In the U.S., Kentucky has become the 47th state to pass a breach notification bill and Wisconsin has passed a social media law and expanded the collection of DNA from arrested individuals. The U.S. House passed bipartisan legislation aiming to protect information held in vehicle event data recorders; the Canadian Senate is considering the Digital Privacy Act, offering new protection for consumers and increased powers for the federal privacy commissioner, and the Court of Justice of the EU invalidated the EU Data Retention Directive. In this week’s Privacy Tracker legislative roundup, read more about all these developments and also what the FTC v. Wyndham decision may, or may not, mean for the future of U.S. privacy regulation. 

LATEST NEWS

Canada’s “Fair Elections Act” May See Constitutionality Challenge
Changes made to the ID requirements under Bill C-23 would eliminate voter-vouching, which election experts say would disenfranchise thousands of voters, The Canadian Press reports. The government has successfully argued in BC courts that the changes are unconstitutional and may now go to the Supreme Court of Canada. Brent Olthuis, the lawyer representing the three voters fighting voter ID rules, wrote in his application to the court, “Regardless of whether that bill (C-23) is ultimately passed, this case offers the court the opportunity to offer guidance to Parliament—and for that matter to the provincial legislatures and the wider public debate—about the constitutional issues engaged by voter ID legislation.”

Driver Privacy Act Cruises On to U.S. Senate
The Senate Commerce Committee has approved the Driver Privacy Act, which makes a vehicle owner the owner of the information collected by the “black box” recorder in the vehicle. Sen. Amy Klobuchar’s (D-MN) said, “Event data recorders can play a key role in improving vehicle safety, but we need to make clear that the owner of the car is the rightful owner of the data collected by an event data recorder.” Fourteen states have passed similar legislation, but those laws only apply to drivers in those states. Klobuchar’s bill now has 23 cosponsors from both sides of the aisle.

Colorado House Approves Education Privacy Bill
The Colorado House approved a number of education bills recently, one of which was HB 14-1294, setting data-handling requirements for the Colorado Department of Education (CDE). The bill would require CDE to create a “data security template” for the use of school districts, make available to the public what data it holds and with what third parties data is shared and set formal requirements for the sharing of data, reports ChalkBeat. While the bill would mean the CDE cannot sell student data for commercial use, it fails to provide for parental opt-out and data security mandates on local districts, the report states. 

Illinois Senate Approves Location Privacy Bill
The Illinois Senate has approved SB 2808, which requires law enforcement to obtain a tracking order, similar to a search warrant, prior to using location tracking devices in a criminal investigation, reports Evanston Now. Sen. Daniel Biss (D-Evanston) says, “Location tracking is just one of many technologies that have advanced rapidly beyond the capacity of existing state law to regulate their use by law enforcement,” adding that while the bill affords individuals privacy protections, it doesn’t “hamstring” investigators. The legislation contains exceptions for emergency situations and now heads to the House for discussion.

Kentucky Passes Breach Notification Law
Kentucky has become the 47^th state to enact a data breach notification law with the signing of HR 232, reports the National Law Review. Similar to other state notification laws, Kentucky’s requires that the breached entity notify those affected in the “most expedient time possible and without unreasonable delay,” and notice may be provided in writing or by electronic means within the requirements of the E-Sign Act. The law also specifically protects student data held by educational institutions in the cloud, prohibiting them from “processing student data for any purpose other than providing, improving, developing or maintaining the integrity of its cloud computing services, unless the provider receives express permission from the student’s parent.” 

Louisiana House Passes Student Privacy Bill
The Louisiana House unanimously passed a bill that would require the state’s Department of Education to attach ID numbers instead of Social Security numbers to student data and place restrictions on accessing data, reports The Times Picyune. Rep. John Schroder (R-Covington), who sponsored the bill, said there’s “an urgent need to protect students' privacy,” noting, "Currently, we have no law protecting student data.” The bill now goes to the Senate.

