Workplace Privacy, Data Management & Security Report : Privacy Lawyers & Attorneys : Jackson Lewis Law Firm : Data Security, HIPAA & Confidentiality Issues

Together with some other U.S. Senators who have offered data security laws in recent years, Senate Majority Leader Harry Reid introduced S.21 on January 25. The bill, a "sense of Congress" bill, urges the passage of a comprehensive law to address cybersecurity, without making any changes to current law.

This bill is important in that it acknowledges the critical role information technology plays in the U.S. economy:

With information technology now the backbone of the United States economy, a critical element of United States national security infrastructure and defense systems, the primary foundation of global communications, and a key enabler of most critical infrastructure, nearly every single American citizen is touched by cyberspace and is threatened by cyber attacks.

Congress "has the sense" that a future law should serve at least 10 critical goals, such as:

• provide incentives to the private sector to quantify, assess, and mitigate cybersecurity risks to their communications and information networks;
• promoting investments in the American information technology sector to create jobs;
• preventing and mitigating identity theft and guarding against abuses or breaches of personally identifiable information;
• protect federal government communications from cyber attack; 
• maintaining robust protections of the privacy of American citizens and their online activities and communications;
• protecting and increasing the resiliency of U.S. critical infrastructure and assets, such as the electric grid, military assets, financial sector and telecommunications networks; and
• enhancing international cooperation on cybersecurity to promote free access and fight cybercrime.

Will a new law follow?

Maybe. It will take some time as Committees and federal agencies jockey for position, although it seems this "sense of Congress" will advance the ball further than it has been.

The advice to companies, business leaders, professionals and others, however, is "Don't wait!" Many states already have data security laws in effect and, even without those laws, all businesses have sensitive company proprietary to safeguard. 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

Employers need to exercise care when accessing employees’ e-mails, particularly e-mails on personal e-mail accounts. In Pure Power Boot Camp Inc. v. Warrior Fitness Boot Camp LLC, a non-compete case that turned into a case about the privacy of stored e-mails and violations of the federal Stored Communications Act (SCA), the court held:

1. SCA statutory damages can be recovered by plaintiffs, even if they suffered no actual damages, and
2. the calculation of statutory damages ($1,000 per violation), generally is based on the number of times the “electronic communications facility” (or personal e-mail account, e.g., Hotmail) is accessed, not the number of emails accessed.

The dispute arose when two employees of a fitness facility, Pure Power Boot Camp Inc., left to start their own fitness facility, Warrior Fitness Boot Camp LLC. A non-compete action followed because Pure Power learned through 546 mails it had accessed over a nine-day period that its former employees had taken customer lists, training and instruction materials, and solicited Pure Power customers. The e-mails were from four personal accounts belonging to the former employees’  – Hotmail, Gmail, Warrior Fitness, and an unrelated corporate account. Pure Power was able to access these accounts because the former employees stored their usernames and passwords on its computers; when Pure Power accessed the particular site, the username and password automatically populated.

The former employees learned of Pure Power’s accessing their personal e-mail accounts and filed counterclaims, including allegations of violations of the Stored Communications Act.

The court ruled in the non-compete action that accessing the former employees’ four accounts violated the SCA. Two of the issues before Judge Theodore H. Katz were whether statutory damages could be recovered in the absence of actual damages and, if so, how to calculate those damages. The SCA provides that “in no case shall a person entitled to recover receive less than the sum of $1,000,” but there is little guidance as to whether this minimum should be awarded for each violation, or what constitutes distinct and independent violations as opposed to a single continuous violation.

SCA Statutory Damages Without Actual Damages. Judge Katz disagreed with a ruling by the Fourth Circuit of the U.S. Court of Appeal, Van Alstyne v. Elec. Scriptorium, Ltd. 560 F.3d 199 (4th Cir. 2009), which held that statutory damages under the SCA can be recovered only where the plaintiff also has suffered actual damages.

Van Alstyne based its holding (i) on a decision by the U.S. Supreme Court in Doe v. Chao, 540 U.S. 614 (2004), which reached a similar conclusion for statutory damages under the Privacy Act of 1974, and (2) on the fact that the language concerning damages in these two statutes (SCA and Privacy Act) were nearly identical.

However, Judge Katz cited a number of other federal court decisions holding that while the language in the two statutes are similar, they are different statutes with different purposes and penalize different behaviors. Rejecting the Doe analysis, he concluded statutory damages were recoverable for SCA violations in the absence of actual damages.

Calculating Statutory Damages. Judge Katz said the SCA punishes anyone who “intentionally accesses without authorization a facility through which an electronic communication service is provided . . . and thereby obtains . . . access to a wire or electronic communication while it is in electronic storage.” 18 U.S.C. Section 2701(a). Based on this language, he rejected the two former employees’ argument that the number of violations should be measured by the number of e-mails accessed, 546, adopting Pure Power’s argument, instead. Accordingly, when an account is accessed multiple times over a short period of time, it should constitute only a single violation of the SCA. Noting the SCA targets the unauthorized access of an electronic communication facility (not the e-mails themselves), and because there was nothing to indicate the number of times each of the four accounts were accessed over the short nine-day period, the court found four violations.
 

• Email This
• Print
• Comments
• Trackbacks
• Share Link

With some harsh words of warning, a judge in the U.S. District Court for the District of Minnesota has sanctioned another law firm for electronic filing of documents disclosing birth dates, names of minors, financial account numbers and at least one social security number in violation of Fed. R. Civ. P. 5.2(a).

In a decision issued on November 24, 2010 in the case of Allstate Insurance Company v. Linea Latina de Accidentes, Judge Joan N. Erickson noted that,

"Every federal district has now embraced electronic filing.  The days of attorneys being able to ignore the computer and shift blame to support staff in the event of an error are gone.  The consequences are simply too serious. To the extent there are attorneys practicing in federal court who are under the impression that someone in the Clerk's office will comb their filings for errors and call them with a heads-up, the court delivers this message: its is the responsibility of counsel to ensure that personal identifiers are properly redacted."

In this case, upon being notified of the problem, plaintiff's counsel initially moved to have the complaint and its attachments filed under seal.  The court responded by stating that there was no reason to seal the complaint if had been properly redacted, and then noted that plaintiff's motion showed no sense of urgency to remedy the fact the information was on the Internet, perhaps permanently.  Counsel then attempted to redact the information using Adobe Acrobat's rectangle tool, which the court found insufficient as the black rectangles could be removed with a few keystrokes. The court ultimately ordered the plaintiff's counsel to remedy the problem, notify each individual affected, provide credit monitoring,and to pay $300 to a charity.

 We previously warned you about similar sanctions in the case of Engeseth v. County of Isanti. Caveat jurisconsultor (lawyer beware)!

• Email This
• Print
• Comments
• Trackbacks
• Share Link