I.
Intro
Four types of privacy: information, bodily, territorial, comms
FIPPs codifications: Dept of HEW FIPP, OECD, 1981 EU Conv, APEC
Privacy Framework, Madrid
Rights: notice, choice/consent, access
Info security and quality
Life cycle: collection, use/retention/disclosure
Management/Admin and Monitor/Enforce
United States Privacy Act IP addresses not PI
But FTC said breaches of healthcare information, IP addresses are
personal information
A. Structure of U.S. Law
 Branches of Govt
 Congress may delegate power to promulgate regs to federal
agencies (FTC, CAN SPAM)
 Agencies may operate under statutes that give them legislative,
executive, and judicial auth
 Sources of law
 Constitutions - CA constitution = right to privacy
 Legislation - 10th A reserved to states
 Regs and Rules - Some agencies required to issue
 Case law - stare decisis
 Common law - via judicial decisions, social customs and
expectations, special privilege rules
 Contract law - offer, acceptance, consideration
 Legal definitions
 Jurisdiction - authority to hear
 Person is entity with legal rights (natural and legal)
 Preemption - supersede inferior government
 Private right of action
B. Enforcement
 Federal Criminal
· DOJ sole fed agency - criminal action, jail and fines
· HIPAA both civil and criminal enforcement
 Civil enforcement - use courts for private right of action FCRA
JFPA VPPA Cable Comm, invasion of privacy
 Federal Administrative actions - agency action per statute
· basic rules under Administrative Procedure Act (APA).
· FTC = general field authority, COPPA = specific
· Often use consent decrees
 State enforcement - similar UDAP statutes, some include
“unconscionable” practices
· CAN SPAM allows state AG to enforce
· state common law privacy torts
· contract, when physician, financial institution breaches
promise of confidentiality and causes harm
· CA AG privacy task force, app platform providers
 Other Regulatory Authorities
 HIPAA HHS (shared with FTC)
 GLBA Federal Reserve, Office of Comptroller of Currency
 Education FERPA
 Tele/Marketing FTC and FCC under TCPA
 ADA, discrimination statutes EEOC
 DoS, DoC, DoT, FAA (drones)
 NHTSA (connected cars)
 OMB (Privacy Act of 1974) FIPs
 IRS (tax records)
 FinCEN (money laundering)
 DHS (E Verify), ICE
 State AGs
 Self regulatory programs and trust marks
 Understanding laws (scope and application, analyzing,
determining jurisdiction, preemption)
 Theories of Liability
1
 Contract
 Tort (intentional, negligent, strict liability). Privacy:
· intruding on seclusion
· public revelation of private facts
· interfering with person’s right to publicity
· casting person false light
 subject to 1A
 negligent failure provide adequate safeguards unsettled area of
law
 Self-regulation
 Quasi regulatory
· Industry drafts code of conduct
· FTC enforces, adjudicates
 PCI DSS does all three roles
· 3P assessment and detection
· Penalty is getting kicked out of CC systems, $$
 Seal/Certification/trust mark
· COPPA authorized FTC to confirm cert program
· DAA icon and choices
· White House encourages self-regulation with consumer input
E.g. NTIA and telcos for drones
 Cross border
 Global Privacy Enforcement Network (GPEN) in 2010. promote
cross-border info sharing, investigation and enforcement
cooperation w/ global privacy authorities
 Asia-Pacific Economic Cooperation (APEC).
· framework to share info and evidence in cross-border
investigations/enforcement in APAC
· CPEA mechanism to cooperate x-border enforcement
· FTC is a CPEA participant
 Intl conflicts (CH 13 14)
C. Information management
 Role of Privacy Professional
 Manage risks consistent with company goals, ID areas where
compliance is difficult, design policies to close gaps in policy vs.
operations
 Risks: legal, reputation, operational, investment
 Four steps: discover, build, communicate, evolve
 Data sharing and Transfers
 Inventory - collect, store, use or disclose, customer and EE, data
location/flow, how/when/who, transfer means
· Mitigate penalties, Required under GLBA Safeguards
 Classification by level of sensitivity (restricted, public)
who has clearance, level of protection
· segregate data
· helps compliance with sector specific laws, discovery
 flow mapping to ID areas for attention
 Accountability - retention policy, sensitivity, encryption?, intl
transfer, who is controller/BA, define process steps, dependency
on other systems (cloud)
 Privacy Program Development
 How many privacy policies?
 Consult legal and executives
 Revisions - notify EEs, then current and past customers
 Need opt-in for retroactive changes (FTC says unfair, even if
changes are truthful)
 notice accessible - online, post high traffic area, annual updates
for FIs, training for EEs, CSRs
 Policy version control - at least once a year
 Managing User Preferences
 Opt-In, Opt-Out. Failure Sec 5 violation
· Not needed for “commonly accepted practices” - consumer
orders a product online.
· internal ops, improving services, fraud prevention, legal
compliance and first-party marketing
 · concern with innovative services
 Opt Ins: COPPA, HIPAA, FCRA
 Opt Outs: GLBA transfer unA 3P
· VPPA video data to 3P
· CAN SPAM email, Do Not Call
· DMA (mail), NAI, DAA (digital)
 Scope of choice, subject or channel
 Mechanism - channel consistency
 Link user’s interactions thru multiple channels
 Time period to implement required by law?
 3P vendors, must communicate preference to them
 Customer Access and Redress
 By Law under FCRA HIPAA FERPA
 FIPs per OECD, APEC principles, GDPR
 Judicial Redress Act 2015, non US person in civil action against
US Govt, to access records
 APEC = good baseline for when to give access
 Find out whether PI held by controller
 With sufficient proof of ID, get PI
 within reasonable time, charge, manner; understandable;
 challenge accuracy, rectify, complete, amend, delete
 except where:
· burden or expense disproportionate to risks
· legal or security reasons, protect CI; or
· third person rights violated
 reasons why and be able to challenge such denial
 Contract and Vendor Management
 K should have: CI provision, use limitation, subK, must notify of
breach, infosec, effect of termination
 Due Dili: reputation, financial condition, insurance, infosec
controls, point of transfer security, disposal requirements, EE
awareness, incident response, audit
D. Online Privacy (CH5)
 Web Tech
 HTTPS data txr over encrypted cxn
 Hypertext transfer protocol (HTTP), how messages formatted and
transmitted over a TCP/IP network
 HTML markup language to render, dynamic links, doctags
 XML markup language, big data
 Firewall as web client for 2 step process
 Proxy server, mask activity, block bad software, logs
 VPN encrypts info
 Web server log: IP address, date/time stamp, referring URL,
browser type and OS
 IP address = unique #
 ISP assign IP address
 IPv6, ID based on hardware interface of device
 TCP reliable data connection
 TLS security protocol, succeeded SSL
 Javascript, XSS danger, DoS
 CSS language
 Flash, can’t delete cookies
 Data Definitions
 Pseudonymous data. direct identifiers removed. Indirect
identifiers remain
 Deidentified data. Direct and indirect identifiers removed
 Anonymous data. Direct and indirect identifiers removed or
technically manipulated to prevent reidentification.
 Blurring. reduces precision of disclosed data to reduce the
certainty of individual identification.
 Masking. masks the original values in a data set with the goal of
data privacy protection.
 Differential Privacy. mathematical approach - risk to privacy is
not substantially increased as part of database
2
 Threats: unauth access, malware, phishing, spear phishing, social
engineering; Technical: SQL injection, XSS
 who gains access to data collected from the web
· 2 factor auth, password field in HTML
· Cookies suck for this
 Industry standard is to encrypt in transit, TLS
 authentication and protecting online identity
· password practice, antivirus software, firewall, wifi and
Bluetooth interception, file sharing - limit accessible files,
public computers and chargers
 verification, certification of compliance with org policy
 email security, follow CIA (confidentiality, integrity, avail)
· methods, remove HTML tags, scanning bad content
 SPAM principles
· No false or misleading header information
· No deceptive subject lines
· Opt-out mechanism in each message
· Notification that message contains adv or promo
· Information about the sending organization
 Info Sec (CIA)
 Three: Physical, Administrative, Technical
 Types of Data Breach Incidents
 Unintended disclosure; Hacking or malware; Payment card fraud
skimming devices; Insider; Physical loss paper documents;
Portable device, Stationary device
 Incident Management for Data Breaches
 Four steps
· 1. Determine if breach occurred, difficult to detect
· 2. Containment and analysis
° Recover lost data
° Ask recipient of misdirected data
° Network intrusion, shut down
° Forensics, audit
· 3. Notify affected parties
° Info re: risks, how to mitigate
· 4. Follow up, adapt
 OMB guidance to Fed agencies:
· Designate breach response team
· ID privacy compliance documentation
· Share info to understand extent of the breach
· Determine what reporting is required
· Assess and mitigate risk of harm for individuals
· Notify individuals affected
 OMB also focused on contracts with vendors: provide training to
EEs, encrypt PII, report breaches, cooperate
 Mobile privacy
 Concerns re: LBS, smart watches, health data, biometrics
 Children’s Privacy
 COPPA, DOPPA for teens, CCPA for teens
 Web privacy notice. TrustArc recommends:
 Say what the organization does and do what is stated
 Tailor disclosures to actual business operations
 Do not treat privacy statements as disclaimers
 Revisit privacy statement frequently
 Communicate these privacy practices to entire company
 Layered notices, increased use
 Mobile Privacy notice
 FTC best practices for platforms, ad networks, app developers,
app developer networks
 include “privacy by design (PbD)” or even privacy by default,
transparency, simplification of consumer choices
 Desktop app with web interfaces
 Privacy by design approach
 Financial software: GAO advised segregate duties, disaster
 recovery · maintain reasonable security
 Third Party F. International Data Transfers
 Syndication, XSS  SCC, Derogation, Adequacy, Appropriate safeguards
 Web services, facilitate comms between computers G. Multinational Considerations
 Cobranded sites  GDPR fundamental right to access and correct personal info about
 Web widgets, installed on another page the data subject
 Online ad networks  conflict with discovery disclosure
 Onward Transfers  employees in both continents
 Orgs that receive data: processor, distinct service like process  CLOUD, Hague last ditch
payment, controller
 FTC: onward transfer is responsibility of host website—not the
third party
· Issued guidance, enforcement actions, Privacy Shield
 Consumer: data contract, notify of transfer, opt out
E. Digital Advertising
 Cookies small HTML file that web server places on the hard drive of
a user’s computer
 personal information if cookie linked to identified transaction
with a user, CC purchase with user’s name
 If CC purchase linked in company’s database with other cookie
info all info is identifiable
 GDPR, cookie = PI
 Session cookie for shopping cart, chat session
 First vs. 3P cookie, Flash cookie respawning problem
 EU Cookie Directive
 Opt in consent before cookies placed
 ePrivacy cookies are personal data (so users must consent)
 Web Cookies best practices:
 Not store unencrypted PI
 adequate notice of usage
 Use persistent variation only if needed
 Not set long expiration dates
 Disclose third-party cookie provider
 opt-out (or in Europe, an opt-in) mechanism
 session, persistent, 1P, 3P, Flash cookie
 Web Beacons clear gif set by browser or HTML email
 Use w/ cookie to track, create profiles w/ web server logs
 Online ad impression counting, monitor file download, ad
campaign performance, opened email
 Digital Fingerprinting
 ID device from web server logs & fonts used computer
 Used by banks to ask for additional auth
 Q over what is sufficient notice
 Search Engines
 Tracking queries can ID person, religion
 Encrypted searches, anonymize after time period
 Virtual assistants as surveillance device
 Social Networking
 Inconsistent control mechanisms, still evolving
 Desktop Ad Ecosystem
 Supply, demand, ad exchanges
 Mobile Ad Ecosystem
 app-based usage, sandbox
 Default mobile browser settings block third-party cookies
 detailed location, GPS Bluetooth for targeted advertising
 store map with MAC address database
 Cross Device Tracking
 Deterministic, predictive profiling
 FTC report recommendations
· transparent
· choice about tracking
· companies refraining from cross-device tracking of sensitive
topics (health, financial, children)

3
II. Limits on Private Sector
Cross-sector FTC Privacy Protection
A. Sec 5 of FTC Act. Unfair and deceptive trade practices UDTP
…unfair methods of competition, Sec 6 investigate power
 FTC Enforcement
 Broad authority to investigate, subpoena, demand reports, admin
trial before ALJ and enjoin
· Consent decree most used, avoid litigation
· Can appeal to 5 commish, then district ct
· FTC cannot assess civil penalties for violation, but can if ruling
is ignored.
