Data Security Law Journal Focusing on legal trends in data security, cloud computing, data privacy, and anything E

Category Archives: Data Privacy

Subscribe to Data Privacy RSS Feed

New Biometric Privacy Decision Creates More Risk for Companies Doing Business in Illinois

By Al Saikali on Posted in Biometric Privacy, Data Privacy, Lawsuits

On Friday afternoon an Illinois intermediate appellate court decided that the bar for a plaintiff bringing a class action lawsuit under the Illinois Biometric Information Privacy Act (BIPA) is low, creating a conflict with its sister intermediate appellate court. The Illinois Supreme Court is expected to resolve the conflict early next year. How the court… Continue Reading

Biometric Privacy Webinar: A Guide for Corporate Counsel

By Al Saikali on Posted in Biometric Privacy, Data Privacy

Does your company collect biometric information?  Are you not entirely sure what “biometric information” means?  Would you like to understand the differences between the different state biometric privacy laws?  Do you want to know why more than 50 companies were hit with class action lawsuits within a period of three months as a result of… Continue Reading

New Wave of Biometric Privacy Class Actions: Could You Be A Target?

By Al Saikali on Posted in Biometric Privacy, Data Privacy, Lawsuits

While the privacy world is focused on the Equifax data breach, another development is taking place that could have a more lasting effect on privacy law.  In the last month, plaintiffs’ lawyers in Illinois have filed over 20 lawsuits against companies that authenticate their employees or customers with their fingerprints.  The lawsuits are based on… Continue Reading

Incident Response: The Increasing Risks to Corporate Legal Departments

By Al Saikali on Posted in Data Breach, Data Breach, Data Security

The consequences of a data breach reached new heights last week when Yahoo announced the resignation of its General Counsel in response to a series of security incidents the company suffered.  A more fulsome explanation of the security incidents and Yahoo’s response can be found in item seven of the company’s 10-K, but here are… Continue Reading

Why Every Business Should Care About Florida’s Information Protection Act

By Al Saikali on Posted in Breach Notification Statutes, Data Breach, Data Breach, Data Privacy, Data Security

My last post described what the recently passed Florida Information Protection Act (FIPA) will do.  This post analyzes how FIPA differs from Florida’s existing breach notification law and explains why those differences will hurt or help companies that maintain information about Florida residents.  Florida’s Governor must still sign the FIPA into law, but his signature… Continue Reading

Everything You Need To Know About Florida’s New Data Protection Law

By Al Saikali on Posted in Breach Notification Statutes, Data Breach, Data Privacy, Data Security

The Florida Legislature recently passed the Florida Information Protection Act of 2014 (FIPA).  This post describes the FIPA and analyzes the advantages and disadvantages to businesses governed by the new law.  The FIPA must still be signed by the Governor, but the law received unanimous support in the legislature, so his signature is expected.  Once… Continue Reading

What’s The Next Wave of Privacy Litigation? “Failure to Match”

By Al Saikali on Posted in Being Proactive, Data Privacy, Lawsuits

A client recently asked me to identify the next wave of data privacy litigation.  I said that with so much attention on lawsuits arising from data breaches, particularly in light of some recent successes for the plaintiffs in those lawsuits, the way in which companies collect information and disclose what they are collecting is flying… Continue Reading

Healthcare Organizations Take It On The Chin

By Al Saikali on Posted in Data Breach, Data Breach, Data Privacy, Data Security, FTC, Health Care Industry, Lawsuits

If you have noticed an increasing number of high profile problems for healthcare organizations with respect to privacy and security issues these last few weeks you’re not alone.  The issues have ranged from employee misuse of protected health information, web-based breaches, photocopier breaches, and theft of stolen computers that compromised millions of records containing unsecured… Continue Reading

Law Firms: How Are You Securing Your Clients’ Information?

