Legal Aid Society of San Mateo CA Suffers Data Breach Including Health Info

On October 10, 2013, the Legal Aid Society of San Mateo County, California sent out a letter notifying potential victims of a data breach suffered by the Society. As the letter states,

On the night of August 12, 2013, our office was burglarized and ten of our laptops were stolen. The stolen laptops were used by our attorneys to assist individuals in getting services. We believe that your personal information may have been stored on the stolen laptops. The personal information believed to be stored on the stolen laptops includes your name, Social Security number, date of birth, medical and health information.

What makes this data breach particularly noteworthy is that, although it occurred at a legal aid organization, the information stolen reportedly included health information. The notice does not discuss how and why health information might have been collected and stored by LASSMC; it may relate to the Society's health advocacy services.

Beyond the immediate impact on the LASSMC clients and others whose stolen personal information may be misused, this incident serves as a reminder that even non-medical professionals may hold, and must keep safe, health information. Even where the formal privacy and security requirements of HIPAA may not directly apply, organizations may still need to comply with HIPAA's Business Associates rules as well as general consumer protection obligations. Attorneys in particular should be aware not only of these requirements, but of their ethical obligations to keep client information confidential, which may further be relevant in a data breach situation.

The California Attorney General's list of reported data breaches may be found here; the LACSSMC letter and information is at this link.

Mobile App Privacy: A Slowly Expanding Area

The area of consumer privacy is a broad area that has been discussed, analyzed and given guidance by both the Federal Trade Commission and the White House. Mobile application privacy, an important subset of consumer privacy, is an area of privacy that has been receiving significant attention over the past year as the importance of the mobile platform increases.

The push for protection in mobile app privacy most clearly began with a Joint Statement of Principles laid out by the California Attorney General, created in February 2012. The California Joint Principles represent an agreement by several top companies in the mobile industry. The agreement, which includes Apple, Google, Research In Motion, HP, and Microsoft (in addition to Facebook, which signed on in June), states what these companies promise to do in their mobile app store. The agreement reached by the major mobile companies provides that the California Online Privacy Protection Act is applicable to any application that collects personal data from a consumer. Such an app requires a “conspicuously posted” privacy policy. The agreement provides that when an app is submitted to a mobile app store by the developer there should be a hyperlink to the privacy policy or the actual privacy policy for that particular app. The privacy policy, whether a hyperlink or the full text, should be available in the mobile app store prior to download of the app. The major mobile companies must also provide a method for users to report apps that do not have such a policy or whose policy does not comply with applicable law.

In addition to the Joint Principles, the FTC has released a new Report on marketing mobile applications, in September of 2012, that contains suggestions on how to limit privacy concerns in a mobile app.  The FTC suggests that mobile app creators:

Build privacy considerations in from the start.  The FTC calls this “privacy by design.”… Incorporating privacy protections into your practices, limiting the information you collect, securely storing what you hold on to, and safely disposing of what you no longer need.  Apply these principles in selecting the default settings for your app and make the default settings consistent with what people would expect based on the kind of app you’re selling.  For any collection or sharing of information that’s not apparent, get users’ express agreement.  That way your customers aren’t unwittingly disclosing information they didn’t mean to share.
Be transparent about your data practices….Offer choices that are easy to find and easy to use…Honor your privacy promises…The FTC has taken action against dozens of companies that claimed to safeguard the privacy or security of users’ information, but didn’t live up to their promises in the day-to-day operation of their business.  The FTC also has taken action against businesses that made broad statements about their privacy practices, but then failed to disclose the extent to which they collected or shared information with others – like advertisers or other app developers…Protect kids’ privacy…
Collect sensitive information only with consent.  Even when you’re not dealing with kids’ information, it’s important to get users’ affirmative OK before you collect any sensitive data from them, like medical, financial, or precise geolocation information.  It’s a mistake to assume they won’t mind.

Keep user data secure...The wisest policy is to:

•  collect only the data you need;
• secure the data you keep by taking reasonable precautions against well-known security risks;
• limit access to a need-to-know basis; and
• safely dispose of data you no longer need.

As mobile app privacy is a new and growing area, the actual implications on businesses are not yet clear. The California Joint Statements only require that those mobile app store providers will provide a location for the individual app’s privacy policy. This only implicitly requires that mobile app creators should have a privacy policy. The FTC guidelines are less stringent. As stated in its report on consumer privacy, the FTC does not believe that they have the powers, at this time, to broadly regulate the area of privacy. However, the FTC suggestions show what the the Commission might enforce if given the power to do so by Congress.

(Written by Brett Alazraki, Fall 2012 IBLT Entrepreneurship Assistance Fellow)

Recent Trend: States Protect Individuals from Employers' and Universities' Logging into Their Social Media Accounts

California recently passed a law that protects individuals from having to give potential employers their login credentials for various social media accounts. The law also prohibits universities from demanding the information from prospective students. The California law is a recent example of numerous states’ laws designed to protect employees/potential employees and students/prospective students.

The text of the employer law itself gives an incredibly broad definition of social media:

As used in this chapter, ‘social media’ means an electronic service or account, or electronic content, including, but not limited to, videos, still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or Internet Web site profiles or locations.

The student protection bill has a slightly different definition of social media:

As used in this chapter, ‘social media’ means an electronic medium where users may create, share, and view user-generated content, including uploading or downloading videos or still photographs, blogs, video blogs, podcasts, instant messages, or Internet Web site profiles or locations.

 While the two definitions are different, they seemingly cover the same types of social media and should be broad enough to cover all forms of social media existing or possibly created in the future.

Maryland was the first state to enact a law of this type, in May of 2012, and the provisions have gone into effect as of October 1, 2012. The law goes about protecting employees by not defining social media, but by protecting employees’ personal accounts.

Several other states have created laws protecting similar employees’ social media accounts, such as Illinois and Delaware. Several other states, including Massachusetts and New York have bills currently in the legislatures or in a committee, waiting to be passed.

The impacts of these new laws on businesses are clear. Businesses can no longer demand that employees hand over username and passwords to personal social media accounts. Therefore, in order to try to find individuals profiles and posts, employers will have to spend significantly more time and resources. The laws also show that states believe that individuals’ social media accounts are something that should be protected from employers and that this is part of a privacy right of citizens.

In addition, to state actions, the National Labor Relations Board has shown that the board is willing to step in and protect employers’ ability to use social media. A September decision by the board struck down a Costco rule that broadly limiting Costco employee use of social media. The board’s decision shows a continued effort by the federal government to protect the right of social media users.

(Written by Brett Alazraki, Fall 2012 IBLT Entrepreneurship Assistance Fellow)