Privacy & Information Security Law Blog

The French Data Protection Authority (the “CNIL”) reports that in late January 2013, representatives of the Article 29 Working Party and the Asia-Pacific Economic Cooperation group (“APEC”) met in Jakarta, Indonesia, to discuss interoperability between EU Binding Corporate Rules and APEC Cross-Border Privacy Rules governing international data transfers. The U.S. Department of Commerce also is participating in the process to develop a roadmap for future progress toward establishing tools companies can use to facilitate true interoperability ...

On March 6, 2013, the French Data Protection Authority (the “CNIL”) announced that it launched a consultation of relevant private and public actors for the purpose of determining whether the CNIL should adopt an initiative on “Open Data.”

Two recently-published German court decisions have clarified German employee data protection law. The decisions validate the independence of works councils in determining how to comply with data protection law and clarify when unused employee email accounts can be deleted.

On March 1, 2013, the German Federal Council (Bundesrat) passed a new registration law after insisting on a number of important amendments (in German). Among other issues covered in the bill, the new law regulates how businesses can obtain the registered addresses of individuals in Germany from Germany’s public authorities (“official address data”) and use that information for commercial purposes.

On February 27, 2013, the Article 29 Working Party (the “Working Party”) issued a statement on the European Commission’s proposed revised data protection framework (“Statement”), including the proposed General Data Protection Regulation (“Proposed Regulation”). The Working Party offered amendments to the Proposed Regulation in the form of two Annexes to the Statement on the topics of competence and lead data protection authority (“DPA”) and the exemption for household or personal activities.

On February 28, 2013, the Centre for Information Policy Leadership at Hunton & Williams LLP (the “Centre”) announced the release of “Big Data and Analytics: Seeking Foundations for Effective Privacy Guidance,” a paper intended to help organizations and policymakers develop a governance framework for using analytics in a way that protects privacy and promotes innovation. The paper, which is the product of an industry-sponsored initiative led by the Centre, suggests a two-phase approach that separates how organizations discover what data can reveal from how those insights are applied to knowledge development and decisionmaking. This approach lays the foundation for workable, effective governance.

On February 26, 2013, the United States Supreme Court decided in Clapper v. Amnesty International that U.S. persons who engage in communications with individuals who may be potential targets of surveillance under the Foreign Intelligence Surveillance Act (“FISA”) lack standing to challenge the statute’s constitutionality. The Supreme Court determined that the plaintiffs’ alleged injuries were not “certainly impending” and that the measures they claimed to have taken to avoid surveillance were not “fairly traceable” to the challenged statute. Although this 5-4 decision would not be considered a “privacy” or “data breach” case, the Court’s analysis will have a significant impact on such cases going forward, and may thwart the ability of individuals affected by data breaches to assert standing based on possible future harm.

On February 28, 2013, a White House official confirmed that President Obama will nominate Edith Ramirez as Chair of the Federal Trade Commission. Ramirez, who has served as an FTC Commissioner since April 2010, will replace outgoing Chairman Jon Leibowitz, who announced his departure earlier this month.

Prior to being nominated to the FTC in 2010, Ramirez worked as an attorney in private practice, focusing on litigation and antitrust issues. Ramirez has been an active participant in the Asia-Pacific Economic Cooperation Data Privacy Subgroup and the development of the APEC ...

Following up on its February 5, 2013 consultation paper, Singapore’s Personal Data Protection Commission has issued two additional public consultation papers concerning the guidelines the Commission is empowered to issue under the new data protection law. The first proposed set of advisory guidelines examines key concepts in the Personal Data Protection Act (“PDPA”), with thorough discussions of definitions as well as data protection obligations set forth in the PDPA. The second paper addresses selected topics: analytics and research, anonymization, employment, use of national ID numbers and online activities. In addition, the Commission has produced a cover note on how to submit comments on these public consultations.

On February 22, 2013, the Federal Trade Commission announced that it had settled charges against HTC America, Inc. (“HTC”) alleging that the mobile device manufacturer “failed to take reasonable steps to secure the software it developed for its smartphones and tablet computers, introducing security flaws that placed sensitive information about millions of consumers at risk.” This settlement marks the FTC’s first case against a mobile device manufacturer.