DBR ON DATA

Security, Privacy and Information Governance

Author: Katherine Armstrong (page 2 of 5)

Protecting Students’ Online Privacy: An FTC & ED Joint Workshop on EdTech

Share

On Friday, December 1, the Federal Trade Commission and the Department of Education hosted a workshop examining student privacy in the burgeoning field of “EdTech.” Both agencies regulate certain educational technology aimed at K-12 students. However, FTC rules implementing the Children’s Online Privacy Protection Act (“COPPA”) are not identical to ED regulations implementing the Family Educational Rights and Privacy Act (“FERPA”). To better understand how both rules interact in practice, the agencies solicited public comment and convened panels of experts and stakeholders – including vendors, schools, parents, and regulators.

The workshop explored several key issues, including when a school may provide consent on behalf of participating students; how record retention (and deletion) should be noticed and executed; and what limits to impose on vendors collecting personal student information. In closing, both agencies expressed a desire to provide clear, workable regulatory oversight while meaningfully protecting student privacy.

Continue reading

Smartwatch News: Privacy Edition

Share

As smartwatches gain in popularity, innovative uses for the wearable technology, along with privacy concerns, continue to pop up. In this roundup, we look at a new app that can help in atrial fibrillation studies and privacy concerns regarding smartwatches for children.

New app identifies irregular heartbeats for medical study

Apple recently launched the Apple Heart Study App, described as a “first-of-its-kind research study using Apple Watch’s heart rate sensor to collect data on irregular heart rhythms and notify users who may be experiencing atrial fibrillation.” Atrial fibrillation is a leading cause of stroke and other heart conditions.

Apple Watch users will be able to enroll in a joint study with Stanford University School of Medicine, which will use the device’s heart rate monitor to check for an irregular heart rate.  If an irregular heart rhythm is identified, the participant will receive a notification on his Apple Watch and iPhone, a free consultation with a study doctor, and an electrocardiogram patch for additional monitoring. This is the first study that Apple itself is sponsoring. Apple will run the study and submit data to the U.S. Food and Drug Administration for approval as a regulated software.

Continue reading

The SEC’s Cyber Specialty Unit Strikes With Its First Case

Share

On December 4, 2017, the SEC Enforcement Division’s new Cyber Unit filed its first enforcement case for a fraudulent initial coin offering (ICO). This new specialty unit was established in late September to increase the Enforcement Division’s focus on cyber-related securities law violations. The focus areas of this unit include securities laws violations involving “blockchain” technologies and ICOs.
Continue reading

Agenda and Panelists Announced for FTC’s Information Injury Workshop in December

Share

The Federal Trade Commission released the agenda and panelists for the Information Injury Workshop which will be held on December 12.

As we covered in a previous DBR on Data post, the goal of the workshop is to explore how to characterize information injuries, how to accurately measure such injuries, and their prevalence.  In addition, panelists will discuss what factors businesses and consumers consider when evaluating the tradeoffs between providing information and potential exposure to injuries.

The panelists come from a variety of fields and disciplines, including information technology, privacy and data security, business, academia, legal and nonprofit fields.

The full agenda and list of panelists is available at this link. The workshop is free and open to the public and will also be available via live webcast through the FTC’s website.

A.G. Schneiderman Announces SHIELD Act to Protect New Yorkers

Share

The Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) was introduced in the New York legislature in early November and would amend New York’s state breach notification law.  The bill was announced after the release of a New York Office of the Attorney General report found a nearly 60% hike in data breaches affecting state residents in 2016 and following the Equifax breach in September, which A.G. Schneiderman is investigating.

Among other things, the SHIELD Act would:

  • Require reasonable security for private information, using standards tailored to the size of the business, while avoiding duplicate regulations and providing incentive to businesses that certify security compliance and provides clear examples of safeguards (e.g., technical, administrative, and physical measures).
  • Carve out “compliant regulated entities,” which are defined as those already regulated by, and compliant with, existing or future regulations of any federal or NYS government entity (including NYS DFS cybersecurity regulations; regulations under Gramm-Leach-Bliley; HIPAA regulations) by deeming them compliant with this law’s reasonable security requirement.
  • Provide safe harbor from AG enforcement actions under this law for “certified compliant entities,” (those with independent certification of compliance with aforementioned government data security regulations, or with ISO/NIST standards).
  • Provide a more flexible standard for small business (less than 50 employees and under $3 million in gross revenue; or less than $5 million in assets): requiring reasonable safeguards “appropriate to the [small business’s] size and complexity.

Continue reading

“Hey toy – can you …”

Share

The Federal Trade Commission provided additional guidance on how the Children’s Online Privacy Protection (COPPA) Rule, 16 C.F.R. Part 312, applies to the practice of collecting audio files that contain a child’s voice, immediately converting the audio to text, and deleting the files containing the voice recording triggers COPPA’s requirements.

The FTC guidance provides that it will not take enforcement action against operators who collect audio files without first obtaining verifiable parental consent in situations where the child’s voice is being used solely as a replacement for written words, such as to convert voice to text in order to perform a search and other function on internet-connected devices.

Continue reading

Older posts Newer posts

© 2018 Drinker Biddle & Reath LLP. All Rights Reserved. Lawyer Advertising.

Disclaimer/Privacy Policy