Home | Databases | WorldLII | Search | Feedback EPIC Alert

EPIC Alert 16.16 [2009] EPICAlert 16

E P I C A l e r t

http://www.epic.org/alert/EPIC_Alert_16.16.html

"Defend Privacy. Support EPIC." http://epic.org/donate

In response to an EPIC Freedom of Information Act Request, the Government Services Administration released several contracts between the federal government and web 2.0 companies, including agreements with Blip.tv, Blist, Google (YouTube), Yahoo (Flickr), and MySpace.

On April 30, 2009, EPIC filed a FOIA request with the GSA requesting (1) all agreements between federal agencies and social networking services, cloud computing services, and/or vendors of other similar services; (2) all records, including memoranda and legal opinions, concerning the application of the Privacy Act of 1974 and the Freedom of Information Act to social networking services, cloud computing services, and/or other similar services, and (3) all instructions, policies and/or procedures concerning the collection, storage, transmission, and use of information about users of social networking or cloud computing services by federal agencies.

The EPIC FOIA request was made after the a news article stated that the GSA had signed agreements with social networking and cloud computing service providers concerning federal agencies' use of Web 2.0 services. The GSA often enters into contracts on behalf of multiple federal agencies in an effort to promote efficiency in government contracting. The news report also stated that a coalition of agencies have been working with private corporations to develop terms of service for federal agencies' participation in social media companies. The article cited a GSA official as stating that some of the areas of concern involved liability limits, endorsements and freedom of information.

Generally, the nine agreements obtained by EPIC state the Government's obligation to comply with federal law, and explicitly note obligations to comply with privacy or freedom of information laws. These contracts include companies like MySpace, SlideShare.net, Flickr, Vimeo.com, AddThis.com, Blip.tv, and BLIST. However, Facebook and Google (YouTube) contracts do not affirmatively express the Agency's obligations to comply with these laws. Further, the Google/YouTube contract explicitly authorizes the use of persistent cookies when it states that "[p]rovider acknowledges that, except as expressly set forth in this Agreement, Google uses persistent cookies in connection with that YouTube Video Player. To the extent that any rules or guidelines exist prohibiting the use of persistent cookies in connection with the Provider Content applies to Google, Provider expressly waives those rules or guidelines as they may apply to Google."

EPIC also discovered that contracts with the GSA consistently omit statements concerning Web 2.0 service providers' obligations to protect privacy. Whereas most privacy policies state how a website processes information, it is actually intended as a disclaimer of liability and does not provide any protection in and of itself. Given the fact that the data collection practices of federal agencies and their contractors are routinely subject to the federal Privacy Act, this omission is significant.

Privacy and Government Contracts with Social Media Companies: http://epic.org/privacy/socialnet/gsa/

EPIC's FOIA Request to GSA: http://www.epic.org/privacy/socialnet/gsa_foia_4-30-09.pdf

GSA's Contract with Google (YouTube): http://www.epic.org/foia/gov2.0/GSA_Google_Contract.pdf

GSA's Contract with Blip.tv: http://www.epic.org/foia/gov2.0/GSA_Blip_Contract.pdf

GSA's Contract with Blist: http://www.epic.org/foia/gov2.0/GSA_Blist_Contract.pdf

GSA's Contract with Yahoo (Flickr): http://www.epic.org/foia/gov2.0/GSA_Yahoo_Contract.pdf

GSA's Contract with MySpace: http://www.epic.org/foia/gov2.0/GSA_MySpace_Contract.pdf

GSA's Amended Contract with Facebook: http://www.epic.org/foia/gov2.0/GSA_Facebook_Amendment.pdf

GSA's Amended Contract with SlideShare.net: http://www.epic.org/foia/gov2.0/GSA_Slideshare_Amendment.pdf

GSA's Amended Contract with Vimeo.com: http://www.epic.org/foia/gov2.0/GSA_Vimeo_Amendment.pdf

GSA's Amended Contract with AddThis.com http://www.epic.org/foia/gov2.0/GSA_Addthis_Amendment.pdf

GSA Training Slides: http://www.epic.org/foia/gov2.0/GSA_Slides.pdf

GSA's Letter to EPIC: http://www.epic.org/foia/gov2.0/GSA_EPIC_Letter.pdf

EPIC - Social Network Privacy: http://www.epic.org/privacy/socialnet/default.html

EPIC - Facebook: http://epic.org/privacy/facebook/

EPIC - Cloud Computing: http://epic.org/privacy/cloudcomputing/

The Federal Trade Commission issued a final rule requiring breach notification by vendors of medical records and related entities. The American Recovery and Reinvestment Act of 2009 establishes provisions for advancing the health information technology while strengthening privacy and security protections for medical data. Recognizing that some web-based entities that collect consumers' health information are not subject to the existing the Health Insurance Portability and Accountability Act, the Recovery Act required the Department of Health and Human Services to study, in consultation with the Federal Trade Commission, potential privacy, security and breach notification requirements and submit a report to the Congress. Until Congress enacts a new legislation implementing the recommendations, the FTC final rule will regulate the requirements. The proposed rule published in April called for public comments.

In June, EPIC submitted comments to the FTC on the rule. EPIC commented that the proposed regulation was not broad enough, and should be modified to ensure that all entities handling electronic health records be subject to the regulation so that the privacy interests of citizens are protected. EPIC also advised that entities report all breaches to the FTC via some centralized means because redundant breach messages will be less likely. The FTC modified the rule in support of EPIC's advice, but exempted all federal agencies.

