We have discussed the Fifth Amendment’s application to encryption and biometric information in the past. So now, the purpose of this article is to discuss biometric privacy laws. The State of Illinois has already passed several pieces of legislation to regulate biometric privacy laws. For example, it has passed the Biometric Information Privacy Act (“BIPA”) which addresses the protective measures of biometric information. The statute defines biometric information as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual. Biometric information does not include information derived from items or procedures excluded under the definition of biometric identifiers.” It defines a biometric identifier as follows:

A retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric identifiers do not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color. Biometric identifiers do not include donated organs, tissues, or parts as defined in the Illinois Anatomical Gift Act or blood or serum stored on behalf of recipients or potential recipients of living or cadaveric transplants and obtained or stored by a federally designated organ procurement agency. Biometric identifiers do not include biological materials regulated under the Genetic Information Privacy Act. Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996. Biometric identifiers do not include an X-ray, roentgen process, computed tomography, MRI, PET scan, mammography, or other image or film of the human anatomy used to diagnose, prognose, or treat an illness or other medical condition or to further validate scientific testing or screening.

However, these rules seem to miss the mark by imposing statutory damages and fee-shifting provisions on commercial organizations. As a result, the legislators have opened the floodgates to class action lawsuits. It is important to note that biometric technology has evolved in recent years and the statutes that have attempted to regulate the technology may be outdated. Also, the recently-developed biometric equipment are capable of transforming the biometric identifier into an encrypted format which makes it unreadable or unidentifiable. Therefore, this kind of advanced technology prevents the anticipated harm, and as such, the statutory provisions should be updated by the lawmakers.

Internet privacy laws have been implemented to protect us from legal violations. These laws are meant to protect us against cyber threats and data intrusions which are designed to extract personal or confidential information (e.g., intellectual properties, trade secrets) without authorization. Data privacy is paramount when it comes to the collection, use, and storage of personal or confidential information. However, not many are taking proper steps to ensure security. These steps can include encryption, firewalls, intrusion detection systems, and two-factor authentication.

It is important to realize that even though the criminals are not personally entering your private space or domain, however, they are still able to follow your digital footprints. These digital footprints can be followed by using special tools – e.g., keylogger – which can follow you without your knowledge and consent. Also, cookies can be used to follow you around in a clandestine manner.

What are the internet privacy rules or regulations?

In general, ransomware is a type of malware (i.e., malicious software) that is designed to take control of an electronic communication device, prevent its owner from accessing the electronic communication device, notify its owner that the electronic communication device has been held ransom, demand payment from the owner, and return access to electronic communication device after payment. There have been many instances of ransomware attacks when the hackers have taken control of a company’s servers and prevented its employees from accessing the network and database servers. The hackers would notify the employees by email and demand payment of funds in order to return access to their computers. Now, in some instances, a payment was necessary, but in some exceptional cases the company owners can have an advantage over the hackers and not be required to transfer the funds.

There are several types of ransomware. First, there are applications that fall under the category of scareware and intended to create fear for the recipients and force them to purchase unnecessary software. Second, there is prankware which is intended to cause fear by sending unanticipated pictures, sounds, or videos. For example, NightMare was a type of prankware that would remain dormant on the recipient’s computer and launch itself by changing the computer screen to a skull and playing a loud noise. Third, there is a group of crypto-ransomware named as GPCode or PGPCoder that claims to use PGP encryption to prevent file access. So, in other words, it’s a virus that encrypts files on the infected computer and demands a ransom to release access to the encrypted files. The hackers have been able to become more effective with their tools. The new generation of this type of ransomware denies user access to files by writing encrypted files to a new location and deleting the original file. However, this strategy was ineffective since a file restoration would allow the victim to recover the files. Fourth, CryptoLocker became the new generation of ransomware. It shares similar distribution models of previous ransomware variants and relied on phishing attacks with portable executable attachments. It would install itself on the user’s profile folder and add a registry key to run on startup to maintain persistence. Then, it would start to communicate with the command and control server to generate an RSA-2048 key pair and send the public key to the victim host.

What are the relevant laws?

Cloud computing has become the normal protocol to store data for most individuals and businesses. The fact that online storage is cheaper these days has contributed to the expansion of this technology. There are numerous companies out there that provide cloud storage facilities which may be inside or outside of your jurisdiction. Now, the question is why is that important at all? Well, the answer is because the laws of each jurisdiction may be different when it comes to interstate commerce and cybersecurity. This is one good reason to make sure you read and understand the cloud service provider’s terms and conditions before you sign up. There will be provisions that can help you understand your rights and responsibilities. For example, where and how the parties can resolve their disputes? Also, the laws of which state will be used to resolve the dispute? The answers will be in the venue, choice of law, or governing law provisions. In some cases, the cloud service provider includes an arbitration clause which requires the parties to resolve their dispute through arbitration.

