Russia Extends Deadline For Data Localization Law

Russian President Vladimir Putin approved a deadline of September 1, 2015, for companies to relocate their computer servers containing Russian citizens’ #personalinformation within the country’s borders.  The new timeframe for compliance with Russia’s data localization law was approved last month by both the upper house of Parliament and the Duma.  The Duma had previously passed a bill that would have moved the deadline up to January 1, 2015, over a year ahead of the law’s original effective date of September 1, 2016.  Lawmakers agreed to change the date after hearing from affected businesses concerned about the feasibility of setting up the necessary IT infrastructure in time to meet the law’s requirements.

© Copyright 2015 Steptoe & Johnson LLP

#eCommerce, #Privacy: Zappos - hacking of personal information

Zappos  - to pay $106,000 to settle an investigation of a 2012 hacking incident affecting the personal data of the online clothing retailer’s customers.  Under the agreement, Zappos must review its information security policies and train its employees in them, ensure adherence to industry data security standards, and obtain a third-party audit of its practices.

Do you have the necessary policies and training in place to prevent a possible breach of privacy?  Contact us for assistance.

US: Boston Hospital Settles Data Breach Suit Over Unencrypted Laptop

Beth Israel Deaconess Medical Center in Boston has agreed to pay $100,000 to settle the Massachusetts Attorney General’s lawsuit over a 2012 data breach involving the theft of a physician’s unencrypted laptop.  In addition to the financial penalty, the hospital will also have to revise its data security measures to ensure compliance with state and federal law.  The consent agreement requires BIDMC to track and encrypt all hospital-purchased devices and to implement ActiveSync or other technology that prevents unencrypted smartphones and tablet devices from accessing personal information on the hospital’s email servers.  BIDMC must also review its policies and procedures regarding portable device security and train employees on how to handle personal and protected health information.  

© Copyright 2014 Steptoe & Johnson LLP. Steptoe & Johnson LLP 

How to avoid a similar risk at your organisation?

i) establish your current position against the applicable legislation

ii) determine realistic goals to achieve the recommended position in terms of data protection

iii) Implement appropriate deliverable, including but not limited to a Data Protection Policy, IT Security Policy, Mobile Device policy and BYOD policy

iv) Implement standard training and audit procedures at your oganisation.

Big win for fibre in South Africa

http://mybroadband.co.za/news/telecoms/111056-big-win-for-fibre-in-south-africa.html

Document Management Systems (#DMS) solutions - audit

Paper documents take up space, they are difficult to store and waste time when people have to handle them. Businesses are further faced with more and more electronic communications via #email, #fax2email and social media communications, and all of this needs to be managed effectively.

There is currently a big drive to use technology to manage documents, records and information better, however not all technology solutions comply with the Protection of Information Act (#POPI) and Consumer Protection Act (#CPA) and other Records Management legislation

Before selecting a #DMS solution for your business, contact us to assist you in the evaluation of the solution and to confirm whether it, or the proposed information process adhere to POPI, CPA and other relevant Records Management legislation.

Adobe Breach Victims Have Standing To Sue Based On Risk Of Future Harm

The U.S. District Court for the Northern District of California has ruled in In Re Adobe Systems, Inc. Privacy Litigation that customers affected by Adobe’s 2013 data breach have standing to sue based on the increased risk of future harm caused by hackers who gained unauthorized access to their personal information.  The decision is in some tension with other court rulings that have interpreted the Supreme Court’s ruling in Clapper vs. Amnesty International USA as foreclosing standing where the plaintiffs’ claims were based on the risk of future harm.  But the opinion is well reasoned, and may help plaintiffs establish standing in other breach suits.

© Copyright 2014 Steptoe & Johnson LLP. Steptoe & Johnson LLP 

Guidelines: Application development

If you are an App developer and/or owner,take note that the use of the word "free" will be, in terms of android apps (as per comments from Google), be phased out where there are app games that contain in-app purchase. We still await what Apple will do.  The Google changes will be implemented during September 2014.

European Court of Justice rules that internet browsing is not copyright infringement

The ECJ confirmed that the simple browsing of copyright material on a website will not infringe copyright and is the prior authorisation from the copyright owner not required, although reproduction takes place on the end user computer screen and in the internet cache of the computer's hard drive.

The Court ruled that on-screen and cached copies, made by an end-user in the course of viewing a website, satisfied the conditions in Article 5(1) of the Copyright Directive (2001/29/EC) that those copies must be temporary, transient or incidental in nature, and must constitute an integral and essential part of a technological process, as well as various conditions laid down in Article 5(5) of the of the Copyright Directive (2001/29/EC), and that they could therefore be made without the authorisation of the copyright holders.

Take note: browsing of copyright protected material is not the same as actually copying same and placing it somewhere else, whether for subsequent use or not.

