Facebook Sued in Northern District for Scanning Private Messages, Selling to Marketers for Targeted Ads

Facebook has been accused of intercepting private messages of its users to provide data to marketers, according to a class-action lawsuit filed in a federal court in California.

The social networking company scanned plaintiffs’ private messages containing URLs (uniform resource locators) and searched the website identified in the URL for “purposes including but not limited to data mining and user profiling,” according to the complaint in the U.S. District Court for the Northern District of California.

http://www.pcworld.com/article/2083800/facebook-faces-lawsuit-for-allegedly-scanning-private-messages.html

Read more »

France Enacts Law to Facilitate Real-Time Collection of Metadata

http://www.hldataprotection.com/2014/01/articles/consumer-privacy/france-enacts-law-to-facilitate-real-time-collection-of-metadata/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+ChronicleOfDataProtection+%28HL+Chronicle+of+Data+Protection%29#!

Read more »

Hulu Loses Motion To Dismiss in Lawsuit Against re Alleged Video Privacy Protection Act (VPPA) Violations

A  US, Magistrate Judge  has turned down a request by ad-supported video content platform Hulu to dismiss a lawsuit which accused it of illegally sharing users’ viewing history with Facebook and comScore.

Hulu has argued that viewers need to demonstrate ‘actual injury’ in order to receive damages under the Video Privacy Protection Act (VPPA). However, the Court ruled that this act requires only injury in the form of a wrongful disclosure before damages might be available. 

http://www.mrweb.com/drno/news18412.htm

Read more »

3 Paradoxes of Big Data

The good, the bad and the ugly.

http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2325537&download=yes

Read more »

Talk about Creepy: Aaron's Settles with FTC re Charges That It Secretly Monitored Consumers Including by Taking Webcam Pictures of Them in Their Home

Aaron’s, Inc., a national, Atlanta-based rent-to-own retailer, has agreed to settle FTC charges that it knowingly played a direct and vital role in its franchisees’ installation and use of software on rental computers that secretly monitored consumers including by taking webcam pictures of them in their homes.

Under the terms of the proposed consent agreement with the FTC, Aaron’s will be prohibited from using monitoring technology that captures keystrokes or screenshots, or activates the camera or microphone on a consumer’s computer, except to provide technical support requested by the consumer.

In addition, Aaron’s will be required to give clear notice and obtain express consent from consumers at the time of rental in order to install technology that allows location tracking of a rented product. For computer rentals, the company will have to give notice to consumers not only when it initially rents the product, but also at the time the tracking technology is activated, unless the product has been reported by the consumer as lost or stolen. The settlement also prohibits Aaron’s from deceptively gathering consumer information.

The agreement will also prevent Aaron’s from using any information it obtained through improper means in connection with the collection of any debt, money or property as part of a rent-to-own transaction. The company must delete or destroy any information it has improperly collected and transmit in an encrypted format any location or tracking data it collects properly.

http://www.ftc.gov/opa/2013/10/aarons.shtm

Read more »

Twitter Discloses That Data Mining Is A Significant Revenue Source

Not terribly surprising and still a relatively small percentage of Twitter's revenue, but I suspect this will only grow.

http://www.bizjournals.com/washington/blog/techflash/2013/10/twitters-data-mining-business-proves.html

Read more »

New Notice Requirement in California Re Do Not Track

In California, the Online Privacy Protection Act, requires a Web site or online service that collects Personally Identifiable Information (“PII”) about California residents to, among other things, state in its privacy policy, not only the types of PII that are collected but also the categories of third parties with whom such PII is shared.

A new amendment, AB 370, was signed into law by Governor Jerry Brown and takes effect on January 1, 2014.  The new law requires that all such Web sites or online services must disclose how they respond to “do not track” features or other mechanisms on Web browsers that provide consumers the ability to exercise choice regarding the collection of PII about an individual consumer’s online activities.

Compliance with this disclosure requirement may be achieved by “providing a clear and conspicuous hyperlink” contained in the privacy policy that links to a description “of any protocol the operator follows that offers the consumer” the choice to opt-out of internet tracking. 