 BCP and DOJ litigate violations of consent decrees
 force redress of harms to consumers
 Early FTC
 Geocities misrep’ed privacy policy
 Eli Lilly accidently sent mass email with addresses, required to
maintain info privacy and sec program
 Unfair
 Can exist without deception
 fail to implement adequate protection measures for sensitive PI,
inadequate disclosure, breach promise
 FTC v. Wyndham 2015; crappy practices, no changes after
breaches. Order: PCI, comprehensive infosec
 FTC v. LabMD, hacking breach, failed to take APM for sPI.
Order: comp sec program, ruled unenforceable
 Equifax - failed to take rble SM, breach exposed SSNs and
home addresses of 147M, $300M consumer fund, $175 to
states, $100M civil pen CFPB
 Lifelock deceptive, and failed to encrypt, no infosec (FTC and 35
states), paid $11M to FTC, then failed to comply with Order =
$100M
 DesignerWare - unfair to secretly collect keystroke logging and
geolo, deceptive to use fake registration
 Deceptive
 material statement or omission likely to mislead (rble)
 false promises, misreps, breach reps, privacy policies or
certifications
 Facebook - 3P access to user friends’ data
 BLU- info to 3P unnecessary to provide services, misrep
protection of PI
 Snapchat - misrep deletion, lax security
 Google - failed to comply consent order, overriding default
cookie settings in Safari
 Excludes banks, federally regulated financial institutions, common
carriers (transportation and communications)
B. COPPA Children’s Online Privacy Protection Act
 Does not preempt state laws
 Privacy Rule: clear and conspicuous notice of data collection
methods, privacy policy on every web page where PI is collected
 consent by parents prior to collection of personal information for
children under the age of 13
 No public security exception to allow disclosure
C. Future of Federal Enforcement
 2012 White House Report: Traditional fair information practices
FIP/Consumer Privacy Bill of Rights
· Individual control
· Transparency; Security; Accountability
· Respect for context of collection
· Access and accuracy
· Focused collection (reasonable limits)
 2012 FTC Report
· Privacy by Design
· Simplified consumer choice
· Transparency
 FTC Priorities
4
· Do Not Track; Mobile self-regulation; Data brokers
· Large platform providers, comprehensive tracking
· Enforceable self regulatory codes
 FTC Updates
· smart TVs, drones, ransomware, Audio beacons, cross device
tracking, cars, mobile practices, streamline updating
D. Emerging Issues
 Artificial intelligence
 Convergence with big data
· Data minimization and deidentification
 AI must be designed to help humanity, must be designed for
intelligent privacy, must be transparent, algorithmic
accountability so we can undo unintended harm
 Data broker laws
 LeapLab, bought SSNs from payday loan sites, sold to biz with
no legitimate use, failure to protect data sold to 3P
 FCRA, ECOA FTC Act all apply
Medical Privacy
A. 1996 (HIPAA) Updated by HITECH
 Does not preempt state laws
 California Confidential Medical Information Act CMIA
 No private right of action
 Enforcement:
 Primary enforcer is HHS’s office of Civil Rights
· Tiered Penalties based on awareness and willfulness: up to
$1.5 mil for most willful violations
 State AGs under HITECH, or UDAP or state law
 DOJ criminal enforcement (prison up to 10 years for IHII)
 FTC can enforce under section 5 UDAP
 FERPA = student health records.
 HIPAA = non-student health records.
 covered entities = healthcare providers, insurers, business
associates, doctors’ offices, hospitals, Healthcare clearinghouses,
Business associates
 Transactions Rule
 Electronic format for reimbursement
 Privacy Rule:
 Privacy Notice: must provide at date of first service delivery and
detail patient’s rights to PHI, unless indirect relationship or
medical emergency
 Allows use and disclosure for treatment, payment (TPO)
 Need auth for outside TPO: what PHI, purpose, 3P recipients.
Cannot condition treatment on consent
· Psychotherapy notes, stricter
· Marketing, sale of PHI
 Exceptions:
· De-identified: Remove 18 elements; expert certify
· Research: permitted on de-identified data
· Other: LE suspect or victim, etc.
° report abuse, neglect, or domestic violence,
° court order, certain government functions
° public health (epidemic)
° mandated reporting (LE, gunshot wound)
° to fed for national security under Nat Sec Act
° to patient or personal rep; and HHS
· Subpoena Civil: must notify patient so they have chance to
object, seek QPO - litigating parties can’t use/disclose PHI
for other purpose, requires destruction afterwards
· Admin subpoena no court involvement for LE:
° info is relevant and material, specific, limited scope
° De-identified info could not be reasonably used
 Minimum Necessary limit to purpose; BA’s must have K
 Access and accountings: right to access, copy, amend, if denied
 append. PHI kept in “designated record set”
· Accounting of recipients; respond w/in 30 days
· Reasonable cost based fee ok
 Safeguards: Admin Physical Tech safeguards
 Accountability: must appt privacy official, train personnel,
complaint procedures, enforcement by OCR: Anthem
cyberbreach, Feinstein FERPA stolen laptop
 Security Rule: minimum security reqmts for ePHI
 Requires reasonable security measures, APT
· Some specs are required
· some are addressable so each CEBA must decide for itself
based on: cost, size, tech, risk
 Admin: appoint officer, policies and processes, EE training
program and discipline for non-compliance
 Physical: access, workstation policies, disposal/backup
 Tech: encryption, login, track users
 Protect v. rbly anticipated threats/disclosure to ePHI
 Unencrypted data loss = presumed breach by OCR
B. Health Information Technology for Economic and Clinical Health
Act (HITECH)
 Breach notice, penalties, limited data
 BA’s subject to privacy and security rules, must sign BAA,
implement reasonable appropriate safeguards
 Breach: must notify individuals within 60 days
· >500 people, must notify HHS immediately
· 500 or more in same jurisdiction, must notify media
· can avoid liability if use encryption software
 Disclosure must be minimum amount necessary
 may not sell EHR without patient consent
C. Confid of Substance Use Disorder Patient Records Rule
 Does not preempt state laws, criminal violation
 Scope: disclosure of “patient identifying” information by treatment
programs for alcohol and substance abuse ASA
 Applicability: any program that receives federal funding:
 Individual or entity that …
 identified unit within a general medical facility that …
 Medical personnel or other staff in a general medical facility
whose primary function is … provide ASA diagnosis, treatment,
referral for treatment
 Must obtain written patient consent before disclosing, consent must
specify type of info, general designation ok
 Redisclosure prohibited if info would identify individual as having
been diagnosed, treated, or referred for treatment
 Cannot use info for criminal charges against patient
 Must have formal policies to protect PI
 Exceptions to consent requirements:
 Medical emergencies
 Scientific Research; Audits and evals
 Comms with a qualified service organization
 Crimes on program premise or against personnel
 Child abuse reporting; Court order
 Criminal Fines Violations: (USA office)
 First not more than $500
 $5000 for each subsequent offense
D. Genetic Information Nondiscrimination Act of 2008 (GINA)
 genetic information in health insurance and employment
 Civil Rights Act no employment discrimination; ERs can’t use genetic
info about EEs or family except:
 request was inadvertent
 part of an employer-wellness program and voluntary
 comply with FMLA
 ER buys commercial, publicly available info
5
 legally required genetic monitoring for toxin exposure in the
workplace, employee voluntarily participates
 DNA lab EE’s for quality control (contamination)
 ER must keep separate from medical files
 No private right to action but may be available under the
federal laws that GINA revises, similar state laws
 Amended ERISA, Public Health Service Act, Social Security Act, can’t
adjust premiums, absent symptoms
 Penalties: $100/day of noncompliance, min up to $15,000
E. The 21st Century Cures Act of 2016 (Cures Act)
 Expedite research process, new medical devices, drug approval,
reform mental health treatment
 Privacy Provisions:
 FOIA exempt for individual biomedical research info
 Researchers can remotely view PHI (must meet minimum
safeguards of HIPAA’s Privacy and Security Rules)
 Information blocking prohibited but HIPAA’s protection of PHI
remains, fine up to $1M
 NIH Certificates of confidentiality, fed funded research, can’t use
info legal/admin proceedings w/o consent
 Compassionate sharing of mental health or substance abuse
information with family or caregivers
Financial Privacy CH 9
A. The Fair Credit Reporting Act (FCRA)
 Generally, preempts state law (see FACTA)
 Does not preempt states from stricter laws re: employment credit
history checks such as the California ICRAA
 Enforcement: private right of action, dispute resolution, FTC & CFPB
share, State AGs = concurrent enf. Auth.
 FTC v TeleCheck, check authorization co. and CRA, did not
comply with dispute procedures for consumers whose checks
were denied. TRS debt-collection co. violated Furnisher Rule who
must ensure accuracy of info provided to CRAs. FTC targeting
data brokers
 CFPB v. Clarity Services failed to properly investigate
consumers who disputed info on credit reports & obtained credit
reports without permissible purpose
 CFPB v. JPMorgan Chase failed to have reasonable policies re:
accuracy of info it gave to CRAs, and failed to give consumers
results of investigations where the consumer disputed accuracy
 CFPB consent order with CitiFinancial—failed to reasonably
investigate consumer’s disputes, failed complete investigations in
timely manner, failed to accurately report certain delinquent
accounts.
