Rite Aid Gets a Million Dollar Lesson in Privacy

July 28, 2010

About four years ago, an Indianapolis TV news station found that Rite Aid – and other pharmacies around the country – were dumping patient information in public trash bins. Based on this report, the Dept. of Health and Human Services Office of Civil Rights (OCR) opened an investigation of Rite Aid, and yesterday announced that it has reached a million dollar settlement with the drug store giant. OCR collaborated with the Federal Trade Commission (FTC) on the investigation.

The Health Insurance Portability & Accountability Act (HIPAA) requires covered entities (like hospitals, pharmacies, doctors’ offices) to protect the privacy of patient information with “reasonable” physical, technical and administrative safeguards. This includes the disposal of records and documents containing patient information. Privacy experts agree: tossing sensitive data in public trash without encryption, shredding  – or really any method of protecting the data from even your average dumpster diver – doesn’t quite measure up to “reasonable.” Not even close.

Read more »

Leave COPPA--and the Kids--Alone

July 28, 2010

In her latest Huffington Post column, CDT President Leslie Harris argues against current moves to expand the Children's Online Privacy Protection Act (COPPA) to include teens up to 17-years-old.  As the law stands, only 12-and-under are covered.  

COPPA, on the books now for a dozen years, has done yeoman like work in helping parents control what information is collected from their kids when they are online.  Websites with content dedicated to children must follow COPPA rules, which includes gaining parental consent.  However, extending those provisions "is unworkable and unwise. And because teenagers have independent rights to access information, any such law would ultimately run afoul of constitutional protections as well," Harris writes in Huffington Post.  

Harris concludes her column this way:  
 

COPPA is doing its job; there is no need to pop the hood and tinker with the law. The expansion effort is well intentioned, but the solution is shot through with privacy and free speech problems. The best move at this time can be summed up in a borrowed line from the iconic rock group Pink Floyd: "Leave them kids alone."

Read more »

CDT Issues Privacy Recommendations for PHRs

July 26, 2010

The Center for Democracy & Technology today released a report recommending privacy and security protections for personal health records (PHRs). CDT believes PHRs should be subject to comprehensive policies comprised of a mix of legal requirements and voluntary best practices. CDT’s recommendations – summarized below – are designed to preserve public trust in PHRs and enable the field to flourish.

A PHR is essentially an electronic tool that enables consumers to store, manage, use, and share their personal health information. A key characteristic of PHRs is the high degree of control the individual consumer – not the health care provider – has over the service, including what data gets uploaded to the PHR and with whom it is shared. Through PHRs, people can monitor chronic conditions, explore treatment and insurance options, ensure their health information is correct, share data with others to gain insight and support, and hold their providers to high standards of accountability. However, the success of PHRs will depend in substantial part on whether consumers trust that their sensitive information is protected.

Read more »

Sticking Up for the DMCA Safe Harbor, Again

July 26, 2010

Last month, YouTube prevailed in the blockbuster copyright lawsuit filed against it by Viacom.  The court agreed, as we had argued in a brief that we filed with a number of allies, that Viacom's crimped reading of the DMCA section 512 "safe harbor" was inconsistent with the statute and with the intent of Congress.  YouTube qualifies for the safe harbor; ergo, case dismissed.  A big vindication for the safe harbor.

But not necessarily the final word.  For one thing, the case is likely to be appealed.  But in addition, it is not the only case of its kind.  Out west, the Ninth Circuit is hearing the appeal in UMG v. Veoh -- a case that raises essentially the same issues, with plaintiffs again seeking to radically pare back the safe harbor provision to exclude a video sharing site.  On Friday, CDT joined EFF and other allies to weigh in, again explaining the rationale and importance of the safe harbor provision.  

Significantly, this case is already at the federal appeals court stage -- meaning that it may be this case, not Viacom v. YouTube, that sets the initial precedent at the appeals court level. 

Read more »

Congress Surveys Consumer Privacy Landscape

July 23, 2010

Privacy is a building block of trust in this digital age; and yes, there's an "app" for that.  It's called a federal baseline consumer privacy bill, it just hasn't passed… yet.  

