Miscellaneous

FTC Delays Enforcement of Red Flags Rule, Court Holds Red Flags Do Not Apply to Lawyers

Posted on October 30, 2009
by Mehmet Munur The FTC news release notes that the Federal Trade Commission delayed the enforcement of the Red Flags rules until June 1, 2010. The FTC news release also notes the decision by the U.S. District Court for the District of Columbia that the FTC Red Flags Rules did not apply to attorneys...

FTC Modifies ChoicePoint Consent Order and Imposes Stricter Compliance

Posted on October 19, 2009
By Mehmet MunurThe Federal Trade Commission announced today that it had entered into a modified consent agreement with ChoicePoint due to ChoicePoint?s inability to live up to the original consent agreement entered into in 2006. The FTC entered into a consent agreement with ChoicePoint was due to compromise of 163,000 financial records and at least 800 cases of identity theft...

FTC Settles with Six Companies with Lapsed Safe Harbor Certifications

Posted on October 07, 2009
By Mehmet MunurOn October 6, 2009, Federal Trade Commission filed six complaints against companies falsely claiming that they were self-certified to the Department of Commerce EU Safe Harbor when their certification had lapsed. This FTC action should serve as a reminder to Safe Harborites either to keep up their annual recertification or to avoid misrepresenting that they are self-certified to the Safe Harbor...

FTC Obtains TRO Against E-Commerce Merchant Falsely Claiming Safe Harbor Certification

Posted on August 24, 2009
By Mehmet MunurOn July 31, the Federal Trade Commission obtained a temporary restraining order against a California website for deceptively claiming to be a member of the EU Safe Harbor administered by the Department of Commerce. This is the first FTC enforcement involving the FTC?s authority to prosecute violations involving EU Safe Harbor and FTC?s authority to prosecute an American company for deception of foreign consumers...

To access blog feed reader register for free. (You will also learn about new ways to read and access the freshest law blogs.)

FTC Issues Final Breach Notification Rules as Required by the Stimulus Bill

Posted on August 19, 2009
By Mehmet MunurOn August 18, Federal Trade Commission issued the final rules on breach notification as required by the American Recovery and Reinvestment Act of 2009, commonly known as the stimulus bill. The rules will take effect in 30 days from publication in the Federal Register...

Federal Authorities Prosecuting Suspects of Heartland and Hannaford Breaches

Posted on August 17, 2009
By Mehmet MunurUS Department of Justice reports that federal authorities are prosecuting three suspects for stealing 130 million credit card numbers from Heartland Payment systems, 7-eleven stores, and Hannaford stores. We previously reported on the Heartland Payment Systems Breach and the Hannaford Stores Breach...

Amending Website Terms of Use Requires Care

Posted on August 05, 2009
By Mehmet MunurRecent case law examining website terms of use highlights the importance of drafting qualified change of terms provisions for online agreements, proposing reasonable unilateral amendments, providing adequate notice, and keeping track of differing versions of online agreements and assents to such agreements...

Sears Settles with FTC on Information Tracking

Posted on July 26, 2009
By Mehmet MunurFTC entered into a settlement agreement with Sears in June related to its failure to provide adequate notice to its customers during the sign up process for an information collection software. This settlement highlights the need to create accurate highlight notices for privacy policies...

District Court Holds Blockbuster Arbitration Provision Unenforceable

Posted on May 16, 2009
By Mehmet MunurA District Court in Texas recently held Blockbuster?s website terms and conditions arbitration provision illusory and therefore unenforceable due to Blockbuster?s right to unilaterally modify it. The District Court cited to established Texas precedent to argue that nothing in the website terms prevented the arbitration provision's retroactive application...

FTC and HHS Issue Proposed Rules on Breach Notification

Posted on April 23, 2009
By Mehmet MunurBoth the Federal Trade Commission and the Department of Health and Human Services issued proposed regulations last week to satisfy their obligations under the Health Information Technology for Economic and Clinical Health (HITECH) Act, which was a part of the American Recovery and Reinvestment Act of 2009...