The Court case: Public Relations Consultants Association v Newspaper Licensing Agency and others, Case C-360/13, 5 June 2014.

Google in quandary over upholding EU ruling

Google and other Internet companies find themselves in a quandary over how to strike a balance between privacy and freedom of information as the top world search engine took a first step towards upholding an EU privacy ruling.

Google moved overnight to put up an online form that will allow European citizens to request that links to obsolete information be taken down – its first response to the ruling by Europe's top court on "the right to be forgotten".

The ruling on 13 May upheld a 1995 European law ondata protection and ordered Google to remove links to a 1998 newspaper article about the repossession of a Spanish man's home.

After putting up the online form in the early hours of Friday, Google received 12 000 requests across Europe, sometimes averaging 20 per minute, by late in the day, the company said.That puts Google and other Internet companies in the position of having to interpret the court's broad criteria for information that is "inadequate, irrelevant or no longer relevant" as well as developing criteria for distinguishing public figures from private individuals.

"The court's ruling requires Google to make difficult judgements about an individual's right to be forgotten and the public's right to know," a Google spokesman said.

Digital rights campaigners say the EU authorities need to agree on a common approach to guide the search engine companies.Next week representatives from the EU's 28 data protection authorities are due to discuss the implications of the ruling at a two-day meeting.

"Companies should not be tasked with balancing fundamental rights or making decisions on the appropriateness, lawfulness, or relevance of information they did not publish," said Raegan MacDonald, European policy manager at Access, a digital rights organisation.

By Reuters
Brussels, 2 Jun 2014

Definitely a discussion to follow in terms of privacy vs. freedom of information.  What are your thoughts on this?

US: Protection of Personal Information

HHS Announces Record HIPAA Settlement

New York-Presbyterian Hospital (NYP) and Columbia University have agreed to pay a combined $4.8 million – the largest HIPAA settlement ever involving a single incident – to settle charges that they violated the HIPAA Privacy and Security Rules by accidentally making the electronic protected health information of their patients accessible to Internet search engines.  The Department of Health and Human Services’ Office for Civil Rights (OCR) launched its investigations after the entities – which operate a shared data network and firewall – notified it of the breach.  As part of the settlement, NYP will pay $3.3 million, and Columbia will pay $1.5 million. The entities also agreed to undertake risk analyses, develop risk management plans, revise their existing policies and procedures, and provide training on privacy and security awareness. 

(c) Steptoe & Johnson LLP

EU: Search engine results to be removed where they affect privacy rights

ECJ confirms right to have search engine results removed where they affect privacy rights

The ECJ has ruled on three questions concerning the interpretation of the Data Protection Directive (1995/46/EC) with regard to the data processing activities of search engine providers, their status as data controllers and the existence and scope of a right to be forgotten, in a reference from a Spanish court. The proceedings had been brought by a Spanish citizen, who had asked that Google remove from the list of search results based on his name links to two announcements in a Spanish newspaper from 1998. The announcements concerned a real-estate auction connected with attachment proceedings prompted by the applicant's social security debts. The ECJ held that a search engine provider is the data controller in respect of the locating, indexing, storing and making available of information accessible on the internet, and that the applicant has a right to rectification, erasure or blocking of that information, and a right to object to the processing of the information in certain circumstances.

The ECJ made it clear that while the search engine's commercial interests in processing the information will not, as a rule, override the data subject's rights to privacy and data protection, a balancing of the data subject's fundamental rights and the interests of other internet users in accessing that information must be carried out. The interest in the continued accessibility of personal information may override the data subject's interest in cases where the data subject plays a prominent role in public life and the accessibility of the information is in the public interest. The ECJ further clarified that the data subject's right to request removal of the relevant links may also apply if the information is true and where its original publication was lawful. This is particularly the case where the information has since become inadequate, irrelevant or excessive.

The ECJ's decision has sent shock waves not only through the online industry but also through the loose collection of groups concerned with the protection of digital rights. While the strengthening of the EU's right to apply its data protection framework to non-EU data controllers in certain circumstances is broadly welcomed (within the EU, if not in the US, where many of the largest, most popular search engines are based), the importance that the court has afforded to the data subject's right to privacy, compared to the right of individuals to access to information, has led to accusations that the decision legitimises individual reputation management, the falsification of historical records and ultimately, censorship. (Google Spain SL and Google Inc. v Agencia Española de Protección de Datos (AEPD) and Mario Costeja González, Case C-131/12, 13 May 2014.)

© 2014 Thomson Reuters. All rights reserved

Protection of Personal Information

Do you think behavioural data collected by third party cookies should be considered personal data, even where it is not connected to information directly identifying an individual?