CDT President Leslie Harris testified yesterday at a hearing of the House Subcommittee on Commerce, Trade, and Consumer Protection examining two current privacy bills; the Best Practices Act (H.R. 5777) from Subcommittee Chairman Bobby Rush and a draft bill from from Congressmen Rick Boucher.  In her written testimony Harris said:
 

Read more »

What if You Had a National Strategy and Nobody Cared?

July 23, 2010

Earlier this month, the White House released its draft National Strategy for Trusted Identities in Cyberspace (NSTIC). This week, CDT submitted comments as part of the public comment process on the National Strategy.

CDT has written about the National Strategy before.  We welcome the National Strategy to the conversation because it has the ability to motivate private digital ID technology efforts and ensure that they are compatible with those developed by the government.
The government will be one of the major consumers of identity, for example, for delivery of online services to citizens and the authentication of contractors and employees, so the government has a built-in interest in the success of online identity systems.

Identity technologies are often criticized as disparate, and the "open pile" approach needs a central organization that can encourage innovation. The Federal government can have a positive effect on the field by setting standards and creating incentives for a diverse system.

Read more »

CDT Announces Four New Board Members

July 20, 2010

CDT Completes Transition to New Board with Election of Four New Members

WASHINGTON – The Center for Democracy & Technology today is pleased to announce four new board members:  Bill Bernstein, member of the law firm Manatt, Phelps & Phillips; Pamela Jones Harbour, former FTC Commissioner; Doug Lowenstein, President and CEO of the Private Equity Council; and Jimmy Wales, founder of Wikipedia.  

With the appointment of these individuals, CDT completes the two-year transition to a new board. At a time when the issues facing the Internet are becoming increasingly complex and global in nature, the wisdom, insight, and leadership of our board will strengthen CDT and help advance its mission of keeping the Internet open, innovative, and free.  CDT board members serve for three years.   

"The new Board members bring enormous talent and a diversity of relevant experiences to our organization," said CDT President Leslie Harris.  "Our ability to attract thoughtful, independent, and impassioned leaders has always been one of our key assets," Harris said.  "Our new board members share our vision for the Internet and a dedication to CDT's mission. They are committed to sustaining CDT’s growth and expanding the organization’s global influence.”

CDT's new board members:

Read more »

Crawford on the Status of DNS

July 20, 2010

One of the main sticking points in the FCC debate over reclassifying Internet service is likely to be whether DNS service makes carriers’ entire offering into a unified information service instead of a telecommunications service, as the FCC found in 2002.  Our comments argue that it should not, because of an exception for the “management, control, or operation” of a telecommunications service.

CDT Fellow Susan Crawford has written a short overview of the arguments here.

Read more »

New Bill Adds Momentum to Push for Consumer Privacy Law

July 20, 2010

Congressman Bobby Rush, (D-Ill.), Chairman of the House Energy and Commerce Committee's Subcommittee on Commerce, Trade, and Consumer Protection, has released his draft of a bold consumer privacy bill, called the Best Practices Act.

In May, Rep. Boucher, Chairman of the House Energy and Commerce Committee’s Subcommittee on Communications, Technology and the Internet, reinvigorated the conversation around baseline consumer privacy legislation when he circulated a draft consumer privacy bill for comment.  Chairman Rush’s bill builds on the groundwork of Boucher's draft but goes further to include a full set of fair information practices. 

Both the Rush bill and the Boucher draft address basic concerns of consumers. A Zogby poll released last month found that 88% of Americans believe that companies "tracking where an Internet user goes on the Internet without the user's permission is an unfair business practice," and a September 2009 study showed that over 60% of Americans believe there should be laws prohibiting advertisers from retaining data about them.

Read more »

Congestion Lessons from the World Cup

July 19, 2010

While soccer fans across the globe have been captivated with the excitement of the World Cup during the last month, vendors of DPI-based technologies have been casting their focus there as well. I recently came across a number of different vendor reports and musings (from Arbor, Allot, and Sandvine) about the impact of World Cup viewing on the Internet, and they got me thinking about the relationship between changes in Internet user behavior and application-specific congestion management.

Read more »