There are various cloud computing platforms that allow the users to send and receive information. So, obviously the users should use precautions when transferring data towards the cloud service provider. For example, it’s recommended to encrypt the data before transferring it. Also, it’s a good idea to confirm that data integrity will be protected after the transfer. The users should also have a functioning backup of their files in a safe place in case the data is lost, stolen, or destroyed.

The Privacy Shield Program applies to cloud computing platforms that do business with other countries – e.g., European Commission, Switzerland. This program is administered by the International Trade Administration (ITA) within the U.S. Department of Commerce and enables U.S.-based organizations to join the Privacy Shield Frameworks. For example, a U.S.-based organization must self-certify to the Department of Commerce and commit to the Framework’s requirements. It’s not mandatory to join the Privacy Shield Program, but once the organization makes the public commitment to comply with the Framework’s requirements, the commitment will become legally enforceable. The participating organization will receive the following benefits:

The question is whether you can copyright computer programs and videogames. The Copyright Act was amended to expressly include the right to register computer programs and videogames.

What is a computer program and how can you copyright it?

A computer program is a set of statements or instructions to be used in a computer to provide a result. See 17 U.S.C. § 101; Stern Electronics, Inc. v. Kaufman, 669 F.2d 852, 855 (2d. Cir. 1982). Copyright protection extends to the copyrightable expressions embodied in the computer program. Computer programs are classified as literary works for the purposes of copyright. See Whelan Associates v. Jaslow Dental Laboratory, 797 F.2d 1222, 1234 (3d Cir. 1986). Also, copyright laws do not protect the functional aspects of a computer program (e.g., algorithms, formatting, functions, logic, system designs).

Part I: DMV Sale of Personal Information

A group has investigated and allegedly found that the California Department of Motor Vehicles has earned more than $50 million by selling personal information of drivers to third parties without consent. This data may include names, addresses, and registration information. The DMV claims on its website that it does not sell information to advertisers or marketers for advertising or direct marketing purposes. It also claims that:

Most information acquired by the DMV is subject to public inspection under Vehicle Code Section 1808. Other statutes, regulations or laws governing subpoenas, discovery for litigation, Public Records Act requests, and commercial requestor requester accounts also apply to information gathered at this website. However, various provisions of law do prohibit or restrict the disclosure of certain electronically transmitted information such as social security numbers, residence addresses, and credit card accounts numbers. DMV also uses the information gathered on this website to help improve this website. For example, by tracking the number of website visitors, the date of visit, and the pages visited, DMV can balance resources so that the maximum number of visitors can obtain needed information. Additionally, by tracking what visitor software is being used (e.g. browser) DMV can avoid using features that visitors can not view or use.

The copyright application process is three parts: (1) application form; (2) nonrefundable filing fee; and (3) a nonreturnable deposit of the work’s copy. In general, the copyright owner should submit a separate application for each work. However, the following exceptions apply for registering multiple works in one application:

  1. Collective Works: When a number of separate and independent contributions are assembled into a collective whole;
  2. Group Registrations: When multiple unpublished works, serials, newspapers, newsletters, contributions to periodicals, photographs, database updates, or secure test items meet registration requirements in one application;

Quantum computing technology will be affecting most of us in a direct or indirect way. We have stated in a prior article that: “A quantum computer is a highly-advanced computer system that works exponentially faster than today’s conventional computers. Quantum computing is the practice of studying quantum computers and their potential. This practice is growing and has caused the rapid decrease in the size of computers at the same time as these systems are rapidly increasing in their capability.”

Now, quantum computing has become a reality and technology companies have launched projects in order to compete in this sector. The question is how quantum computers will affect us.

First, since quantum computers are faster than conventional computers, they can break passwords or decrypt encryptions in a shorter time. This has caused concern over privacy and security which has forced companies to invest in quantum resistant cryptography. This technology and its potential ramifications on encrypted networks will also affect EU’s General Data Protection Regulation (GDPR) which outlines the rules and regulations for protecting unauthorized access. The United States government has also reacted and Congress has passed H.R. 6227 in order to implement the National Quantum Initiative Act that states as follows:

The basic rules for commercial emails should be known by all business organizations. They should include having proper identifiers, opt-out mechanisms, and a valid mailing address in all commercial emails. In fact, the CAN-SPAM Act states that the senders of commercial emails will be acting legally if:

1) The header of the commercial email (indicating the sending source, destination and routing information) doesn’t contain materially false or materially misleading information;

2) The subject line doesn’t contain deceptive information;

Internet spam violations have increased in the past years. For example, the spammers use the interconnected network of computers that links us together in the world to disseminate malware. The spammers also use the internet to send junk email that fills up email accounts and can be used to commit online fraud – e.g., identify theft.

Robocall violations have also increased in the past years. For example, the robocallers use the telephone systems to continuously call without proper authorization. They do not state their personal or business organization’s names. They call before or after the permissible time periods (i.e., before 8:00 am/after 9:00 pm). They call by using artificial voices or recordings. They may also use automated telephone equipment to make the phone calls.

What are the legal remedies?