Consider carefully what law or regulation you use to sue someone when a privacy breach occurs...
I read with great interest the FindLaw story today about the Federal court decision today that, *UNDER GRAMM-LEACH-BLILEY* a financial institution is not obligated to encrypt customer information on mobile workers or on mobile computing devices. I think the plaintiff went about this the wrong way. I wonder how the decision would have turned out if this was tested under the FTC Act as an unfair and deceptive business practice? Then, wouldn't the court have had to consider the types of security and privacy promises that Brazos had made? There is a privacy policy on the Brazos site. The policy states, "The Brazos Group (BRAZOS) is committed to preserving the individual privacy rights of all of the users of its websites. Brazos strongly believes that it has a responsibility to protect from disclosure to unauthorized parties the personally identifying information (name, address, date of birth, social security number, etc.) of its website users. Therefore, Brazos has adopted and implemented a privacy policy to protect the individually identifying account and personal information of its website users." But then as it goes on it only references the privacy of the information through the website. However, wouldn't this initial statement put them in some hot water under the FTC Act? Hmm...
Technorati Tags
Gramm Leach Bliley
compliance
privacy judgment
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine