State Attorneys General Write to Google

Posted on February 22, 2012 by Colin J. Zick

In a letter sent earlier today, 37 state attorneys generals (or their equivalents) wrote to Larry Page, Google's CEO, "to express our strong concerns with the new privacy policy that Google announced it will be adopting for all of its consumer products."

According to the letter:

Google’s new privacy policy is troubling for a number of reasons. On a fundamental level, the policy appears to invade consumer privacy by automatically sharing personal information consumers input into one Google product with all Google products. Consumers have diverse interests and concerns, and may want the information in their Web History to be kept separate from the information they exchange via Gmail. Likewise, consumers may be comfortable with Google knowing their Search queries but not with it knowing their whereabouts, yet the new privacy policy appears to give them no choice in the matter, further invading their privacy. It rings hollow to call their ability to exit the Google products ecosystem a “choice” in an Internet economy where the clear majority of all Internet users use – and frequently rely on – at least one Google product on a regular basis.

The state officials ask that Google meet with them, and request a response by February 29.  There has been no response from Google yet, although it would be difficult for Google not to meet, even if it has no intention to change anything.

Tags: , , , , ,

The Right To Be Deleted

Posted on February 20, 2012 by Colin J. Zick

If you haven't Googled yourself in a while, this might be a good time. My own self-search reveals, among other things, a page at mylife.com.  I didn't put it there, and I'd rather it not be there. However, right now, there isn't a right to have your personal or professional information be deleted from social media, review sites, and other types of websites that gather your personal information.  However, legislation may be coming that will address this concern.

According to the Wall Street Journal,

Lawmakers and regulators are trying to do more to address consumer concerns. There is no U.S. law, as there is in Europe, requiring companies to allow people to view or delete their personal data on file at an institution. Last year, Sens. John Kerry (D., Mass.) and John McCain (R., Ariz.) introduced legislation that would require most data brokers to let people view and make corrections to the personal data stored about them. The White House is expected to call for similar rights when it releases its "Privacy Bill of Rights" later this year.

We also know the FTC is watching online background reporting entities, and recently warned marketers of six mobile applications that provide background screening apps that they may be violating the Fair Credit Reporting Act. The FTC warned the apps marketers that, if they have reason to believe the background reports they provide are being used for employment screening, housing, credit, or other similar purposes, they must comply with the Act.  While this doesn't deal with unwanted listings, it might limit their impact.
 

 

 

Tags: , , , , , , , , , ,

Google Disables Its iPhone Tracking

Posted on February 20, 2012 by Colin J. Zick

Interesting article in the Wall Street Journal about Google's iPhone tracking. 

Google Inc. and other advertising companies have been bypassing the privacy settings of millions of people using Apple Inc.'s Web browser on their iPhones and computers—tracking the Web-browsing habits of people who intended for that kind of monitoring to be blocked.

The companies used special computer code that tricks Apple's Safari Web-browsing software into letting them monitor many users. Safari, the most widely used browser on mobile devices, is designed to block such tracking by default.

A telling statement: 

Google disabled its code after being contacted by The Wall Street Journal.

 

Tags: , , , , , , , ,

More on Google's Privacy Policy

Posted on January 27, 2012 by Colin J. Zick

Here is an excerpt from my interview yesterday with Jon Mitchell of ReadWriteWeb:

"From a legal perspective, I'm not seeing anything that's much different in what's being proposed to take effect on March 1 and what's in place right now," Zick says. "In particular, the language about sharing across services has been in [Google's policies] for a long time."

Zick points out that all the past versions of Google's privacy policies are on the website, and the last two versions offer line-by-line comparisons to the previous version. Zick expects that Google will do the same with the new policy once it's officially issued.

"What we have is not a reaction to a change in legal language," Zick says, "but it's a change in perception. ... People are just reflexively reacting to the idea that Google is big."

The entire article can be viewed here, and our earlier post here.

