Gmail Privacy: The hot topic of the week (well, it was…)
The most reported on privacy story of the week—prior to Thursday night’s NSA revelation—has been the (mis)representation of Google’s argument in a class-action complaint over the privacy of Gmail correspondences.

Here’s what the IAPP wrote on Tuesday in the Daily Dashboard, stemming from a Consumer Watchdog report: “Meanwhile, Google has responded to a class-action complaint over Gmail privacy saying, ‘a person has no legitimate expectation of privacy’ when sending messages to a Gmail account.”

What we failed to acknowledge—as did many others—was that this quote is, in fact, from Smith v. Maryland, which established what's known as the “third-party doctrine,” which Google cites in its argument.

What Google actually argues is that it is covered under the third-party doctrine. Google states, the plaintiffs “impliedly consent to Google’s practices by virtue of the fact that all users of e-mail must necessarily expect that their e-mails will be subject to automated processing,” pointing to the Smith decision, which noted “that persons communicating through a service provided by an intermediary...must necessarily expect that the communication will be subject to the intermediary’s systems.” That’s Google summarizing the third-party doctrine, by the way, not quoting.

Lauren McCauley writes for MintPress News that some say this shouldn’t be a big surprise. “Third-party precedent has long been cited by government officials as support for the constitutionality of Section 215 of the Patriot Act,” McCauley writes.

In the new privacy-charged atmosphere, it would be prudent for privacy pros to keep tabs on the Gmail class-action case and potential reexamining of the USA PATRIOT Act, as these might be an opportunity for the courts to reexamine the third-party doctrine, which was the result of a case decided by the Supreme Court in 1979, before the wide use of the Internet and e-mail. 

Will HHS Enforce Actions Against Offshore Vendors?
With a nearing enforcement date for the final HIPAA Omnibus Rule, Healthcare Info Security reports on whether U.S. regulators will enforce actions against foreign business associates (BAs) and subcontractors. “It’s a mess,” said Wiley Rein Partner Kirk Nahra, CIPP/US. “There’s a lot of uncertainty.” If there is a breach with a foreign vendor, the ability for the Department of Health and Human Services (HHS) to take action is unclear. Though a BA would be subject to a breach of contract agreement with a covered entity, Davis Wright Tremaine Partner Adam Greene noted, "it is untested…whether HHS has jurisdiction to bring an (enforcement) action,” adding, “HIPAA, unlike certain other federal statutes, does not have explicit extra-territorial reach.” Additionally, Becker’s ASC Review has posted 15 things to know before the final rule’s deadline. Editor’s Note: For more on complying with the final HIPAA Omnibus Rule, see Close-Up: HIPAA.
Full Story

Are Class-Actions Failing To Serve the Class?
The New York Times reports on class-action settlements that strip plaintiffs of any benefit. The article highlights a past settlement attorney Scott Kamber reached with Facebook, resulting in the company paying roughly $6.5 million to a new foundation that it would partly control, with the millions of plaintiffs in the class—who’d sued for a privacy violation—receiving nothing. According to the report, the Supreme Court could soon decide to hear the case, noting that “justices have been quite active in restricting other aspects of class-actions, and they may decide it is time to consider settlements that critics say leave plaintiffs worse off than when they started.” (Registration may be required to access this story.)
Full Story


Working Party Weighs In on Purpose Limitation and Big Data
The concept of purpose limitation is a cornerstone of the protection of personal data. It is an essential first step in applying data protection laws since it constitutes a prerequisite for other data quality requirements, contributes to transparency and legal certainty and sets limits on how controllers are able to use personal data. In this exclusive for The Privacy Advisor, Stefano Tagliabue, CIPP/E, discusses the Article 29 Working Party’s opinion on purpose limitation and Big Data.
Full Story

French Court Finds for Employer in E-mail Case
In a post for Field Fisher Waterhouse’s Privacy and Information Law Blog, Olivier Proust writes about the French Court of Cassation’s ruling in favour of a company that dismissed an employee “based on e-mail exchanges between him and a competitor that were found on his computer’s hard drive and used against him as evidence in court.” Proust writes that the employee argued “this evidence was inadmissible because it was unlawfully obtained by the company in violation of his right to privacy,” but the court holds that unless they are marked as private, “documents and files created by an employee on a company computer for work purposes are presumed to be professional, which means that the company can access those documents and files without the employee’s presence.”
Full Story

UK FOI Reforms In Effect September 1
As of September 1, amendments to the Freedom of Information Act go into effect, meaning public bodies in the UK will be required to disclose datasets "in an electronic form which is capable of re-use" when requested, subject to it being "reasonably practicable" to do so, reports Out-Law.com. The ICO has issued guidance on the law and advised authorities to consult its code of practice on anonymising personal data before responding to FOI requests.

