Published on: | by

There has been an increase in privacy violations that have led to class action lawsuits. For example, Facebook was forced to pay $550 million to settle a class action lawsuit for privacy violations. In that case, it was ordered to pay the plaintiffs due to an alleged systematic violation of an Illinois consumer privacy law. The settlement agreement included a provision that required Facebook to procure express consent for face analysis and auto-tagging its users. There have been other lawsuits filed against technology companies, such as, Shutterfly, Snapchat, and Google for similar violations.

The California Consumer Privacy Act (“CCPA”) gives consumers the right to request information from a business about its data collection and retention practices. The consumers have the right to know if the business is using their data to make inferences from their behavior, attitude, psychology, intelligence, or abilities. This statute grants consumers the right to request a data deletion. It gives the consumers an “opt-out option” from selling their data to third parties. However, the statute is not retroactive which means that it does not apply to violations that took place before implementing the law.

A putative class action lawsuit was filed against Hanna Andersson, LLC and Salesforce.com for their alleged failure to maintain reasonable safeguards that led to a data breach. The complaint alleges that a group of hackers infiltrated the defendants’ websites with malware allowing them to extract personal information. Under Civil Code § 1798.150, a consumer is permitted to file a lawsuit if he or she can prove the business failed to implement reasonable safeguards to protect personal information. Then, if the plaintiff overcomes the applicable burden of proof, then he or she may be entitled to a minimum of $100 or maximum of $750 per consumer per incident, or actual damages, whichever is greater, as well as injunctive relief. However, there is a provision which requires giving the business an opportunity to cure the violation. In other words, the consumer must initially inform the business of the violation and grant at least 30 days to cure the violation. The business must provide a written statement that confirms the violation has been cured and no other violation will take place. Yet, the statute does not yield a safe harbor clause for the business against consumers who are seeking actual damages.

Continue Reading ›

Published on: | by

There are various ways to protect your intellectual property rights. First, you can register a copyright. Second, you may register a trademark or service mark. Third, you may register a patent. Copyrights are meant to protect literature, music, motion pictures, artistic works, photographs, essays, articles, computer programs, graphic design, and sound recordings. A trademark is a word, phrase, symbol, or design, or a combination of any of them that identifies and distinguishes the source of the goods of one party from those of others. A service mark is the same as a trademark but it identifies and distinguishes the source of a service. A patent grants a property right to the inventor. It grants the right to exclude others from making, using, offering for sale, or selling the invention or importing the invention into the United States. In general, patents are valid for 20 years from the application date.

So, in summary, trademarks, service marks, copyrights, and patents protect different types of intellectual property. Trademarks protect brand names and logos used on goods and services. A copyright protects an original artistic or literary work. A patent protects inventions. For example, if you invent a television, you should file a patent application. You would apply to register a trademark to protect the television’s brand name. You can also register a copyright for the product’s advertisement.

There have been multiple intellectual property disputes especially between e-commerce websites. For example, there was a legal battle between Amazon and Barnes & Noble regarding the “single click” or “one-click” buying mechanism. This legal action was confidentially settled between the parties. Google has been sued by multiple companies for selling their trademarks as keywords. In fact, American Airlines and Geico have instigated legal actions against it. Also, the infamous “Da Vinci Code” lawsuit was brought by several authors against the Random House Group claiming copyright infringement. The case was about an alleged copyright violation by Dan Brown who wrote the bestselling “Da Vinci Code” book. However, the court dismissed the case and stated that there was no copyright infringement by textual or non-textual copying of a substantial part of the subject book.

Continue Reading ›

Published on: | by

Electronic discovery (“eDiscovery”) rules and regulations must be understood when dealing with digital or electronic evidence. It is the concept of locating, identifying, collecting, and producing electronically stored information (“ESI”) as part of a response to production of documents in a pending legal action. Electronically stored information may include electronic messages, files, presentations, databases, voicemails, audio/video files, or websites.

Federal Rule of Civil Procedure 34 defines “electronically stored information” as writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations that are stored in any medium from which information can be obtained directly or after translation by the responding party into a reasonably usable form.