As always, a fundamental consideration is: What is the consequence for non-compliance? Here, it seems the answer is "not much". My sources tell me the privacy advocates feel shafted on this one, getting "only" a notice requirement out of the state legislature and violators receiving a 30 day "cure" period following receipt of notice of non-compliance.

http://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=201320140AB370

Read more »

Google Considers Abandoning Cookies

It has been reported (initially in USA Today) that Google is considering abandoning cookies for AD-ID, a system which might be sold as something more appealing to advertisers, market researchers and consumers alike. Already of course,  Microsoft has made "do not track" the default setting for Internet Explorer. Apple Safari already blocks third party cookies as will new versions of Firefox.

Hard to tell if this is a "if you can't beat them, join them" situation or something much deeper/more nuanced. Somehow though, if I were forced to beat, I know where I would put my money.

http://www.businessinsider.com/google-may-ditch-cookies-for-adid-2013-9

Read more »

Pew Poll Regarding Online Anonymity: The Findings Stink

A new survey finds that most internet users would like to be anonymous online, but many think it is not possible to be completely anonymous online. See details contained in link below.

http://pewinternet.org/Reports/2013/Anonymity-online.aspx

Read more »

FTC Publishes New Guidelines for Mobile Apps

Mostly a recapitulation of previous FTC guidelines on the issue, but important reinforcements nonetheless regarding the need to be truthful in advertising and to have core privacy protections that would be required, for example, of any dynamic website.

http://business.ftc.gov/documents/bus81-marketing-your-mobile-app

Read more »

Judge Rejects Facebook Settlement

Five Facebook users filed the lawsuit in April 2011, three months after Facebook introduced the ads that include users' names and faces. An earlier ruling in the case ordered Facebook to allow users to opt out of having their information used in the so-called Sponsored Stories.

Facebook and the suing parties struck a deal to resolve the case, but with Friday's ruling, the monetary settlement is back up in the air. The terms Judge Seeborg rejected would have included a $10 million "cy pres" payment to Internet privacy advocacy groups and up to $10 million in fees for the plaintiffs' attorneys.

Per Facebook's public filings, they earn $1 million per day in revenue for these sponsored stories.

http://money.cnn.com/2012/08/20/technology/facebook-sponsored-stories-settlement/index.html?source=cnn_bin

Read more »

FTC Approves Final Order Settling Privacy Breaches Around U-Promise Rewards

Following a public comment period, the Federal Trade Commission has approved a final order settling charges that Upromise, Inc., a membership reward service aimed at consumers trying to save money for college used a web-browser toolbar to collect consumers' personal information without adequately disclosing the extent of the information it was collecting.

http://www.ftc.gov/opa/2012/04/upromise.shtm

Read more »

U.S Supreme Court Rules Police Warrant is Needed for GPS Tracker

The Supreme Court ruled Monday that police must obtain a warrant before attaching a GPS tracker to a suspect’s vehicle, voting unanimously in one of the first major cases to test constitutional privacy rights in the digital age.


http://blogs.wsj.com/law/2012/01/23/supreme-court-police-need-warrant-for-gps-tracker/

Read more »

Data Breaches Involving Payment Card Skimming at Michaels Stores results in Lawsuits

In May 2011, Michaels Stores reported that “skimmers” using modified PIN pad devices in eighty Michaels stores across twenty states had gained unauthorized access to customers’ debit and credit card information.  Lawsuits alleging claims under the Stored Communications Act (“SCA”), the Illinois Consumer Fraud and Deceptive Business Practices Act (“ICFA”), and for negligence, negligence per se, and breach of implied contract.

Late last month, U.S. District Court Judge Charles Kocoras ruled on Michaels’s motion to dismiss. Some claims were dismissed, but others survived. The opinion presents a broad-brush survey of potential data security breach claims, with some fine detail and local color particular to this variety of criminal data security breach.

http://privacylaw.proskauer.com/2011/12/articles/data-breaches/michaels-stores-still-pinned-beneath-payment-card-skimming-lawsuit/#more

Read more »

Facebook reaches settlement with FTC on privacy alleged breaches

As reported in the Wall Street Journal: 

The settlement stems in part from changes Facebook made to its privacy settings in December 2009 to make aspects of users’ profiles—such as name, picture, city, gender, and friends list—public by default. The FTC said Facebook didn’t warn users the change was coming or obtain their approval.

Among the other charges, the FTC said Facebook promised users it wouldn’t share their personal information with advertisers, but did so anyway. The agency also said Facebook shared much of its users’ data with third-party applications, despite its representation that such data-sharing would be limited.