EPIC had also suggested that the FTC establish comprehensive privacy and security standards, and create a private right of action for violation of the rule. EPIC further recommended that information "accessed" be treated as "acquired" and substitute media notices like text messaging and social networking be used to notify individuals of breaches. Other suggestions included verification of data breach notices, creation of minimum security standards, assessing penalties for violations. EPIC opposed the creation of "safe-harbors" for de-identified data due to uncertainties and privacy risks associated with such information.

The final rule, 16 CFR Part 318, defines "breach of security" as acquisition of unsecured electronic health information without authorization. The rule also defines other terms such as "business associate," "HIPAA-covered entity," "personal health record," "PHR identifiable health information," "PHR related entity," "state," "third party service provider," "unsecured" PHR and "vendor of personal health records."

The rule requires each vendor of personal health records to notify both the individual affected by the breach as well as the FTC following the discovery of a "breach of security" of unsecured PHR. Third party service providers are required to notify designated officials or a senior official at the vendor of personal health records, and obtain an acknowledgement from such official that the notice was received. The rule requires the breach notifications be sent without unreasonable delay and no later than 60 calendar days after the discovery of the breach. However, a law enforcement official is entitled to determine if a notification would impede a criminal investigation and delay the notice.

The Health Breach rule also prescribes different methods of individual notices; media notices; as well as notice to the FTC. The notice must contain a brief description of what happened including the date of breach and the date of discovery, description of types of unsecured health information that were involved in the breach, steps that should be taken by the individual, a brief statement of action taken by the entity following the breach, and contact procedures for individuals affected by the breach in case they wanted to ask questions or learn additional information.

The rule becomes effective 30 days after the publication in the Federal Register and sunsets on the effective date of legislation, if enacted, establishing requirements for notification for health data breaches. The FTC Health Breach notification rule does not apply to HIPAA-covered entities or to any entity's activities as a business associate of a HIPAA-covered entity.

FTC Health Breach Notification Rule: http://www.ftc.gov/os/2009/08/R911002hbn.pdf

EPIC's Comments to the FTC on the Health Breach Notification Rule: http://epic.org/privacy/medical/Comments_on_FTC_EHR-EPIC.pdf

FTC Issues Final Breach Notification Rule for Electronic Health Information: http://www.ftc.gov/opa/2009/08/hbn.shtm

FTC Page on Health Data Breach: http://www.ftc.gov/healthbreach/

FTC Page - Privacy Initiative (Health Breach Notification Rule): http://www.ftc.gov/healthbreach/

FTC Health Breach Notification Form: http://www.ftc.gov/os/2009/08/R911002hbnform.pdf

The American Recovery and Reinvestment Act of 2009: http://epic.org/redirect/022309_Stimulus_Act.html

EPIC - Identity Theft: http://epic.org/privacy/idtheft

EPIC - Medical Privacy: http://epic.org/privacy/medical

In mid-July, the Office of the Privacy Commissioner of Canada released a Report of "Findings into the Complaint Filed by the Canadian Internet Policy and Public Interest Clinic" against Facebook, Inc. The complaint was filed by the CIPPIC under the Personal Information Protection and Electronic Documents Act and comprised 24 allegations ranging over 12 distinct subjects. These included default privacy settings, collection and use of users' personal information for advertising purposes, disclosure of users' personal information to third-party application developers, and collection and use of non-users' personal information.

Although the Commissioner's Office made several recommendations which were resolved, the Assistant Privacy Commissioner of Canada found that in the subjects of third-party applications, account deactivation and deletion, accounts of deceased users, and non-users' personal information to be in contravention of PIPEDA. The Assistant Commissioner determined that Facebook did not have adequate safeguards in place to prevent unauthorized access by application developers to users' personal information, and furthermore was not doing enough to ensure that meaningful consent was obtained from individuals for the disclosure of their personal information to application developers.

The Commissioner's Office made several suggestions to Facebook. The Office advised the social networking firm to limit application developers' access to user information, inform users specifically about the nature and use of shared information, and share information after obtaining consent of only users who add an application. The Office also said that deactivated account information should be deleted after a reasonable length of time, and that the privacy policy be amended to include all intended uses of personal information. Facebook was given 30 days. Facebook updated its privacy policy on August 11, 2009 to include "clarifying changes and minor updates."

The updated policy asks developers, operators of platform applications, and websites to respect user privacy settings. The modified policy directs developers to use the data received only to operate the specific applications, inform readers on what data is being collected, how it would be used, and whether it would be shared. The policy also states that developers must delete user data if their application is deleted by the user. The updated policy also made some clarifications in terms regulating advertisements and in the special provisions applicable to advertisers.

Facebook is complying with the Commissioner's Officer and revising its Privacy Policy to better describe a number of practices, including the reasons for the collection of date of birth, account memorialization for deceased users, the distinction between account deactivation and deletion, and how its advertising programs work. It will also educate users about reviewing their privacy settings to make sure the defaults and selections reflect the user's preferences. The social networking firm has also undertaken the task of increasing the understanding and control a user has over the information accessed by third-party applications. Facebook plans to introduce a new permissions model that will require applications to specify the categories of information they wish to access and obtain express consent from the user before any data is shared. Further, users would also have to specifically approve any access to their friends' information, which would still be subject to the friend's privacy and application settings.