Like = freedom of Speech

“Liking” something on Facebook is a form of speech protected by the First Amendment, a federal appeals court ruled Wednesday, reviving a closely watched case over the extent to which the Constitution shields what we do online

What Happens In Social Media Stays In Social Media

Nevada has joined the club of states that bar employers from requiring or requesting that current or prospective employees provide access to their personal social media accounts.  Twelve other states (Arkansas, California, Colorado, Delaware, Illinois, Maryland, Michigan, New Mexico, Oregon, Utah, Washington, and, most recently, New Jersey) have placed similar restrictions on employers.  Comparable legislation is pending in at least 35 other states.  Importantly, Nevada’s A.B. 181 does not affect an employer’s right to comply with “any rule of a self-regulatory organization.”  Securities firms affected by rules promulgated by the Financial Industry Regulatory Authority (FINRA) have sought exemptions from social media laws to ensure that they can comply with FINRA’S rules, which may affect social media accounts.  The Nevada law takes effect on October 1, 2013. 

3D mark as a Trade Mark?

TM: You can register a '3D mark' as trade mark, e.g. Coke's 500ml bottle. However, you must be able to demonstrate that its destintive character departed significantly from the norms and customs of the sector. A distinctive character is imperative.For more information contact Gerrie van Gaalen

High Court rules Marks & Spencer's use of advertising keywords infringed Interflora's trade marks

The High Court has applied the ECJ's ruling on various questions it referred in proceedings brought by Interflora against Marks & Spencer (M&S) in relation to M&S's use of the word INTERFLORA as an advertising keyword leading Google internet search engine users to advertisements for M&S flower delivery services. The ECJ said that "double-identity" infringement would only be made out if there is an adverse effect on one of the functions of the trade mark. Arnold J found that M&S had infringed the trade mark under Article 5(1)(a) of the Trade Marks Directive (89/104/EEC, now replaced by consolidated Directive 2008/95/EC) and Article 9(1)(a) of the Community Trade Mark (CTM) Regulation (40/94/EEC, now replaced by 207/2009/EC) because a significant proportion of consumers who searched for "interflora", and then clicked on M&S's advertisements displayed in response to those searches, were wrongly led to believe that M&S's flower delivery service was part of the Interflora network, so that the mark's origin function was adversely affected. The judgment includes a detailed analysis of ECJ case law and establishes a number of interesting points, including clarifying the meaning of the "investment function" of a trade mark, substantial interference with which the ECJ found could constitute infringement of the mark. The decision that M&S had infringed Article 5(1)(a) and Article 9(1)(a) will be welcomed by Interflora. However, it is not clear to what extent other trade mark owners will be able to draw comfort from the decision, since it turned on its facts, in particular the fact that the Interflora network included numerous and diverse separate undertakings. (Interflora Inc and another v Marks and Spencer plc and another [2013] EWHC 1291 (Ch), 21 May 2013.)

© Practical Law Publishing Limited

IP Symbols - shortcut

IP: Symbol short cuts for IP
Alt + 0153..... ™... trademark symbol
Alt + 0169.... ©.... copyright symbol
Alt + 0174..... ®....registered ­ trademark symbol
If you want to know the meaning of each of the above symbols and when to use them, then call Gerrie

Internet Browsing: copyright infringement or not with reference to caching

what do you think - should the mere viewing of copyright material on the internet amount to copyright infringement, taking into consideration the caching function on your browser?

Bank's "Commercially Unreasonable" Security Practices to Blame for Cyber Theft

The First Circuit earlier this month held that a bank could be liable for the theft of nearly $600,000 from a company’s bank account because the bank’s online security systems were not “commercially reasonable” under the Uniform Commercial Code.  This ruling, in Patco Construction Company v. People’s United Bank, indicates that banks cannot entirely shift risk to their customers through contractual provisions, and that courts will scrutinize a bank’s security practices to determine whether they are adequate


© Copyright 2012 Steptoe & Johnson LLP

French Court Narrows the Scope of Workplace Privacy

The Bordeaux Court of Appeals in France has ruled, in Pierre B. v. Epsilon Composite, that a company was justified in reviewing emails sent by an employee using a workplace computer, since the employee had not identified the messages as personal.  The employer was also justified in firing the employee when it discovered that he had emailed confidential work files from his work email to his personal email account, in violation of company rules and a confidentiality agreement he had signed.   As we previously reported, the Cassation Court’s 2001 decision in Nikon France SA v. Frédéric O. established that employees have a right to privacy in personal messages transmitted using a workplace computer, even where an employer has banned non-business use of the computer.  But, since then, French courts have refined the Nikon decision in ways that narrow employees’ privacy rights in the workplace in favor of employers.  This decision continues that trend.


© Copyright 2012 Steptoe & Johnson LLP