Privacy Law and Policy : Privacy Lawyer & Attorney : Kevin Whitaker Law Firm : Patient Confidentiality, Defamation, Identity Theft : Privacy Law & Policy Blog

The scramble in on as companies seek to comply with the identity theft regulations adopted in Massachusetts and touted as 'the first of their kind in the country' which are scheduled to take effect on March 1, 2010.

The effective date’s announcement followed a report indicating there have been over one million instances of Massachusetts residents’ personal information being exposed in two years. “We hope these regulations will make it harder for information to get into the wrong hands, and lower the number of instances of data being lost or stolen,” said Barbara Anthony, the Undersecretary of the Office of Consumer Affairs and Business Regulation (OCABR).

While M.G.L. c. 93H was passed in 2007, controversy emerged over how to pursue some of the law’s objectives under the regulations. After repeated postponements and revisions—brought upon largely by changes in the economic climate as well as compliance concerns of businesses— the regulations are now set to take effect on March 1st.

• Email This
• Print
• Comments (1)
• Trackbacks

The Massachusetts Supreme Judicial Court recently reversed four indictments of Matt H. Zubiel for an attempt to disseminate matter harmful to a minor, under M.G. L. c. 272, § 28, and as defined in M.G. L. c. 272, § 31. Each indictment was based on Internet conversations between Zubiel and an undercover police officer on different days.

Deputy Sheriff Melissa Marino, a member of the "high-tech evidence analysis team" in the Plymouth County sheriff's department, conducted undercover investigations of crimes, including child pornography and child enticement. Marino created an undercover screen name, "Melissa QT 1995 and set up a Yahoo profile describing herself as "Meliss Smith" from the South Shore, age thirteen, and in the eighth grade. Her profile invited others to "PM" her (a form of instant messaging) if they wanted to send her a "private message."
 

On February 8, 2006, Zubiel with a screen name of "Ilikesports04," said, "Hi, how are you?" Marino informed Zubiel she was thirteen years old. He indicated he was age twenty-five. Their first online chat lasted forty-two minutes with Zubiel asking Marino for a photograph.  She emailed him photographs of herself when she was thirteen years old. They discussed where each lived and they gave physical descriptions of themselves. Zubiel asked Marino, "[You] ever fool around with boys?" and other questions regarding what she had done with boys, how old the boys were, and additional details about those events.

• Email This
• Print
• Comments
• Trackbacks

As indicated by my prior posts, You've Got Email, But Is It Private At Work? and Is Einstein Reading Your Email for the Government?, the questions and arguments about privacy and email are heating up.  A recent case in point covered by the ABA Journal in Martha Neal's article, Prosecutor’s E-Mail Sent to His Lawyer on a Work Account is Privileged, Court Says, presents an interesting case. Here Neal reports,

A federal prosecutor's e-mail to his own lawyer is privileged, even though he sent it from work on a government computer, a federal court has ruled.

As pointed out in the article, this is in contrast to similar cases and interpretations. A comparison of this case and the government's arguments reviewed in, Is Einstein Reading Your Email for the Government? shows how the divide in these matters is growing.

Attorney-client privilege is a fiercely guarded area of privacy and this case may present the opportunity for the Supreme Court to reaffirm the attorney-client privilege in the the context of email and the information age. Of course, if taken up, how they go about this could have far wider implications for privacy rights and email communications. If heard, would they focus on the rule (reasonable expectation of privacy) or rather focus on the exceptions or privileges. If examined, will they look at the totality of the circumstances and thus leave the law to be advanced case-by-case as the circumstances come before courts or could they take a more holistic approach that offers guidance in this uncertain arena. Time will tell, but the issue seems to be ripening with each "send" button pressed.

• Email This
• Print
• Comments
• Trackbacks

Not that long ago I blogged, Is Einstein Reading Your Email for the Government? The issue there was email and the government's argument about its right to read it. In short, they suggest you don't have a reasonable expectation of privacy in your email sent to (or read by) government employees. In sum, while computer users generally have a legitimate expectation of privacy in the content of Internet communications (such as an e-mail) while it is in transmission, the government argues there are things they can do to eliminate a person's reasonable expectation of privacy and thus remove any of email's privacy protections. It stands to reason that if certain things and conduct implemented by the government can remove privacy protections, then why not employers, too?