In a blog post on Facebook, Chief Executive Mark Zuckerberg admitted that the company made a “small number of high profile mistakes.”

http://blogs.wsj.com/law/2011/11/29/facebook-reaches-privacy-settlement-with-ftc/

Read more »

Law Firm Confidential Documents with Private Medical Records Donated to Elementary School as Scratch Paper

It looks like a paralegal at the Minneapolis law firm, Sawicki and Phelps donated paper (which contained confidential and private health information) to a local elementary school. You can't make this stuff up.

http://minnesota.cbslocal.com/2011/11/17/private-medical-records-used-as-scrap-paper-at-mpls-school/

Read more »

Cyber Attack on Illinois Water Plant

Reports are that this cyberattack emanated from foreign soil. This is again another piece of disparate but highly disturbing news.  One can only speculate but a plausible reason is that this is part of systematic series of "tests" for a broader, deeper and more insidious attack and disablement of critical American systems.

http://www.washingtonpost.com/blogs/checkpoint-washington/post/foreign-hackers-broke-into-illinois-water-plant-control-system-industry-expert-says/2011/11/18/gIQAgmTZYN_blog.html

Read more »

James Fallows Explains His travails in addressing a Data Breach of His Wife's Gmail Account

An excellent, though rather long,  Atlantic Monthly piece by the superb essayist, James Fallows concerning the massive data breach of his wife's Gmail account.  Of course, this is everyone's worst nightmare.  A hacker breaches your email or other electronic files.

In the Fallows' case, the hacker sent emails to Deb Fallows' (James' wife) contact list, posing as Deb under the ruse that Deb travelled to Madrid on a lark and needed money because she was robbed; could you, dear old friend, please send some money to pay for a hotel and a plane ticket home?

The real interesting part was how Google handled, or more precisely, mishandled the breach, only to get largely it right in the end. Given the initial bureaucratic run-around that Fallows was getting from Google at the beginning of the process following the breach, one wonders that if Fallows had not been on personal terms with the Chairman of Google (Eric Schmidt) who was actually one of the recipients of the hacker's email posing as Deb and purportedly cryptically wrote back an email with the subject line: "Deb's email has been hacked",  would this situation been properly addressed by Google if it were you or me?  I don't know, but I suspect it would be a very tough go.

Making matters far worse, six years of Deb's emails archives were wiped out by the hacker. For those that operate in the Cloud (which increasingly is everyone), this is too horrible a scenario to even contemplate. Treasured family and friend correspondences, photos, personal financial information, business emails, documents and other records, all gone. Poof! That is what happened, at least initially, to Deb. Major take-aways: 1) devise complex passwords and switch them with some regularity; 2) actually shut down your computer after each session; and 3) avoid using computers at libraries, internet cafes when accessing personal email and other accounts which require passwords.

This is the reality of life in the Cloud. Adapt or face the risk of personal and professional catastrophe.

http://www.theatlantic.com/magazine/archive/2011/11/hacked/8673/#

Read more »

Reader Privacy Act of 2011 (SB 602) -- The Development of Digital Rights in California

 SB 602, the Reader Privacy Act of 2011 that is now pending in California's legislature. The Reader Privacy Act would bring privacy rights to digital books, electronic reading records, and including the records of commercial book service providers.

As Californians increasingly rely on digital services to browse, read, and buy books, it is essential that state law keep pace to safeguard readers. The market for digital books now represents a nearly $70 million dollar market and sales in the past year have increased more than 115% . The book records of public libraries are protected under California law, but the records of private libraries and booksellers are not. The explosion of digital books makes this problem even more acute, since digital book services can collect extraordinarily detailed information: which books are browsed, how long each page is viewed, and digital notes made in the margins. A link to the text of SB 602 is contained within the link below.

http://www.eff.org/cases/sb-602-californias-reader-privacy-act-2011

Read more »

Online Tracking Practices Face Increased Scrutiny

As has been previously reported on this blog, online tracking practices face increased scrutiny. Here is a link to an excellent Hunton posting which summarizes some recent developments.

http://www.huntonprivacyblog.com/2011/09/articles/online-privacy/online-tracking-practices-face-increasing-scrutiny/

Read more »