Privacy Compliance & Data Security : Data Security Lawyer & Attorney : Fox Rothschild Law Firm : Privacy Rights, Security Breach Responses

The Supreme Court of the United States has ruled in Federal Communications Commission, et al. v. AT&T Inc., et al. (slip opinion - PDF link) that business entities have no personal privacy rights under the Freedom of Information Act (FOIA) (PDF link).  The ruling was unanimous and arose from a Third Circuit decision.

There are several exemptions built into the FOIA, whereby federal agencies do not have to make certain information available when requested.  Exemption 7(C) pertains to law enforcement records that, if disclosed, “could reasonably be expected to constitute an unwarranted invasion of personal privacy.” 5 U. S. C. §552(b)(7)(C).  The issue addressed was whether corporations have "personal privacy" for purposes of exemption 7(C).

AT&T was investigated by the Federal Communications Commission in connection with AT&T's participation in the FCC's E-Rate (Education-Rate) program for schools and libraries.  As a result, AT&T disclosed to the FCC that it may have overcharged the Government for its services in connection with the E-Rate program.  During the resulting investigation, AT&T disclosed various information to the Government, including billing information, name and job descriptions of employees involved and AT&T's conclusion regarding wrongdoing by its own employees.  The matter was resolved in December 2004 and AT&T paid $500,000 and instituted a plan to ensure the incorrect billing did not occur again.

CompTel, "a trade association representing some of AT&T's competitors," submitted a FOIA request in connection with the E-Rate program investigation.  The FCC's Enforcement Bureau did withhold some competitive information, as well as names and other personal information related to AT&T's employees.  However, the Enforcement Bureau did not apply exemption 7(C) to AT&T itself because "businesses do not possess 'personal privacy' interests as required by the exemption."

AT&T took the position the root term “person” in the phrase "personal privacy" refers to "persons" as defined under the Administrative Procedures Act. The definition of "person" under the Administrative Procedures Act includes several types of business entities, specifically, corporations.  The FCC concluded that AT&T's position that it is “a ‘private corporate citizen’ with personal privacy rights that should be protected from disclosure that would ‘embarrass’ it . . . within the meaning of Exemption 7(C) . . . at odds with established [FCC] and judicial precedent,” and concluded that “Exemption 7(C) has no applicability to corporations such as [AT&T].”

The Court of Appeals for the Third Circuit agreed with AT&T, and the FCC petitioned the United States Supreme Court for review, and the Third Circuit holding was overturned.

Chief Justice Roberts delivers a thoughtful analysis of why the terms "person" and "personal" should not be read to give business entities "personal privacy rights," which you can read in detail in the opinion (PDF link).  In a final wink, nudge and affirmation of his reasoning, Chief Justice Roberts concludes the analysis by stating that "[w]e trust that AT&T will not take it personally." 

• Print
• Comments
• Trackbacks
• Share Link

 With the ever-growing popularity of social networking sites, and with so many employees exercising poor judgment online, it's easy to understand why employers are concerned about the messages and images that that their employees are disseminating on these websites.

For employers, the costs are real: Poor choices by their employees can bring with it not only bad publicity but the loss of confidential information and the risk that the employer and employee will be sued by a third party for a wide range of legal claims, including defamation, invasion of privacy, negligence, discrimination, false light publicity, public disclosure of private facts, infliction of emotional distress and violations of state and federal data breach laws.

Employees seem to comprehend the potential effect of their online rants. According to the 2009 Deloitte Ethics and Workplace Survey, 74 percent of employees believe it is easy to damage a company’s reputation on social media sites. Yet, many conduct themselves as they have a right to do so. Fifty three percent of the employees surveyed believe that an employee’s social networking page is not their employer’s business, and nearly one third said they never consider what their boss would think before posting material online. 

Social media content is also becoming a new source of evidence in employment cases. Employers view such material as a unique way to identify false statements employees make in these cases.  Employees, however, often view their employer’s interest in such content as an invasion of their privacy.

These divergent viewpoints are creating new tensions in the workplace and new issues for the courts to address.  I have written an article in the New Jersey Law Journal this week discussing these issues and trends.   To view the article, click this link.

• Print
• Comments
• Trackbacks
• Share Link

 A complaint (PDF link) seeking class action status on behalf of all high school students at Harriton High School and Lower Merion High School (the “High Schools”) in the Lower Merion School District (the “School District”) in suburban Philadelphia was filed on February 16th.

Apparently, the School District maintains a program whereby all high school students at the High Schools are provided with a laptop in connection with their educational endeavors. Like most modern laptops, apparently these laptops include a webcam embedded in the laptop bezel.

The Complaint alleges that students and parents were never told that the School District (and its agents) have the ability (or would) to remotely activate the webcam. The Plaintiffs cite all documentation provided with the laptop and on the School District’s online resources as further support that they were never told of this remote activation/capture ability. Once activated, the School District can apparently then view and capture whatever is happening within the view of the webcam. Plaintiffs point out that this activity occurs regardless of whether anyone is sitting in front of the webcam, and captures the entire viewing area of the webcam.

• Print
• Comments
• Trackbacks
• Share Link

Ars Technica reported yesterday about a graduate student at Indiana University's School of Informatics and Computing that has compiled documents and recordings obtained through Freedom of Information Act requests that support that Sprint/Nextel has provided GPS location data about Sprint’s wireless customers to law enforcement over eight (8) million times in just over one year.

• Print
• Comments
• Trackbacks
• Share Link

A young woman in Coalinga, California, following a visit home from college, penned to her MySpace page “An ode to Coalinga” (the “Ode”).  The Ode opens with “the older I get, the more I realize how much I despise Coalinga” and then proceeds to make a number of extremely negative comments about Coalinga and its residents.  She removed the Ode from her MySpace page within six days of posting it.

However, during the six days that the Ode was posted on MySpace, the principal of Coalinga high school discovered the Ode and sent it to his friend, the editor of the local paper, the Coalinga Record.

The editor of the Coalinga Record republished the Ode as a “Letter to the Editor,” adding the author’s last name (which was not present on the MySpace page).  The author and her family received death threats, and a shot was fired at the family home, forcing the family to move out of Coalinga.  Due to severe losses, her father closed the 20-year-old family business.

The California Court of Appeal, in Moreno et al. v. Hanford Sentinel, Inc., et al., F054138, slip op. (Cal. Ct. App. April 2, 2009) (PDF link) ruled that the principal did not invade the author’s privacy when he handed it over to the Coalinga Record.  The court further held that the editor of the Coalinga Record did not violate the author’s rights when it published her full name.

• Print
• Comments
• Trackbacks
• Share Link