A recent Wall Street Journal article, Some Courts Raise Bar on Reading Employee Email, Companies Face Tougher Tests to Justify Monitoring Workers' Personal Accounts; Rulings Hinge on 'Expectation of Privacy' was summarized by Debra Cassens Weiss in an ABA Journal post, May Employers Monitor Personal E-Mail? Cases Turn on Disclosure.

The articles and comments at each post raise good points. Some comments from Weiss' post touch upon, email retention policies and duties to preserve email as evidence, otherwise privileged communications (example, an email to your attorney), ownership or control of the computer, private vs. company email, and more.

Nonetheless, the takeaway lesson for employers sounds a lot like the government's arguments about Einstein 2.0, be very explicit in informing your employees about your monitoring activities and those employees don't have a reasonable expectation of privacy anymore. Thus, as an employer, if you don't have an email and electronics' communications policy, then it's time to consistently adopt, implement, and enforce one. While this is no guarantee that you are on safe ground in monitoring all email, it appears to be the direction things are heading. As for employees, you should know what monitoring is taking place at your work. Take the time to review the email and other company policies and to understand what each means. Also, think twice before sending that email with your resume attached from your office computer or before checking your personal email while at work or on a work computer. Stop, think, and remember--there's a good chance your boss, as well as big brother, may be watching what you send and what you read.

While this post discusses email, don't forget about blogs, comments, tweets on twitter, text messages, Instant Messages (IM), or others, too.

• Email This
• Print
• Comments
• Trackbacks

A tweet from @AbbieCitron brought me to the Medical News Today post Electronic Medical Records Could Help Predict Domestic Abuse. The article discusses forecasting patients' risks by using electronic medical records. Specifically, the article deals with domestic abuse screening or predictions.

Dr Ben Reis of the Children’s Hospital Informatics Program at the Harvard-MIT Division of Health Sciences and Technology, Children’s Hospital Boston; and Harvard Medical School, co-authored the study, Longitudinal histories as predictors of future diagnoses of domestic abuse: modelling study. The study concluded,

Commonly available longitudinal diagnostic data can be useful for predicting a patient’s future risk of receiving a diagnosis of abuse. This modelling approach could serve as the basis for an early warning system to help doctors identify high risk patients for further screening.

• Email This
• Print
• Comments
• Trackbacks

An ABA Journal post by Martha Neil, Could Your New Facebook ‘Friend’ Be a Bill Collector? notes there is little regulation of collection practices on the Internet because current laws are focused on traditional technology.

As the number of consumers giving up landlines increases, and while the information age continues advancing, consumer protections will need to continue undergoing changes in order to keep up with the times. The Congressional Findings and Declaration of Purpose found in The Fair Debt Collections Practices Act (PDF) notes:

There is abundant evidence of the use of abusive, deceptive, and unfair debt collection practices by many debt collectors. Abusive debt collection practices contribute to the number of personal bankruptcies, to marital instability, to the loss of jobs, and to invasions of individual privacy.

In addition, Subsection (b) adds:

Existing laws and procedures for redressing these injuries are inadequate to protect consumers.

Interestingly, consumers are not the only ones who may be interested in reform. Forbes.com posted a letter from the President of a Debt Collection company who also believes reform is needed:

The Fair Debt Collection Practices Act (FDCPA) is over 30 years old and largely regulates communication pertaining to debt collecting. Keep in mind, when FDCPA was crafted over 30 years ago, answering machines were not even used, let alone faxing, e-mailing, texting, etc. ... The FDCPA is in desperate need of being updated

Without clear rules, debt collectors interested in collecting debts ethically will be disadvantaged against those who look to collect consumer debts any way they can, including through abusive tactics. This argument that debt collectors trying to follow the rules should not be prejudiced against those that are abusive is referenced in Subsection (e) of the FDCPA:

It is the purpose of this title to eliminate abusive debt col­lection practices by debt collectors, to insure that those debt collectors who refrain from using abusive debt col­lection practices are not competitively disadvantaged, and to promote consistent State action to protect consumers against debt collection abuses.

With benefits to both consumers and collection companies available by updating collection laws, this should be an area that is ripe for review and change.

