Today is Data Privacy Day!

January 28 is “Data Privacy Day.”  In honor of the day, below are several links relating to efforts to protect the privacy of personal data and some tools for small businesses:

Council of Europe’s explanation of the purpose Data Privacy Day (now in its eighth year): http://www.coe.int/t/dghl/standardsetting/dataprotection/data_protection_day_en.asp

* Note that the Council of Europe published its “Handbook on European data protection law” (prepared in cooperation with the European Union Agency for Fundamental Rights (FRA) and the European Court of Human Rights) on January 28, which is available here: http://www.coe.int/t/dghl/standardsetting/DataProtection/TPD_documents/Handbook.pdf.    

European Union’s Data Protection Day initiatives, including promoting the reform of EU Data Protection laws:  http://europa.eu/rapid/press-release_MEMO-14-60_en.htm (see embedded video).

Federal Communications Commission’s Cyber Security Planner:  http://transition.fcc.gov/cyber/cyberplanner.pdf, which the FCC describes as a “a tool for small businesses to create customized cyber security planning guides.”  (More information about this tool can be found here:  http://www.fcc.gov/cyberforsmallbiz).

Federal Trade Commission’s Data Security (for Businesses):  http://business.ftc.gov/privacy-and-security/data-security.  

Microsoft’s Data Privacy Day resources:  http://www.microsoft.com/en-us/twc/privacy/data-privacy-day.aspx

Stay Safe Online’s Data Privacy Day Site:  http://www.staysafeonline.org/data-privacy-day/landing/ -- and specifically their library: http://www.staysafeonline.org/data-privacy-day/privacy-library.

Online Trust Alliance’s Data Privacy Day Site:  http://otalliance.org/news/DataPrivacyDay.html -- includes for example, its 2014 Data Protection & Breach Readiness Guide.

New “Personal Information Privacy” Legislation Introduced

On January 8, 2014, Sen. Patrick Leahy (D-Vt) re-introduced a personal privacy protection bill intended “to prevent and mitigate identity theft, to ensure privacy, to provide notice of security breaches, and to enhance criminal penalties, law enforcement assistance, and other protections against security breaches, fraudulent access, and misuse of personally identifiable information.”  Personal Data Privacy and Security Act of 2014, S. 1897 at preamble (introduced Jan. 8, 2014).  Sen. Leahy introduced prior versions of this bill in 2005, and in each of the four Congresses since.  Press Release, “Leahy Reintroduces Data Privacy Legislation,” Jan. 8, 2014.

Sen. Leahy’s published summary of the bill provides a detailed list of the key components.  There are two principal titles in this bill:  1) Enhancing Punishment for Identity Theft and Other Violations of Data Privacy and Security; and 2) Privacy and Security of Personally Identifiable Information (“PII”).  (There is a third title, relating to compliance with a statutory Pay-As-You-Go Act, but the text is a short paragraph and just relates to budget compliance.)  See Leahy’s Section-By-Section Analysis of the Bill.

Punishment Enhancement:  The Bill adds expands the definition of racketeering activity (18 U.S.C. § 1961(1)) to include violations of the Computer Fraud and Abuse Act (“CFAA,” 18 U.S.C. § 1030); criminalizes the knowing concealment of a security breach that requires notice (and provides for either a fine or imprisonment up to 5 years); enhances the penalties for fraud and related activities under the CFAA; provides the same penalties for conspiracy to commit computer hacking as for completed, substantive offenses; clarifies the criminal forfeiture requirements; creates a civil forfeiture provision (providing that gross, not net, proceeds may be forfeited under this section); precludes civil actions based on violations of acceptable use policies or terms of service agreements; and adds a new criminal provision making it a felony to damage a computer that manages critical infrastructure systems, such as national security, transportation or public health and safety (imprisonment would be between 3 and 20 years if convicted).

Privacy and Security of PII.  It covers detailed requirements for data privacy and security programs; enforcement for data breach events (although this specifically denies a private right of action); security breach notifications (to whom made, method, contents, timing, notice to law enforcement, permitting delays by Secret Service or FBI where notice could impede active criminal investigations or national security); and preemption of state law on breach notification; and enforcement (it appears to provide only agency enforcement (by federal or state agencies) or criminal enforcement, and not a private right of action). 