Federal Rules of Evidence 902(13) and 902(14) provide for the self-authentication of electronic evidence. So now, electronic evidence may be authenticated by certification instead of testimony. FRE 902(13) applies to electronic evidence like computer files, social media posts, and smart device information. FRE 902(14) applies to data copied from an electronic device, storage medium, or file.

Continue Reading ›

Published on: | by

The coronavirus pandemic has affected us on a national and global level. This pandemic has caused a financial and health crisis for most of us. Now, the bad actors are taking advantage of this tragic situation by engaging in online scams. For example, our law firm’s investigation has determined that they are sending emails and other types of messages to unwary individuals as a way to extract sensitive or confidential information.

The Federal Trade Commission has outlined the following steps to avoid coronavirus scams:

  • Do not pick up any kind of robocalls and do not press any numbers. Scammers are using illegal robocalls to pitch everything from scam Coronavirus treatments to work-at-home schemes.
Continue Reading ›

Published on: | by

Identity theft has been described as the use of one person’s identity by another to commit fraud. See Remsburg v. Docusearch, Inc. (2003) 149 N.H. 148, 155, 816 A.2d 1001, 1007.  This case was about an individual seeking personal information (e.g., date-of-birth, social security number, work address) about someone else from an internet-based investigation and information service company. Unfortunately, the culprit, who obtained the personal information, located and fatally shot the victim as she left work. Thereafter, the victim’s mother sued the defendants for negligence, invasion of privacy, and violation of the state consumer protection act. In response, the federal court issued an order of certification and outlined the following factual questions to be determined by the state Supreme Court:

(1) Under the common law of New Hampshire and in light of the undisputed facts presented by this case, does a private investigator or information broker who sells information to a client pertaining to a third party have a cognizable legal duty to that third party with respect to the sale of the information?

(2) If a private investigator or information broker obtains a person’s social security number from a credit reporting agency as a part of a credit header without the person’s knowledge or permission and sells the social security number to a client, does the individual whose social security number was sold have a cause of action for intrusion upon her seclusion against the private investigator or information broker for damages caused by the sale of the information?

Continue Reading ›

Published on: | by

In the past, real estate transactions were consummated by signing the dotted line with ink after printing the documents. Now, most, if not all, real estate transactions are being finalized by using electronic signatures. Technology is directly affecting real estate transactions since software programs allow the parties to electronically review and sign the papers. So, in this article, we will be discussing how technology affects real estate transactions and the relevant rules and regulations.

On June 30, 2000, the Electronic Signatures In Global and National Commerce Act (“E-SIGN Act”) was passed to ensure the validity for electronic records and signatures in commercial transactions. It was formally enacted under 15 U.S.C. §§ 7001, et seq. It actually grandfathered pre-existing contracts that were consummated between users and commercial entities in delivering electronic information. Yet, any contracts that were executed on or after October 1, 2000 are subject to the statute’s provisions.

The E-SIGN Act has several requirements. For example, a commercial institution should provide notice to the consumer and obtain prior consent. It should provide notice to the consumer regarding hardware and software requirements. It should be able to associate the electronic signature with the records. It should ensure proper retention and accurate reproduction of those records for a period that is legally required.

Continue Reading ›

Published on: | by

The Information Age has brought many advantages for us all across the globe. Now, we can instantaneously communicate with each other by email or text messages. We can connect by using videoconferencing software and see each other in real time. We can send and receive files in a very efficient manner.

Our clients want to know if a cyberthreat can be prevented before it happens. The usual answer is that a complete prevention is not possible for several reasons. First, the technology that is being used may be susceptible for using legacy or open source technologies. In most cases, the network architecture is outdated and the electronic devices may not be able to properly communicate with each other. In other words, they are as smart as the least smart device within the framework. Second, most individuals do not update their software programs on a constant basis and do not participate in training programs. Third, the executive team of an organization must ensure that their technology experts understand and efficiently use the latest tools and techniques. Fourth, it has been proven that not one organization can have sufficient threat intelligence to fend off all kinds of cyberthreats by itself. As such, it is important to strive for real-time sharing of threat intelligence.

What Is a Cyberthreat and How Does It Happen?

