Privacy & Information Security Law Blog

On August 21, 2012, the European Commission formally approved Uruguay’s status as a country providing “adequate protection” for personal data within the meaning of the European Data Protection Directive (Article 25(6) of Directive 95/46/EC). This follows the Article 29 Working Party’s earlier favorable Opinion issued in 2010, and takes into account certain interpretative assurances and clarifications provided by Uruguay. Accordingly, transfers of personal data from the EU to Uruguay may now take place without additional intergovernmental guarantees and in accordance with applicable data protection provisions.

On August 23, 2012, the Federal Trade Commission announced that it had filed suit against DISH Network LLC (“DISH Network”) alleging violations of the FTC’s Telemarketing Sales Rule (“TSR”). The FTC’s complaint claims that DISH Network is a “seller” and “telemarketer” as such terms are defined by the TSR because the company sells satellite television programming to consumers and also markets its programming through a variety of methods, including telemarketing. According to the complaint, since September 2007, DISH Network has engaged in initiating ...

On August 23, 2012, the United States Court of Appeals for the Sixth Circuit held in Retailer Ventures, Inc. v. Nat’l Union Fire Ins. Co. that losses resulting from the theft of customers’ banking information from a retailer’s computer system are covered under a commercial crime policy’s computer fraud endorsement.

On August 30, 2012, Taiwan’s Executive Yuan announced that the Personal Data Protection Act will become effective on October 1, 2012. In connection with the announcement, the Executive Yuan also proposed several amendments to certain controversial provisions to be discussed by the Legislative Yuan in September.

Reportedly, the amendments would include the following changes:

1. adding “medical records” as a type of sensitive personal data, and inserting exceptions to restrictions on the use of sensitive personal data (e.g., for public interest reasons or with the data ...

On July 31, 2012, Minnesota Attorney General Lori Swanson announced a $2.5 million settlement with Accretive Health, Inc. (“Accretive”) for violations of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations, and various Minnesota debt collection and consumer protection laws. As we previously reported in January 2012, Accretive, which acted as a business associate to two Minnesota hospital systems, experienced a breach in July 2011 that involved the protected health information of more than 23,000 patients.

On August 15, 2012, Philippines President Benigno S. Aquino III signed the Data Privacy Act of 2012 passed earlier this year by the Philippine Senate and House of Representatives. Concerns about the creation of the National Privacy Commission and the criminal penalties associated with the Act delayed final enactment.

On August 8, 2012, the Federal Trade Commission settled with HireRight Solutions, Inc. (“HireRight”) for failure to comply with certain Fair Credit Reporting Act (“FCRA”) requirements. At first blush, the case may appear to be a simple FCRA matter – the FTC alleged that HireRight functioned as a consumer reporting agency when providing employment screening services to companies, but then failed to take steps to assure the accuracy of those reports and prevented consumers from dispute inaccurate information. Despite initial appearances, however, the case has broader geopolitical implications.

On August 10, 2012, a federal district court in California denied Hulu’s motion to dismiss the remaining claim in a putative class action suit alleging that the online streaming video provider transmitted users’ personal information to third parties in violation of the Video Privacy Protection Act (“VPPA”). The VPPA prohibits a “video tape service provider” from transmitting personally identifiable information of “consumers,” except in certain, limited circumstances. According to the complaint, Hulu allegedly allowed KISSmetrics, a data analytics company, to place tracking codes on the plaintiffs’ computers that re-spawned previously-deleted cookies, and shared Hulu users’ video viewing choices and “personally identifiable information” with third parties, including online ad networks, metrics companies and social media networks.

On July 24, 2012, Lisa J. Sotto, partner and head of the Global Privacy and Data Security Practice at Hunton & Williams LLP, gave a presentation on “Data Privacy in the Global Era” to the Western Independent Bankers Service Corporation. Sotto discussed U.S., EU and other international privacy laws, with a focus on two specific areas of interest, cloud computing and vendor management. 

On August 10, 2012, the Federal Trade Commission announced that it has accepted the final settlement with Facebook which resolves allegations “that Facebook deceived consumers by telling them they could keep their information on Facebook private, and then repeatedly allowing it to be shared and made public.” As we previously reported, the settlement requires Facebook to (1) not misrepresent how it maintains the privacy or security of users’ personal information; (2) obtain users’ “affirmative express consent” before sharing their information with any third ...