Federal law does allow states to impose higher standards than those found in the FDCPA and it will be interesting to see whether legislative changes come from the states or federal government. If neither, then I'd keep an eye on unfair and deceptive trade practices claims, as well as others, to emerge in this area as courts wrestle with trying to fit today's tactics into yesterday's laws.

• Email This
• Print
• Comments
• Trackbacks

Ways may someday be developed by which the government, without removing papers from secret drawers, can reproduce them in court, and by which it will be enabled to expose to a jury the most intimate occurrences of the home. - Justice Louis Brandeis (1928)

A recent ABA Journal article on privacy law (Feds Can Monitor Personal E-Mail Sent Privately to Gov’t Workers, DOJ) began as follows:

You might think that a private-mail sent to another U.S. citizen's personal account isn't subject to government monitoring. But that assumption could be wrong if the recipient is a federal government employee.

Both recipients and senders have no reasonable expectation of privacy if an e-mail is opened by a federal employee logged into a work computer network, according to an Aug. 14 legal opinion from the U.S. Department of Justice that was released Friday.

The Memorandum (PDF file) begins,

Operation of the EINSTEIN 2.0 intrusion-detection system complies with the Fourth Amendment to the Constitution, title III of the Omnibus Crime Control and Safe Streets Act of 1968, the Foreign Intelligence Surveillance Act, the Stored Communications Act, and the pen register and trap and trace provisions of chapter 206 of title 18, United States Code, provided that certain log-on banners or computer-user agreements are consistently adopted, implemented, and enforced by executive departments and agencies using the system. Operation of the EINSTEIN 2.0 system also does not run afoul of state wiretapping or communications privacy laws.

The Memorandum “briefly summarizes the current views of the Office of Legal Counsel on the legality of the EINSTEIN 2.0 intrusion-detection system.” The arguments presented are basically:

1. There is no "search" under the 4th Amendment;
2. If there is a "search", then it is reasonable; and
3. Federal laws trump any state laws.

The central premise of the Memorandum is this, while computer users generally have a legitimate expectation of privacy in the content of Internet communications (such as an e-mail) while it is in transmission over the Internet, the deployment, testing, and use of EINSTEIN 2.0 technology complies with the Fourth Amendment where each agency participating in the program consistently adopts, implements, and enforces the model log-on banner or model computer-user agreements, or their substantial equivalents.

The government's position (which methinks goes too far) is summarized below.

No Search Under the 4th Amendment

The government argues there is no search for Fourth Amendment purposes because “the adoption, implementation, and enforcement of model log-on banners or model computer-user agreements eliminates federal employees’ reasonable expectation of privacy in their uses of Government-owned information systems…."

[Further]… individuals in the private sector who communicate directly with federal employees of agencies participating in the EINSTEIN 2.0 program through Government-owned information systems do not have a legitimate expectation of privacy in the content of those communications provided that model log-on banners or agreements are adopted and implemented by the agency.

… By clicking through the model log-on banner or agreeing to the terms of the model computer-user agreement, a federal employee gives ex ante permission to the Government to intercept, monitor, and search “any communications” and “any data” transiting or stored on a Government-owned information system for any “lawful purpose,” including the purpose of protecting federal computer systems against malicious network activity. Therefore, an individual who communicates with a federal employee who has agreed to permit the Government to intercept, monitor, and search any personal use of the employee’s Government-owned information systems has no Fourth Amendment right against the Government activity of protecting federal computer systems against malicious network activity, as the employee has consented to that activity.

The Memorandum goes on to say this applies even when the email was sent to the employee’s non-governmental or personal account. When the,

sender of an email to an employee’s personal, Web-based email account (such as Gmail or Hotmail) does not know of the recipient’s status as a federal employee or does not anticipate that the employee might read, on a federal Government system, an email sent to a personal email account at work or that the employee has agreed to Government monitoring of his communications on that system. A person communicating with another assumes the risk that the person has agreed to permit the Government to monitor the contents of that communication.

But if it is a "Search," then it's Reasonable anyway

The Memorandum argues, even if EINSTEIN 2.0 operations were to constitute a “search” under the Fourth Amendment, …those operations would be consistent with the Amendment’s “central requirement” that all searches be reasonable [because] the Government has a lawful, work-related purpose for the use of EINSTEIN 2.0’s intrusion-detection system that brings the EINSTEIN 2.0 program within the “special needs” exception to the Fourth Amendment’s warrant and probable cause requirements."