Tags: , , , , , , , ,

Google Changes Its Privacy Policies

Posted on January 24, 2012 by Colin J. Zick

As many of you have probably seen already, Google is changing its privacy policies, effective March 1, 2012.  These changes will be effective across all of Google's platforms, and users will not be able to opt out.  A user's only choice to avoid these changes will be to leave Google's search engine, Gmail, Calendar, Search, and YouTube; there is no "opt out" or selective acceptance/rejection of these new policies.  In this regard, Google noted that it remains committed to data liberation, "so if you want to take your information elsewhere you can."

These changes are likely to draw FTC scrutiny, especially in light of the recent decision by Google to incorporate data from its social network, Google+, into search results, which has already resulted in a FTC antitrust investigation. 

Tags: , , , , ,

"Performing Due Diligence Before Signing a Cloud SLA"

Posted on January 5, 2012 by Colin J. Zick

My overview of some of the major issues involved in signing a cloud computing agreement can be found in searchcloudcomputing, "Performing Due Diligence Before Signing a Cloud SLA."

                                                                     *  *  *

No one is certain of all the legal risks associated with enterprises storing confidential or proprietary information outside the corporate firewall -- in the cloud. However, there is growing consensus about what companies should ask cloud vendors to maintain a secure IT environment and avoid potential legal risks associated with the cloud. 

General areas of concern surrounding the cloud are similar to those of traditional IT:

  • Data security during transmission and storage;
  • Data privacy and confidentiality;
  • Rights of access in general as well as access for local governments and e-discovery;
  • Data ownership;
  • Suspension and termination of service;
  • Forming and negotiating service-level agreements (SLAs) with cloud providers.
     

Because many leading cloud vendors are huge entities with an even larger customer base, fine details of an SLA aren’t always negotiable. Often, SLAs are simply forms presented on a “take-it-or-leave-it” basis. As such, the first question you should consider is whether are you willing to put your company data into an environment where you are not in control of most of the terms of your engagement. If you’re not comfortable with this, I recommend you look for a provider that is willing to discuss the terms of service.

Los Angeles city officials were able to negotiate their contract for Google applications in the cloud. But if you’re not the second biggest city in the U.S., you may not be as lucky.

If you’re new to cloud storage, consider prioritizing data storage. Many companies kick off a move into the cloud by migrating non-core data first. This allows them to trial the service and determine if it was cost effective without risking core business functions.

For example, a law firm that is new to cloud computing might decide to place back-office information in the cloud -- payroll, employee benefits -- before moving privileged and confidential client information outside the standard network firewall.

Cloud SLAs and a la carte options
Assuming you have a proposed SLA with a potential cloud vendor that is negotiable and you are ready to place some data in the cloud, there are some additional services you may want to look into before signing on the dotted line:

Request that sensitive data reside in a private cloud. This is a slight misnomer since the purpose of cloud computing is to achieve economies of scale by sharing facilities; however, there may be scenarios in which having a dedicated cloud infrastructure makes sense.

Seek special data encryption. If you have particularly sensitive information, you may want the cloud vendor to provide extra protections. For example, while there seems to be growing understanding that cloud providers are not business associates under HIPAA, this isn’t universally known. You might want the cloud provider to agree to adhere to HIPAA standards, even if they’re not required by law to do so.

Geographic restrictions on where your data is stored. For legal or client-relation purposes, you may not want data stored overseas where law enforcement is not as rigorous or the laws are uncertain.

Unique service levels. If your enterprise has special requirements for data access or use, don’t be afraid to ask the cloud vendor for special service.

Special penalties for violation of agreement terms. If it is it important to you or your customers that there be especially high penalties for violating data privacy, ask for them.

Provisions that would deal with a change in ownership over your cloud provider. The cloud computing market is changing rapidly. You may want to build in a change-in-ownership or non-assignment clause into your SLA. In such a provision, you might also make clear that the cloud provider will never own the data that they hold for you, even if you decide to change providers.