UK ICO Publishes Regulatory Action Policy
The UK Information Commissioner’s Office (ICO) has published a Data Protection Regulatory Action Policy, outlining what the office will consider when deciding whether to initiate regulatory action, reports Out-Law.com. Noting that “market factors” may influence the decision, the policy points to some “initial drivers,” including issues of “general public concern,” those due to the “novel or intrusive nature of particular activities” and those stemming from complaints. When asked for clarity on “market factors,” an ICO spokesman said in markets where "consumers demand effective privacy protection…market forces will be driving businesses to deliver better privacy protection, without the need for the regulator to intervene."
Full Story

UK Court Ruling on SARs Makes the Case for Good Destruction Practices
A legal expert has said that a recent court ruling on subject access requests (SARs) bolsters the need for strong data destruction practices, Out-Law.com reports. Noting that data retention checks can be viewed as a regulatory burden, technology law expert Luke Scanlon said good destruction practices can both comply with data protection laws but also remove the burden of responding to SARs from individuals or organizations requesting data. A High Court judge said companies must respond to SARs but added there is no duty “to retain data so that it can remain available to be mined by former customers or claims companies with a view to making claims against third parties.”
Full Story

Written By

Emily Leach, CIPP/US


If you want to comment on this post, you need to login.


Board of Directors

See the esteemed group of leaders shaping the future of the IAPP.

Contact Us

Need someone to talk to? We’re here for you.

IAPP Staff

Looking for someone specific? Visit the staff directory.

Learn more about the IAPP»

Daily Dashboard

The day’s top stories from around the world

Privacy Perspectives

Where the real conversations in privacy happen

The Privacy Advisor

Original reporting and feature articles on the latest privacy developments

Privacy Tracker

Alerts and legal analysis of legislative trends

Privacy Tech

Exploring the technology of privacy

Canada Dashboard Digest

A roundup of the top Canadian privacy news

Europe Data Protection Digest

A roundup of the top European data protection news

Asia-Pacific Dashboard Digest

A roundup of the top privacy news from the Asia-Pacific region

Latin America Dashboard Digest

A roundup of the top privacy news from Latin America

IAPP Westin Research Center

Original works. Groundbreaking research. Emerging scholars.

Get more News »

IAPP Communities

Meet locally with privacy pros, dive deep into specialized topics or connect over common interests. Find your Community in KnowledgeNet Chapters, Sections and Affinity Groups.

IAPP Job Board

Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.

Join the Privacy List

Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.

Find a KnowledgeNet Chapter Near You

Talk privacy and network with local members at IAPP KnowledgeNet Chapter meetings, taking place worldwide.

Find more ways to Connect »

Find a Privacy Training Class

Two-day privacy training classes are held around the world. See the complete schedule now.

The Privacy Core™ Library Has Evolved

Privacy Core™ e-learning essentials just expanded to include seven new units for marketers. Keep your data safe and your staff in the know!

Online Privacy Training

Build your knowledge. The privacy know-how you need is just a click away.

Upcoming Web Conferences

See our list of upcoming web conferences. Just log on, listen in and learn!

Train Your Team

Get your team up to speed on privacy by bringing IAPP training to your organization.

Let’s Get You DPO Ready

There’s no better time to train than right now! We have all the resources you need to meet the challenges of the GDPR.

Learn more »

CIPP Certification

The global standard for the go-to person for privacy laws, regulations and frameworks

CIPM Certification

The first and only privacy certification for professionals who manage day-to-day operations

CIPT Certification

The industry benchmark for IT professionals worldwide to validate their knowledge of privacy requirements

FIP Designation

Recognizing the advanced knowledge and issue-spotting skills a privacy pro must attain in today’s complex world of data privacy.

Certify Your Staff

Find out how you can bring the world’s only globally recognized privacy certification to a group in your organization.


The IAPP’S CIPP/E and CIPM are the ANSI/ISO-accredited, industry-recognized combination for DPO readiness. Learn more today.

Learn more about IAPP certification »

Are You Ready for the GDPR?

Check out the IAPP's EU Data Protection Reform page for all the tools and resources you need.

IAPP-OneTrust PIA Platform

New U.S. Government Agency privacy impact assessments - free to IAPP members!

IAPP Communities

Meet locally with privacy pros, dive deep into specialized topics or connect over common interests. Find your Community in KnowledgeNet Chapters, Sections and Affinity Groups.

Privacy Vendor List

Find a privacy vendor to meet your needs with our filterable list of global service providers.

More Resources »

Europe Data Protection Intensive 2017

The Intensive is sold out! But cancellations do happen—so hurry and get on the wait list in case more seats become available.

Global Privacy Summit 2017

The world’s premier privacy conference returns with the sharpest minds, unparalleled programs and preeminent networking opportunities.

Canada Privacy Symposium 2017

The Symposium returns to Toronto this spring and registration has opened! Take advantage of Early Bird rates and join your fellow privacy pros for another stellar program.

The Privacy Bar Section Forum 2017

The Privacy Bar Section Forum is sold out! But you can still add your name to the wait list, and we'll keep in touch about your status. Good luck!

Asia Privacy Forum 2017

Call for Speakers open! Join the Forum in Singapore for exclusive networking and intensive education on data protection trends and challenges in the Asia Pacific region.

Privacy. Security. Risk. 2017

Call for Speakers open! This year, we're bringing P.S.R. to San Diego. Submit today and be a part of something big! Submission deadline: February 26.

Europe Data Protection Congress 2017

Call for Speakers open! The Congress is your source for European policy debate, multi-level strategic thinking and thought-provoking discussion. Submit a proposal by March 19.

Sponsor an Event

Increase visibility for your organization—check out sponsorship opportunities today.

More Conferences »

Become a Member

Start taking advantage of the many IAPP member benefits today

Corporate Members

See our list of high-profile corporate members—and find out why you should become one, too

Renew Your Membership

Don’t miss out for a minute—continue accessing your benefits

Join the IAPP»