State Privacy Laws vs. The Supremacy Clause

The Memoradum’s final argument is the EINSTEIN 2.0 program does not run afoul of state wiretapping or communication privacy laws due to Supremacy clause.

To the extent that such laws purported to apply to the conduct of federal agencies and agents conducting EINSTEIN 2.0 operations and imposed requirements that exceeded those imposed by the federal statutes discussed above, they would “stand as an obstacle to the accomplishment and execution of the full purposes and objectives of Congress,” and be unenforceable under the Supremacy Clause.

What do you think? Do you buy the argument that if you send an email to a government employee's private gmail or yahoo account, then the government may have the right to read the email?

Preceding the last presidential election, Condoleezza Rice was apologizing to presidential candidates for government intrusions into their private passport records. President Obama, a candidate at the time, called for hearings on the matter. Watergate, Hoover, and McCarthyism should remind us as to what ends government intrusions into personal privacy can have. Deeper historic reflections illuminate this point even more. Benjamin Franklin, offered, "they who would give up an essential liberty for temporary security deserve neither liberty nor security." Of a more local flavor, Boston's Samuel Adams, stated:

Driven from every other corner of the earth, freedom of thought and the right of private judgment in matters of conscience, direct their course to this happy country as their last asylum.

• Email This
• Print
• Comments
• Trackbacks

Ross Clark's book, The Road to Big Brother, One Man's Struggle Against the Surveillance Society, involves Clark's experience in avoiding CCTV cameras and surveillance efforts in England. PrivacyDigest's review of the book, states (in part):

Ross Clark lays bare the astonishing amount of personal data which is hoarded by the state and by commercial organizations, and asks whom should we fear most: the government agencies who are spying on us - or the criminals who seem to prosper in the swirling fog of excessive data-collection.

As a city councilor, I was surprised to see surveillance cameras recently installed on new sets of local traffic lights. I wondered, "Who decides where these go and who will have access? Why are they there?" "Why didn't I have to approve these?"

I realize there's a practical argument for the potential advantages, such as recording accident data, raising compliance with safe driving laws, and, of course, avoiding traffic. In fact, the Connecticut Department of Transportation site lets you view traffic camera images that are updated every five minutes. The Boston SmarTraveler site offers several views, too.

But are things like Google Earth, government surveillance, and private webcams streaming on the web taking us into unchartered territories? I was excited to use Google Earth to see where my wife lived in Spain or others' travels. I've been on guided tours from the comfort of our home and they were fun experiences. But is there a trade off for fun?

• Email This
• Print
• Comments
• Trackbacks

In previous posts, I discussed the legislative amendment being kicked around that would weaken the MA data security law (M.G.L. 93H).

• An Act Ensuring Less Privacy of Massachusetts Residents' Data: Part One
• An Act Ensuring Less Privacy of Massachusetts Residents' Data, Part 2 of 5
• An Act Ensuring Less Privacy of Massachusetts Residents' Data: Part 3 of 5
• An Act Ensuring Less Privacy of Massachusetts Residents' Data: Part 4 of 5,
• An Act Ensuring Less Privacy of Massachusetts Residents' Data: Part 5 of 5.

Well, it appears the legislative change may not be necessary as the latest and ungreatest regulatory scheme changes appear to do the hatchet job for them.  Too bad.  In short, it's not good news for Massachusetts consumers or their privacy rights as privacy rights seem, once again, to be taking a backseat to political influences.

The Official Website of the Office of Consumer Affairs & Business Regulation (OCABR) states:

BOSTON – Aug. 17, 2009 – ... The updated regulations will take effect March 1, 2010. The regulations make clear that their approach to data security is a risk-based approach that is especially important to small businesses that may not handle a lot of personal information about customers. Under a risk-based approach, a business, in developing a written security program, should take into account its size, nature of its business, the kinds of records it maintains, and the risk of identity theft posed by its operations.

...

New language in the regulations recognizes that the size of a business and the amount of personal information it handles plays a role in the data security plan the business creates. The new language requires safeguards that are appropriate to the size, scope and type of business handling the information; the amount of resources available to the business; the amount of stored data; and the need for security and confidentiality of both consumer and employee information.