 Violations: civil/criminal penalties. Statutory damages of at least
$1000 per violation, at least $3,756 for willful
 Amended by FACTA re: to ID theft, truncate #s KYC, free annual
report, Disposal, Red Flag rules, EE internal invest.
 Consumer report is any comms by a CRA that pertains to:
 Creditworthiness , Credit Standing, Credit Capacity
 Character, General Reputation
 Personal Characteristics, Mode of Living
 Four User requirements:
 3P data for decision making, accurate, current, complete
 Give consumers notice when 3P data used to take AA
 only use for permissible purposes
 consumer must have access to their consumer reports and
opportunity to dispute or correct errors
 Also: record keeping, certifications, securely dispose
 CRA’s MUST:
  Must give Consumers access to their consumer reports and
opportunity to dispute or correct errors
 Must ensure maximum possible accuracy of report
 Not report outdated negative info, >7 years old, bankruptcies
>10 years
 Provide only to entities with permissible purpose
 Maintain records regarding entities that received reports
 Provide consumer assistance as required by FTC
 FTC drafted Notice  User
 Users must have a “permissible purpose”
· Court order; icw child support payments;
· Consumer requests in writing
· Extension of credit
· Underwriting of insurance
· Employment purposes
· See if consumer breached terms of account
· Eligibility for license or other govt benefit
· Valuation assessment by investor/servicer/insurer
· Prescreened unsolicited offers of credit or insurance
 Users must provide certifications of permissible purpose
 Users must notify consumers when adverse actions
 Adverse Action based on Info from CRA: inform consumer (oral
ok):
 Contact info of CRA
 Statement CRA didn’t take adverse action, can’t explain
 Statement consumer’s right to obtain free disclosure of file from
CRA if consumer requests within 60 days
 Statement consumer’s right to dispute directly with CRA the
accuracy and completeness of info
 Adverse Action based on info from non-CRA: credit for personal,
family or household purpose, must inform consumer of right to be
informed of the nature of the info that was relied upon if request is
made within 60 days. User must disclose within reasonable period
of time.
 Adverse Action based on info from affiliates: insurance,
employment, or credit: must inform consumer they may obtain
disclosure of nature of info relied upon by making a request within
60 days. user must disclose within 30 days
 Other Disclosures
 If use credit scores re: mortgages, must give credit scores and
other info about credit scores to applicant
 Risk-based pricing notice to the consumer if CR used icw
application for credit on terms that are less favorable than the
most favorable terms available to most other consumers. E.g.,
Sprint
 Companies that extend credit to consumers must implement Red
Flag program to deter identity theft
 Medical Info (usually just payment info)
 payment info must be coded, not ID medical provider
 For insurance txn, must be coded or need prior consent
 For employment or credit purpose, need prior consent and info
must be relevant
 Disclose only as necessary, or as required by law
 Prescreened Lists
 creditors and insurers can obtain limited consumer report info icw
firm unsolicited offers of credit or insurance
 obtain from CRA a list of consumers who meet certain
preestablished criteria
· must: (1) before the offer is made, establish the criteria that
will be relied upon to make the offer and to grant credit or
insurance
· (2) maintain such criteria on file for three-year period from
date offer is made to each consumer.
6
· any user must include with each written solicitation a clear
and conspicuous statement that:
° Info in consumer’s CRA file was used
° consumer received offer b/c they satisfied the criteria
for creditworthiness or insurability
· Credit or insurance may not be extended if, it determines
that consumer does not meet the criteria, or he does not
furnish required collateral.
 consumer can optout of use of info in their file with future
prescreened offers by contacting the notification system
established by CRA that provided the report
 2015, must give simple easy-to-understand notices explaining
consumer’s right to opt out of receiving offers
B. The Fair and Accurate Credit Transactions Act (FACTA)
 Made substantial amendments to FCRA
 CFPB is rule-making and enforcement authority
 preempts most stricter state laws except:
· states retain some powers to enact laws re: ID theft
· laws re: insurers use of credit-based insurance scores
 called out by FACTA as not preempted
· credit scores, state laws in CA CO
· frequency of free credit reports, state laws in CO, GA, ME,
MD, MA, NJ, and VT remain in effect
 Required truncation of debit and credit card numbers
 Required more detailed “know your customer” documentation for
domestic and foreign FI
 Gave consumers new rights to explanation of credit scores and
right to request a free annual credit report
 Add’l rules for “free offers” of report w/ font limitations
 Disposal Rule and Red Flags Rule
 FACTA Disposal Rule
 Disposal = sales, transfer, donation
 User of consumer report and derived info, must dispose in a way
that prevents unauthorized access and misuse, reasonable
methods based on media
 Enforcement: FTC, federal banking regulators, CFPB
 Violations: civil liability
 State disposal rules may impose broader requirements
 FACTA Red Flags Rule
 required FTC and fed banking agencies to develop rules for FIs
to detect, prevent and mitigate ID theft
 CFPB has rulemaking and enforcement authority
 Red Flags Program Clarification Act of 2010 narrowed
definition of creditor to exclude service providers who bill in
arrears. Applies if you’re a creditor:
· Use consumer reports icw credit transaction
· Furnish information to CRA
· Advance funds to or on behalf of someone
 Each entity must create its own list flags. FTC recs:
· Alerts from CRA; Suspicious ID documents; personal
identifying data; unusual use of covered account
C. State Financial Data
 Credit History
 FCRA does not preempt states from stronger laws for
employment credit history checks, such as ICRAA.
 11 states CA CO CT HI IL MD NV OR VT WA limit the use of
credit information in employment
· credit history info used only for position applied for
 some states allow credit history checks to be performed for
predened occupational categories:
· nance or management or exposure to CI
D. Gramm-Leach-Bliley Act (GLBA) privacy framework for modern · If FI wants to share with nonAff 3P and no exception:
banking ° must give privacy notice
 Does not preempt stricter state laws ° including an opt-out notice.
 banks, insurance providers, securities firms, payment settlement · can give short-form notice instead of full if:
services, check-cashing services, credit counselors, pawn shops, ° explain full privacy notice is available on request;
mortgage lenders (significantly engaged in financial activities) ° reasonable way to get the full privacy notice; and
 Enforcement: ° include an opt-out notice
 No Fed private right to action ° model notice short privacy notice Financial Services
· private right to action in some states Regulatory Relief Act (FSRRA)
 failure to give certain notice may be deceptive trade practice  FI can never share consumer account numbers w/ nonAff 3P
per Fed and state law for marketing, even if consumer hasn’t opted out
 by federal financial regulators for institutions in their jurisdiction  FI must ensure service providers not use consumer data for
- Federal Reserve, Office of Comptroller of Currency, FDIC, and anything other than intended purpose
SEC  GLBA allows disclosure for investigation on matter “related to
 Financial institutions not in the jurisdiction of the other agencies public safety” (national sec)
FTC and CFPB F. GLBA Safeguards Rule
 state AGs can enforce  FIs must protect CIA of personal consumer info
 TaxSlayer poor security measures  develop program that addresses ATP safeguards
 Venmo misled re: privacy practices, security of data  Five Must-Dos:
 Violations: civil and criminal · Designate an employee to coordinate safeguards
 penalties under Financial Institution Reform, Recovery, and · Identify and assess risks to customer info
Enforcement Act (FIRREA). · implement safeguard program and regularly monitor
· up to $5,500 for violation · Select appropriate vendors and sign Ks
· max of $27,500 if violations are unsafe, reckless. · Evaluate, update program upon changes
· $1.1M for knowing violations  Note: CFIPA conflict
 U.S. Bancorp / MemberWork v. MN AG, sold NPI to G. CA SB-1 California Financial Information Privacy Act
telemarketer that used account to autocharge  CCPA applies to FI’s when engaged outside of GLBA
 Definitions  CFIPA applies to FI’s when engaged in GLBA activity
 Consumer = anyone who buys or applies for financial product · caution - applies to dataset, not who holds dataset
for personal, family, or household purposes.  opt in for FI to share data with nonaffiliated parties
 Customer = consumer who has an ongoing customer relationship  opt out for FI to share data with affiliates not in the same line of
(account holder) business
 Customer, non-consumer = customer who is not also a consumer.  But FI can share nonmedical info with affiliates in same line of
I.e. large institutional customer business e.g., insurance, banking, securities
 FIs must protect consumers’ nonpublic personal info  Violations:
 Regulates “nonpublic personal information” defined as · negligent noncompliance statutory damages of $2,500 per
personally identifiable financial information: consumer, up to $500,000/occurrence.
· Provided by consumer to a financial institution · Willful non-compliance eliminates the $500,000 cap
· Resulting from a transaction or service performed for the
consumer or
· Otherwise obtained by financial institution
· That someone is FI’s customer
 Publicly avail info is not NPI (phone book, govt records)
E. GLBA Privacy Rule: Financial institutions must:
 Customers clear and conspicuous notice of FI’s info sharing
policies, annually
· Info collected from customers and consumer
· Recipients
· How it protects/safeguards the info
· how consumer can opt out of info shared thru reasonable
opt-out process
 After giving notice, FI can share any info it has with affiliates
and joint marketing partners
 If FI also wants to share with nonAff 3P and no exception:
· Must also disclose info sharing practices and optout
· wait reasonable time to optout B4 sharing NPI
 Exceptions: Can’t opt out (FI can share w/o notice)
· Outsourced crucial services (txn processing)
· Outsourced marketing service provider
· Disclosure is legally required
 must process opt outs within 30 days
· can’t discriminate against those who optout
 Customers who are not consumers: fewer notice req’s
7
H. New York Cybersecurity Reg 2017 NYDFS comprehensive strict · Additional $5000 per day for failure to comply
cybersecurity regulations that far exceed GLBA  Penalties up to $25,000, fail to meet info sharing requirements
 cybersecurity mandates on all covered FIs of PATRIOT Act.