Wisconsin Gets Less Restrictive DNA Collection and Social Media Privacy Bill
Wisconsin Gov. Scott Walker signed a number of bills into law last week, including a DNA collection bill and a social media privacy bill, Fox News reports. The DNA collection bill allows police to collect DNA from individuals arrested for a felony or convicted of a misdemeanor, while currently they can collect DNA only from convicted felons and sex offenders. The report states that the bill requires the samples be held in the state crime lab and not be analyzed unless probable cause is established. The new social media bill prohibits employers to require from employees and applicants login information for personal online accounts.

U.S.

Marketers Concerned About Franken's Anti-Stalking Bill
A bill introduced by Sen. Al Franken (D-MN) last month is facing criticism from the marketing industry, Time reports. The bill proposes to ban mobile apps that track mobile phone locations. At the time, Franken said, “My bill would finally put an end to GPS stalking apps that allow abusers to secretly track their victims.” The Interactive Advertising Bureau’s (IAB) Sarah Hudgins said it “could happily support” the anti-stalker portion of the bill, but, “Unfortunately, it’s sort of two bills in one,” and the IAB worries the bill could hamper the mobile marketing industry. A representative from the National Center for Victims of Crime said, “All we’re saying … is, basically, you have to get somebody’s permission before you can get their geolocation information.”
Full Story

SCOTUS To Hear Two Cellphone Privacy Cases
The Supreme Court is set to hear two cases this month involving warrantless searches by law enforcement of suspects’ cellphones, NorthJersey.com reports. Vanderbilt University Law Prof. Christopher Slobogin said, “Technology changes the nature of the game … The justices would need to rethink what the Fourth Amendment is all about.” One case involves a suspected drug dealer in Boston, MA. Police searched the suspect’s phone without a warrant, thereby determining where he lived. The other case involves an individual whose cellphone, which contained photos of gang-related activity, was seized when he was pulled over for an expired registration. He was later convicted of attempted murder. A number of civil liberties and privacy groups have filed amicus briefs.
Full Story

Court Rules FTC Has Data Security Authority
In what many are calling an important ruling, a federal court in New Jersey has shot down a challenge to the Federal Trade Commission (FTC) by Wyndham Hotels. In round one of the challenge, Wyndham argued the FTC overstepped its authority by suing companies for poor data security practices. The ruling by U.S. District Court Judge Esther Salas, however, denied the hotel chain’s motion to dismiss, saying the case can move forward. Salas noted her ruling “does not give the FTC a blank check to sustain a lawsuit against every business that has been hacked” but added there is “binding and persuasive precedent” upholding the FTC’s authority. This exclusive for The Privacy Advisor looks at the decision and rounds up the day’s reaction to the case.
Full Story

Courts Say FTC Can Punish Rulebreakers. Industry Asks: What Are the Rules?
If anyone was having a case of the Mondays this week it was Wyndham Hotels and Resorts, after a District Court of New Jersey judge denied the company’s motion to dismiss a Federal Trade Commission (FTC) lawsuit alleging Wyndham violated Section 5 of the FTC Act. Some say it’s a landmark decision that emboldens the FTC’s authority as a de facto privacy regulator and could even thwart national privacy legislation, while others say the decision simply gives the FTC the power to regulate concepts that aren’t well defined, as they haven’t been proscribed succinctly for companies aiming to comply with rules effectively created piecemeal via FTC consent decrees. In this exclusive for The Privacy Advisor, Angelique Carson, CIPP/US, rounds up reaction from industry, academia and activists regarding a case that may be closer to the starting line than the finish line.
Full Story

Opinion: In Standoff with FTC, Wyndham Shoots Itself in the Foot
In response to Monday’s federal court ruling allowing the Federal Trade Commission (FTC) data security case against Wyndham Hotels to proceed, IAPP VP of Research and Education Omer Tene writes the decision “paves the way for increasing privacy and data security action by the agency, which over the past decade has asserted itself as the most forceful and well-respected privacy enforcement authority in the world.” In this exclusive for Privacy Perspectives, Tene looks at the ruling and explains why it’s a “wakeup call to anyone who has doubted the emergence of an FTC privacy and data security jurisprudence…”
Full Story