In June, the Article 29 Working Party warned about the dissemination and use of information available on Social Networking Sites for other secondary, unintended purposes. The officials issued an opinion requiring robust security, privacy-friendly default settings. The European Privacy Commissioners recommended that controllers take "appropriate technical and organizational measures, 'both at the time of the design of the processing system and at the time of the processing itself' to maintain security and prevent unauthorized processing, taking into account the risks represented by the processing and the nature of the data." Earlier, in January, EPIC had suggested the regulation of Social Network Service partners, including advertisers and application developers.

Office of the Privacy Commissioner of Canada: http://www.priv.gc.ca/index_e.cfm

Report of Findings into the Complaint Filed by the CIPPIC against Facebook, Inc. under PIPEDA: http://www.priv.gc.ca/cf-dc/2009/2009_008_0716_e.cfm

Personal Information Protection and Electronic Documents Act (PIPEDA): http://www.priv.gc.ca/cf-dc/2009/2009_008_0716_e.cfm#appendixB

Remarks at a Media Briefing- Jennifer Stoddart (July 16, 2009): http://www.priv.gc.ca/speech/2009/sp-d_20090716_e.cfm

Redlined Version of Proposed Changes to Facebook's SRR: http://www.box.net/shared/hi66nsrhss

Facebook Announces Privacy Improvements in Response to Recommendations by Canadian Privacy Commissioner : http://www.facebook.com/press/releases.php?p=118816

Facebook agrees to address Privacy Commissioner's concerns: http://www.priv.gc.ca/media/nr-c/2009/nr-c_090827_e.cfm

Delivering More Control and Transparency, Facebook Blog, August 27, 2009: http://blog.facebook.com/blog.php?post=126129882130

Article 29 Working Party Opinion of Social Networking Sites: http://epic.org/privacy/socialnet/Opinion_SNS_090316_Adopted.pdf

Article 29 Working Party: http://epic.org/redirect/040109_A29WP.html

Facebook Privacy Policy: http://www.facebook.com/policy.php

Facebook Statement of Rights and Responsibilities: http://www.facebook.com/terms.php

EPIC's Suggestion on Social Networking Privacy: http://www.cpdpconferences.org/L-Z/rotenberg.html

EPIC - Facebook Privacy: http://epic.org/privacy/facebook/

EPIC - Social Networking Privacy: http://epic.org/privacy/socialnet/

The Department of Homeland Security is proposing to rescind its SSN No-Match Rule and the 2008 Supplemental Final Rule. In August 2007, DHS issued a rule describing legal obligations of an employer when a no-match letter from the Social Security Administration or a letter regarding employment verification forms from the DHS was received. The final rule also described "safe-harbor" procedures that the employer could follow in response to such a letter and thereby be certain that the DHS will not use the letter as any part of an allegation that the employer had constructive knowledge that the employee referred to in the letter was an alien not authorized to work in the United States. Failure to correct discrepancies resulted in liability under US immigration laws. However, due to the cumbersome process involved in correcting errors, employers instead choose to fire workers including citizens and non-citizens.

A federal court granted a preliminary injunction in the implementation of the rule. The court raised few issues regarding DHS's rulemaking action which included whether DHS had supplied a reasoned analysis to justify what the court viewed as a change in the Department's position that a no-match letter may be sufficient, by itself, to put an employer on notice, and thus impart constructive knowledge, that employees referenced in the letter may not be work-authorized; and whether the DHS had exceeded its authority (and encroached on the authority of the Department of Justice) by interpreting the antidiscrimination provisions of the an immigration statute.

DHS subsequently published a supplemental notice of proposed rulemaking and supplemental final rule to clarify certain aspects of the 2007 No-Match final rule and to respond to the findings underlying the court's injunction. Neither the SNPRM nor final rule, however, changed the safe-harbor procedures or applicable regulatory text. In October 2008, the same court declined to vacate the injunction on the SSN No-Match Rule.

The DHS conducted a review of existing programs and regulation under the incumbent Secretary and determined that the U.S. Citizenship and Immigration Services' program, E-Verify, along with other DHS programs "provide better tools for employers to reduce incidences of unauthorized employment" and "better detect and deter" the use of fraudulent identity documents by employees. Consequently, DHS has decided to rescind both the August 2007 No-Match rule as well as the 2008 Supplemental Final Rule.

DHS has also decided to focus resources on promoting E-Verify, U.S. Immigration and Customs Enforcement's Mutual Agreement Between Government and Employers, and other similar programs. In May 2008, E-Verify also added the Integrated Border Inspection System realtime arrival and departure information of non-citizens to its databases and in February 2009, USCIS also added Department of State passport data into E-Verify. In 2010, DHS plans to incorporate the Student and Exchange Visitors Information System into E-Verify.

EPIC, the Government Accountability Office, the Social Security Administration's Inspector General, and the CATO Institute have detailed many shortcomings of E-Verify, and have highlighted several issues with the program including high levels of inaccuracies in the databases on which the program is based, employer misuse resulting in discrimination and unlawful termination, the lack of privacy protections as well as the program's high costs. Last year, EPIC also filed a Freedom of Information request with the DHS asking for all records, including contracts and related documents, between DHS and NPR concerning the E-Verify promotion that began earlier. The request had included a demand for records involving contracts and related documents involving DHS and other media outlets. In spite of filing a FOIA Appeal, the agency has failed to produce the relevant documents.

The agency has called for comments which must be submitted no later than September 18, 2009. The comments may be submitted, identified by DHS Docket No. ICEB-2006-0004.