 National Institute of Standards and Technology (NIST)  Penalties up to $1M fail due dili req’mts
Cybersecurity Framework  Criminal penalties
 risk assessments, document policies, designate CISO, limit data · up to $100,000 fine and/or 1 year jail and
retention, incident response plan, audit trails · up to $10,000 fine and or/5 year jail
 defines nonpublic information more broadly than GLBA K. International Money Laundering Abatement and Anti-Terrorist
 key requirements not in GLBA: personnel, reporting, Financing Act of 2001
documentation, and 3P service providers req’mts  Part of USA PATRIOT Act
İ. Dodd-Frank Wall Street Reform & Consumer Protection Act  Expanded BSA’s reach
 Created CFPB, indie bureau Fed Reserve, Broad authority  Gave Treas Sec ability to make broad, modified KYC rules
 Rule making auth. for existing financial privacy laws: FCRA,  USA PATRIOT Act compliance issues categories:
GLBA, Fair Debt Collection Practices Act  Info-sharing regs, cooperate to deter money laundering
 Over all nondepository FIs, depository FIs with $100B  KYC rules, ID of beneficial owners of account, procedures
 investigations and issue subpoenas, hold hearings  Development of formal money-laundering programs
 civil actions under UDAP & “abusive acts and practices”  BSA expansions, new reporting and record-keeping for different
· Materially interferes with the ability of a consumer to industries (broker-dealers) and currency txns
understand a term or condition of financial product or  Evolving: Foreign Account Tax Compliance Act of 2010 (FATCA)
· Takes unreasonable advantage of: more detaile “KYC” doc for domestic/foreign FIs
° C’s lack understanding of risks, costs, conditions;
° inability of consumer to protect its interests; or
° reasonable reliance on a covered person to act in the
interests of the consumer
 Violations:
 $5,526/day for federal violations
 $27,631/day for reckless violations
 $1,105,241/day for knowing violations.
 State AG’s can bring civil actions under Act
J. Bank Secrecy Act of 1970 (BSA)
 Currency and Foreign Transaction Reporting Act
 Treas Sec can impose record-keeping and reporting
requirements on FI’s to fight money laundering and fraud
 Applies to: entities subject to supervision by state or federal bank
supervisory authority: banks, securities brokers, card clubs,
telegraph, casinos - evolves as launderers get creative
 Reporting
 currency txns in excess of $10,000
 check txns for $3000, info re: purchaser
 certain wire transfers
 exempted: Electronic Funds Transfer Act, automated
clearinghouses, ATM or POS systems
 Record Retention:
 $10,000 extension of credit
 Other records, those with “high degree of usefulness”
· Borrower’s name and address
· Credit amount and purpose and date of credit
· Such records may be maintained for five years
 Deposit account records: taxpayer ID; Signature cards
 CD’s
 Wire, direct deposit if $100+
 Suspicious Activity Reports (SAR)
 Alert U.S Dept of Treasury’s Financial Crimes Enforcement
Network (FinCEN):
· FI suspects an insider committing a crime
· detects crime $5000 and basis for identifying suspect
· detects crime $25000 (no need for suspect)
· detect currency transactions aggregating $5000+ that
involves potential money laundering
 Violations:
 Civil penalties, fines:
· $25000, txn amount, $100,000 max
· negligence $500/violation
8
 II.D Education CH 10
A. Family Educational Rights and Privacy Act (FERPA)
 Applies all educational institutions that get federal funding
 Does not preempt state law
 Provides students with the right to: (FIPPs)
 Control the disclosure of their education records
 Review and seek amendment of their education records
 Receive annual notice of their rights under FERPA
 File complaints with the U.S Department of Education
 Education Record directly related to student, maintained by the
school or behalf of - all formats. Excluded:
· Campus police, Employment, Treatment, Applicant, Alumni;
Grades on peer-graded papers
 Disclosure of Education Record permitted if:
· Info is not PI
· Info is directory info, and no opt out
· Consent provided by parent or 18 y/o student
· To holder of FERPA rights
· Statutory exception, health or safety purposes
· PII in directory information
 GPA, grades, or transcripts not released without consent
 Personally Identifiable Info:
 Name of student’s, student’s parent or other family
 Mailing address; SSN or student number
 Other identifiers such as DOB
 Other info that alone or in combo would link
 Info requested by a person whom the school reasonably believes
knows the identity of student
 Directory Info - not generally considered an invasion of privacy or
harmful if disclosed (self determined by school)
 Name, DOB, address, email, ph#, major honors
 Never SSN, maybe student ID
 Consent under FERPA
 must be signed and dated. Must also identify:
· record to be disclosed; purpose; recipient
 Use reasonable methods to authenticate
 Records Disclosure Consent Exceptions:
 to school officials with “legitimate educational interest”
· outsourcer can’t re-disclose
 education institutions where student seeks to enroll
 icw financial aid
 to orgs doing research studies for educational institutions
 to accrediting orgs
 to alleged victim of forcible or nonforcible sex
· info related to sex offenders
· verified party that provided or created the record
· to law enforcement, judicial order or subpoena
· appropriate parties icw a health or safety emergency
 Right to access records
 within 45 days of request
 If denied opportunity to fix, must be given hearing
 No right to access parent’s financial records, treatment records,
LoRec, LE records, third party info
 Right to correct records if inaccurate, misleading, violation of
privacy
 Enforcement
 Dept of Education, FPCA investigates complaints
 Penalty loss of federal funding
 No private right of action
 Who has rights?
 18 y/o student is person in control of rights
 Parent for minor
 If student has left high school and is attending only a

9
 postsecondary institution, rights are held by student regardless
of age.
 school may disclose to parents the educational records of student
without student’s consent, if student is a dependent for tax
purposes.
B. FERPA and Protection of Pupil Rights Amendment (PPRA)
 Applies to elementary and secondary schools that receive
federal funding, no colleges
 parents rights re: to collection of sensitive info from students
through surveys:
· Political, Mental and psychological; Sex; Illegal, antisocial,
self-incriminating and demeaning behavior, Critical
appraisals of individuals privileged relationships, Religion,
Income (other than by law)
C. No Child Left Behind Act of 2001
 Broadened PPRA to limit collection/disclosure of student survey
info. Now requires schools to:
· Enact policies re: commercial purposes
· Allow parents to inspect surveys, opt-out; prior notice
D. FERPA and the HIPAA Privacy Rule
 health records are subject to FERPA and not HIPAA where a
public K12 school has a nurse for student health
 FERPA does not apply to private elementary or secondary
schools that do not receive federal funding
· subject to HIPAA if school is “covered entity”
 Both FERPA and HIPAA Privacy Rule typically apply to college
healthcare b/c treats both students and staff
· FERPA applies to student health records
· HIPAA Privacy applies to nonstudent health records.
E. Education Technology
 Google Apps students sued under FERPA violation
 Self Reg - tech pledge to safeguard student privacy, violation
enforced as deceptive trade practice Sec 5
10
Telemarketing and Marketing Privacy
A. FTC issues Telemarketing Sales Rule (TSR) in 1995
 FCC counterpart, issued Telephone Consumer Protection Act of
1991 (TCPA)
· restricts unsolicited advertising by phone, fax, texts
 FCC and FTC share regulatory jurisdiction
· FCC promotes transparency in online comms, monitor online
markets, consumer complaints and investigate.
· FTC prevents UDAP, takes enforcement actions
 Does not preempt stricter state laws
 Some states require marketer license or register w/state
 State DNC with differing exceptions/fines
 Some require written contract for certain transactions
 Enforcement by FTC, state AGs, or private individuals
 Civil penalties up to $42,530 per call
 State private right of action via intrusion on seclusion tort
B. Rules Governing How Calls Can Be Made Under Telemarketing
Laws
 Defines telemarketing as plan, program, or campaign conducted
to induce purchase of goods/services/ charitable contribution,
use of phones interstate
 TSR requires covered orgs to:
 Call only between 8am and 9pm
 Screen and scrub names against national DNC list
 Display caller ID info
 ID themselves and ID product they are selling
 Disclose all material info and terms
 Comply with special rules for prizes and promotions
 Respect requests to call back
 Retain records for at least 24 hours
 Comply with special rules for automated dialers
 TSR requires disclosures at beginning of call:
 Identity of seller
 Purpose of the call is to sell goods/services
 Nature of goods/services
 No purchase or payment is necessary to participate/win
promotion, does not increase chances of winning
 If call has multiple purposes (sale of different types of products
or different purposes), disclosures have to be made for all sales
purposes
 Misreps/material omissions: Ten categories of info that must
always be disclosed:
 Cost and quantity
 Material restrictions, limitations, conditions
 Performance, efficacy, central characteristics
 Refund, repurchase, or cancellation policies
 Material aspects of prizes, investment opportunities
 Affiliations, endorsements, or sponsorships
 Credit card loss protection
 Negative option features
 Debt relief services
 More disclosures for non CC payment (phone or utility billing), with
express verifiable authorization
 Caller ID must transmit if technically feasible
 Call Abandonment prohibited: must connect call to a live sales rep
within 2 secs of person’s completed greeting.
 No pre-recorded sales pitches w/o opt in from consumer
 Abandonment Safe Harbor:
· Use tech to ensure less than 3% abandonment measured per
day per calling campaign
· Allows telephone to ring for 15 secs or four rings before
disconnecting unanswered call
 · Play recorded message w/ name and ph# of seller if live
sales rep is unavail w/in 2 secs of person answer
· Maintains records documenting adherence to preceding 3
req’mts, 97% of calls answered
 Unauthorized Billing can’t bill without consent
· More rules for billing to Pre-acquired account info
· Special requirements for freemium
° Last four digits
° Audio recording of txn
 Robocall Autodialers - TCPA Updates
 FCC revised TCPA to reconcile with TSR
· Even if business has EBR, still need prior express written
consent for robocall to residential #
· Consumer opt out of future robocalls during robocall
· Align with FTC, requires assessment of call abandonment
rate, every 30 days
· HIPAA health related entities are exempt
 Consent can be revoked at any time by any rble means
 Robotexts
 Texts subject to TCPA
 Prior written consent must be clear and conspicuous
 Consent cannot be requirement of purchase
 mere fact that consumer’s wireless # appears in contact list of
another customer is not consent
 When caller has consent for wireless #, and # reassigned, caller
is not liable for first call but liable for subsequent
 Records:
 Advertising and promotional materials
 Prize recipients info
 Sales and Employee records
 All verifiable authorizations or records of express informed
consent or express agreement
 each sales record must include:
 name and last known home address of each customer
 Goods or services to be purchased
 date the goods or services were shipped/provided
 amount the customer paid for goods/services
 Info on former and current employees:
 Name, Job title, home address and phone number, alias
C. Rules Governing Who can be called Under Telemarketing Laws
 FTC created U.S National Do Not Call (DNC) Registry
 Enforced by FTC, FCC, and state AGs
· Civil penalties up to $42,530 per call
· private right of action state intrusion on seclusion tort
 Must receive a Subscription Account No, non transferable
 must update call lists every 31 days
 Exceptions to list:
· Nonprofits calling on their own behalf
· Calls to customers with EBRs within last 18 mons
° prospect, last three months
· Inbound calls, no upsell of additional products/service
· Most business to business calls
· Consumer C&C opts in to calls with signature and phone #,
don’t bundle consent with sweepstakes
 Telemarketers can avoid liability under the DNC safe harbor:
 implement written procedures to honor requests
 train personnel and entity assisting in its compliance
 maintain and record an entity specific DNC
 maintain records documenting DNC and National DNC within 31
days of call
 someone monitors and enforces compliance
 call is result of error
11
D. Junk Fax Marketing TCPA covers faxes
 Junk Fax Prevention Act (JFPA) consent can be inferred from an
EBR, as long as sender offers an opt-out
 private right of action
 statutory damages of up to $500 per fax
 Preempted CA law based on interstate regulation
E. Controlling the Assault of Non-Solicited Pornography and
Marketing Act of 2003 (CAN-SPAM)
 No private right to action
 Preempts most state spam laws
 not superseded if they prohibit false or deceptive activity
 Applies: - covers transmission of commercial email primary purpose
is advertising product directed to or from U.S.
