Denmark’s Data Protection Agency (DPA) has rejected a Danish city’s request to use cloud computing to store sensitive information, citing “important security issues.” The DPA's opinion letter, which will be sent to other EU data protection officials for their information, may become an important precedent for public and private entities that are considering storing information in the cloud, as well as for cloud providers. Still, the DPA left open the possibility of allowing storage in the cloud if the cloud provider offers adequate assurances about security.

© Copyright 2011 Steptoe & Johnson LLP

Canada Introduces Anti-Spam and Computer Crime Legislation

Canadians may enjoy their poutine, but spam is another matter. Canada has finally passed national anti-spam legislation (Bill C-28) that, in addition to prohibiting the sending of unsolicited electronic messages, prohibits the unauthorized alteration of a message’s transmission data and the unauthorized installation of computer programs. It also introduces monetary penalties and a private right of action against spammers, as well as extended liability which will allow plaintiffs to “follow the money” to the responsible party. And the law amends Canada’s Personal Information Protection and Electronic Documents Act to crack down on the collection or compiling of unlawfully obtained personal information. The new legislation will be enforced by the Canadian Radio-television and Telecommunications Commission, the Competition Bureau, and the Office of the Privacy Commissioner.

© Copyright 2011 Steptoe & Johnson LLP

Supreme Court rules that IP addresses are personal data in file-sharing case

The Supreme Court of Switzerland ruled that IP addresses constitute as personal data in an 8 September 2010 case involving a company, Logistep AG, which had collected, without consent, the IP addresses of internet users who were illegally downloading copyrighted materials using peer-to-peer software. The company – which then passed on the details of those users to copyright holders for a fee - was held to have violated the Swiss Data Protection Act.

Logistep AG had developed software in 2008 to research which works were being offered online on peer-to-peer networks without the author's consent. Whenever one of these works was downloaded illegally, the software would record and store the data relating to the download. This data was then sold to members of music and film industries interested in protecting their intellectual property, who could identify the owners of the internet connection used for the download and claim compensation for copyright violation.

The Court ruled that, while the interest of Logistep AG to reduce copyright infringement was valid, it did not override or justify the infringement into personal privacy. The method was deemed to have ‘significant interference in the private sphere of each user’, which the state is obliged to protect. Logistep AG must now discontinue all of its activities.

The Swiss Data Protection Authority filed the case at the Supreme Court, after the Federal Administrative Tribunal found in Logistep AG’s favour, ruled that the goal to hunt down those guilty of internet piracy did not require the consent of users.

Copyright (C) 2010 Data Guidance

CAP Code to apply to organisations' own website content and social networking sites

The Advertising Standards Authority (ASA) and the Committee of Advertising Practice (CAP) have extended the scope of the British Code of Advertising, Sales Promotion and Direct Marketing (CAP Code) to cover, from 1 March 2011, marketing communications on an organisation's own website and in other non-paid-for online space under a company's control, such as social networking sites. Currently, the Code applies to sales promotions wherever they appear but only to other marketing communications in paid-for online space. However, the Code's remit is to be extended in response to a formal recommendation from a wide cross-section of UK industry. As CAP accepts that it may be difficult to decide what marketing communications are covered by the new rules, it has set out a new three-step test to assist. The change represents a major extension to the remit of the ASA and CAP. Organisations have six months to ensure that their websites and other online space under their control comply with the code. The extended remit follows the introduction of a new CAP Code and Broadcast Committee of Advertising Practice (BCAP) Advertising Standards Code on 1 September 2010.

©Practical Law Publishing Limited; Practical Law Company Limited 2010

Update to Google Keyword Policy in Europe

Google has announced on 4 August 2010 a change to its keyword policy in Europe meaning that as of 14 September 2010 they will introduce a notice and take down procedure. Complaints can then be made directly to Google and if Google agrees that they are valid, Google will remove the offending ads. This follows the recent ruling of the Court of Justice in the recent Google France joined Cases.

See new policy - Adwords Trademark Policy

EU Takes Search Engines to Task on Data Retention

The European Union’s Article 29 Working Party has sent letters to Google, Yahoo!, and Microsoft telling them that they must cease retaining personal data of search engine users for more than six months and must improve their anonymization procedures. It also asked the companies to appoint outside auditors to review their procedures for anonymizing data to ensure that they truly prevent identification of the users behind the data. In addition, the Party sent copies of the letters to the U.S. Federal Trade Commission and asked it to investigate whether the companies’ data retention practices were “unfair” or “deceptive” within the meaning of the FTC Act.

Canada Moves A Step Closer to Mandatory Data Breach Notification

Canada’s Ministry of Industry has proposed amendments to the Personal Information Protection and Electronic Documents Act (PIPEDA) that would require private sector entities to notify the Office of the Privacy Commissioner of breaches of personal data, and to notify affected individuals directly if the breach creates a “real risk of significant harm.” The proposal will now be considered by Parliament. The Privacy Office in the past has opposed mandatory notification, but this time around has said it welcomes the proposal. Chances thus seem fairly good that Canada will join the breach notification club.

EU Revises Model Contract Clauses for Data Transfers

The EU Data Protection Directive restricts transfers of personal data of EU residents to non-EU countries. A common approach for complying with this obligation is for the EU data transferor and the transferee abroad to adopt model contract clauses approved by the European Commission. The European Commission earlier this month adopted a decision approving a new set of model contract clauses for the transfer of personal data from a data controller to a foreign processor (controller-to-controller clauses were previously approved). The new clauses permit the foreign processor to re-transfer data to a sub-processor (the previous version did not permit this), and delete an arbitration provision from the previous version that had never been applied in practice.

© Copyright 2010 Steptoe & Johnson LLP