The changes, Anthony said, make clear the regulations are risk-based in implementation, not just in enforcement as had been the case in earlier versions of the regulations. In addition, the regulations are technology neutral and acknowledge that technical feasibility plays a role in what many businesses, especially small businesses can do to protect data.  The overall approach is more consistent with federal law, she said.

...

The Office of Consumer Affairs and Business Regulation today sent to the Secretary of State notice of public hearing on the changes. That hearing will be held on Tuesday, Sept. 22, at 10 a.m. at the Transportation Building, 10 Park Plaza, Boston.

For more information about identity theft protection, visit the Office of Consumer Affairs and Business Regulation website, www.mass.gov/consumer.

• Email This
• Print
• Comments
• Trackbacks

Massachusetts Senate Bill No. 173 (PDF file) introduced earlier this year, would amend M.G.L. 93H (Massachusetts data protection law) and effectively water down the Office of Consumer Affairs and Business Regulation's (OCABR) authority (as well as their data protection regulations) on a few fronts. I'm reviewing four of the proposed changes in separate posts. Today, I'll examine a proposed change which requires different strokes for different folks, or rather different legal standards for protecting people's personal data. The proposed change adds,

Notwithstanding the rules adopted by the department [OCABR] ..., said department shall create separate regulations for small businesses ... that reflect said small businesses unique situation and resources.

Thus, under this proposed change, the law would not apply evenly, but would depend on the size of the business and require separate standards be promulgated for small businesses. Perhaps it sounds reasonable when looked at from the perspective of protecting small businesses, but this change implies a person's privacy rights matter less depending on who is allowing them to be trampled upon. Should the law allow for different standards when it comes to individuals' rights or should the emphasis be on protecting the absolute rights held by individuals instead?

• Email This
• Print
• Comments (2)
• Trackbacks

Massachusetts Senate Bill No. 173 (PDF file) introduced this year, would amend M.G.L. 93H and effectively water down the Office of Consumer Affairs and Business Regulation's (OCABR) authority on a few fronts. I'm taking each one up in a separate post and today, I'll address the first proposed change.

If SB 173 is enacted, businesses would not have to comply with any state regulations with stricter standards than federal law.  While businesses need to comply with federal law, this should not stop states from implementing higher standards to protect their residents. This suggested revision hurts individuals' privacy rights as compliance is limited to the lowest common denominator and doesn't aspire to improve safeguards beyond minimum standards.

While some commentators previously commended MA for leading the way on data privacy protections, this proposal brings us back, at best, to the status quo--a review of data breach news headlines demonstrates the status quo simply isn't working or protecting peoples' privacy. MA has a chance to take the lead in protecting individuals' privacy rights and punting isn't the best option.

In the end, so long as economic incentives and business interests are placed before individuals' rights, then privacy rights are at risk. I hope Massachusetts opts to lead the way on protecting privacy and doesn't adopt the proposed amendment. 

The timing of this proposed amendment baffles me, why gut a law the state legislature passed that hasn't even been given a chance to work?

Next, I'll discuss the data encryption and data protection methods that are being stripped away under the proposed change.

• Email This
• Print
• Comments
• Trackbacks

Massachusetts Senate Bill No. 173 (PDF file), introduced earlier this year, would amend M.G.L. 93H (MA Data Security Law) and effectively water down the law while reducing the Office of Consumer Affairs and Business Regulation's (OCABR) authority to protect Massachusetts consumers' privacy rights.

These proposed changes to the data protection law are a timely topic as the original MA law was passed following TJX's large-scale data breach. TJX has recently entered into a $9.75 million settlement with 41 states over their data breach. According to the Boston Herald in, TJX to pay states $9.75M in data breach settlement,

The $9.75 million settlement payment includes $2.5 million to establish a data security fund for the states and $1.75 million to cover the states’ investigations into the data breach. Massachusetts will receive more than $950,000 of that money.

The Herald reports, Attorney General Martha Coakley, who was a driving force for all states' involved, said in a statement

Protecting consumers’ personally-identifiable information is of paramount importance to prevent fraudulent use of credit and identity theft.