 Enforcement: FTC, other federal regulators, state AGs and other
state officials
 Violation:
 fines up to $40,654/violation
 Authorizes ISP’s to sue, act allows injunctive relief, damages up
to $250/violation with max of $2M
 court may increase damage award up to 3 times in cases of
willful or aggravated violations
 egregious punishable up to 5 years’ imprisonment
 2009, federal judge shut down 3FN based on FTC’s allegations
that it knowingly distributed spam and malware and hosted
illegal content, child porn
 Commercial email content:
 Prohibits false or misleading headers
 Prohibits deceptive subject lines
 C&C notice of opt out, by return email or opt out link
 10 business days grace period for opt out
 C&C ID that message is commercial (unless affirmative consent
was provided) and
 physical address of the sender
 Prohibits aggravated violations re: commercial email:
 Address-harvesting and dictionary attacks
 Automated creation of multiple email accounts
 Retransmission of commercial email through unauthorized
accounts
 Email with sexually oriented material must have warning label
(unless recipient has given prior affirmative consent)
 Marketer liable for vendor violations
 deceptive commercial email could be false, misleading ad
 FTC has authority to issue rules implementing CAN-SPAM
 commercial vs. transactional or relationship messages whose
primary purpose is to:
· Facilitate or confirm commercial transaction
· Warranty or safety info re: product purchased
· Info re: ongoing commercial relationship
· Provide info re: employment or a related benefit plan
· Deliver purchased service to recipient
F. Wireless Message Rules Under CAN-SPAM
 MSCM is commercial email transmitted directly to wireless
device used by subscriber of commercial mobile service, that has
or uses a unique electronic address that includes a reference to
Internet domain
 FCC says designed to apply only to mail addresses designed by
carriers for mobile services messaging
 Rules cover SMS but not phone to phone messages
 Requires subscriber’s express prior authorization, opt in
· given prior to sending MSCM
· authorization/revocation is free to user, enable revocation
by same means
· authorization must be documented
 · Each authorization must disclose:  PI must be destroyed when no longer needed for original
° Sub agrees to receive MSCMs on device purpose and there are no pending requests for access
° from a particular ID’ed sender (no 3Ps) İ. Video Privacy Protection Act of 1988 (VPPA)
° may be charged for receipt of message  Private right of action for violations
° may revoke authorization at any time · Statutory damages set at $2,500
· Disclosures must be C&C, be separate, have conspicuous opt · Allows actual, punitive, and rble attorney fees
out link  Does not preempt more protective state laws
 10 business day grace period to revoke auth · CA laws covering the same privacy issues as VPPA
 Wireless Domain Registry  Applies to video tape service providers, rental, sale or delivery
 FCC registry of wireless domain names that are do not text. of pre-recorded video cassette tapes, individuals who receive PI
commercial mobile radio service providers must ID all email in ordinary course of business or for marketing purposes. N/A to
domains dedicated to subs for wireless devices video streaming
 Senders are responsible for checking before sending commercial  Prohibited from disclosing PI. Exceptions:
messages to anyone on domain · Disclosure is made to the consumer themselves
 providers must update within 30 days before issuing any new or · Per contemporaneous written consent of consumer
modified domain names · to LE per warrant, subpoena or other court order
G. Telecommunications Act of 1996 · per civil court order and consumer had right to object
 CPNI is info collected by telco carriers re: to subscribers. · Includes only the names and addresses of consumers
subscription info, services used, network and billing info, phone · If only used for marketing to consumer: only names,
features and capabilities, call log data such as time, date, addresses, subject matter descriptions
destination and duration of calls
· for order fulfillment, request processing, transfer of
· Not CPNI: certain PI such as name, ph #, address ownership or debt collection
 No sale of CPNI without prior consent:  PI must be destroyed as soon as practicable but no later than
· Need opt in before carriers can share CPNI with joint one year after no longer necessary and no pending requests
venture partners and vendor for marketing purposes for access
 Restrictions on access, use, and disclosure of CPNI J. Video Privacy Protection Act Amendments Act of 2012
· Ok in service categories customers already subscribed  Allowed for one-time consumer consent that was valid for up to
· Carriers can use CPNI for billing and collections, fraud two years replacing contemporaneous reqmt
prevention, customer service, and emergency services  Addresses social media concerns
· U.S West Inc v FCC set legal standard of opt out for
carrier’s own use of CPNI
 Other requirements aimed at curbing pretexting, or gaining
access to CPNI through fraudulent means
· Carriers must notify LE if CPNI is disclosed in security breach
w/in seven business days
· Customers must give password before they can access their
CPNI via telephone or online account
· Carriers must certify compliance annually, explain how
systems ensure compliance, provide annual summary of
consumer complaints re: unauth disclosure of CPNI
 Applies to carriers and VoIP, Trump repealed FCC attempt to
regulate ISPs
H. Cable Communications Policy Act of 1984
 Provides private right of action
 Excludes internet services via cable b/c defined as: oneway
transmission to subs of video programming and sub interaction
required for selection of programming
 Cable service providers must give 1st and annual privacy notice
that C&C informs subscribers of:
· nature of the PI collected
· How PI will be used
· retention period of such info
· manner by which sub can access and correct such info
 provider can only collect PI that is necessary to render services
or detect unauthorized reception of services
 Can’t share PI w/o written or econsent. Exceptions:
· extent necessary to render services
· conduct legit business activities
· only name & address, and sub was given optout
· Subject to court order with notice to sub
° in conflict ECPA, which allows w/o notice to consumer,
b/c notice may negatively impact LE investigation
° Courts have resolved tension by allowing w/o notice to
sub per ECPA
12
K. Federal Regulation: FCC Broadband Privacy Rule
 Pre-2015, FTC primary enforcer of digital ad violations
 2015 FCC reclassified broadband internet service as a public
utility per “Open Internet” or net neutrality rule
 2016 Appeals Ct upheld FCC’s authority to regulate broadband
internet providers
· telephone Verizon, cable companies Comcast
· Effect = subject to Telco Act of 1996, including CPNI privacy
req’mts in 222
 FCC issued Privacy Rule for broadband … but
 2017 Congress rescinded FCC Privacy Rule
· But FCC order said Section 222 and CPNI rules still apply to
broadband internet providers
L. California Online Privacy Protection Act of 2013 (CalOPPA)
 operator of website must display a privacy notice:
· Categories of PII collected through the site
· Categories of 3P operator may share PII with
· How operator treats browser’s Do Not Track signals
· Whether other parties collect PII about consumer’s online
activities and across different websites
 implementation of Do Not Track by browsers varies
· Default = tracking is acceptable unless user sets browser to
send Do Not Track to requesting site
· Do Not Track as a default
· Selective Do Not Track as default
 Caution: embedded dynamic code from 3Ps (such as advertisers)
operator may not be fully aware of their tracking activities
taking place on their own site over time
Government and Court Access to Private-sector Info
III.A Law Enforcement and Privacy
A. Fourth Amendment - Right to be secure in persons, houses, papers,
effects, against unrble searches seizures, warrants need probable
cause, particularity of place searched
 Olmstead subjective and objective rble exp of privacy
 Katz v. US. warrant needed for police bug in restaurant, placed to
hear calls behind closed doors of phone booth.