Federal Register, Vol. 74, No. 159, Wednesday, August 19, 2009 - (Proposed Rule Rescinding SSN No-Match Rule): http://edocket.access.gpo.gov/2009/pdf/E9-19826.pdf

Federal Register, Vol. 72, No. 157, Wednesday, August 15, 2007 - (Final Rule - Safe-Harbor Procedures for Employers Who Receive a No-Match Letter): http://edocket.access.gpo.gov/2007/E7-16066.htm

Department of Homeland Security, Safe Harbor Procedures for Employers, October 28: http://edocket.access.gpo.gov/2008/pdf/E8-25544.pdf

EPIC's letter to NPR Ombudsman: http://epic.org/DHS_NPR_ltr_12-08.pdf

EPIC's FOIA request to DHS: http://epic.org/privacy/e-verify/dhs_foia_120408.pdf

"Employment Verification - Challenges Exist in Implementing a Mandatory Electronic Employment Verification System", United States Government Accountability Office", June 10, 2008: http://www.gao.gov/new.items/d08895t.pdf

"Inspector General's Statement on SSA's Major Management and Performance Challenges", Nov. 5, 2008: http://epic.org/redirect/120808_IG_SSA_statement.html

E-Verify Debunking Exposes Debunking Errors, The Cato Institute, May 21, 2008: http://epic.org/redirect/120808_CATO_EVerify_error.html

EPIC, "Spotlight on Surveillance: E-Verify System - DHS Changes Name, But Problems Remain for U.S. Workers.": http://epic.org/privacy/surveillance/spotlight/0707/default.html

A federal court has passed an order prohibiting Verified Identity Pass, Inc., the company behind the Registered Traveler program "CLEAR," from "selling or otherwise transferring, disclosing to third parties or maintaining in an unsecure manner any personal biographic or biometric information that was provided to it by members of the putative class in connection with or as a condition to their membership in the CLEAR program...."

The Federal Court for the Southern District of New York found that there was "an immediate need for preliminary injunctive relief preventing the transfer or disclosure of such information" and "there is a risk of disclosure of such confidential private information resulting from the lack of accountability or oversight concerning the manner in which that information is maintained or stored." The court mandate directs VIP to "forthwith take all steps necessary to preserve, through the conclusion of this litigation, all documents, data and other materials relevant to the allegations" and includes biographic information collected by VIP, all communications with CLEAR members, all documents archiving and/or stored websites containing CLEAR marketing materials, promotional membership information, payment and membership history, and financial records.

VIP ceased operations on June 22, 2009 after declaring bankruptcy. At that time, VIP was the largest RT program in the nation operating out of 20 airports with about 250,000 members. The CLEAR RT application process collected a vast amount of personal information from members, such as proof of legal name, date of birth, citizenship status, home address, place of birth, and gender. The information was used to pre -screen travelers for express service through airport security checkpoints.

After its shutdown in June, the company statement on the fate of information on customers evolved several times. On July 1, 2009, the company stated that "Applicant and Member data is currently secured by Lockheed Martin, and that they are working with Verified Identity Pass on securing the data. According to Steve Brill, Clear's founder who had left the company in February, TSA could quickly reclaim the data under Registered Traveler rules. Brill also warned that the rules might have been altered since he left the company. Clear had "reserve[d] the right to change [its] policies [from time to time]" by informing its "customers by email."

On June 25, 2009, leaders of the House Homeland Security Committee sent a letter to the TSA regarding the bankruptcy of VIP. The committee is investigating among other things: when the TSA became aware of the bankruptcy; whether they have asked the company for its plan regarding its RT data; if the agency is seeking a privacy impact assessment on the bankruptcy; and whether the agency has a contingency plan for safeguarding the data now that the company has gone out of business.

Eight lawsuits have been filed against VIP by former CLEAR customers and raises claims of breach of contract, fraud and deceptive trade practices violating New York Law, where the company was registered. One case also highlighted the wrongful retention of highly personalized and sensitive personal data.

Perkins v. Verified Identity Pass Inc., S.D.N.Y., No. 09-5951, 08/18/09: Complaint: http://epic.org/privacy/airtravel/clear/CLEAR_complaint.pdf

Court Order: http://epic.org/privacy/airtravel/clear/sdny_clear_injunction.pdf

EPIC - Bankruptcy of Verified Identity Pass and the Privacy of Clear Registered Traveler Data: http://epic.org/privacy/airtravel/clear

TSA - Registered Traveler: http://www.tsa.gov/approach/rt/index.shtm

TSA - Minimum Required RT Security Standards and Procedures for Assessing Compliance with RT Security Standards: http://www.tsa.gov/assets/pdf/rt_appendix_c.pdf

TSA - Registered Traveler Security, Privacy, and Compliance Standards for Sponsoring Entities and Service Providers: http://www.tsa.gov/assets/pdf/rt_standards.pdf

House Homeland Security Committee Letter: http://epic.org/dhs-committee_tsa-ltr.pdf

Clear's Privacy Policy: http://www.flyclear.com/clear_privacy.pdf

Clear's Online Privacy Policy: http://www.flyclear.com/clear_online.pdf

CBP - Trusted Traveler Programs: http://www.cbp.gov/xp/cgov/travel/trusted_traveler/

Airports Accepting the Clear Card (Archived): http://epic.org/privacy/airtravel/clear/clear-airports.pdf

EPIC Spotlight on Surveillance - Registered Traveler Card: http://epic.org/privacy/surveillance/spotlight/1005/

