Supreme Court drops hints about upcoming privacy decision in Carpenter

By Todd Kim and Kelley Chittenden on 25 May 2018 Posted in In the Courts, Privacy & Data Protection

As previously reported, the Supreme Court on November 29 heard arguments in Carpenter v. United States, an important privacy case about the Fourth Amendment’s application to 127 days’ worth of a criminal suspect’s cell-site location information. While the Court has yet to decide the case, its decisions last week in Byrd v. United States and earlier this Term in District of Columbia v. Wesby (argued by one of this post’s authors) hint of trouble ahead for the government.

Byrd and Wesby: A practical rather than technical reading of the Fourth Amendment

While the facts were quite different in Byrd and Wesby, the decisions share a common theme. In both, the Supreme Court rejected analytical shortcuts that did not reflect the real world.

Byrd involved a police search of a rental car trunk yielding contraband, including forty-nine bricks of heroin. The lower courts accepted the government’s argument that the driver could not object to the search under the Fourth Amendment because “drivers who are not listed on rental agreements always lack an expectation of privacy in the automobile based on the rental company’s lack of authorization alone.” The Supreme Court decisively rejected this “per se rule.” It noted how there are “countless innocuous reasons why an unauthorized driver might get behind the wheel of a rental car and drive it” and how “car-rental agreements are filled with long lists of restrictions.” A breach of an agreement would not automatically mean the driver lacked even the reasonable expectation of privacy necessary to claim Fourth Amendment protection. (The same might be argued of email providers’ fine-print-laden Terms of Service, as the Electronic Frontier Foundation and Orin Kerr have noted.) But the Court also rejected the competing argument that the sole occupant of a rental car “always” has an expectation of privacy, and so it remanded for a ruling based on the precise facts rather than categorical rules. Continue Reading

Network and Information Systems Regulations 2018 come into force in the UK and government cybersecurity survey is published

By Cynthia O’Donoghue and Karen Lee Lust on 24 May 2018 Posted in Privacy & Data Protection, Regulatory

On 10 May 2018, the Network and Information Systems Regulations 2018 (NISR) came into force in the UK. NISR stems from the Network Information Systems Directive 2016 of the EU, which has been covered by this blog previously. Relatedly, on 25 April 2018, the UK government’s Department for Digital, Culture, Media and Sport (DCMS) published the Cyber Security Breaches Survey 2018. This survey details business and charity action on cybersecurity and the impact of cyberattacks.

Summary of NISR

These regulations outline measures to protect critical IT systems in economic sectors like energy, banking, transport and health. NISR applies to “operators of essential services” (OESs) and “digital service providers” (DSPs). It focuses on network and systems security and interruption to services.

The UK government has the power to designate which organisations are OEPs, and therefore within scope of the new laws – providing certain criteria is met. DSPs are directly subject to the new regulations, although micro and small businesses are exempt. OESs and DSPs are required to keep their networks and information secure, and to notify competent authorities of security incidents. Competent authorities vary by sector and include the Information Commissioner’s Office, Ofcom and various regulatory bodies.

NISR contains a tiered system of fines for breaches, dependent on the severity of their consequences:

Up to £3.4 million where a security incident has or could cause a reduction in the provision of services for a significant period of time
Up to £8.5 million where services have or could be disrupted for significant period of time
Up to £17 million for serious cases where a security incident has or could cause “an immediate threat to life or significant adverse impact on the United Kingdom economy.

Comment

NISR appears to have been overshadowed by the General Data Protection Regulation, which comes into force on 25 May 2018. However, NISR should be closely examined by any potential OES or DSP, especially given the notification obligations and potentially large fines. The DCMS provided important clarity that operators who assess risks adequately, take appropriate security measures and engage with regulations can avoid fines, which should only be used as a last resort.

Cyber Security Breaches Survey 2018

The messaging around the survey is that UK businesses need to do more to protect themselves against cybercrime. The statistics in the survey show that 43 per cent of business and 19 per cent of charities suffered a cyber breach or attack in the past 12 months. For large businesses, the figure rises to 72 per cent.

Common breaches involve fraudulent emails, scammers impersonating the organisation, viruses, ransomware and malware. The impact of breaches and attack can range from temporary or permanent file loss, to reduced website functionality, to theft of money, assets and intellectual property. The survey urges businesses to consider their “organisational cultures”, seek guidance, engage in staff training and deploy cybersecurity policies, and undertake audits and monitoring regarding the efficacy of such policies.

The survey forms part of the UK’s broader National Cyber Security Programme, linking in with the introduction of NISR, the GDPR coming into force on 25 May 2018 and continued government investment in this area.

Trade secret litigation – is Germany next?