 3P and in public doctrines - can share customer and employee
records to LE if given to company as 3P
 Jones, warrant needed for GPS car tracking for a month. police
had trespassed, even public movements
 Riley v. California - need warrant to search contents of cell phone
b/c large quantity/qual of data
 Carpenter v. U.S, reduced scope of the third-party doctrine. need
warrant to access cell site location info
B. HIPAA - Disclosure is permitted per court order or subpoena, or
admin request, if three criteria are met:
 relevant and material to legitimate LE inquiry
 specific and limited in scope for purpose
 Deidentified information could not reasonably be used
C. Electronic Communications Privacy Act (ECPA)
 Private right of action and criminal penalties
 Does not generally preempt state
· CalECPA protects email comms
 Amended Wiretap and SCA
D. Wiretap (Title III) - real time interception of wire, oral, and email
comms. Most strict and require a super warrant
 Only certain offenses, only necessary/minimize
 Violations are criminal offence, PRA, does not preempt
 Two exceptions to needing warrant:
· If a person is a party to a call or one party consent, some
states require all party consent
13
· interception is done in ordinary course of business
 offensive to a rble person can be state invasion of privacy or
other common-law claims
E. Stored Communications Act (SCA)
 Private right of action and criminal penalties
 voluntary and compelled disclosure of "stored wire and e-comms
and transactional records" held by third-party ISP
 prohibits unauthorized acquisition, alteration, or blocking of ecomms
while in storage at e-comm facility
 Two exceptions:
· By entity providing wire or ecomm service
· By user of service/comm or intended for that user
 upon govt request, wire or ecomm provider must preserve records
and evidence pending court order
 Over 180 days, unopened, only need subpoena
 Microsoft, CLOUD act overrides SCA - now requires Co. to provide
electronic evidence even if stored outside U.S
F. Pen Registration and Tap Trace Order
 no private cause of action
 New pen register and trap/trace order from judge under lax
standard of “relevant to an ongoing investigation”
 PATRIOT Act Section 217 expanded to include dialing, routing,
addressing, or signaling info
 Freedom Act ended its use for bulk collection
G. Communications Assistance to Law Enforcement Act (CALEA)
Aka Digital Telephony Bill
 FCC implemented CALEA
 Applies to telcos to cooperate in interception of comms for LE
needs relating to security and safety of the public
 carriers must design to give gov access to comms
 2005, FCC expanded to broadband internet access and VoIP
when interconnect w/ traditional telephone services
H. Media Records & Privacy Protection Act (PPA) 1980
 Does not preempt state laws
 extra layer of protection for media and media orgs from gov
search or seizures in course of criminal investigation
 LE must use subpoenas or voluntary cooperation to obtain
evidence from those engaged in 1A activities
 Applies to gov officers or employees at all levels of gov
 Applies to criminal investigations (not civil)
 Violations: $1,000 actual damages and attorney’s fees
 Exception: Probably cause that reporter is involved or in process
of committing a crime (does not apply if crime is possession,
receipt or communication of work product)
İ. Right to Financial Privacy Act (RFPA)
 Only applies to requests from federal agencies
 Applies to FI, such as banks, credit card companies, and
consumer finance companies
 No gov authority may access unless financial records are
reasonably described and meet one of these conditions:
· customer authorizes access
· appropriate admin judicial subpoena or summons
· qualified search warrant
· appropriate formal request by gov authority
 Customers must receive notice in advance of the gov request for
the records, right to challenge disclosure
J. Cybersecurity Information Sharing Act (CISA) 2015
 federal gov may share unclassified technical data with
companies re: network attacks and successful defenses
 CISA encourages companies to voluntarily share the same info
with gov
 Companies that share info receive certain protections
· Limitations on liability, Non-waiver of privileges
· Exemption from FOIA disclosure
 Provisions:
· Reqmt to remove personal info before sharing
· Sharing info with federal gov does not waive privileges
(doesn’t apply with state/local gov)
· Prohibition on gov using shared info to regulate or take
enforcement actions against lawful activities
· Authorization for company’s monitoring and operating
defensive measures
B. Judicial Redress Act of 2016
 Extends U.S Privacy Act protections to non-U.S persons
C. Bank Secrecy Act (see above)

14
III.B National Security and Privacy U.S. persons (currently expired)
A. Foreign Intelligence Surveillance Act (FISA) 1978  If info relates to U.S. person, must be relevant to preventing
 4A left gap for “national security” terrorism, not based solely on 1A activities
 Needed cold war monitoring of Russian embassy  requires adoption of minimization procedures, per recently
 Covered wiretaps, emails/stored records, NSL declassified FISC orders
 statutory system to authorize foreign intelligence wiretaps, that  permitted bulk collection telephony metadata/call-log info, from
did not meet reqmts of 4A searches telcos. No content. (ended by FREEDOM)
 checks and balances on previously unfettered discretion of pres  Disclosure is permitted to the persons necessary to comply with
and AG to conduct national security surveillance the order, and to an attorney
 2001 Amended by PATRIOT Act allowed foreign wiretaps and  Expanded use of National Security Letters
relaxed rules, expanded NSL use, but telcos were sued Fed statutes: ECPA, NSA, RFPA, FCRA, amended by PATRIOT Act
 2008 FISA Amendment Act and reauth of 2006
Subpoena-like = allows FBI to get a customer’s name, address,
 Legal authorization for wiretap, pen register, trap and trace for
length of service, comms (phone and Internet) records, banking,
phone # and emails, and video surveil for foreign intel, even
financial, credit, travel records
outside US
 No court action required. Typically FBI
 Immunity for telcos
 Can’t disclose that you received an NSL to customer
 More reporting to Congress; Some limits on NSL secrecy
 2006 amendment: recipients under gag order only if Fed thinks
 foreign intel must be significant purpose of investigation
it will interfere w/ criminal or counterterrorism investigation or
 Instead of PC of a crime, FISC orders issue on PC that party listed purposes
monitored is foreign power or agent of
 Recipients can petition court to modify or end secrecy
 fine up to $10,000 or up to 5 years in prison, Wiretap Act,
 2015 FBI now presumptively terminates NSL secrecy when
punishable with fine or up to 5 years in prison
investigation closes, or 3 years after inv. opened
 Section 702 of FISAA C. USA FREEDOM Act 2015 (reform of FISA)
 Applies to collection of e-comms that takes place in US, and  Stopped bulk collection under Sec 215 Patriot Act with pen
only for comms of targeted individuals for listed foreign intel register/trap and trace orders
purposes, and gov must have rble belief that person is non-U.S
 Must use specific selectors - email or phone number
citizen located outside U.S
 Companies now allowed to publish statistics about the number of
 FISC must annually approve certifications by DNI and US AG FISA orders and NSLs they receive
setting the terms for section 702 surveillance
 government issues yearly transparency reports, and has
 cannot notify FISA target before or during investigation
declassified lots of orders from FISA Court
 include content, not just metadata
 # of FISA orders exceed traditional LE wiretap orders
 Previously, prez could authorize elec surveillance w/o court
 FISA can be important for comm providers, such as telephone
order for one year (Bush warrantless wiretap)
companies and email services, but arise much less often for most
 Two surveillance programs under Section 702 other companies.
 PRISM: judicially approved, supervised directive to collect  Other U.S. privacy laws with national security exceptions.
to/from messages with certain selectors such as an email
 HIPAA “to authorized federal officials for lawful intl, counter-
address. Co’s (ISP) lawyers can challenge the request
intel, national security under Nat. Security Act
 Upstream: filters Internet based comms as they pass thru
 GLBA privacy exception vaguely worded, for an investigation
physical infrastructure located in U.S. if they contain a tasked
on a matter related to public safety.
selector, and stored for access by the NSA
 COPPA makes no mention of national security exception
 2018 amendments to Section 702
 reqmts for querying procedures consistent with 4A
 restrictions on the use of information pertaining to U.S. persons in
criminal proceedings, and
 congressional oversight of “about” collection
B. USA Patriot Act 2001
 Section 217 “hacker trespasser” exception
 O&O of computer can face penalties under ECPA for providing
access to LE without following procedures
 permits, does not require, O&O to provide access
 LE can perform interceptions if:
· O&O authorizes interception of computer trespasser’s
communications on protected computer
· LE is lawfully engaged in an investigation
· reasonable grounds to believe contents of trespasser’s
comms relevant to investigation
· interception does not acquire comms other than those
transmitted
 Section 217 Expanded definition of pen register/trap and trace to
include dialing, routing, addressing, signaling info
 Section 215 Snowden Tangible Things or Business Records FISC
order can require production of any tangible thing
 Seeks to obtain foreign intelligence info that does not concern

15
III.C Civil Litigation and Privacy deprive American court to order a party subject to its jurisdiction
A. Disclosures Required by Law to produce even if it violates that law
 BSA reporting reqmts  Or focus on nature of documents, prepare a privacy log
 FDA report serious adverse events describing the documents without disclosing contents
G. Hague Convention, party seeking bears burden of demonstrating
 DOL’s OSHA reporting of workplace injuries and illnesses
that foreign law prohibits discovery
 Many states - injuries, med conditions, abuse, gunshot wounds,
 importance of the documents or data to litigation
immunization records, contagious diseases
 specificity of the request
 HIPAA permits disclosure of PHI where required by law
 whether information originated in United States
 FRCP 45 subpoena
 alternative means of securing information
 LE - PEN register, stored content, search warrant, wiretap
B. Disclosures Permitted by Law  important interest of U.S. & foreign (fighting terrorism)
 “computer trespasser” or “hacker trespasser” exception created  ensure storage and transmission are secure
by Section 217 of the USA PATRIOT Act H. Clarifying Lawful Overseas Use of Data Act (CLOUD Act)
C. Disclosures Forbidden by Law  addresses Intl issue
 Opt In: HIPAA COPPA  appropriate request through a mechanism such as a Mutual
 Opt Out: GLBA, FTC Legal Assistance Treaty MLAT
 evidentiary “privileges” can prohibit disclosure  US has first agreement with UK
· generally defined under state law  negotiations with the EU and Australia concerning possible
· attorney-client privilege, exceptions: waive to prevent CLOUD Act executive agreements
imminent physical harm to another person
 assert privilege against self-incrimination under 5A
D. Public Access to Court Records, Protective Orders, and Required
Redaction
 U.S. has strong tradition of transparency, FOIA
 litigants seeks protective orders for PI
· judge decides what info should not be made public
· conditions that apply
 Rule 26(c) of FRCP - party may seek protective order that CI
may not be revealed or “attorney’s eyes only”
· must demonstrate good cause, court three-part test
° info is confidential
° info is relevant and necessary
° harm vs. need for info
 HIPAA Privacy Rule requires consent or court order
· QPO can apply in state court
 Redact to limit to only what’s necessary - FRCP Privacy
Protection for Filings Made with the Court
· Last 4 digits of SSN or Fin acct, DOB Minor’s initials
· Federal Criminal Rules of Procedure, Bankruptcy similar
redaction. Criminal: city and state of the home address are
a fifth category must be redacted too
E. Electronic Discovery
 e-discovery = well-managed data retention program.