EPIC - Air Travel Privacy: http://epic.org/privacy/airtravel/

EPIC - Secure Flight: http://epic.org/privacy/airtravel/secureflight.html

EPIC - Passenger Profiling: http://epic.org/privacy/airtravel/profiling.html

EPIC's testimony before Congress: "The Future of Registered Traveler," November 3, 2005: http://epic.org/privacy/airtravel/rt_test_110305.pdf

EPIC's testimony before Congress: "Ensuring America's Security: Cleaning Up the Nation's Watchlists", September 9, 2008: http://epic.org/privacy/airtravel/watchlist_test_090908.pdf

Massachusetts Lowers Privacy Protection in Data Privacy Rule

In November 2008, the Commonwealth of Massachusetts became the first state in the United States to enact comprehensive data privacy and security standards and regulations in order to ensure that businesses are taking steps to safeguard personal information. The purpose of the new regulation is to protect against unauthorized access or use in a way that creates a risk of identity theft or fraud. Although it was initially announced that the rules would come into effect from January 1, 2009, it has now been modified and postponed to March 1, 2010. The amended rules changes several definitions, and affects employers with regard to personal data of Massachusetts employees even if these employees do not reside in Massachusetts. The amended rules no longer require an obligation to limit the amount of personal information, or the time period such information is retained and no longer prohibits access to those persons who are required to know the information. Further, the new rules remove the obligation to identify records that contain personal information as well as the obligation to implement a written procedure for how physical access to records is restricted.

Standards for The Protection of Personal Information of Residents of the Commonwealth (201 CMR 17.00): http://www.mass.gov/Eoca/docs/idtheft/201CMR1700reg.pdf

FAQs regarding 201 CMR 17.00: http://www.mass.gov/Eoca/docs/idtheft/201CMR17faqs.pdf

EPIC - Identity Theft: http://epic.org/privacy/idtheft

New Hampshire Enacts Electronic Health Privacy Law

New Hampshire signed into law a statute that is aimed at protecting health information privacy in electronic medical records and allows individuals to opt out of sharing their names, addresses, and protected health care information with electronic health data exchanges. A companion statute restricts health data for marketing and fundraising and puts forth breach notifications for health care providers and their business associates. The new statute is scheduled to take effect on January 1, 2010. Earlier this year, the U.S. Supreme Court refused to hear the challenge to another New Hampshire law, the Prescription Confidentiality Act, which prevents data brokers from collecting information on which individual physicians were prescribing which drugs and selling such information to pharmaceutical companies to influence physicians' prescribing habits. The First Circuit had upheld the constitutionality of the statute. EPIC and 16 other experts in privacy and technology submitted a friend of the Court brief highlighting the presence of substantial privacy interest in de-identified patient data. In IMS Health v. Sorrell, the Second Circuit is now considering the constitutionality of a similar statute arising from Vermont.

HB 542 – Final version: http://www.gencourt.state.nh.us/legislation/2009/HB0542.html

HB 619 – Final version: http://www.gencourt.state.nh.us/legislation/2009/HB0619.html

EPIC - IMS Health v. Sorrell: http://epic.org/privacy/ims_sorrell/

IMS Health's Notice of Appeal: http://epic.org/privacy/ims_sorrell/IMS_appeal.pdf

PhRMA's 2nd Circuit Brief: http://epic.org/redirect/082809_PhRMA_2dCir_Brief.html

IMS Health's 2nd Circuit Brief: http://epic.org/redirect/082809_IMS_2dCir_Brief.html

Supreme Court Docket: IMS Health v. Ayotte: http://origin.www.supremecourtus.gov/docket/08-1202.htm

First Circuit Opinion: http://epic.org/privacy/imshealth/11_18_08_order.pdf

Prescription Confidentiality Act: http://www.gencourt.state.nh.us/legislation/2006/HB1346.html

EPIC's Brief - IMS Health v. Ayotte: http://epic.org/privacy/imshealth/epic_ims.pdf

EPIC - IMS Health v. Ayotte: http://epic.org/privacy/imshealth/

Health Department Issues Final Rule on Breach Notification

The Department of Health and Human Services published a final interim rule requiring individuals be notified by health care providers, health plans, and other entities covered under Health Insurance Portability and Accountability Act when their health information is breached. The rules require health care providers and other HIPAA covered entities to promptly notify affected individuals of a breach, as well as the HHS Secretary and the media in cases where a breach affects more than 500 individuals. The regulations also require business associates of covered entities to notify the covered entity of breaches at or by the business associate. The FTC Health Breach notification rule does not apply to HIPAA-covered entities or to any entity's activities as a business associate of a HIPAA-covered entity. The creation of this rule was mandated under the American Recovery and Reinvestment Act of 2009.

HHS - Health Information Privacy: http://hhs.gov/ocr/privacy/

HHS - HITECH Breach Notification Interim Final Rule: http://epic.org/redirect/082809_HHS_BreachNotifRule.html

Breach Notification Interim Final Regulation (74 FR 42740)-August 2009: http://edocket.access.gpo.gov/2009/pdf/E9-20169.pdf

Press Release: http://www.hhs.gov/news/press/2009pres/08/20090819f.html

HITECH Breach Notification Guidance and RFI (74 FR 19006)-April 2009: http://epic.org/redirect/082809_HHS_BreachNotifGuide.html

The American Recovery and Reinvestment Act of 2009: http://epic.org/redirect/022309_Stimulus_Act.html