All retailers and companies that hold or use personally-identifiable information must employ data security systems that guard against the improper disclosure or use of that information. This settlement ensures that companies cannot write-off the risk of a data breach as a cost of doing business.

The Identity Theft Assistance Center (ITAC) blog, in TJX Agrees to Pay $9.75 million to 41 States in Data Breach Case, states:

The company [TJX] also stated in an official news release that it “firmly believes it did not violate any consumer protection or data security laws.” However, California Attorney General Jerry Brown had a different POV [point of view] and cited the company’s 2004 internal audit, which found security vulnerabilities. ... "TJX ignored flaws in its credit card database, until hackers broke into it, gaining access to the personal information of almost 50 million people..."

In the wake of the TJX settlement, under MA Attorney General Coakley's and other attorney generals' realized efforts, it's disappointing to see present attempts to water down the Massachusetts data protection law by state legislators. In coming posts I'll discuss four changes being proposed and how each fails to help consumers or protect individual privacy rights. Thus the title of this series, "An Act Ensuring Less Privacy of Massachusetts Resident's Data" which plays off of the proposed act's title "An Act ensuring the privacy of certain data."

• Email This
• Print
• Comments
• Trackbacks

Does privacy matter? I was recently reviewing excerpts from an earlier interview by International Association of Privacy Professionals with Bruce Schneier where he was asked, "Is privacy the new environmentalism?" Schneier's reply was prescient,

Yes, and data is the pollution problem of the Information Age. Think about it. All computer-mediated processes produce data. Unless dealt with, it stays around. And its after-effects can be pretty toxic. And, just as 100 years ago we ignored pollution in our rush to build the Industrial Age, today we're ignoring data in our rush to build the Information Age. And, I believe, 100 years from now our great-grandchildren will look back at the decisions we made and wonder how we could have been so ignorant and short-sighted.

• Email This
• Print
• Comments
• Trackbacks

Thank you to the folks at e-Justice Blog for including Privacy Law and Policy in their 50 Best Blogs for Privacy Nuts. It's an honor to be included and also to be among the top ten blogs in the Law and Policies category.

e-Justice covers issues from cyber-law to personal security and aims to promote a more pro-active and informed citizenry by tackling issues of justice that affect people's safety and well-being.

• Email This
• Print
• Comments
• Trackbacks

I recall a law professor telling me that when the Titanic sank it was lawful to not have enough lifeboats to hold the ships' occupants. I quickly checked on Wikipedia and it states,

The Titanic carried 20 lifeboats with a total capacity of 1,178 people. While not enough to hold all of the passengers and crew, the Titanic carried more boats than was required by the British Board of Trade Regulations. At the time, the number of lifeboats required was determined by a ship's gross register tonnage, rather than her human capacity.

Additional research indicates the Titanic had the potential to carry 48 lifeboats (as suggested by Alexander Carlisle) but cost-cutting resulted in only 20 being carried (albeit still more than the 16 required.) The NY Times headline on April 17, 1912 read, "LIFEBOATS FOR ALL NOT ORDERED BY LAW; Apparent Security of Modern Liners Kept Out-of-Date, Requirements in Force. The first paragraph states,

The disaster to the Titanic may bring about a change in the British Laws establishing the requirements in regard to appliances for the saving of life on modern liners, a development of marine architecture which was apparently not contemplated by those who framed the laws and amended them.

Sometimes privacy law seems like the Titanic to me. A U.S. District Court in the Northern District of California recently held the alleged risk of identity theft is enough to grant standing to an identity theft victim, but that the risk alone is not enough to survive summary judgment.

• Email This
• Print
• Comments
• Trackbacks

Throughout Massachusetts, including Boston where crowds awaited their victors, today is “Marathon Monday,” signifying the running of the Boston Marathon, a challenging race with many individuals striving towards a common goal. 

Through the streets of Boston, some will run fast, some slow. Regardless (or “Irregardless” as is often heard here), the field of runners couldn’t participate unless there was a shared goal and a protected course laid out for their journey. Shouldn’t we aim for the same in privacy law and policy, a shared goal of protecting individual's privacy rights while defending against infringements along our journey?

Society’s direction over the information superhighway, however, is not anywhere nearly as well laid out and organized as the Boston Marathon. While the Internet is a course we are all racing on more and more, law and policy aren’t the ones leading the pack or setting the pace. Rather, a widening gap is developing between the law (looking back over its shoulder of precedent to gage how it’s doing) versus a Web 2.0 world racing ahead under the quickening pace of Moore’s law.

