Gmail Privacy: The hot topic of the week (well, it was…)
The most reported on privacy story of the week—prior to Thursday night’s NSA revelation—has been the (mis)representation of Google’s argument in a class-action complaint over the privacy of Gmail correspondences.

Here’s what the IAPP wrote on Tuesday in the Daily Dashboard, stemming from a Consumer Watchdog report: “Meanwhile, Google has responded to a class-action complaint over Gmail privacy saying, ‘a person has no legitimate expectation of privacy’ when sending messages to a Gmail account.”

What we failed to acknowledge—as did many others—was that this quote is, in fact, from Smith v. Maryland, which established what's known as the “third-party doctrine,” which Google cites in its argument.

What Google actually argues is that it is covered under the third-party doctrine. Google states, the plaintiffs “impliedly consent to Google’s practices by virtue of the fact that all users of e-mail must necessarily expect that their e-mails will be subject to automated processing,” pointing to the Smith decision, which noted “that persons communicating through a service provided by an intermediary...must necessarily expect that the communication will be subject to the intermediary’s systems.” That’s Google summarizing the third-party doctrine, by the way, not quoting.

Lauren McCauley writes for MintPress News that some say this shouldn’t be a big surprise. “Third-party precedent has long been cited by government officials as support for the constitutionality of Section 215 of the Patriot Act,” McCauley writes.

In the new privacy-charged atmosphere, it would be prudent for privacy pros to keep tabs on the Gmail class-action case and potential reexamining of the USA PATRIOT Act, as these might be an opportunity for the courts to reexamine the third-party doctrine, which was the result of a case decided by the Supreme Court in 1979, before the wide use of the Internet and e-mail. 

Will HHS Enforce Actions Against Offshore Vendors?
With a nearing enforcement date for the final HIPAA Omnibus Rule, Healthcare Info Security reports on whether U.S. regulators will enforce actions against foreign business associates (BAs) and subcontractors. “It’s a mess,” said Wiley Rein Partner Kirk Nahra, CIPP/US. “There’s a lot of uncertainty.” If there is a breach with a foreign vendor, the ability for the Department of Health and Human Services (HHS) to take action is unclear. Though a BA would be subject to a breach of contract agreement with a covered entity, Davis Wright Tremaine Partner Adam Greene noted, "it is untested…whether HHS has jurisdiction to bring an (enforcement) action,” adding, “HIPAA, unlike certain other federal statutes, does not have explicit extra-territorial reach.” Additionally, Becker’s ASC Review has posted 15 things to know before the final rule’s deadline. Editor’s Note: For more on complying with the final HIPAA Omnibus Rule, see Close-Up: HIPAA.
Full Story

Are Class-Actions Failing To Serve the Class?
The New York Times reports on class-action settlements that strip plaintiffs of any benefit. The article highlights a past settlement attorney Scott Kamber reached with Facebook, resulting in the company paying roughly $6.5 million to a new foundation that it would partly control, with the millions of plaintiffs in the class—who’d sued for a privacy violation—receiving nothing. According to the report, the Supreme Court could soon decide to hear the case, noting that “justices have been quite active in restricting other aspects of class-actions, and they may decide it is time to consider settlements that critics say leave plaintiffs worse off than when they started.” (Registration may be required to access this story.)
Full Story


Working Party Weighs In on Purpose Limitation and Big Data
The concept of purpose limitation is a cornerstone of the protection of personal data. It is an essential first step in applying data protection laws since it constitutes a prerequisite for other data quality requirements, contributes to transparency and legal certainty and sets limits on how controllers are able to use personal data. In this exclusive for The Privacy Advisor, Stefano Tagliabue, CIPP/E, discusses the Article 29 Working Party’s opinion on purpose limitation and Big Data.
Full Story

French Court Finds for Employer in E-mail Case
In a post for Field Fisher Waterhouse’s Privacy and Information Law Blog, Olivier Proust writes about the French Court of Cassation’s ruling in favour of a company that dismissed an employee “based on e-mail exchanges between him and a competitor that were found on his computer’s hard drive and used against him as evidence in court.” Proust writes that the employee argued “this evidence was inadmissible because it was unlawfully obtained by the company in violation of his right to privacy,” but the court holds that unless they are marked as private, “documents and files created by an employee on a company computer for work purposes are presumed to be professional, which means that the company can access those documents and files without the employee’s presence.”
Full Story

UK FOI Reforms In Effect September 1
As of September 1, amendments to the Freedom of Information Act go into effect, meaning public bodies in the UK will be required to disclose datasets "in an electronic form which is capable of re-use" when requested, subject to it being "reasonably practicable" to do so, reports Out-Law.com. The ICO has issued guidance on the law and advised authorities to consult its code of practice on anonymising personal data before responding to FOI requests.