EPIC - Medical Privacy: http://epic.org/privacy/medical

EPIC - Identity Theft: http://epic.org/privacy/idtheft

DHS Issues PIA for Border Searches of Electronic Devices

The Department of Homeland Security released a Privacy Impact Assessment for the searches of electronic devices conducted at U.S. borders. The legality of searching and examining persons and property crossing into the U.S. has been recognized for centuries. A court has also upheld the searching of electronic devices at the border. Privacy concerns have been raised by members of Congress. Senators Russ Feingold (D-Wi) and Patrick Leahy (D-Vt) had urged the Customs and Border Patrol to reconsider the policy of searching laptops, digital cameras, and handheld devices at borders. The PIA analyzes how CBP and Immigration and Customs Enforcement handles the examination, detention, retention, and seizure of electronic devices and information. The two federal agencies identified several privacy risks associated with the examination, detention, retention, and/or seizure of a traveler's electronic device or information during a border search which include the traveler being unaware of the viewing or detention of his personal information; detention of PII when not required; disclosure of PII to other agencies that may misuse or mishandle it; and new privacy risks that may arise due to ever-changing technology.

DHS Border Searches of Electronic Devices PIA: http://epic.org/redirect/082809_DHS_Border_ElecDevice_PIA.html

Senator Patrick Leahy (D-Vt.), Chairman, Senate Judiciary Committee, "Laptop Searches And Other Violations Of Privacy Faced By Americans Returning From Overseas Travel" (June 25, 2008): http://leahy.senate.gov/press/200806/062508.html

CRS - The Department of Homeland Security Intelligence Enterprise: Operational Overview and Oversight Challenges for Congress: http://epic.org/crs-rept_dhs-oversight.pdf

"TIME CHANGE -- Laptop Searches and Other Violations of Privacy Faced by Americans Returning from Overseas Travel": http://judiciary.senate.gov/hearings/hearing.cfm?id=3420

Congress Urges Department of Commerce to Oversee ICANN

Members of the House Committee on Energy and Commerce wrote a letter to the Secretary for the United States Department of Commerce urging that the oversight of Internet Corporation for Assigned Names and Numbers be made permanent. The letter asked for a "permanent instrument to which ICANN and the Department of Commerce are co-signatories." The representatives asked that the new instrument provide for periodic reviews of ICANN's performance with respect to transparency and accountability, the security and stability of the Internet, management of generic top-level domains and implementation of any new gTLDs. The members also asked for outlining the steps that ICANN would take to maintain and improve its accountability; and create a mechanism for ICANN's implementation of any new gTLDs and internationalized domain names that ensured appropriate consultation with stakeholders. Further, the representatives asked that ICANN adopt measures to maintain timely and public access to accurate and complete WHOIS information, including registrant, technical, billing and administrative contact information that is critical to the tracking of malicious websites and domain names. The committee members also stated that the new instrument include commitments that ICANN will remain a not-for-profit corporation headquartered in the United States.

Congress Letter to Gary Locke, Department of Commerce: http://epic.org/linkedfiles/sen_icann.pdf

House Committee Energy & Commerce: http://energycommerce.house.gov/

U.S. Department of Commerce: http://www.commerce.gov/

The Pubic Voice http://www.thepublicvoice.org

Privacy Advocate Joins FTC

Chris Soghoian, a member of the EPIC Advisory Board, is joining the Federal Trade Commission as technical consultant in the Division of Privacy and Identity Protection in the Bureau of Consumer Protection. As a Ph.D. candidate at Indiana University's School of Informatics, Chris's research interests included data security and privacy, cyber law and policy. As a security researcher, he has discovered and disclosed vulnerabilities in software applications made by Google, Yahoo, Facebook and Apple. In the policy sphere, his activism has resulted in the successful passage of an amendment to Indiana's data breach laws and a Congressional investigation into security flaws at the Transportation Security Administration. Earlier this year, Chris raised the issue of using cookies on the White House website within embedded YouTube videos for the President's weekly address. Such cookies could also be used to track individuals who played the President's weekly address on their computer.

"Going Fed:" http://paranoia.dubfire.net/2009/08/going-fed.html

White House exempts YouTube from privacy rules: http://news.cnet.com/8301-13739_3-10147726-46.html

White House acts to limit YouTube cookie tracking: http://news.cnet.com/8301-13739_3-10148844-46.html

Chris Soghoian, EPIC Advisory Board: http://epic.org/epic/advisory_board.html#soghoian

Report Finds "Leakage" of PII from Social Networks

A paper by two researchers from AT&T Labs and Worcester Polytechnic Institute has established that it is possible for personally identifiable information to "leak" from Social Networking Sites to third-party aggregators. The research found that the top-10 third-party servers across a large set of popular web sites had grown from 40% in October 2005 to 70% in September 2008. The study found that leakage in PII could occur via a combination of HTTP header information and cookies being sent to third-party aggregators. The report also stated that while it was not known whether aggregators were recording PII, it was undeniable that information was available to them. The researchers stated that online Social Network Sites were in the best position to prevent such leakage by eliminating social network identifiers from request URLs and consequently, the referrer header.

Krishnamurthy and Willis, "On the Leakage of Personally Identifiable Information Via Online Social Networks:" http://epic.org/redirect/082809_PII_SNS_Leak_Report.html

EPIC - Social Network Privacy: http://epic.org/privacy/socialnet

NIST Published Revised Security Controls for Federal Information Systems and Organizations

The Computer Security Division Information Technology Laboratory of the National Institute of Standards and Technology revised and published security controls for federal information systems. The published guideline is a mandatory federal standard developed by NIST in response to the Federal Information Security Management Act. The new guideline is more detailed than its predecessor and advises agencies to write cybersecurity policy and includes several controls to defend against computer threats. The new guidelines would not only be applicable to civilians agencies, but also the Defense Department and other intelligence agencies. A companion document, "Special Publication 800-53A," includes a procedures for testing and evaluating each security control.