Opinion: Wyndham Doesn't Mean the Sky is Falling
This week’s ruling in FTC v. Wyndham has made waves in the privacy world and garnered plenty of media coverage, including reports that it’s the “most important federal court decision on data security enforcement” and that it’s “a major win for the agency.” Based on such reports, writes Covington Burling’s Jeff Kosseff, CIPP/US, “one would think that the sky is falling on efforts to resist FTC enforcement actions relating to data security.” Instead, Kosseff offers a different take on the case: “The sky is not falling … Indeed, it may even be safe to say that nothing has changed in this past week.” In this post for Privacy Perspectives, Kosseff discusses his reasoning and where the privacy community may be better served to focus its attention.
Full Story

Amnesty for Sharing Cyber-Threat Warnings
The Obama administration is asking companies to work together to battle hackers, National Journal reports. The Justice Department and the Federal Trade Commission (FTC) have issued a formal policy statement assuring businesses they won’t face federal lawsuits for sharing data with each other on computer system attacks, the report states. “This statement should help private businesses by making it clear that antitrust laws do not stand in the way of legitimate sharing of cybersecurity threat information,” said FTC Chairwoman Edith Ramirez. Meanwhile, the Department of Homeland Security’s privacy office said sharing cyber-threat information with the private sector presents some “modest privacy risks.”
Full Story

Groups Call Out SEC for Stymying ECPA Reform
A number of advocacy groups have called out the Securities and Exchange Commission (SEC) for making “contradictory and misleading statements” in its opposition to reform of the Electronic Communications Privacy Act (ECPA), The Hill reports. The SEC has been one of the leading opponents to ECPA reform. The groups did agree with a proposed amendment by Sen. Patrick Leahy (D-VT), aimed at satisfying concerns of the SEC, that would ensure “ECPA cannot be used to shield data in the cloud from ordinary discovery techniques,” by permitting the SEC to use subpoenas to access data held by third-party service providers during an investigation, the report states. Meanwhile, Future of Privacy Forum Founder and Co-Chair Christopher Wolf writes about the need for ECPA reform.
Full Story

CANADA

Government Proposes Digital Privacy Act
Industry Canada reports on the introduction of the Digital Privacy Act in the Canadian Parliament. The act offers new protection for consumers, fines for companies that breach the act and increased powers for the federal privacy commissioner. The act is part of the government’s Digital 150 plan, which has set a path for the country’s digital future. Under the act, organizations could face fines of up to $100,000 per individual if they fail to notify the privacy commissioner and affected customers of a data breach. Meanwhile, The Globe and Mail reports that in the past year, the Canada Revenue Agency has fired 14 employees and suspended another 18 for inappropriately accessing computer files.
Full Story

Experts: FATCA Is Unacceptable
In a feature for The Globe and Mail, Queens University Law Prof. Arthur Cockfield and McGill University Heward Stikeman Chair in the Law of Taxation Allison Christians write about the implications of the U.S. Foreign Account Tax Compliance Act (FATCA) for Canadians. “For the first time in Canadian history, our federal government is preparing to provide a foreign government with sensitive personal financial information about hundreds of thousands of Canadians. It is doing so to stave off threatened economic sanctions, and is getting nothing in return,” the report states. The Canadian government is set to implement FATCA by July 1, they write, adding, “This move is unacceptable as it gravely threatens Canadian financial privacy.”
Full Story

Yukon Commissioner: Override Provision Needed
CBC News reports Yukon government officials are sorting “through hundreds of documents for information on how residential school students died in Yukon,” but privacy laws are making it difficult “to get the full picture.” Yukon's Information and Privacy Commissioner Diane McLeod-McKay believes the province “needs a provision to override privacy laws when there's a clear public interest,” the report states. “I think it's something they should consider,” she said, “so they don't run into problems where there is clearly a compelling public interest to have access to information that would otherwise be exempted from disclosure.” Yukon’s government is reviewing her suggestion.
Full Story