Bill Status

This version of the legislation comes close on the heels of the data breach at Target retail stores, involving the “debit and credit card data of as many as 40 million customers during the Christmas holidays.”  Id. (quoting Sen. Leahy).  Once introduced, the bill was read twice, and referred to the Senate Judiciary Committee.  Bill Status (last visited on Jan. 26, 2014); see also Detailed Summary.  Sen. Leahy also announced that the bill “will be” the focus of a hearing before the Senate Judiciary Committee this year.  Id.  (Sen. Leahy is chair of the Senate Judiciary Committee.)

Senate Hearing:  February 4, 2014 (To be Webcast in Real Time)

A related hearing has already been announced, to be held before the full Judiciary Committee.  The hearing notice does not specifically mention this bill, but is undoubtedly related:  "Privacy in the Digital Age: Preventing Data Breaches and Combating Cybercrime," scheduled for February 4, 2014, at 10:15 am in the Dirksen Senate Office Building, Room 226.  

Two panels of testifying witnesses are currently scheduled.  Panel 1 includes John J. Mulligan, EVP and CFO of Target Corporation and Delara Derakhshani, Policy Counsel of Consumers Union (publishers of Consumer Reports).  Panel 2 includes The Honorable Edith Ramirez, Chairwoman of the Federal Trade Commission, William Noonan, Deputy Special Agent in Charge at the Criminal Investigative Division of the U.S. Secret Service and Mythili Raman, Acting Assistant Attorney General in the Criminal Division at the U.S. Department of Justice.

If prior hearings are any indication, then it is likely this hearing, which has been announced as a webcast, will also broadcast live.  Visit the Judiciary Committee’s Hearing Notice to access the video feed.

Other Data Privacy Legislation

Sen. Leahy’s Bill is not the only one proposed in the current Congress relating to data security breaches and notifications to customers.  Indeed, there are 303 other bills pending with the words “privacy” in their title.  See Search Results. One particularly noteworthy is the Data Security Act of 2014 (S. 1927), introduced by Sen. Thomas Carper (D-DE) and Sen. Blunt (R-MO) on January 15, 2014.  It seems to also be responsive to the Target data breach notification problem in December 2013.  It was read twice and referred to the Senate Committee on Banking, Housing, and Urban Affairs.

Index of Articles in 2013

Well, 2013 turned out to be a very busy year (on a personal level, so there aren't as many articles posted here during the year!), and 2014 promises to be very interesting. Given the public debates about copyright reform, we will probably be covering copyright law more than previously. However, the 1976 version of the Copyright Act took over two decades to finalize ("In fact, former Register of Copyrights Barbara Ringer, who had worked closely with Congress for much of the 1976 revision process, later called it a 'good 1950 copyright law.'" from March 20, 2013 Speech By Maria Pallante), so I do not expect that all of the issues raised about digital publication and distribution (among others) will be resolved overnight.

We expect to see more proposals on the trademark side as well, although it's likely that members of Congress may avoid controversial issues this year. As a result, it is hard to predict whether we expect to see any revisions to the COICA/PIPA/SOPA drafts (relating to counterfeiting by predatory foreign websites), given that these proposals each had their own challenges in public debate.

I look forward to your comments in the coming year, and wish you all the best in your own practices!


Chronological Index of Articles Posted in 2013:
January

• January 1, 2013, New Year's Resolution: Always Read Terms of Service for Social Media Networks!

February

• February 3, 2013, Webinar Scheduled for February 12, 2013
  

March

• March 12, 2013, Common Questions: Can I Copyright My 'Knight in Shining Armor' Story?
  