Court Strikes Down Electronic Signature Due to Weak Security Procedures

Posted on March 23, 2009
By Mehmet MunurThe US District Court in Kansas held on February 19, 2009 that the data security procedures Dillard?s Stores had created to authenticate the electronic signature its employees used to execute an arbitration policy were not sufficient. While the case may have turned on its particular facts, Dillard?s could have avoided such problems by abiding by ISO 17799 procedures in operating its electronic signature systems...

Stimulus Bill Requires Data Breach Notification Under HIPAA and Signals Broader Enforcement

Posted on February 27, 2009

Heartland Payment Systems Loses Credit Card Data to Malware

Posted on February 02, 2009
by Mehmet Munur Heartland Payment Systems, the 6th largest card acquirer in the United States with a processing volume of $51.9 billion, reported that its ?investigation uncovered malicious software that compromised data that crossed Heartland?s network...

Article 29 Working Party Releases 11th Annual Report

Posted on January 23, 2009
By Mehmet MunurOn January 21, 2009, the Article 29 Working Party released its 11th Annual Report on Data Protection and the report shows a rise in enforcement activities by the European Union Data Protection Authorities (DPAs) resulting in fines totaling millions of Euros, some criminal prosecutions, and concerns over liberal use of electronic discovery in US litigation involving EU subsidiaries...

US-Swiss Safe Harbor Framework Signed

Posted on January 22, 2009
by Mehmet MunurOn December 9, 2008, the Swiss Federal Data Protection and Information Commissioner and the Department of Commerce signed ?an exchange of letters? to create the ?US-Swiss Safe Harbor Framework.? As a result, multinational corporations certified under the Department of Commerce Safe Harbor program are now able to transfer data from Switzerland to the US more conveniently...

US Supreme Court to Review Whether States Can Enforce Antidiscrimination Laws against Federally Chartered Banks

Posted on January 19, 2009
By Dino TsibourisThe US Supreme Court will consider whether the New York Attorney General can enforce antidiscrimination laws against federally chartered banks. In The Clearing House Assoc., LLC v. Cuomo, 510 F.3d 105 (2d Cir. 2007), the New York-based Second Circuit Court of Appeals upheld the OCC's position that a state may not request or subpoena information relating to potential lending discrimination from such banks...

ABA: Boutique Law Firms Make Inroads During the Downturn

Posted on January 16, 2009
By Dino TsibourisThe ABA Journal and New York Law Journal have interesting stories about how the downturn in work at large law firms has opened doors for small firms that offer specialized expertise at competitive rates. The article focuses on the New York market, but the factors apply in any legal market:Despite the struggling economy and Wall Street layoffs, some small law firms in New York are seeing their business boom...

Federal Rule of Evidence 502: Protecting Against the Inadvertent Waiver of the Attorney-Client Privilege

Posted on November 11, 2008
By Kelly Prior, Esq.President Bush recently signed a bill creating new Federal Rule of Evidence 502, which addresses the disclosure of communications and information protected by either the attorney-client privilege or the work-product doctrine. The purpose of FRE 502 is two-fold: 1) to resolve the conflicts which have arisen between courts in the area of inadvertent disclosure and subject matter waiver; and 2) to bring some measure of control over spiraling discovery costs that are due in part to the concern that any disclosure, however small or unintentional, will result in the subject matter waiver of all protected communications and information...

Google Updates IP Address Log Retention Policy

Posted on November 10, 2008
By Dino Tsibouris & Mehmet MunurOn September 8, 2008, Google announced that it will reduce the amount of time it retains distinct IP addresses from 18 months to 9 months due to pressure from European regulators. This is not the first time, and likely not the last time, Google will have to amend its IP log retention period in order to comply with the European regulators? strict policies...

Best Lawyers in America - 2009

Posted on October 06, 2008
Dino Tsibouris of Tsibouris & Associates, LLC was recently selected to be included in the 2009 edition of The Best Lawyers in America in the specialty of Information Technology Law. The Best Lawyers in America is a publication of the most respected attorneys in their fields, which has been known to be a very valuable referral list of attorneys in practice...

Recent 9th Circuit Ruling Highlights the Importance of Employee Policies Regarding Electronic Communications

Posted on August 09, 2008
By Dino Tsibouris & Mehmet MunurThe 9th Circuit Court recently ruled that the unauthorized search of employee text messages on an employer provided text messaging pager may have violated the employee?s privacy rights despite a written policy stating that the employees should have no expectation of privacy...