Recommended Security Controls for Federal Information Systems and Organizations: http://epic.org/redirect/082809_NIST_Sec_Control.html

Markup Version: http://epic.org/redirect/082809_NIST_Sec_Control_Markup.html

Guide for Assessing the Security Controls in Federal Information Systems: http://epic.org/redirect/082809_NIST_Sec_Control_Guide.html

"OECD Communications Outlook 2009"

http://www.amazon.com/gp/product/9264059830?tag=e03a6-20

Although the advent of telecommunications technology has crossed many miles in the last few centuries, the human desire to connect and communicate has always pushed mankind into developing novel ways to communicate. The OECD Communications Outlook provides a bird's-eye perspective over not only the development of telecommunications and technology, but also the market forces that shape, hammer and thrust it forward.

Drafted by the staff working in the OECD Directorate for Science, Technology and Industry, the book is divided into chapters examining recent changes in communication policy, market size, network dimensions and development, internet infrastructure, broadcasting, and pricing trends. The report confirms the perception that the telecommunications market has expanded and goes on to emphasize how the ability to communicate has seven pathways now as compared to one in 1980. The report uses statistical data analyses to show striking trends in the medium of communication technologies and identifies both the bottlenecks as well as the impetus for future growth.

The publication studies the rise of broadband on fixed lines and the increase in demand of bundled services over the specter of abysmal investments in communications infrastructure. The report notes that, although government's ownership of public telecommunication operators have reduced, the current financial situation makes it likely that major reductions in state ownership would be deferred. The OECD book also notes the changing audio visual landscape with both being delivered over a range of different network and devices and the money being poured in new, high-speed broadband networks which allows for a much richer audio-visual experience.

This book is not meant as an advice or guide; but rather as a compilation of statistics that would help policy makers comprehend a plethora of simultaneous evolutions in data interchange. The publication gives a technical and informational overview of the digital evolution against the backdrop of ever-changing, dynamic technologies mapped onto competing market forces and leaves the readers to best judge how to realize and apply the learning in their respective fields.

-- Anirban Sen

"Litigation Under the Federal Open Government Laws 2008," edited by Harry A. Hammitt, Marc Rotenberg, John A. Verdi, and Mark S. Zaid (EPIC 2008). Price: $60.

http://epic.org/bookstore/foia2008/

Litigation Under the Federal Open Government Laws is the most comprehensive, authoritative discussion of the federal open access laws. This updated version includes new material regarding the substantial FOIA amendments enacted on December 31, 2007. Many of the recent amendments are effective as of December 31, 2008. The standard reference work includes in-depth analysis of litigation under Freedom of Information Act, Privacy Act, Federal Advisory Committee Act, Government in the Sunshine Act. The fully updated 2008 volume is the 24th edition of the manual that lawyers, journalists and researchers have relied on for more than 25 years.

"Information Privacy Law: Cases and Materials, Second Edition" Daniel J. Solove, Marc Rotenberg, and Paul Schwartz. (Aspen 2005). Price: $98.

http://www.epic.org/redirect/aspen_ipl_casebook.html

This clear, comprehensive introduction to the field of information privacy law allows instructors to enliven their teaching of fundamental concepts by addressing both enduring and emerging controversies. The Second Edition addresses numerous rapidly developing areas of privacy law, including: identity theft, government data mining and electronic surveillance law, the Foreign Intelligence Surveillance Act, intelligence sharing, RFID tags, GPS, spyware, web bugs, and more. Information Privacy Law, Second Edition, builds a cohesive foundation for an exciting course in this rapidly evolving area of law.

"Privacy & Human Rights 2006: An International Survey of Privacy Laws and Developments" (EPIC 2007). Price: $75.
http://www.epic.org/phr06/

This annual report by EPIC and Privacy International provides an overview of key privacy topics and reviews the state of privacy in over 75 countries around the world. The report outlines legal protections, new challenges, and important issues and events relating to privacy. Privacy & Human Rights 2006 is the most comprehensive report on privacy and data protection ever published.

"The Public Voice WSIS Sourcebook: Perspectives on the World Summit on the Information Society" (EPIC 2004). Price: $40.

http://www.epic.org/bookstore/pvsourcebook

This resource promotes a dialogue on the issues, the outcomes, and the process of the World Summit on the Information Society (WSIS). This reference guide provides the official UN documents, regional and issue-oriented perspectives, and recommendations and proposals for future action, as well as a useful list of resources and contacts for individuals and organizations that wish to become more involved in the WSIS process.

"The Privacy Law Sourcebook 2004: United States Law, International Law, and Recent Developments," Marc Rotenberg, editor (EPIC 2005). Price: $40.

http://www.epic.org/bookstore/pls2004/

The Privacy Law Sourcebook, which has been called the "Physician's Desk Reference" of the privacy world, is the leading resource for students, attorneys, researchers, and journalists interested in pursuing privacy law in the United States and around the world. It includes the full texts of major privacy laws and directives such as the Fair Credit Reporting Act, the Privacy Act, and the OECD Privacy Guidelines, as well as an up-to-date section on recent developments. New materials include the APEC Privacy Framework, the Video Voyeurism Prevention Act, and the CAN-SPAM Act.