Continue Reading ›

Published on: | by

We have discussed the Fifth Amendment’s application to encryption and biometric information in the past. So now, the purpose of this article is to discuss biometric privacy laws. The State of Illinois has already passed several pieces of legislation to regulate biometric privacy laws. For example, it has passed the Biometric Information Privacy Act (“BIPA”) which addresses the protective measures of biometric information. The statute defines biometric information as “any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual. Biometric information does not include information derived from items or procedures excluded under the definition of biometric identifiers.” It defines a biometric identifier as follows:

A retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Biometric identifiers do not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color. Biometric identifiers do not include donated organs, tissues, or parts as defined in the Illinois Anatomical Gift Act or blood or serum stored on behalf of recipients or potential recipients of living or cadaveric transplants and obtained or stored by a federally designated organ procurement agency. Biometric identifiers do not include biological materials regulated under the Genetic Information Privacy Act. Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996. Biometric identifiers do not include an X-ray, roentgen process, computed tomography, MRI, PET scan, mammography, or other image or film of the human anatomy used to diagnose, prognose, or treat an illness or other medical condition or to further validate scientific testing or screening.

However, these rules seem to miss the mark by imposing statutory damages and fee-shifting provisions on commercial organizations. As a result, the legislators have opened the floodgates to class action lawsuits. It is important to note that biometric technology has evolved in recent years and the statutes that have attempted to regulate the technology may be outdated. Also, the recently-developed biometric equipment are capable of transforming the biometric identifier into an encrypted format which makes it unreadable or unidentifiable. Therefore, this kind of advanced technology prevents the anticipated harm, and as such, the statutory provisions should be updated by the lawmakers.

Continue Reading ›

Published on: | by

Internet privacy laws have been implemented to protect us from legal violations. These laws are meant to protect us against cyber threats and data intrusions which are designed to extract personal or confidential information (e.g., intellectual properties, trade secrets) without authorization. Data privacy is paramount when it comes to the collection, use, and storage of personal or confidential information. However, not many are taking proper steps to ensure security. These steps can include encryption, firewalls, intrusion detection systems, and two-factor authentication.

It is important to realize that even though the criminals are not personally entering your private space or domain, however, they are still able to follow your digital footprints. These digital footprints can be followed by using special tools – e.g., keylogger – which can follow you without your knowledge and consent. Also, cookies can be used to follow you around in a clandestine manner.

What are the internet privacy rules or regulations?

Continue Reading ›

Published on: | by

In general, ransomware is a type of malware (i.e., malicious software) that is designed to take control of an electronic communication device, prevent its owner from accessing the electronic communication device, notify its owner that the electronic communication device has been held ransom, demand payment from the owner, and return access to electronic communication device after payment. There have been many instances of ransomware attacks when the hackers have taken control of a company’s servers and prevented its employees from accessing the network and database servers. The hackers would notify the employees by email and demand payment of funds in order to return access to their computers. Now, in some instances, a payment was necessary, but in some exceptional cases the company owners can have an advantage over the hackers and not be required to transfer the funds.

There are several types of ransomware. First, there are applications that fall under the category of scareware and intended to create fear for the recipients and force them to purchase unnecessary software. Second, there is prankware which is intended to cause fear by sending unanticipated pictures, sounds, or videos. For example, NightMare was a type of prankware that would remain dormant on the recipient’s computer and launch itself by changing the computer screen to a skull and playing a loud noise. Third, there is a group of crypto-ransomware named as GPCode or PGPCoder that claims to use PGP encryption to prevent file access. So, in other words, it’s a virus that encrypts files on the infected computer and demands a ransom to release access to the encrypted files. The hackers have been able to become more effective with their tools. The new generation of this type of ransomware denies user access to files by writing encrypted files to a new location and deleting the original file. However, this strategy was ineffective since a file restoration would allow the victim to recover the files. Fourth, CryptoLocker became the new generation of ransomware. It shares similar distribution models of previous ransomware variants and relied on phishing attacks with portable executable attachments. It would install itself on the user’s profile folder and add a registry key to run on startup to maintain persistence. Then, it would start to communicate with the command and control server to generate an RSA-2048 key pair and send the public key to the victim host.

What are the relevant laws?

Continue Reading ›