Privacy & Information Security Law Blog

On March 8, 2013, a U.S. federal appeals court issued a decision in the case United States v. Cotterman, holding that the federal government must have “reasonable suspicion” of criminal activity to conduct a forensic search of laptops and similar devices in the possession of individuals attempting to cross the border. 

On March 28, 2013, the Department of Commerce’s Notice of Inquiry into “Incentives to Adopt Improved Cybersecurity Practices” was published in the Federal Register (78 Fed. Reg. 18954). This Notice, which includes a series of broad questions for owners of the nation’s critical infrastructure, follows up on earlier Commerce inquiries focused on incentives for noncritical infrastructure. The Notice states that Commerce will use the responses it receives to evaluate a set of incentives designed to encourage owners of critical infrastructure to participate in a voluntary cybersecurity program. The Notice also indicates that Commerce will use the responses to inform its evaluation of whether the incentives would require legislation or could be implemented pursuant to existing law and authorities. In addition, the Notice provides that Commerce may use the responses to develop a broader set of recommendations that would apply to U.S. industry as a whole.

On March 21-22, 2013, the data protection authorities (“DPAs”) of the Baltic states of Estonia, Latvia and Lithuania met in Riga, Latvia, for their second annual meeting to discuss several practical cooperation matters regarding data protection.

Hunton & Williams LLP is pleased to announce that Lisa J. Sotto, partner and head of the firm’s Global Privacy and Data Security practice, has been named to The National Law Journal’s “The 100 Most Influential Lawyers in America” list. Last published in 2006, this is only the eighth time this list of legal luminaries has been compiled since it was first established in 1985 as “Profiles in Power.”

On March 27, 2013, the UK Government announced the Cyber Security Information Sharing Partnership (“CISP”), a partnership between government and industry to share intelligence on cybersecurity threats.

Introduction of the CISP follows a successful pilot program across key UK sectors and is part of the UK’s Cyber Security Strategy to facilitate information-sharing on cyber threats. It introduces a secure web portal where government and industry partners can exchange real-time information regarding threats and vulnerabilities they have identified. It also sets up a team of expert analysts, the Fusion Cell, to draw together a single intelligence picture of cyber threats across the UK. It is understood that the Fusion Cell will be staffed by analysts drawn from industry, as well as the law enforcement and intelligence communities.

On March 26, 2013, the Article 29 Working Party issued a press release on the recent developments concerning cooperation between the EU and the Asia-Pacific Economic Cooperation group (“APEC”) on cross-border data transfer rules. A joint EU-APEC committee, which includes the French and German data protection authorities as well as the European Data Protection Supervisor and the European Commission, has been studying similarities and differences between the EU’s binding corporate rules (“BCRs”) framework and APEC Cross-Border Privacy Rules. The committee’s goal is to facilitate data protection compliance in this area for international businesses operating in the EU and the APEC region, including by creating a common frame of reference for both sets of cross-border data transfer rules.

On March 1, 2013, the Irish Presidency published a note to the European Council of Ministers regarding its progress on the European Commission’s proposed General Data Protection Regulation (“Proposed Regulation”). The Note details the Irish Presidency’s work to bring a more risk-based approach to the Proposed Regulation.

On March 22, 2013, Peru issued the implementing regulations of its new data protection law. The Reglamento de la Ley No 29733, Ley de Protección de Datos Personales (“Regulations”) provide detailed rules on a variety of topics, including the following:

• Territorial scope;
• notice and consent;
• data transfers;
• processing of personal data relating to children and adolescents;
• data processing in the communications and telecommunications sectors;
• outsourcing;
• information security;
• data subjects’ rights;
• registration of databases;
• codes of conduct; and
• enforcement.

On March 20, 2013, the French Data Protection Authority (“CNIL”) issued (in French) guidance on keylogger software (the “Guidance”). Keylogger software enables an employer to monitor all the activities that take place on an employee’s computer (such as every key typed on the computer’s keyboard and every screen viewed by the employee), without the employee’s knowledge.

On March 20, 2012, the UK Information Commissioner’s Office announced that it has issued a monetary penalty of £90,000 against DM Design Bedrooms Ltd. (“DM Design”) for making thousands of unwanted marketing calls.