UK ICO Publishes Regulatory Action Policy
The UK Information Commissioner’s Office (ICO) has published a Data Protection Regulatory Action Policy, outlining what the office will consider when deciding whether to initiate regulatory action, reports Out-Law.com. Noting that “market factors” may influence the decision, the policy points to some “initial drivers,” including issues of “general public concern,” those due to the “novel or intrusive nature of particular activities” and those stemming from complaints. When asked for clarity on “market factors,” an ICO spokesman said in markets where "consumers demand effective privacy protection…market forces will be driving businesses to deliver better privacy protection, without the need for the regulator to intervene."
Full Story

UK Court Ruling on SARs Makes the Case for Good Destruction Practices
A legal expert has said that a recent court ruling on subject access requests (SARs) bolsters the need for strong data destruction practices, Out-Law.com reports. Noting that data retention checks can be viewed as a regulatory burden, technology law expert Luke Scanlon said good destruction practices can both comply with data protection laws but also remove the burden of responding to SARs from individuals or organizations requesting data. A High Court judge said companies must respond to SARs but added there is no duty “to retain data so that it can remain available to be mined by former customers or claims companies with a view to making claims against third parties.”
Full Story

Written By

Emily Leach, CIPP/US


If you want to comment on this post, you need to login.


Board of Directors

See the esteemed group of leaders shaping the future of the IAPP.

Contact Us

Need someone to talk to? We’re here for you.

IAPP Staff

Looking for someone specific? Visit the staff directory.

Learn more about the IAPP»

Daily Dashboard

The day’s top stories from around the world

Privacy Perspectives

Where the real conversations in privacy happen

The Privacy Advisor

Original reporting and feature articles on the latest privacy developments

Privacy Tracker

Alerts and legal analysis of legislative trends

Privacy Tech

Exploring the technology of privacy

Canada Dashboard Digest

A roundup of the top Canadian privacy news

Europe Data Protection Digest

A roundup of the top European data protection news

Asia-Pacific Dashboard Digest

A roundup of the top privacy news from the Asia-Pacific region

IAPP Westin Research Center

Original works. Groundbreaking research. Emerging scholars.

Advertise in IAPP Publications

Find out how to get your message in front the people you want to reach. Download a media kit now.

Get more News »

Find a KnowledgeNet Chapter Near You

Network and talk privacy at IAPP KnowledgeNet meetings, taking place worldwide.

Women Leading Privacy

Events, volunteer opportunities and more designed to help you give and get career support and expand your network.

IAPP Job Board

Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.

Join the Privacy List

Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.

Find more ways to Connect »

Find a Privacy Training Class

Two-day privacy training classes are held around the world. See the complete schedule now.

Online Privacy Training

Build your knowledge. The privacy know-how you need is just a click away.

The Training Post—Can’t-Miss Training Updates

Subscribe now to get the latest alerts on training opportunities around the world.

New Web Conferences Added!

See our list of upcoming web conferences. Just log on, listen in and learn!

Train Your Staff

Get your team up to speed on privacy by bringing IAPP training to your organization.

Learn more »

CIPP Certification

The global standard for the go-to person for privacy laws, regulations and frameworks

CIPM Certification

The first and only privacy certification for professionals who manage day-to-day operations

CIPT Certification

The industry benchmark for IT professionals worldwide to validate their knowledge of privacy requirements

Certify Your Staff

Find out how you can bring the world’s only globally recognized privacy certification to a group in your organization.

Learn more about IAPP certification »

Get Close-up

Looking for tools and info on a hot topic? Our close-up pages organize it for you in one easy-to-find place.

Where's Your DPA?

Our interactive DPA locator helps you find data protection authorities and summary of law by country.

IAPP Westin Research Center

See the latest original research from the IAPP Westin fellows.

Looking for Certification Study Resources?

Find out what you need to prepare for your exams

More Resources »

GDPR Comprehensive: Registration Open

New! Intensive two-day GDPR training led by the sharpest minds in the field. It's a can't-miss event.

The Congress Is Cancelled

The IAPP Europe Data Protection Congress 2015 is cancelled. Click through to learn more.

Sponsor an Event

Increase visibility for your organization—check out sponsorship opportunities today.

Exhibit at an Event

Put your brand in front of the largest gatherings of privacy pros in the world. Learn more.

More Conferences »

Become a Member

Start taking advantage of the many IAPP member benefits today

Corporate Members

See our list of high-profile corporate members—and find out why you should become one, too

Renew Your Membership

Don’t miss out for a minute—continue accessing your benefits

Join the IAPP»