 Sedona Conference, email retention
· policies - interdisciplinary teams
· continually develop and ID the gaps policy/practice
· reach consensus, look to industry standards
· solutions should meet functional requirements of org
 good faith, data that is “transitory in nature considered outside
the duty of preservation
 Have clear employee personal use policies
 Court will likely prevail over company policy; per 3-factor test:
(1) a retention policy should be reasonable, (2) similar
complaints against organization, and (3) bad faith
 Consistent with disclosure under HIPAA
 Consent, court order, QPO
 Consistent with disclosure under GLBA
 FI may disclose PI to comply with laws, civil, criminal, or reg
investigation or subpoena
F. Transborder / conflicts with Foreign laws (GDPR)
 Some courts require production if party sought to take
advantage of U.S. jurisdiction
 Some courts require production b/c [foreign] law does not
16
IV. Workplace Privacy
No overarching law for EE privacy, state remedy is limited
ER EE relationship fundamentally based on contract law, CBA
Torts: invasion of privacy, publicity given to private life, defamation. All
narrow protections
Department of Labor (DOL), the Equal Employment Opportunity
Commission (EEOC), FTC, CFPB, and NLRB
DOL administers FLSA OSHA ERISA
HR management of multinational corp EE’s data
A. U.S. Laws Protecting Employee Privacy
4A, CA extended privacy rights to private sector EEs
HIPAA - Protect PHI
COBRA continuous coverage after termination
ERISA EE benefit programs created fairly administered
FMLA unpaid leave birth or illness of self or a family member
Fair Labors Standards Act (FLSA) Establishes minimum wage and sets
standards for fair pay
OSHA regulates workplace safety
Whistleblower Protection Act - federal EEs subjected to personnel
actions because of whistleblowing
National Labor Relations Act (NLRA) Sets standards for collective
bargaining, which also applies in social media communications
Immigration Reform and Control Act (ICRA) Requires employment
eligibility verification
SEC Act of 1934 - info about Sr execs of public companies
Anti-Discrimination laws: Limits on background checks, secondary
effect on how interviews are conducted
Title VII of the Civil Rights Act of 1964 bars discrimination in
employment - race, color, religion, sex, and national origin
Equal Pay Act of 1963 bars wage disparity based on sex
Age Discrimination Act bars discrimination against over 40
Pregnancy Discrimination Act bars discrimination due to pregnancy,
childbirth, and related medical conditions
Americans with Disabilities Act of 1990 bars discrimination against
qualified individuals with disabilities
GINA bars discrimination based on individuals’ genetic info
Bankruptcy Act prohibits employment discrimination against persons
who have filed for bankruptcy
Americans with Disabilities Act (ADA) Medical Screenings
 ERs with 15 or more employees
 Can’t discriminate against qualified individual with a disability
because of disability
 Before an offer, ADA permits exams and medical inquiries if
job related, consistent with biz necessity
 company may require medical exam after offer and may
condition offer on results, if:
· All entering EEs are subjected to exam
· Confidentiality rules applied to results
· results used in compliance with discrimination laws
 drug addiction is disability
 ER must provide reasonable accommodations during employment
but can’t ask before offer
 ADA Amendments Act (ADAAA) expanded scope - conditions
that are mitigated, in remission or episodic if would substantially
limit a major life activity of EE employee when active or absent
mitigation
B. FCRA limits on EE Background Checks
 FCRA applies to nontraditional providers of background check
information (like social media aggregators)
 covers any type of background check, criminal records or driving
records
 Permissible purposes for employment checks include:
 Evaluating the candidate for employment
 Existing EE, for promotion, reassignment, or retention
17
 ER using any consumer report
 written notice to applicant - obtaining consumer report for
employment purposes, and if investigative consumer report also
obtained (no notice reqd for self-performed)
 need written auth, may be for duration of employment
 only use data from qualified CRA
 Certify to CRA, permissible purpose, gave notice, got consent,
will comply with anti-disc laws
 Before taking AA, give pre-adverse-action notice to the
applicant with a copy of consumer report, opportunity to dispute
 Before taking AA, provide copy of report to consumer with
summary of the consumer’s rights (drafted by CRA)
 adverse action notice sent after adverse action is taken
· contact info of CRA, statements, right to correct
 If EE requests, ER must give complete disclosure of the nature
and scope of the investigation
· must be made in writing within five days after request, or
when report requested (whichever later)
 INTERNAL Investigative consumer reports: (Vail)
 No notice required if icw internal investigation of:
· Suspected work misconduct or noncompliance with laws or ER
policy
· not done for creditworthiness and no credit info
· only given to ER, federal or state officer/agency, Self-
regulating org with authority over ER or EE
C. California Investigative Consumer Reporting Agencies Act
(ICRAA) stricter disclosures than FCRA
 Need prior consent, give proper notice, give opportunity to
request a copy of the report
 even for internal investig, must give EE all public records unless
EE waives
 ER notice must be C&C and separate from FCRA notice
 Need consent for EACH background check
 written disclosure must state:
· report may be obtained; permissible purpose
· disclosure may include info on character, general reputation,
personal characteristics, mode of living
· contact info of CRA and CRA’s website
 If ER wants to take AA based on report, must provide EEs full
report even if EE waived right to get copy
· Consent not required if EEs suspected of wrongdoing
 tracking individual’s online presence and screening candidates for
predesignated elements selected by the employer, drug use,
criminal activity, or unsafe behavior. FCRA might apply to
nontraditional providers of background check information
 Artificial Intelligence - used to assess candidate in video, caution re:
privacy and biases
Privacy During Employment
A. Fed Employee Polygraph Protection Act of 1988 (EPPA)
 Violations: subject to fine by DOL and private lawsuits
 Does not preempt stricter state laws
 DOL rules: ERs are prohibited from using lie detectors on
incumbent workers or to screen applicants, can’t retaliate
· OK for govt EEs, controlled substances, defense contractors,
and national security functions
· Ok for w/ ongoing investigation involving economic injury to
ER business, reasonable suspicion
 ER must post essential EPPA provisions conspicuously
 EPPA and ADA limits psych testing, ADA prohibits use of medical
tests, impairment of mental health. ERs use psych tests
personality traits
B. Drug Testing Law
  Public sector EEs covered under 4A  Social engineering may invade privacy
 Fed laws mandate for:  Most states prohibit disclosure of SM credentials
· Positions within the federal sector, e.g. CBP  Consumerization of IT and BYOD
· Aviation, Railroading, Trucking industries  work tech for personal use = lack of control over device
· preempt state laws that limit drug testing  Consider breach notification laws
 Variety of settings:  EE has higher XofP with own device
· Preemployment, if not to ID legal use or addiction  EE device could be subject to discovery
· Rble suspicion based on specific facts, evidence  DLP Data Loss Prevention - could be mass surveillance
· Routine testing: EEs notified at the time of hire  Investigation of EE Misconduct
· Post-accident: if reasonable suspicion  Take allegations seriously
· Random testing: sometimes required by state law, prohibited  Treat EE fairly, document everything
in certain states
 Comply with law, CBA, policies
° More likely regulated jobs, public safety, natsec
 Data handling risks
 Fed ADA, state laws wildly vary
 3P in investigations - FCRA Vail Letter
 Litigation re: defamation, negligent testing, invasion of privacy,
breach of contract and CBAs  Concern for retaliation vs. other EEs
 MJ legalization, IL says can’t punish EE for MJ use unless impairs  After Employment
their work. Fed EEs MJ use is prohibited  Terminate access to physical and info
 Half of states limit ability to ban EEs smoking  Manage transition, passwords
 Lifestyle Discrimination  HR issues with defamation, state laws re: references
 ADA amended in 2009 = protect person who is 100 pounds
overweight from discrimination
 No federal law protects smokers from discrimination
C. EE Monitoring
 In US, private-sector employees in general have limited
expectations of privacy at the workplace. Contrast EU
 Check CBA
 Legal Obligations or Incentives to Monitor
· OSHA requires ERs to provide safe workplace
· Call centers, customer disputes
 Defend vs. tort claim for negligent supervision
 Biometrics - in HR and employment context
 Video surveillance/CCTV.
 video w/o sound not covered under federal wiretap and stored-
record statutes, no federal prohibition
 States often forbid use in sensitive areas (CA, MI)
 Common law tort claim invasion of privacy
 Intercepting Comms
 Wiretap Act of ECPA strict prohibition, criminal
 calls, video sound, oral, bugs, emails except:
· In ordinary course of business
· Parties consent
 Stored Comms intercept
 SCA/ECPA prohibits with 2 exceptions:
· ER because they provide the comms service, and
· EE because they use that service
 Ontario v. Quon - SCOTUS held ER could review EE pager
messages to ensure personal use compliance.
· Reasonable and work related
 ECPA does not preempt stricter state laws
 DE law ERs monitor phone, email, internet access or usage w/
prior written notice and daily e-notice
 CT law ER e-monitoring must give prior notice, types of
monitoring, post notice in conspicuous place
 Geolocation tracking
 Track work vehicle ok during work hours, EE is informed
 But monitoring EE restricted under some states laws
· CT no monitoring of EE without notice
· CA criminal misD to use e-tracking device on person
 Invasion of privacy claims if RXofP
 Social Media monitoring
 May violate antidiscrimination and privacy laws
18
V. State Laws
A. Federal v. State Authority
 Preemption
· state AGs retain the ability to use state consumer protection
law to bring civil suits
 Lack of Federal Data Breach Law = patchwork
· federal privacy law: Q of whether it would preempt federal
wiretap law and federal privacy laws that permit stricter
state laws
B. State Data Security Laws
 majority of states have laws limiting biz right to use SSN.
 CA prohibits biz, state and local agencies from SSN public posting,
printing on mailings (unless mandated by federal law), printing on
ID or membership cards. prohibits biz from requiring transmission of
SSN unencrypted
 S.B. 178 Cal Electronic Comms Privacy Act (CalECPA)
 state LE needs warrant before they can access electronic
information, content or metadata
· warrant must “describe with particularity” info sought
· if service provider gives info, LE must destroy data within 90
days, unless consent, court order, or LE reasonably believes
info is related to child porn
 Subpoenas allowed only if info is not requested in the context of
a criminal investigation or prosecution.
 Notice required when warrant is executed, must state “with
reasonable specificity the nature of the government
investigation.” include copy of warrant or
 in emergency cases, give statement with facts to support decl of
emergency situation 3 days after data collected
 Delaware’s Online and Personal Privacy Protection Act
 prohibits ads for products that kids can’t legally buy,
 restricts certain online ad practices based on minors’ PI.
 minor = state resident under age of 18
 private right of action
 operators must post C&C notice of data collection, privacy policy
on every web page where PI is collected
 Requires consent by parents prior to collection of personal info
for children under 13
 GDPR, under 16 parental consent
 Nevada SB 538
 applies if (1) retain certain types of NV resident PII and
 (2) direct activities towards NV residents, complete a transaction
with state or resident, or purposefully avail themselves of NV law
 cookie or tracking beacons = PII
 exempt if
· biz located in NV, revenue primarily from non-online
· small biz with less than 20k unique visitors per year, or
· 3P that operates site, or process info on behalf of biz
 no private right of action
 fail to comply within 30 days = civil enforcement by AG
 injunctive relief and/or a monetary penalty not to exceed
$5,000 for each violation
 Illinois Right to Know Act 2017
 operator that collects PII about IL residents must
· notice: specified info re: PI sharing practices
· make available certain specified info after disclosing a
customer's PI to a third party, and
· provide an email, toll-free number, or webform whereby
customers may request or obtain
 private right of action: (i) liquidated damages of $10 or actual
damages, greater; (ii) injunctive relief; and (iii) reasonable
attorneys' fees, costs, and expenses
 attempted waiver of the Act or non-compliant agreement is void
19
and unenforceable
 not intended to supercede federal or State law
 New Jersey Personal Information and Privacy Protection Act
 retail establishments, scan government-issued ID card
 Can only collect name, address, DOB, ID card number, and
jurisdiction that issued the card.
Valid Purposes of ID Scanning (8)
· Verify ID if not cash, returns, refund or exchange;
· Verify age for age-restricted goods or services;
· Prevent fraudulent returns or exchanges
· Prevent fraud re: credit account
· Establish/maintain contractual relationship
· required by law
· Disclose to FI, debt collector, or CRA for FRCA, GLBA, or Fair
Debt Collection Practices Acts; and
· Per HIPAA by covered entity
 Data Retention and Use
· report breach to affected persons and NJ State Police
· retail store may not “sell or disseminate to a third party any
info obtained” per Act for any purpose
 Penalties
· $2,500 civil penalty for a first violation
· $5,000 civil penalty for each violation
· Private right of action against store
 Washington Biometric Privacy Law (H.B. 1493) 2017
 Can’t store a biometric identifier in a database for commercial
purpose without providing notice, consent, or preventing
subsequent use for commercial purpose
 “enroll” = capture biometric ID data, convert to template that
cannot be reconstructed, matched to an individual
 does not apply to biometric identifiers “unenrolled”
· notice required in separate from, and is not considered,
“affirmative consent.”
· exact notice and type of consent required is “context-
dependent
 may not use or disclose it in a manner materially inconsistent with
original terms without new consent
 Need consent unless:
· (1) necessary to provide a product or service
· (2) 3P contractually promises that biometric ID will not be re-
disclosed or enrolled in database for a commercial purpose
that is inconsistent with the notice and consent
 broad “security exception,” in furtherance of a “security
purpose.”