Google Health Launches

Posted on May 26, 2008
By Dino Tsibouris & Mehmet MunurHaving concluded its testing at the Cleveland Clinic, Google Health launched amid privacy concerns last week. Commentators are concerned that Google is not currently regulated under the Department of Health and Human Services (?DHHS?) and Google?s claim that it is regulated by the Federal Trade Commission does not appear to appease them...

Ohio Supreme Court Prepares to Adopt Electronic Discovery Rules

Posted on May 13, 2008
By Dino Tsibouris & Mehmet MunurThe Ohio Supreme Court is finalizing Proposed Amendments to the Rules of Civil Procedure that include amendments related to electronic discovery. The comment period for the proposed amendments ended on March 4, 2008...

Senate Votes to Expand Student Loan Access

Posted on May 01, 2008
By Dino TsibourisWe represent a number of student lenders with respect to their online lending operations. In the past several months we have observed a number of unique events in the marketplace, ranging from the reduction of interest rates in federally-insured student loans that have made the business financially unattractive to banks, to disruptions in the bond markets that have impaired the ability of lenders to obtain funds to make student loans...

In Case You Missed It: Judge Dismisses Cheating Husband?s Breach of Privacy Policy Case

Posted on May 01, 2008
By Dino Tsibouris & Mehmet MunurA federal judge in Texas recently dismissed a case (due to improper venue) in which the plaintiff alleged that the website?s breach of its privacy policy led to his wife finding out about his infidelity, which ultimately led to his divorce...

Google Health Starts Pilot at the Cleveland Clinic

Posted on April 11, 2008
By Dino Tsibouris & Mehmet MunurOn February 21, 2008, Google announced a partnership with the Cleveland Clinic to test its online personal health records management platform called Google Health. While Google is late to bring its platform to the party, its offering appears to go beyond Microsoft?s HealthVault offering...

Google Health Starts Pilot Project at the Cleveland Clinic

Posted on April 01, 2008
By Dino Tsibouris & Mehmet MunurOn February 21, 2008, Google announced a partnership with the Cleveland Clinic to test its online personal health records management platform called Google Health. While Google is late to bring its platform to the party, its offering appears to go beyond Microsoft?s HealthVault offering...

Supermarket Chain Falls Victim to Security Breach

Posted on March 18, 2008
By Dino Tsibouris & Mehmet MunurOn Monday March 17, 2008, Hannaford, an East Coast supermarket chain, announced that it fell victim to a security breach. The security breach has so far resulted in 1,800 actual cases of fraud.Hannaford announced that the breach affected 4...

NY AG Cuomo Announces Code of Conduct for Private Student Loan Programs

Posted on December 19, 2007
By: Dino Tsibouris and Mehmet MunurNew York Attorney General Andrew M. Cuomo reached a settlement with University Financial Services (UFS), a private student loan consolidation service and announced a Direct Marketing Code of Conduct that would apply to student loans marketed directly to students...

Microsoft Health Vault

Posted on December 10, 2007
By: Dino Tsibouris & Mehmet Munur Microsoft recently launched Health Vault promises benefits in healthcare information storage and sharing online but raises concerns on privacy of this information. Health Vault is Microsoft?s ?new personal health platform that lets you gather, store, and share health information online...

Court Rules That Cease and Desist Letter Confirms Notice of Website Terms of Use

Posted on October 29, 2007
Written by: Dino Tsibouris and Mehmet MunurA federal trial court in Texas held that cease and desist letters explaining infringing conduct created knowledge of website terms of use and further use of the website after this knowledge was a breach of contract...

Best Lawyers in America - 2008

Posted on October 22, 2007
Dino Tsibouris of Tsibouris & Associates, LLC was recently selected to be included in the 2008 edition of The Best Lawyers in America in the specialty of Information Technology Law. The Best Lawyers in America is a publication of the most respected attorneys in their fields, which has been known to be a very valuable referral list of attorneys in practice...

