Hot Legal Topics for Mobile Playing offense & defense

1. Hot Legal Topics for Mobile Playing offense & defense Robin Luce Herrmann Butzel Long

2. Agenda • Mobile Data Management • Personal Identifying Information • Protected Health Information • Geolocation Issues Affirmative Obligations: Offense Resisting Inquiry: Defense

3. iPhones Now Top 5% Of Total E-CommerceWebsite Traffic

4. Playing Offense

5. Management of Mobile Data: Personal Identifying Data With the advent of online and mobile transactions which collect individual identifying information, data protection protocols have become more important. Although various legislative strategies have been adopted (both federally and on a state by state basis), this area is rapidly evolving.

6. Personal Identifying Information • Personally Identifiable Information (PII), is information that can be used to uniquely identify, contact, or locate a single person or can be used with other sources to uniquely identify a single individual. • The abbreviation PII is widely accepted, but for legal purposes the effective definitions vary depending on the jurisdiction and the purposes for which the term is being used. • The pertinent issue is Information Security. • Although the concept of PII is old, it has become much more important as technology has made it easier to collect PII through breaches of internet security, network security and web browser security, leading to a profitable market in collecting and reselling PII. PII can also be exploited by criminals to stalk or steal the identity of a person, or to plan a person's murder or robbery, among other crimes. • As a response to these threats, many website privacy policies specifically address the collection of PII, and lawmakers have enacted a series of legislation to limit the distribution and accessibility of PII.

7. PII Examples • IP address (in some cases) • Driver’s license number • Face • Credit card numbers • Digital identify • Date of Birth • Birthplace

8. Potential PII Examples • Place of residence • Name of school(s) attended • Workplace • Grades • Salary • Job position

9. Legislation to Protect PII • The U.S. Senate proposed the Privacy Act of 2005, which attempted to strictly limit the display, purchase, or sale of PII without the person's consent. • Similarly, the (proposed) Anti-Phishing Act of 2005 attempted to prevent the acquiring of PII through phishing.

10. Business & PII • Legislation is often seen as a barrier to progress & requiring an attorney just to engage in simple business practices (i.e., user registration). • Preference is for laws that stress “acceptable uses” of PII.

11. Children’s Online Privacy Protection Act (“COPPA”) • Passed to add protections when an internet site sought to collect PII from children under 13. • On Aug. 1, the FTC proposed amendments to keep up with changes

12. Changes to COPPA • Until now the person responsible for compliance was the “operator” of the website, presumably the party that was collecting the PII from children. • That has changed. A large number of websites contain links to Facebook and other social media, which may ask for and obtain PII even if the primary “operator” does not. Other devices, including pop-up ads on a web page, may also be used to gather PII. • Now, an operator of a child-directed site or service that chooses to integrate the services of others that collect personal information from its visitors should itself be considered a covered operator under the Rule.

13. Management of Mobile Data: Protected Health Information As Tele-Medicine enters the scene, often supported through mobile interfaces, HIPAA compliance will be a key area of concern

14. PHI and PII • One of the primary focuses of the Health Insurance Portability and Accountability Act (HIPAA), is to protect a patient's PII.

15. More HIPAA • HIPPA required the Secretary of the U.S. Department of Health and Human Services (HHS) to develop regulations protecting the privacy and security of certain health information. • HHS published what are commonly known as the HIPAA Privacy Rule and the HIPAA Security Rule. • The Privacy Rule, or Standards for Privacy of Individually Identifiable Health Information, establishes national standards for the protection of certain health information. • The Security Standards for the Protection of Electronic Protected Health Information (the Security Rule) establish a national set of security standards for protecting certain health information that is held or transferred in electronic form. • The Security Rule operationalizes the protections contained in the Privacy Rule by addressing the technical and non-technical safeguards that organizations called “covered entities” must put in place to secure individuals’ “electronic protected health information” (e-PHI).

17. The HIPAA Security Rule – and YOU! • The Security Rule requires covered entities to maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting e-PHI. • Specifically, covered entities must: • 1. Ensure the confidentiality, integrity, and availability of all e-PHI they create, receive, maintain or transmit; • 2. Identify and protect against reasonably anticipated threats to the security or integrity of the information; • 3. Protect against reasonably anticipated, impermissible uses or disclosures; and • 4. Ensure compliance by their workforce

18. Management of Mobile Data: Geo-location With the advent of geo-location programs utilizing LinkedIn, Foursquare, Twitter and other mobile apps, the management and use of geo-location data has become critical.

19. It’s all about Location, Location, Geo-location… • Although pulled from the market in April 2012, the Girls Around Me app was able to locate women near an individual’s Foursquare check-in site • The most “invasive” geo-location tool released to date is Creepy (the program’s real name, which is widely believed to be an accurate description), a “geo-location information aggregator” app that locates an individual’s coordinates using Twitter or other social media when they log on with their phone

20. I complied with all these &^%#&( security protocols…..

21. There’s nothing more to worry about…..Right?

22. WRONG!!!Other folks may be interested in getting the information being gathered

23. Playing Defense

24. Look at Google alone…. • Google said in June that government agencies across the United States sought user data 6,321 times for the six months ending December 2011, up from 5,950 the six months prior. • Google said the U.S. government targeted 12,243 Google accounts, compared to 11,057 in the six months before. • But neither Google nor any other ISP releases how many times it turns over user data in the United States without a probable-cause warrant. It is highly likely that the numbers are too frightening.

25. The Law is Clear as mud… The 6th Circuit Court of Appeals has said that there is a reasonable expectation of privacy in emails stored in a 3rd party server. But, just this week held that a man did not have a reasonable expectation of privacy in the data emanating from his cell phone that showed its location. • Another Federal Court said it was ok to have an ISP install a monitoring device that recorded a target’s IP address, to/from email addresses & volume sent from the account.

26. More mud…. A federal judge has upheld the practice of police using seized phones to impersonate their owners, reading messages and sending entrapping replies to contacts in the phone's memory, without a warrant. The judge reasoned that constitutional privacy rights don't apply to messages if they appear on a seized device -- even if the messages originated with someone who has not been arrested or is under suspicion of any crime.

27. And more mud • Another court held that cell phone location records could not be disclosed without a warrant.

28. And it isn’t just the Government that is interested Trolls • Litigants • Public officials looking for leakers/whistleblowers

29. No Evident PII - Anonymous Posters There are instances where businesses seek to unmask an anonymous poster or may be the recipient of a subpoena to unmask and anonymous poster. This is a complex area of privacy law and is currently unsettled in Michigan, the 6th Circuit, and various state and federal jurisdictions.

30. Wireless Surveillance Act of 2012 • In the wake of an investigation that revealed over 1.3 million law enforcement requests for mobile phone info from providers, this month Rep. Ed Markey (D-Mass.) released a draft of a bill, the Wireless Surveillance Act of 2012, that would put some limits on those requests, including requiring a court order for location tracking. • The new law would: • require the FCC to set limits on how long carriers can keep customer personal information. • require law enforcement to make regular disclosures of the volume and nature of their requests. • Would curb data dumps from cell towers that yield info on large groups of users, in part by requiring requests to be more targeted. • would require a judge to authorize the release of location tracking info, and only for probable cause that the info could uncover evidence of a crime. The Justice Department has argued that law enforcement wants more access to that data, not less, in order to track down criminals.

31. Amendment of Electronic Communications Privacy Act • Attempt to re-write legislation that generally grants the government wide powers to access cloud-stored data without a probable cause showing.

32. QUESTIONS ?