C. State breach notification laws & Key Differences among States
 Definition of PI CT: (1) SSN; (2) DL number or state ID card number;
or (3) account number or credit or debit card number, in
combination with any required security code, access code, or
password that would permit access to an individual’s financial
account
 Some states: healthcare and med info, passwords, personal ID
Nos, account Nos., any Fed or State ID No. like passport, military,
tax ID, biometric data, DNA profile, maiden name
 CCPA: IP address, commercial info, online activity, inferences
drawn to create profiles
· All states PI = Unencrypted
· All states exclude publicly available info, lawfully
 Covered Entities:
· CT “any person who conducts business in this state, and who,
in the ordinary course of such person’s business, owns, licenses
or maintains computerized data that includes personal
information”
 Conditions for notification
 Subject rights
 Harm and Definition of Security Breach
  CT “unauthorized access to electronic files, media, databases or
e-data containing PI when access to PI not secured by encryption
or other method that renders PI unreadable or unusable.
 Almost every state contains similar language, although some laws
require the compromise to be “material” or event that causes (or
is likely to cause) identity theft or other material harm
 CCPA “an unauthorized access and exfiltration, theft, or
disclosure” of the consumer’s PI resulting from business’s failure to
“implement and maintain reasonable security procedures and
practices
D. Conditions for Notification
 Whom to Notify
 state residents who are at risk
 all states require third-party notification
· CT: notify owner of info of breach immediately
 AG or State Agency Notification
· two-thirds of states require notify the state attorney general
and/or other state agencies
· time periods vary, # of residents threshold, only if after
investigation
 Credit Reporting Agencies Notification
· two-thirds of states require notify nationwide CRAs, # of
residents threshold varies
 When to Notify Affected Parties
 most common “most expedient time possible and without
unreasonable delay”
 some states specify time, 45 days most common
 national companies, best practice is report within 30 days
 allow delays for a reasonable period of time if LE requests b/c
impede investigation
 What to Include in the Notification (NC)
 general description
 type of PI
 general acts to protect PI from further access
 telephone number to call
 Advice to remain vigilant - review statements and reports
 toll-free numbers, address for CRAs, FTC, AG
 Exceptions to Notification
 More stringent state laws
 Ok to follow breach notification procedures of internal infosec
policy if compatible with law
 Safe harbor if encrypted, redacted, unreadable, unusable
· Encrypted no longer safe harbor in TN or CA
 Penalties and Private Right of Action
 AG enforcement
 Some states allow penalties
 Private right of action - CA, AL, D.C., LA, MD, MA, NV, NH, NC,
SC, TN, VA and WA
 CCPA statutory damages for sensitive data
· CA first state to allow
B. Recent developments
 Tennessee SB 2005
 Requires notice of breach regardless of encryption
 2017 amendment: clarified that encrypted data gets safe
harbor, unless encryption key also acquired in breach
 Illinois Breach Notification HB 1260
 expanded definition of protected PI to include usernames and
email, if when combined would allow 3P to access an individual's
online account
 required to alert affected parties to change their credentials if
compromised
 California SB 1386 2003
 Original breach notice law
 California Breach Notification AB 2828
 California data breach notification law expanded: requires
20
notice of breach of encrypted data if:
· Both encrypted data and encryption key or
· Encrypted data when the business has a reasonable belief
that the encryption key or security credentials can be
obtained by the hacker
 New Mexico Breach Notification HB 15
 PII includes biometric, fingerprints, voice print, iris or retina
patterns, facial characteristics or hand geometry
 applies to unencrypted computerized data or encrypted data
when encryption key is also compromised
 Notice to AG New Mexico Office and major CRA’s if >1,000
NM residents notified
 Notice to New Mexico residents within 45 days
 3P service providers are required to notify data owner or
licensor within 45 days of discovery
 Massachusetts Data Breach Laws: House Bill No. 4806
 2019, bill amends the state data breach notification law
· increase reporting if collect MA resident PI
· expands notification requirements
· requires companies to contract with 3P to offer affected
residents free credit monitoring services, and
· prohibits security freeze fees
 Updated Notification Requirements to State:
· preexisting law, notice to state regulators: (i) nature of
breach; (ii) # residents affected; and (iii) steps taken
· Whether they maintain a written infosec program
 Expanded notification to affected residents.
· (i) resident’s right to obtain a police report; (ii) how to
request a security freeze and necessary info; (iii) no charge
for security freeze; and (iv) provide mitigation services (i.e.,
free credit monitoring services).
· cannot be required to waive their right of action as a
condition to receiving credit monitoring services
 modified timing requirements.
· as soon “as practicable and without unreasonable delay,”;
but now can’t delay notice on ground that total number of
affected residents not yet known
 Additional Notification Requirements
· general public notice, Officer of Consumer Affairs and
Business Regulation (the “OCABR”) must publish “electronic
copies of the sample notice sent to consumers on its website
and update, how to obtain a copy of the notice sent to the
agency from the breached entity.
 Free Credit Monitoring Services
· Massachusetts is 4th state (CA CT DE) to require offer free
credit monitoring services re: SSN breach
· free credit monitoring services for a period of not less than
18 months
· If CRA breach of security not less than 42 months
 Security freeze fees prohibited; allow residents to place, lift, or
remove security freezes without charge
CCPA
Right of action for certain data breaches
 unencrypted and unredacted subset of PI
· SSN, DL or CA identification number;
· Account number, credit or debit card number, in combination with
security code, access code, or password;
· Medical or Health insurance information
 unauthorized access, theft, disclosure and failed to take reasonable
security practices
 civil action for any of:
· (A) damages between $100 and $750 per consumer/incident or
actual damages, greater of
· (B) Injunctive or declaratory relief
 · (C) Any other relief the court deems proper
 Statutory damages, consider: nature and seriousness of misconduct, #
of violations, persistence and time of misconduct, willfulness, D’s net
worth. No proof of actual damage required
 Consumer or class - 30 day notice to cure for stat damages
· if cures and gives written statement of cure and no further
violations, no action for stat damages allowed
· but consumer may still sue to enforce written statement, statutory
damages for breach
 No cure notice required for individual consumer suing for actual
damages
 Attorney General
 Injunction and civil penalty up to $2,500 per violation or $7,500
for intentional, civil action by AG
 Can seek opinion of AG for guidance
 Violation if fails to cure within 30 days
 Civil penalties shall be exclusively assessed and recovered in a
civil action by AG
 Civil penalties  Consumer Privacy Fund
 What is covered
 Usual plus signature, insurance policy #, protected class
· Info linked at household or device level
· biometric info collected without person’s knowledge
· records of personal property
· product purchased or considered
· Inferences drawn from PII: preferences, predispositions,
attitudes, intelligence, abilities
 Not PI
· Publicly available info
· Deidentified or aggregate consumer data
· Certain B2B comms or txns (still must comply with non
discrimination rights and right to opt out of sale of a
consumer’s data)
 Does not apply (Covered elsewhere)
· Education info, nonpublic PII per FERPA
· PI from job applicants, employees or contractors
· Privileged, medical, clinical trial info
· PII per FCRA or GLBA
· Vehicle or ownership info, by dealer or manufacturer, for
warranty or recall
° still can’t sell, share, or use info for other purpose
· Driver’s Privacy Protection Act
· Emergency contact info
 GLBA PI that is exempt from CCPA: transaction info, joint
products, account website info
 CFIPA applies to FI data
 Who is regulated: for profits doing business in CA
· Gross Rev greater than $25M
· Buy, receive, or sell the personal info of >50,000 CA
residents, households, or devices; or
· >50% annual revenue from selling CA residents PI
 Service providers and third parties excluded if:
· When consumer interacts with 3P, if 3P does not further sell
PI inconsistently with CCPA
· Data shared with 3P in order to implement a consumer’s
decision to opt out from data sales
· Data shared with vendors as necessary to provide services to
the business
· To avoid data sales, service providers must have K that
prohibits retention, use or disclosure of personal information
except to provide services
 Who is protected: Consumers
 In CA for other than a temporary purpose
 Domiciled in CA but outside CA for temp purpose
 Customers household goods, partially in B2B transactions
21
 Notice/Info Right
 inform consumers at time of collection:
· categories of PI and intended use for each category
 Further notice is required to:
· Collect other PI categories
· Use PI for unrelated purposes
 Upon verifiable consumer request
· Free, mail or elec, portable, readable
· no more than twice in 12 month period
 Excludes onetime transaction, if info not sold or retained
 3P notice of opt out before re-selling PI from other source
 Opt-Out Right for Personal Information Sales
 Must post “Do Not Sell My Personal Information” link
 separate link describe consumer’s rights, to “Do Not Sell My
Personal Information” web page in:
· (A) online privacy notice if online
· (B) CA-specific consumers’ privacy rights.
 Must comply w/ request to opt-out of sale of PI to 3P
 Can’t re-ask to sell for 12 months
 Opt-In Right for Sales of PI re: Children
 Can’t sell PI of consumer under 16 without consent
 Children aged 13 – 16 can directly provide consent
 Children under 13 require parental consent
 COPPA still applies on top of the CCPA
 willful disregard age deemed to have actual knowledge
 Right of Disclosure or Access (no port right)
 right to disclosure or access
· (1) categories of PI
· (2) categories of sources
· (3) commercial purpose for collecting or selling
· (4) categories of third parties shared with
· (5) specific pieces of PI it has collected
 verifiable consumer request from the consumer
 Disclose same info on privacy notice/website
 does not require business to:
· Retain any PI collected for a one-time transaction
· Reidentify or otherwise link any data
 Right of Deletion consumer rights are broader than GDPR, but
exceptions are also broader
 Verifiable consumer has the right to deletion
· must direct service providers to delete data too
 Exceptions, can keep if necessary to:
· transaction, warranty or product recall per federal law
· rble w/in context of relationship, provide service
· detect security incidents, prevent fraud, illegal activity
· debug errors that impair the service
· exercise of free speech or other right
· California Electronic Communications Privacy Act
· scientific, historical, statistical research in PI, render
impossible, impair aim, w/ informed consent
· perform a contract
· legal obligation
 No Right of Rectification, Restrict, Object
 Non Discrimination can’t:
· (A) Deny goods or services to the consumer
· (B) Charge different prices, discounts or
· (C) Different level of service, unless
° Rsbly relates to value of consumer’s data
° financial incentives disclosed and opt-in consent
· (D) Suggest consumer will receive different price or a
different level of service
 shall not use financial incentive practices that are unjust,
unreasonable, coercive, or usurious
 Responding to Rights Requests
  verifiable consumer request for info, delete, sale of info
 at least 2 methods for submitting, toll-free number
 online exclusive biz w/ direct relationship, only email ok
 Respond within 45 days after receipt, extendable once for
another 45 or 90 days w/ notice
 Inform of reasons for not taking action
 free of charge, unless request is unfounded or excessive
 No limits on deletion and do not sell requests
 other information requests no more than twice a year and only
for a 12-month look-back
 Security
 No directly imposed data security requirements
 A.B. 1281 –Partial Exemptions for EE and B2B Data

22