Court Upholds Written Contract that Incorporates Terms Posted on Company's Website

Posted on October 15, 2007
Written by: Kenneth Sperl and Mehmet Munur On September 10, a Federal District Court in Alabama held that contract terms a service provider posted on a website and then clearly mentioned in business negotiations were enforceable. Conexant, a semiconductor provider for the broadband industry, entered into a contract with Conference America, a Voice over Internet Protocol (VOIP) services provider, for large volume conference call services...

School Directory Information - Public Record

Posted on July 20, 2007
Last year, there was a major hubub in my hometown of Dublin, Ohio when the school district released student directory information to the Columbus Dispatch, who had asked for the information in a public records request.According to the Family Education Rights and Privacy Act ("FERPA"), schools may disclose, without consent, "directory" information such as a student's name, address, telephone number, date and place of birth, honors and awards, and dates of attendance...

New York's consumer protections for Internet purchases

Posted on July 05, 2007
Last Month, the Governor of New York signed into law Senate Bill 4964. The bill was introduced by Senator Fuschillo at the request of Attorney General Andrew Cuomo. The AG requested the bill because of the consumer complaints the office received regarding failure to deliver goods ordered online or other improper conduct related to online purchases...

Google's EU Data Protection Issues

Posted on June 06, 2007
On May 16, 2007, the Article 29 Data Protection Working Party sent Google a letter praising Google's efforts in improving its privacy practices. However, the Article 29 Working Party questioned Google's storage of server logs of 18-24 months.Why should Google, a company based in the United States, care about what the EU says? Simply, the Article 29 Working Party states:Although Google's headquarters are based in the United States, Google is under legal obligation to comply with European laws, in particular privacy laws, as Google's services are provided to European citizens and it maintains data processing activities in Europe, especially the processing of personal data that takes place at its European centre...

New England Banks to Sue TJX

Posted on April 25, 2007
The Boston Globe reports that a group of New England banks are planning to sue TJX Cos. over TJX's data breach.

Privacy & Civil Liberties Oversight Board 2007 Report

Posted on April 25, 2007
The Privacy & Civil Liberties Oversight Board recently released its report (PDF) to Congress on the Board's major activities during the preceding year. The Board's conclusions regarding Anti-terrorism policies and programs will probably be scrutinized and discussed:Based upon its review, the Board has concluded that the Executive Branch?s conduct of these surveillance activities appropriately considers and reasonably protects the privacy and civil liberties of U...

SEC's new Anti-Money Laundering Source Tool

Posted on April 19, 2007
On April 16, 2007, the Securities and Exchange Commission announced the availability of the "AML Source Tool," a research guide and compliance tool to assist anti-money laundering compliance efforts by broker-dealers.Broker-dealers have compliance obligations under statutory and regulatory provisions and related rules of the securities self-regulatory organizations (SROs)...

FDIC Supervisory Policy on Identity Theft

Posted on April 17, 2007
On April 11, 2007, the FDIC issued Financial Institution Letters FIL-32-2007, Supervisory Policy on Identity Theft.Financial institutions have an affirmative and continuing obligation to protect the privacy of customers' nonpublic personal information...

Data Breaches and Buyer Behavior

Posted on April 11, 2007
Javelin Strategy & Research has a study for purchase entitled "Data Breaches and Buyer Behavior: Moving PCI Compliance from Costly Burden to Competitive Advantage" (link is to the free preview).Hat tip to Payments News which states:The study concludes that "77% of consumers intend to stop shopping at merchants that suffer from data breaches...

TJX Companies 10K on Computer Intrusions

Posted on April 11, 2007
This InternetNews story says that TJX Companies, Inc. revealed to the SEC that as many as 47.5 million customer records were stolen during TJX's highly publicized computer intrusion. For those interested, here's TJX's 10-K filing. Pages 7-10 are devoted to a discussion of the computer intrusion and pages 18-21 detail the 19 legal proceedings related to the computer intrusion...

Intersection between Art and Surveillance

Posted on March 26, 2007
We make money not art describes the Evidence Locker project by artist Jill Magid. Walking the streets of Liverpool in a red trenchcoat for 31 days, Ms. Magid then requested video surveillance video of herself by completing 31 Subject Access Request Forms...