By Anette Gaertner on 14 May 2018 Posted in Privacy & Data Protection, Regulatory

In anticipation of the implementation of the Trade Secrets Directive, the topic of know-how protection has been widely discussed. Dr Anette Gärtner, along with Sabrina Gossler, has written an article which explores the current legal situation in Germany, analyses the relevant provisions of the Directive and explains the immediate next steps for companies operating in Germany. Key messages to take from the article include the need for companies to take objective measures to safeguard confidentiality and the introduction of the Confidentiality Club, which will lead to an increase in German trade secret litigation. Please refer to the full article by Dr Anette Gärtner and Sabrina Gossler in the May issue of Mitteilungen der dt. Patentanwälte for further commentary.

D.C. federal court rules that web scraping does not violate the CFAA and may be protected by the First Amendment

By Mark H. Francis on 2 May 2018 Posted in Big Data, In the Courts

On March 30, 2018, a D.C. federal district court denied a motion to dismiss an ACLU case filed against the government to challenge the constitutionality of the Computer Fraud and Abuse Act (CFAA), which makes it a federal crime to access a computer in a manner that “exceeds authorized access.” Sandvig v. Sessions, No. 1:16-cv-01368, Dkt. 24 (D.D.C. Mar. 30, 2018). The court held that the plaintiffs could proceed with their claim that the Free Speech and Free Press Clauses of the First Amendment, as applied, bar prosecution under the CFAA because it would restrict the plaintiffs’ ability to report on publicly available information, and even information available only following user registration on a site is generally available to the public.

The particular facts of the Sandvig case are unsurprisingly aimed at highlighting a potentially extreme application of the CFAA. The named plaintiffs are four professors and a media organization investigating whether automated decision-making and ad targeting technologies employed by various websites would result in potentially discriminatory practices against protected classes. For example, they want to analyze whether a real estate or employment website would discriminate against a user based on race. To perform the necessary analysis, they intend to use web scraping, bots, fake accounts (“sock puppets”) and other data collection techniques to conduct outcomes-based audit testing of websites and uncover such practices. These activities are typically prohibited by websites’ terms of service (TOS) and therefore unauthorized activity.

Brexit sectoral analysis – ICT report

By Cynthia O’Donoghue and John O'Brien on 30 April 2018 Posted in Privacy & Data Protection, Regulatory

In November 2017, the House of Commons Committee on Exiting the European Union (the Committee) published impact assessment reports of Brexit on various UK business sectors. The Report on the Technology (ICT) Sector (the Report) is a mix of qualitative and quantitative analysis. For each business sector, the Report includes: (i) a description of the sector; (ii) the current EU regulatory regime in which the sector operates; and (iii) an explanation of the frameworks governing how trade is facilitated between countries in the sector. Information provided by the government to the Committee about specific sector views has been withheld by the Committee.

Sector overview

The UK digital sector is vast. It covers digital goods, digital services and digitally enabled transactions of goods and services. It includes the following services and products: (i) audio-visual; (ii) e-commerce; (iii) telecommunications; (iv) data; (v) emerging industries, such as artificial intelligence; (vi) FinTech (dealt with in a separate report); (vii) the Internet of Things; and (viii) cybersecurity. Though London is a prominent hub, digital companies are spread across the UK. Several other cities have highly ranked digital clusters.

The Report highlights:

the extent of the UK’s investment in the digital sector;
how tech companies are investing in the UK since the Brexit referendum; and
information about the value added by the ICT industry, including its contribution to national economy statistics, employment, national balance of trade and international trade.

Being first isn’t always best: SEC settles for $35 million fine for failure to disclose data breach to investors

By Mark S. Melodia, Gerard Stegmaier, Paul Bond, Kimberly Chow and Jim Barbuto on 30 April 2018 Posted in Data & Cyber Security

Company response to major data breach results in first-of-its-kind fine for improper disclosure to investors

On April 24, 2018, U.S. Securities and Exchange Commission (SEC) and Altaba Inc., (formerly known as Yahoo! Inc.) agreed to settle SEC Division of Enforcement charges stemming from the compromise of 3 billion Yahoo accounts that occurred in 2013 and 2014, but were not disclosed until 2016.^[1] The 2014 incident was attributed to Russian hackers by the U.S. government in March 2017.^[2]

The SEC’s administrative proceeding order pointed to Altaba’s delayed disclosure of the 2013–2014 security incident as well as the company’s public filing of multiple reports with the SEC, which commented on the risks and consequences of a breach in general, but did not notify investors that such a threat had already been realized in 2013 and 2014.^[3] Unlike previous high-profile fines for improper incident response arising from failures to disclose to affected customers or subjects of breached data, the $35 million fine levied against Altaba is the first of its kind to focus on disclosure to investors of a public company that has suffered a breach, and should encourage companies to direct commensurate focus to their data breach response plans to meet responsibilities to shareholders.