EU

Court: EU Data Retention Directive Invalid
The Court of Justice of the EU has ruled the Data Retention Directive is invalid. The court believes that “by requiring the retention of those data and by allowing the competent national authorities to access those data, the directive interferes in a particularly serious manner with the fundamental rights to respect for private life and to the protection of personal data.” The European Data Protection Supervisor (EDPS) welcomed the ruling. “We consider this a landmark judgment that limits the blanket government surveillance of communications data … permitted under the directive,” the EDPS wrote. Simon McGarr, a lawyer for Digital Rights Ireland said, “The court has rejected the principle of mass surveillance of EU citizens without suspicion and says it’s incompatible with the charter of fundamental rights.” Hunton & Williams points to five main criticisms the court had with the directive.
Full Story
                                                                                                                 
Court Ruling Gives Boost to EU Data Protection Reform
On Tuesday, the Court of Justice of the EU invalidated the EU Data Retention Directive, prompting Wilson Sonsini’s Christopher Kuner to note, “Beyond its significance for data retention, this judgment has important implications for EU data protection law in general and the proposed General Data Protection Regulation in particular.” In this post for Privacy Perspectives, and while cautioning “the exact implications of the judgment will only become clear in the coming weeks,” Kuner looks into a number of implications that may result from what he calls “a milestone in EU data protection law,” including how it could affect the EU-U.S. Safe Harbor agreement and “whatever system of data retention the U.S. may be considering.”
Full Story

CJEU: DPA Firing Violated EU Law
The Court of Justice of the European Union (CJEU) has determined “Hungary violated European Union law by firing the head of its data protection agency (DPA) in 2012,” The Wall Street Journal reports. In its judgment Tuesday, the CJEU found national DPAs “must not be bound by instructions of any kind” and their decision-making processes “must be free from political influence,” noting if a government can fire staff before their terms’ end, “that authority might be prompted to enter into a form of prior compliance with political powers.” The CJEU has ordered Hungary to comply “without delay” but has not specified “what form compliance should take,” the report states. (Registration may be required to access this story.)
Full Story

Commission Proposes Drone Standards
The European Commission is proposing the EU “set strict standards for the operation of civilian drones,” European Voice reports, including “rules on safety, security and the protection of personal data.” The commission has recommended privacy be continually monitored as “the capacity to store ever-increasing amounts of data may raise ethical and data protection concerns.” European Commissioner for Transport Siim Kallas said, “Many people, including myself, have concerns about drones' safety and security … Now is the time to act because the industry is still in its infancy.” Meanwhile, ZD Net reports The Netherlands’ Parliament “has approved legislation that will allow drones to be used for video surveillance of the country's citizens.”
Full Story

German DPAs Share Position on “One-Stop Shop”
Out-Law.com reports on German DPAs’ outlining their position on the proposed “one-stop shop” in the EU’s General Draft Data Protection Regulation. The “one-stop shop” proposal would require oganisations operating in the EU “to engage with just one DPA, in the country of their ‘main establishment,’ rather than every DPA in the EU member states they are active in.” The German DPAs believe authorities “should have powers to protect the privacy of people in the country in which they are based even if organisations serving those people are based elsewhere,” the report states.
Full Story

ASIA PACIFIC

AMSRO Develops Privacy Code
Following the release of the Privacy Amendment Act in March, the Association of Market & Social Research Organisations (AMSRO) has developed a privacy code for its members, Ad News reports. AMSRO is the only industry body seeking to register a non-mandatory Australian Privacy Principles code, the report states, noting, “AMSRO’s Market and Social Research Privacy Code 2014 has now moved to public consultation as a draft code; once registered the code will operate in addition to the new Privacy Amendment Act.” AMSRO President Nicola Hepenstall said “it was important that we redeveloped our own industry code to reflect the new Privacy Act. AMSRO pioneered its own privacy code for members in 2003, which won an Australian Privacy Award in 2009.”
Full Story