Provision for business continuity in the event of a disaster.You need to know specifically what will happen to your data in the event of an earthquake, tsunami or other natural disaster.

In addition to these terms, you may want to add traditional IT outsourcing contract terms that you’ve grown accustomed to regarding e-discovery functionality and indemnification from breaches, such as the ability to:

  • search based on defined criteria -- content, sender and/or recipient, date range and metadata;
  • store search results with any metadata;
  • add and delete from search results to create an e-discovery set.
Tags: , , , , , , ,

Mozilla and Google Announce "Do Not Track" Browser Features

Posted on January 28, 2011 by Colin J. Zick

By Katie Perry

Earlier this week, both Mozilla and Google announced new browser features aimed at giving users greater control over how their personal data is collected online. Microsoft announced a similar initiative in December. 

 

The introduction of browser “Do Not Track” features follows the Federal Trade Commission’s preliminary staff report, "Protecting Consumer Privacy in an Era of Rapid Change:  A Proposed Framework for Businesses and Policymakers,” which supports a “universal consumer choice mechanism for online behavioral advertising.” In its report, the FTC noted that “[t]he most practical method of providing uniform choice for online behavioral advertising would likely involve placing a setting similar to a persistent cookie on a consumer’s browser and conveying that setting to sites that the browser visits, to signal whether or not the consumer wants to be tracked or receive targeted advertisements.”   We discussed the FTC's proposal's in an entry last month.

 

The recent announcements by Mozilla, Google and Microsoft signal the beginning of a larger trend towards the voluntary implementation of “Do Not Track” mechanisms, as companies try to preempt the legislative and regulatory efforts likely to flow from the FTC’s proposed framework.

As far as the specifics of these "Do Not Track" browers, Mozilla’s proposed feature would allow a Firefox user to select a browser setting resulting in the transmission of a “Do Not Track HTTP header” that alerts websites of the user’s desire to opt-out of third-party tracking for behavioral advertising “with every click or page view.” Mozilla’s mechanism relies on the cooperation of third-party tracking companies, however, as the transmission of the HTTP header does not force an opt-out or require that websites comply. 

 

While the Firefox “Do Not Track HTTP header” is still in the works, Google already has a plug-in called “Keep My Opt-Outs” available for its Chrome browser. “Keep My Opt-Outs” which allows users to permanently opt out of online tracking, rather than relying on cookies to save their opt-out settings. The plug-in will only block tracking from companies that already offer self-regulated opt-out services, however. According to Google, more than 50 companies offer opt outs, including the top 15 largest ad networks in the U.S.

Unlike Mozilla and Google, Microsoft has taken a user-generated approach to its “Do Not Track” mechanism, called “Tracking Protection.” The feature, to be included in Internet Explorer 9, would enable users to limit third-party tracking through the use of tracking protection lists identifying which websites they do not want to share information with. By default, the tracking protection lists will be empty, but consumers can create their own lists or add lists created by others, including consumer advocacy groups. Once a user subscribes, the tracking protection list will be automatically updated whenever the creator makes changes.
Tags: , , , , , , ,

Tracking Protection to be Included in Internet Explorer 9: Is This the Tipping Point?

Posted on December 8, 2010 by Colin J. Zick

Microsoft announced yesterday in its IE blog that it will be adding a tracking protection feature to Internet Explorer 9.  In particular, Microsoft promises that:

  1. IE9 will offer consumers a new opt-in mechanism (“Tracking Protection”) to identify and block many forms of undesired tracking.
  2. “Tracking Protection Lists” will enable consumers to control what third-party site content can track them when they’re online.

Together with the FTC's jump into the tracking fray last week, have we reached the tipping point on tracking, so that this is the beginning of the end of it?  Or might this be simply another skirmish in the battle between Microsoft and Google (since Google's primary revenue source is online ads)?