But privacy’s race is not yet lost—individuals’ rights have triumphed before and are the fabric of our democracy. In Boston, today is not only “Marathon Monday,” it is also Patriots’ Day, a day honoring the first battles fought on April 19^th, 1975 in Lexington and in Concord. Ralph Waldo Emerson memorialized this day in this stanza with it's famous last line,

By the rude bridge that arched the flood,

Their flag to April's breeze unfurled;

Here once the embattled farmers stood,

And fired the shot heard 'round the world.

• Email This
• Print
• Comments
• Trackbacks

Before becoming a political celebrity, he [Obama] said that when he visited Europe he was free to wander down to a cafe, sip wine, do some people-watching and shopping, and watch the sun set. "Now, I'm in hotel rooms all the time and I have security around me all the time," said Obama…. 

Answering the query about regrets, he also noted the loss of "privacy and anonymity." But he was quick to add that "there's nothing more noble than public service."

While the nobility of public service may be worth the President’s privacy regrets, do these casual remarks hint at global concerns in a New Web 2.0 World Order? I find it interesting to note Obama’s statements came during his first overseas trip as President. With technologies reach making all nations virtual neighbors on the Internet, are privacy concerns best suited for local, national, or international laws or standards? To whom should they apply? How do we best safeguard privacy rights in this new digital world as well as respond to intrusions into a private person’s privacy and anonymity.

While Massachusetts, California, and Nevada are enacting independent privacy laws of sorts, what effect do these have on those outside of their borders, both within the U.S. and abroad? Recently we’ve seen a call for nationalizing the web for public safety reasons. Is a privacy argument next? If not, how will privacy be protected in the cloud and how will we handle those who make unwanted intrusions? These and other concerns are raising interesting policy questions for a linked in globally interdependent world.

Some may ask, “Is an Obama administration likely to get tech and its issues?” Given, there’s much on his plate and agenda, but don’t forget, during this same trip, the President (also referred to in the above article as “geek-in-chief”) did give the Queen of England an engraved iPod while he was visiting Buckingham Palace. Maybe a tech friendly president coupled with his privacy regrets might still open the door for meaningful policy debate and innovative privacy legislation.

• Email This
• Print
• Comments
• Trackbacks

Cloud computing (the "cloud") is abuzz in e-commerce and tech circles. The idea of computing online or in the cloud continues to be an emerging trend being watched by many, including leading Chief Information Officers (CIO's).

What, then, do leading IT pro's think about this cloud concept? Julian Goldsmith at silicon.com asks this question of twelve IT experts in, CIO Jury: Cloud under a cloud with IT heads. Her jury of 12 CIO experts voted against employing today’s cloud in their organizations by a vote of 10-2.

Pro cloud arguments offered by her panel include benefits in cost savings, service delivery, infrastructure, and others. Her panel’s opponents of today’s cloud model raised concerns of security, sophistication, and reliability. Regardless of the final vote, this case is not closed and it appears even the cloud’s critics believe operating in the cloud could be the wave of the future. While he voted “no” on the panel, IT Manager, Ben Acheson, discussing the cloud’s potential, said:

Above all it needs to be tried and tested before it will catch on. In the meantime I'm keeping my eye on the technology because in my view it represents the future [.]

Perhaps the only barrier to businesses' ascendancy into the cloud seems to be time. While reliability, sophistication, and innovation are concerns perhaps best left to the free market, should privacy be treated differently? I think so, but I’m concerned our laws may not travel ahead of, or at least alongside, the path technology’s advancements are taking.

Alternatively, privacy concerns run the risk of becoming outweighed by the market and the comparative efficiencies cloud applications could provide. If so, then privacy cases will likely proceed case-by-case in various jurisdictions with disjointed bodies of law emerging.

In the end, if privacy laws (and their penalties) don’t give IT professionals a leg to stand on in prioritizing privacy rights, then perhaps privacy lawsuits, cloud class actions, or other cloud torts will.  I’d argue, however, this is not ideal for businesses or consumers on a number of fronts.

• Email This
• Print
• Comments
• Trackbacks