By Al Saikali on Posted in All Things E, Data Privacy, Data Security, Vendor Management

What are law firms doing to protect their clients’ sensitive information?  What are clients doing to determine whether their outside counsel are using reasonable security measures to protect their sensitive information (confidential communication, customer data, financial information, protected health information, intellectual property, etc.)? According to the data forensic firm Mandiant, at least 80 major law… Continue Reading

Texas’s Data Privacy Training Laws Change (Again)

By Al Saikali on Posted in Data Privacy, Data Security, Health Care Industry

In August of last year, I wrote about HB 300, a Texas law that, beginning September 1, 2012, created employee training and other requirements for any company doing business in Texas that collects, uses, stores, transmits, or comes into possession of protected health information (PHI).  The law’s training provisions required covered entities to train their… Continue Reading

U.S. Senate Considers Federal Data Security Legislation

By Al Saikali on Posted in Data Breach, Data Breach, Data Privacy, Data Security

Legislation was introduced in the U.S. Senate late last week that, if passed, would create proactive and reactive requirements for companies that maintain personal information about U.S. citizens and residents.  The legislation, titled the “Data Security and Breach Notification Act of 2013” (s. 1193) creates two overarching obligations:  to secure personal information and to notify… Continue Reading

Data Breach Lawsuits – Revisiting the Risks

By Al Saikali on Posted in Data Breach, Data Breach, Data Privacy, Data Security, Lawsuits

Until recently, individuals whose information was compromised as a result of a company suffering a data breach faced an uphill battle when suing the company in a class action lawsuit.  Far more often than not, Courts dismissed the lawsuits or entered summary judgment in favor of defendants on grounds that the plaintiffs could not establish… Continue Reading

What’s In Your Trash?

By Al Saikali on Posted in Data Privacy, Data Security, FTC

How does your company dispose of personally identifiable information (medical records, financial information, applications containing sensitive information, etc.) and other sensitive information when the information is no longer needed?  Do you throw it in the trash can next to your desk?  Where does it go after that? Is it securely shredded, or thrown into an… Continue Reading

Is Secrecy A Prerequisite For Privacy?

By Al Saikali on Posted in Data Privacy

It can be easy in the data privacy and security sphere to focus significantly on best practices, changing statutes, new administrative investigations, and evolving industry standards.  It is important, however, not to lose the forest for the trees by ignoring larger issues like “what criteria should we use to determine whether information is in fact… Continue Reading

Where’s Your Privacy Policy?

By Al Saikali on Posted in Data Privacy, FTC

Regulators increasingly want to know what companies are telling consumers about how the companies are using information about their consumers.  Companies that do not properly explain how they collect, store, and use their customers’ information are facing increased scrutiny.  Nowhere is this increased scrutiny move evident than in the $22.5 million civil penalty that the… Continue Reading

Data Privacy – Is Your Business Ready For HB 300?

By Al Saikali on Posted in Data Privacy

On September 1, 2012, a new law will go into effect in Texas that imposes new requirements on organizations that maintain protected heath information (PHI).  The new legislation, HB 300, imposes even tighter standards than required by the federal Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical… Continue Reading

Why is the Countrywide data breach lawsuit dismissal important?

By Al Saikali on Posted in Data Breach, Data Security, Lawsuits

Another court has weighed in on the issue of what constitutes a cognizable injury in a data breach case. In a lengthy opinion, the U.S. District Court for the Western District of Kentucky in Holmes v. Countrywide Financial Corp. dismissed a lawsuit against Countrywide by plaintiffs who claimed that their personal information had been compromised… Continue Reading

Video Interview: Discussing the LinkedIn Data Breach Class Action Suit with LXBN TV

By Al Saikali on Posted in Data Breach, Data Security, Lawsuits

Following my post on the subject last week, I had the chance to speak with Colin O’Keefe of LXBN regarding the class action suit filed against LinkedIn following their recent high-profile data breach. In the brief interview, I explain the background of the case, what damages the plaintiffs are alleging and why it’s too early… Continue Reading

Should Companies Be Allowed To Ask Their Employees For Their Social Media Passwords?

By Al Saikali on Posted in Data Privacy, Social media

Tom Barnett, Managing Director and eDiscovery Practice Leader for Stroz Friedberg, has written an article entitled “What Happens on Facebook Stays on Facebook”.  The article provides a good overview of legislation passed recently by the Maryland legislature, which prohibits an employer or prospective employer from asking their employees or prospective employees for their social media… Continue Reading

FTC Action – Companies Must Guard Against Software That Threatens Private Information

By Al Saikali on Posted in Data Privacy, Data Security, FTC

Flying “under the radar” this week as a result of the high profile LinkedIn data breach, was news that the Federal Trade Commission charged two businesses with illegally exposing the sensitive personal information of consumers by allowing peer-to-peer (P2P) file-sharing software to be installed on their corporate computer systems.  P2P software is commonly used to… Continue Reading