U.S.

Gmail Privacy: The hot topic of the week (well, it was…)
The most reported on privacy story of the week—prior to Thursday night’s NSA revelation—has been the (mis)representation of Google’s argument in a class-action complaint over the privacy of Gmail correspondences.

Here’s what the IAPP wrote on Tuesday in the Daily Dashboard, stemming from a Consumer Watchdog report: “Meanwhile, Google has responded to a class-action complaint over Gmail privacy saying, ‘a person has no legitimate expectation of privacy’ when sending messages to a Gmail account.”

What we failed to acknowledge—as did many others—was that this quote is, in fact, from Smith v. Maryland, which established what's known as the “third-party doctrine,” which Google cites in its argument.

What Google actually argues is that it is covered under the third-party doctrine. Google states, the plaintiffs “impliedly consent to Google’s practices by virtue of the fact that all users of e-mail must necessarily expect that their e-mails will be subject to automated processing,” pointing to the Smith decision, which noted “that persons communicating through a service provided by an intermediary...must necessarily expect that the communication will be subject to the intermediary’s systems.” That’s Google summarizing the third-party doctrine, by the way, not quoting.

Lauren McCauley writes for MintPress News that some say this shouldn’t be a big surprise. “Third-party precedent has long been cited by government officials as support for the constitutionality of Section 215 of the Patriot Act,” McCauley writes.

In the new privacy-charged atmosphere, it would be prudent for privacy pros to keep tabs on the Gmail class-action case and potential reexamining of the USA PATRIOT Act, as these might be an opportunity for the courts to reexamine the third-party doctrine, which was the result of a case decided by the Supreme Court in 1979, before the wide use of the Internet and e-mail. 

Will HHS Enforce Actions Against Offshore Vendors?
With a nearing enforcement date for the final HIPAA Omnibus Rule, Healthcare Info Security reports on whether U.S. regulators will enforce actions against foreign business associates (BAs) and subcontractors. “It’s a mess,” said Wiley Rein Partner Kirk Nahra, CIPP/US. “There’s a lot of uncertainty.” If there is a breach with a foreign vendor, the ability for the Department of Health and Human Services (HHS) to take action is unclear. Though a BA would be subject to a breach of contract agreement with a covered entity, Davis Wright Tremaine Partner Adam Greene noted, "it is untested…whether HHS has jurisdiction to bring an (enforcement) action,” adding, “HIPAA, unlike certain other federal statutes, does not have explicit extra-territorial reach.” Additionally, Becker’s ASC Review has posted 15 things to know before the final rule’s deadline. Editor’s Note: For more on complying with the final HIPAA Omnibus Rule, see Close-Up: HIPAA.
Full Story

Are Class-Actions Failing To Serve the Class?
The New York Times reports on class-action settlements that strip plaintiffs of any benefit. The article highlights a past settlement attorney Scott Kamber reached with Facebook, resulting in the company paying roughly $6.5 million to a new foundation that it would partly control, with the millions of plaintiffs in the class—who’d sued for a privacy violation—receiving nothing. According to the report, the Supreme Court could soon decide to hear the case, noting that “justices have been quite active in restricting other aspects of class-actions, and they may decide it is time to consider settlements that critics say leave plaintiffs worse off than when they started.” (Registration may be required to access this story.)
Full Story

EU

Working Party Weighs In on Purpose Limitation and Big Data
The concept of purpose limitation is a cornerstone of the protection of personal data. It is an essential first step in applying data protection laws since it constitutes a prerequisite for other data quality requirements, contributes to transparency and legal certainty and sets limits on how controllers are able to use personal data. In this exclusive for The Privacy Advisor, Stefano Tagliabue, CIPP/E, discusses the Article 29 Working Party’s opinion on purpose limitation and Big Data.
Full Story

French Court Finds for Employer in E-mail Case
In a post for Field Fisher Waterhouse’s Privacy and Information Law Blog, Olivier Proust writes about the French Court of Cassation’s ruling in favour of a company that dismissed an employee “based on e-mail exchanges between him and a competitor that were found on his computer’s hard drive and used against him as evidence in court.” Proust writes that the employee argued “this evidence was inadmissible because it was unlawfully obtained by the company in violation of his right to privacy,” but the court holds that unless they are marked as private, “documents and files created by an employee on a company computer for work purposes are presumed to be professional, which means that the company can access those documents and files without the employee’s presence.”
Full Story

UK FOI Reforms In Effect September 1
As of September 1, amendments to the Freedom of Information Act go into effect, meaning public bodies in the UK will be required to disclose datasets "in an electronic form which is capable of re-use" when requested, subject to it being "reasonably practicable" to do so, reports Out-Law.com. The ICO has issued guidance on the law and advised authorities to consult its code of practice on anonymising personal data before responding to FOI requests.

UK ICO Publishes Regulatory Action Policy
The UK Information Commissioner’s Office (ICO) has published a Data Protection Regulatory Action Policy, outlining what the office will consider when deciding whether to initiate regulatory action, reports Out-Law.com. Noting that “market factors” may influence the decision, the policy points to some “initial drivers,” including issues of “general public concern,” those due to the “novel or intrusive nature of particular activities” and those stemming from complaints. When asked for clarity on “market factors,” an ICO spokesman said in markets where "consumers demand effective privacy protection…market forces will be driving businesses to deliver better privacy protection, without the need for the regulator to intervene."
Full Story

UK Court Ruling on SARs Makes the Case for Good Destruction Practices
A legal expert has said that a recent court ruling on subject access requests (SARs) bolsters the need for strong data destruction practices, Out-Law.com reports. Noting that data retention checks can be viewed as a regulatory burden, technology law expert Luke Scanlon said good destruction practices can both comply with data protection laws but also remove the burden of responding to SARs from individuals or organizations requesting data. A High Court judge said companies must respond to SARs but added there is no duty “to retain data so that it can remain available to be mined by former customers or claims companies with a view to making claims against third parties.”
Full Story