Data Protection

Subscribe to Data Protection

Hamburg DPA orders WhatsApp to stop sharing data with Facebook; GAO: HHS Needs to Improve is Digital Health Protection Rules; Notice and Choice Becoming Par for the Course for Interest-Based-Ads in Apps

German Data Protection Authority of Hamburg orders WhatsApp to stop sharing data with Facebook

On September 27, 2016, the Hamburg Commissioner for…

‘Privacy Shield’ certifications possible since August 1, 2016; Hamburg DPA aims to challenge ‘Privacy Shield’; EU Court rules on applicability of EU privacy laws to online companies; Pokémon Go violating EU Privacy Laws?; Norwegian DPA criticizes ‘Facebook at Work’; Advocate Health to Pay Largest HIPAA Settlement Ever; FTC Overrules LabMD Dismissal; Banner Health Cyberattack Affects 3.7M; HHS Announces Grant for Healthcare Sector Information Sharing Organization

‘Privacy Shield’ certifications possible since August 1, 2016

On Monday, August 1, 2016, the U.S. Department of Commerce has opened up the registration process for multinationals so that they can self-certify their compliance with the newly adopted ‘EU-U.S. Privacy Shield’ (‘Privacy Shield’) for transfers of personal data from Europe to the U.S.

The ‘Privacy Shield’, which had been formally approved via the European Commission’s adequacy decision on July 12, 2016, is replacing the formerly invalidated ‘U.S.-EU Safe Harbor’ Framework that had been struck down before the European Court of Justice in October 2015. The national Data Protection Authorities (‘DPAs’), in their function as Article 29 Working Party (‘WP29’), had also okayed the new Framework, by stating that they would not seek to challenge it “at least until the next annual review”.

Companies, who decide to sign up with the new framework as from now, may therefore rely on it at least until next May. For more details, see also our Client Alert on Privacy Shield as well as our previous week’s blog post.Continue Reading Privacy & Cybersecurity Weekly News Update – Week of July 31

“Pokémon Go” Developer feels the heat over data collection; 2nd Circuit Ruling limits government’s access to data stored overseas; 9th Circuit CFAA Ruling increases Facebook’s control over its Users’ Data; Dutch Study reveals tension between EU Trade Deals and Data Protection

“Pokémon Go” Developer in Hot Water over Extensive Data Collection Practices

In early July, mobile game developer Niantic released “Pokémon Go,” a free-to-download “augmented reality” game for Android and iOS devices. In less than a week, the game had been downloaded by more than 15 million unique users, making the game’s launch one of the most widely-adopted in history. Privacy advocates soon raised serious questions about the game and its accompanying privacy policy, which until July 12 granted full access to users’ Google account data unless users opted-out of such permissions—prompting Niantic to issue its first update resolving the permissions issue.

On July 12, Senator Al Franken (D-MN) sent a letter to Niantic CEO John Hanke demanding the company explain in detail the types of data Niantic collects from players, why that data “in necessary for the provision or improvement of services,” and how the company plans to use the data gathered. Franken’s letter also questioned the company’s opt-out data collection practices, suggesting that “Niantic consider making this collection/access opt-in.”  Franken, who serves as the Ranking Member on the Senate Judiciary Committee’s Subcommittee on Privacy, Technology, and the Law, has in the past spoken out against similar practices by other mobile app developers, including Uber and Lyft. Mr. Hanke has until August 12 to respond to Sen. Franken’s questions.Continue Reading Privacy & Cybersecurity Weekly News Update- Week of July 9

A victory for net neutrality; U.S. may join Irish Facebook Data-Transfer case; EU-U.S. Privacy Shield by early July?; French Data Protection Authority opens GDPR consultation; FTC addresses proposed TCPA changes; DOJ and DHS cybersecurity sharing guidelines.

Federal appellate court upholds net neutrality

The U.S. Court of Appeals for the D.C. Circuit upheld “net neutrality” rules that require all broadband providers to treat internet traffic the same regardless of source.  Last year, the Federal Communications Commission (“FCC”) issued its net neutrality decision, which reclassified broadband service as common carriers under the Communications Act and thus brought Internet service within the FCC’s power to regulate common carriers under Title II of the Communications Act.  The FCC then issued rules banning providers from blocking, throttling, or otherwise degrading internet traffic lawful content, and also from engaging in paid prioritization of traffic.

A number of Internet service providers and other groups challenged the FCC’s authority to reclassify broadband service and promulgate such regulations. They also challenged the legality of the net neutrality rules.  In a 115-page opinion, the D.C. Circuit rejected each challenge and, in doing so, affirmed the FCC’s power to regulate broadband service under Title II of the Communications Act.  The court also rejected the argument that net neutrality impacts service providers’ First Amendment rights, explaining that a service provider “does not . . . ‘speak’ when providing neutral access to Internet content as common usage.”

The petitioners are expected to appeal the ruling to the Supreme Court. Unless the Court reverses this ruling, the FCC retains broad power to regulate Internet service providers as common carriers, and may use that power to continue implementing and enforcing regulations concerning open access to content as well as consumer privacy.Continue Reading Privacy & Cybersecurity Weekly News Update- Week of June 13

Today, only 2 days after consensus was reached on the final text of the new EU Data Protection Regulation, the first step has been taken to officially adopt the law and enter a new era of data protection.  This morning, the Parliament’s Civil Liberties, Justice and Home Affairs Committee (LIBE) formally adopted the text…