Electronic Check Conversion - NACHA Amends Operating Rules To Reflect Regulation E Requirements

Posted on February 28, 2007
Electronic Check Conversion - NACHA Amends Operating Rules To Reflect Regulation E RequirementsBy Laura CareyRegulation E AmendmentsJanuary 1, 2007 marked the mandatory compliance date under the Federal Reserve Board?s final amendments to Regulation E [press release] (which implements the Electronic Fund Transfer Act) for parties involved in electronic check conversion (ECK) transactions...

Ohio Senate Bill No. 6

Posted on February 23, 2007
Senate Bill Number 6 was introduced:to allow consumers to place a security freeze on the consumer's credit reportto specify that Social Security numbers are confidentialto specify that certain personal information is not a public recordto require a public office to redact from a document that is otherwise a public record certain personal informationto require a public office to redact Social Security numbers and other confidential information from any document that is made available online to the public through the Internetto require the Office of Criminal Justice Services to make state funding grants available to local law enforcement agencies for enforcement of identity fraud lawsto require the attorney general to support local law enforcement agencies with the enforcement of identity fraud laws, and to enact a special statute of limitations for criminal prosecutions and civil actions against identity fraud The bill, if passed, would help erase the problem reported last year where a number of records from the Ohio Secretary of State's Office was displayed with Social Security numbers...

Lambert v. Hartmann

Posted on January 10, 2007
The United States District Court for the Southern District of Ohio recently dismissed identity theft victim Cynthia Lambert's case against Greg Hartman and the Hamilton County Board of County Commissioners. In this case, Lambert was issued a speeding ticket which was published on the Hamilton County Clerk of Court's website...

December 1 is Approaching ? Do You Know What Your Electronic Records Retention Policy Is?

Posted on November 24, 2006
According to The Sedona Guidelines for Managing Information and Records in the Electronic Age, ?organizations that comprehensively address electronic data issues in their policies and practices are better positioned to meet their legal duties (regulatory as well as in litigation) and are also more likely to maximize the value of internal business data...

What Would De Jesus Do?

Posted on November 08, 2006
When you answer that question, do the opposite. WebProNews reports on Edwin De Jesus's MySpace copycat website MySpace for Business. When asked whether the attorneys at News Corp. approved of his site, he replied:"I'm not concerned about any trademark violations," he said, "I made sure I didn't commit any...

Dino Tsibouris - Best Lawyers In America

Posted on September 18, 2006
Dino Tsibouris of Tsibouris & Associates, LLC was selected to be included in the 2007 edition of The Best Lawyers in America in the specialty of Information Technology Law. The Best Lawyers in America is a publication of the most respected attorneys in their fields, which has been known to be the most valued referral list of attorneys in practice...

Trademark News from Across the Pond

Posted on August 24, 2006
UK based cigarette manufacturer Imperial Tobacco PLC recently purchased the Davidoff trademark from Germany's Tchibo Holding for ?540m (£365m, $691m) in cash.  (Story in The Independent).  Imperal was already making Davidoff brand cigarettes under license, but by purchasing the trademark it gives Imperial "full autonomy on marketing the brand and allows it to further develop the premium end of its product portfolio, especially in Asia where it has been particularly successful...

The Copyright Code in Verse

Posted on July 18, 2006
Blogger Yehuda Berlinger wanted to review the US Copyright Law, and spent three hours reviewing and putting the sections to verse. Recommended reading!Tags: copyright, verse, poetry

A Blogger Blogspot Cautionary Tale

Posted on July 01, 2006
When we started the MT-Law Blog, we started hosting it on Blogger's free blog hosting service on blogspot. The URL for the blogspot hosted blog was "mtlaw.blogspot.com." Later, we transfered the blog to our servers.For the longest time Blogger kept the mtlaw...

Wall shot the Sheriff ... and won $764,271 in copyright damages and fees

Posted on May 24, 2006
The United States Court of Appeals for the Ninth Circuit affirmed a lower court ruling in Wall Data Inc. v. Los Angeles County Sheriff's Dept. (PDF) that the Los Angeles County Sheriff's Department infringed upon Wall Data's copyright in software by making copies of software in excess of the number of copies permitted by the License Agreement between Wall and the Sherrif...