Tags: , , , , , ,

Advocacy Groups File FTC Complaint Over Online Consumer Health Sites and Health-Related Marketing

Posted on November 30, 2010 by Colin J. Zick

In a complaint filed with the FTC on November 23, four advocacy groups asked for "Investigation, Public Disclosure, Injunction, and Other Relief" against several online health giants, including Google, Microsoft, QualityHealth, WebMD, Yahoo, AOL, HealthCentral, Healthline, and Everyday Health. 

The advocacy groups behind this complaint are the Center for Digital Democracy, U.S. PIRG, Consumer Watchdog and World Privacy Forum.  They allege (in 144 pages, complete with web page screen-shots) that:

"Digital marketing raises many distinct consumer protection and privacy issues, including an overall lack of transparency, accountability and personal control, which consumers should have over data collection and the various interactive applications used to track, target, and influence them online (including on mobile devices).  The use of these technologies by pharmaceutical, health product, and medical information providers that directly affect the public health and welfare of consumers requires immediate action."

Any business that has a web presence should read this complaint; it will show you what these (and other) advocacy groups are complaining about.  While I do not expect the FTC to jump into action based on this complaint alone, it would not surprise me to see an increase in the discussion of regulation and enforcement in this patch of cyberspace during 2011. It is only a matter of time until a consumer health web site has a significant data breach.  Traditionally, such breaches bring increased inforcement activity.

The complaint also cites a FTC complaint made in June 2009 against Sears Holding Management  concerning that company’s dissemination of "a software application for consumers to download and install onto their computers” that violated the FTC Act.  That FTC complaint alleged that Sears Holding:

"failed to disclose adequately that the software application, when installed, would: monitor nearly all of the Internet behavior that occurs on consumers’ computers, including information exchanged between consumers and websites other than those owned, operated, or affiliated with respondent, information provided in secure sessions when interacting with third-party websites, shopping carts, and online accounts, and headers of web-based email; track certain non-Internet-related activities taking place on those computers; and transmit nearly all of the monitored information (excluding selected categories of filtered information) to respondent’s remote computer servers. These facts would be material to consumers in deciding to install the software. Respondent’s failure to disclose these facts, in light of the representations made, was, and is, a deceptive practice."
Tags: , , , , , , , , , , , , , , , , , , , ,

Nearly 250,000 Opt Out of Google's Street View in Germany

Posted on October 29, 2010 by Colin J. Zick

According to a recent entry on Google's own European public policy blog, only  a small minority of German's have opted-out of its Street View service:  "Out of a total of 8,458,084 households, we received 244,237 opt-outs, which equals 2.89% of households. Two out of three opt-ots [sic] came through our online tool."

If you are interesting in learning more about Street View, or opting out, the instructions are here.

 


 
Tags: , , , ,

New Google Tool Maps Goverment Requests For Users' Personal Information

Posted on April 23, 2010 by Gabriel M. Helmer

This week Google rolled out its Government Requests tool that quantifies the number of government requests it receives from various countries around the world.  The move was announced by David Drummond, Google's Chief Legal Officer on Tuesday on the official Google blog.  In his post, Drummond stated:

So it's no surprise that Google, like other technology and telecommunications companies, regularly receives demands from government agencies to remove content from our services. Of course many of these requests are entirely legitimate, such as requests for the removal of child pornography. We also regularly receive requests from law enforcement agencies to hand over private user data. Again, the vast majority of these requests are valid and the information needed is for legitimate criminal investigations. However, data about these activities historically has not been broadly available. We believe that greater transparency will lead to less censorship.

The issue has been somewhat controversial in the wake of the expansion of government requests in recent years.  The Google Tool maps the number of data requests and removal requests that Google received between July 1, 2009 and December 31, 2009.  Google indicates that it will be updating this data every six months.

Tags: , , ,

Highlights from the IAPP Privacy Summit - March 11-13, 2009 Washington, D.C.

Posted on March 15, 2009 by Gabriel M. Helmer

Between March 11, 2009 and March 13, 2009, the International Association of Privacy Professionals (IAPP) hosted a Privacy Summit in Washington, D.C. that featured keynote presentations from fraud expert Frank W. Abagnale and information security guru Bruce Schneier. The three-day event included dozens of breakout sessions with industry experts and government officials.  Read some of the highlights below.