• March 27, 2013, FTC Issues New Guidance on Online Advertising Disclosures
  

April

• April 12, 2013, Yankees Successfully Oppose Registration of "BASEBALLS EVIL EMPIRE" Trademark
  

June

• June 20, 2013, White House Releases Second Joint Strategic Plan for IP Enforcement
  

July

• July 21, 2013, Online Piracy and Counterfeiting: Ad Networks Adopt New "Best Practices Guidelines"
  
• July 22, 2013, USPTO Extends Deadline for Voluntary Best Practices Study
  

August

• August 15, 2013, IPEC Victoria Espinel Steps Down
  

October

• October 2, 2013, New Copyright Proposal Addresses Performance Rights

New Copyright Proposal Addresses Performance Rights

According to the BNA, Rep. Melvin L. Watt (D-NC) introduced the Free Market Royalty Act (H.R. 3219) on September 30, 2013.  See “Rep. Melvin Watt Introduces Bill to Create Performance Right for Recording Artists,” BNA’s Patent, Trademark & Copyright Journal – Daily Update, No. 191 (Oct. 2, 2013).  Rep. Watt stated that this bill provides “a ‘performance right’ that will obligate AM/FM radio stations to compensate performers for the use of their music just as cable, satellite and internet radio are obligated to do.”  Press Release, “Congressman Watt's Statement on the Introduction of H.R. 3219, the Free Market Royalty Act,” October 1, 2013.  (Note that the index of Rep. Watt’s press releases indicates that this was issued on October 1.  The release itself shows no date.  Congress.gov indicates it was introduced on September 30, and has already been referred to the House Committee on the Judiciary.)

Rep. Watt explains that under current law, when an AM or FM station plays a song, the composer and the publisher both receive royalties and the performer does not.  Press Release.  This bill proposes to level that playing field, and put compensation for music broadcasting on par with international counterparts.  Id.

As of this writing, there are no co-sponsors to the bill.  The text of the bill has not been received by the Library of Congress to post on its website, which states instead:

“As of 10/02/2013 text has not been received for H.R.3219 - To amend title 17, United States Code, to provide copyright owners in sounds recordings with the exclusive right to negotiate in the marketplace the performance of their works to the public by means of an audio transmission, and for other purposes.

“Bills are generally sent to the Library of Congress from GPO, the Government Printing Office, a day or two after they are introduced on the floor of the House or Senate. Delays can occur when there are a large number of bills to prepare or when a very large bill has to be printed.”

Undoubtedly, this lack of information is the result of the government shutdown, which took effect on October 1, 2013 at 12:01am.  (The Copyright Office has a notice on its site explaining that the site is down because of the government’s shutdown, and will not be available again until the office reopens.)  Current status, list of co-sponsors and any applicable text of the bill can be found here once it is made available by the Library of Congress.

IPEC Victoria Espinel Steps Down

Intellectual Property Enforcement Coordinator, Victoria Espinel, has stepped down from her position, effective Friday, August 9, 2013. Andrew Ramonas, "White House IP Chief Victoria Espinel Steps Down," Corporate Counsel, Aug. 13, 2013. Until a new IPEC is officially named, Howard Shelanski, administrator of the U.S. Office of Information and Regulatory Affairs, will act as Interim IPEC. Id.
According to Corporate Counsel, "Congress created the intellectual property enforcement coordinator post in the Prioritizing Resources and Organization for Intellectual Property Act of 2008 (text), and the Senate confirmed Espinel as the coordinator in December 2009. She previously was an IP law professor at George Mason University School of Law and the first assistant U.S. trade representative for intellectual property and innovation." Id.
    
It has been suggested that Ms. Espinel will be moving over to the Business Software Alliance, although no formal announcement has yet been made. See, e.g., Alex Byers, "Where will Victoria Espinel land? - NYT: NSA leaks hurt cyber plan's chances - Senators step up Bitcoin scrutiny," Politico Morning Tech, Aug. 13, 2013; The Deadline Team, "Nation's First IP Czar Steps Down," Deadline, Aug. 12, 2013; Jennifer Martinez, "Obama's intellectual property chief steps down," Hillicon Valley (The Hill's Technology Blog), Aug. 12, 2013. 
 
Updates from the IPEC's Office can be found here: http://www.whitehouse.gov/omb/intellectualproperty. Interestingly, this site still lists Ms. Espinel as serving as the IPEC.

Prior Posts on the Privacy and IP Law Blog about the IPEC and its reports can be found here: http://privacyandip.blogspot.com/search/label/IPEC.