"Filters and Freedom 2.0: Free Speech Perspectives on Internet Content Controls" (EPIC 2001). Price: $20.

http://www.epic.org/bookstore/filters2.0

A collection of essays, studies, and critiques of Internet content filtering. These papers are instrumental in explaining why filtering threatens free expression.

EPIC publications and other books on privacy, open government, free expression, crypto and governance can be ordered at:

EPIC Bookstore
http://www.epic.org/bookstore

EPIC also publishes EPIC FOIA Notes, which provides brief summaries of interesting documents obtained from government agencies under the Freedom of Information Act.

Subscribe to EPIC FOIA Notes at: https:/mailman.epic.org/mailman/listinfo/foia_notes

EPIC, Privacy Scorecard for the Obama Administration, National Press Club, Washington DC, September 9, 2009. For more information,
http://www.theprivacycoalition.org/

Section: Protest Politics | Panel: The Contentious Politics of Intellectual Property, 5th ECPR General Conference, Potsdam, Germany, September 10-12, 2009. For more information,
http://www.ecpr.org.uk/potsdam/default.asp

2nd International Action Day "Freedom not Fear - Stop the Surveillance Mania" Demonstrations, Events, Privacy Parties, etc., in many countries. Worldwide, September 12, 2009. For more information,
http://wiki.vorratsdatenspeicherung.de/Freedom_Not_Fear_2009

Pan-European Dialogue on Internet Governance (EuroDIG), Geneva, Switzerland, September 14-15, 2009. For more information,
http://www.eurodig.org/

World Summit on the Knowledge Society WSKS 2009, Crete, Greece, September 16-18, 2009. For more information,
http://www.open-knowledge-society.org/

Gikii, A Workshop on Law, Technology and Popular Culture, Institute for Information Law (IViR), University of Amsterdam, September 17-18, 2009. For more information, http://www.law.ed.ac.uk/ahrc/gikii/2009.asp

"The Net will not forget," European conference on ICT and Privacy, Copenhagen, Denmark, September 23-24, 2009. For more information, http://www.ict-privacy.dk/

3rd International Conference "Keeping Children and Young People Safe Online," Warsaw, Poland, September 29-30, 2009. For more information,
http://tinyurl.com/KCYPSO

"6th Communia Workshop: Memory Institutions and Public Domain" Barcelona, Spain, October 1-2, 2009. For more information,
http://www.communia-project.eu/ws06

10th German Big Brother Awards, Bielefeld, Germany, October 16, 2009. For more information, http://www.bigbrotherawards.de

eChallenges 2009, Istanbul, Turkey, October 21-23, 2009. For more information, http://www.echallenges.org/e2009/default.asp

Big Brother Awards Switzerland, Zurich, Switzerland, October 24, 2009. Deadline for nominations: August 31, 2009. For more information, http://www.bigbrotherawards.ch/2009/

3rd European Privacy Open Space, Vienna, Austria, October 24-25, 2009. For more information, http://www.privacyos.eu

Austrian Big Brother Awards Vienna, Austria, October 25, 2009. Deadline for nominations: 21 September 2009. For more information,
http://www.bigbrotherawards.at

Free Culture Forum: Organization and Action, Barcelona, Spain, October 29 - November 1, 2009. For more information, http://fcforum.net

Free Society Conference and Nordic Summit, Gothenburg, Sweden, November 13-15, 2009. For more information, http://www.fscons.org

3rd European Privacy Open Space, Vienna, Austria, October 24-25, 2009. For more information, http://www.privacyos.eu

Global Privacy Standards in a Global World, The Public Voice, Madrid, Spain, November 3, 2009. For more information,
http://thepublicvoice.org/events/madrid09/

31st International Conference of Data Protection and Privacy Commissioners, Madrid, Spain, November 4-6, 2009. For more information,
http://epic.org/redirect/072009_31Conf_IntlDPA.html

UN Internet Governance Forum, Sharm El Sheikh, Egypt, November 15-18, 2009. For more information, http://www.intgovforum.org/

Join the Electronic Privacy Information Center on Facebook

http//facebook.com/epicprivacy

http://epic.org/facebook

Start a discussion on privacy. Let us know your thoughts. Stay up to date with EPIC's events. Support EPIC.

The EPIC Alert mailing list is used only to mail the EPIC Alert and to send notices about EPIC activities. We do not sell, rent or share our mailing list. We also intend to challenge any subpoena or other legal process seeking access to our mailing list. We do not enhance (link to other databases) our mailing list or require your actual name.

In the event you wish to subscribe or unsubscribe your e-mail address from this list, please follow the above instructions under "subscription information."

The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues such as the Clipper Chip, the Digital Telephony proposal, national ID cards, medical record privacy, and the collection and sale of personal information. EPIC publishes the EPIC Alert, pursues Freedom of Information Act litigation, and conducts policy research. For more information, see http://www.epic.org or write EPIC, 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. +1 202 483 1140 (tel), +1 202 483 1248 (fax).

If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "EPIC" and sent to 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. Or you can contribute online at:

http://www.epic.org/donate

Your contributions will help support Freedom of Information Act and First Amendment litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and expanding wiretapping powers.

Thank you for your support.

Subscribe/unsubscribe via web interface:
http://mailman.epic.org/mailman/listinfo/epic_news

Back issues are available at:
http://www.epic.org/alert

The EPIC Alert displays best in a fixed-width font, such as Courier.

.