  •  Frank W. Abagnale spoke at length about his life, made famous by the Spielberg movie "Catch Me If You Can."  What became clear through his stories was that armed with only an agile mind, Mr. Abagnale was able to compromise a series of security and anti-fraud systems at financial institutions and other businesses.  And today, according to Mr. Abagnale, it is "4000 times easier" because of the leaps made in computer technology.  "Technology breeds crime. It always has. It always will."
  • Bruce Schneier, a luminary in the field of information security, spoke at length about how "data is today's pollution problem" - a problem that requires a new generation of professionals fluent in technology and law to manage a new "data environmentalism." 
  • Peter Cullen, Microsoft's Chief Privacy Strategist and member of the Consumer Privacy Legislative Forum (now called the Business Forum for Consumer Privacy) discussed the CPLF's decision to first generate a set of self-regulatory privacy guidelines before seeking to draft a comprehensive federal privacy standard.  According to Mr. Cullen, businesses "need self-regulation" and to compile what have become best practices before attempting to impose a single federal standard.  "[L]egislation is only part of the puzzle" and "bad legislation [would be] worse than no regulation." 
  • A panel of security experts from (ISC)2, discussed the roles of the Chief Privacy Officer and Chief Information Security Officer during incident management.  The panel also outlined several essential elements of an incident response plan, including: (1) a procedure for ensuring that a breach initiates an incident response team meeting, (2) a procedure to confirm that a breach has occurred, (3) anticipation and preparation of likely scenarios, (4) draft press releases and notifications, and (5) identifying key consultants and vendors used in investigating and resolving incidents.
  • Representatives from Google and Salesforce.com discussed privacy issues raised by cloud computing models that may require different types of end user licenses, policies and agreements.  Key issues include: (1) selecting the cloud model that is appropriate for your needs; (2) data persistence - ensuring that there is an appropriate policy for destruction of data; (3) data centralization and security - the more data served by a single service, the more of a target it will become for those seeking unauthorized access; (4) data use - centralizing data permits the cloud provider with the ability to provide additional services, but what limits should apply to the service provider's use of that data?
  • A legislative update - the consensus is that consumer protection is one of Congress' top priorities and that Congress may be moving towards authorize the FTC to regulate information security more broadly. 
  • Jeffrey M. Kopchick, Senior Policy Analyst for the FDIC, reported that federal agencies involved in the development of federal Red Flags Rules were preparing FAQs regarding compliance with those rules that should be published in the near future.   He also indicated that because banks and other financial institutions have been subject to those rules since November 1, 2008 (unlike many other companies, who will see the rules go into effect on May 1, 2009), a number of common problems have been observed by FDIC examiners: (1) confusion in identifying what accounts give rise to the risk of identity theft; (2) insufficient oversight of third party service providers; and (3) lack of internal training to teach staff how to recognize red flags and mitigate the harm from identity theft.
  • Joel Winston, Associate Director of the FTC's Division of Privacy and Identity Protection, updated members on recent trends in FTC enforcement.  He indicated that the FTC intends to harmonize rulemaking on information security under a single federal standard evident in the recent Red Flags Rules: requiring businesses to adopt "reasonable and appropriate procedures." Given the speed of innovation, the FTC believes that requiring "reasonable" protections is the only manner for regulation to keep pace with technology.  The FTC has considered and rejected suggestions that it impose specific security tools on businesses, as some states (including Massachusetts) have done.  "Technology is too fluid."  For example, "encryption may not always be the perfect solution - there could be good alternatives."  The FTC appears to be unwilling to extend the May 1, 2009 deadline for enforcement of the Red Flags Rules and will be expecting businesses to demonstrate good faith efforts to comply with the regulations.

Links:
Tags: , , , , , , , , , , , , , ,