Archive for the ‘Privacy and Compliance’ Category

BONY Loss Of Backup Tape With Unencrypted PII Is Disappointing…But Not Surprising

Tuesday, May 27th, 2008

Late last week I communicated with Linda McGlasson about a story she was putting together for bankinfosecurity that was published today, “Bank of New York Mellon Investigated for Lost Data Tape: 4.5 Million Customers Potentially Exposed.”
It’s a good and interesting article; check it out.
In Linda’s article there was a quote from Bank of New York (BONY) Mellon’s spokesperson Ron Sommer,

(more…)

Do Your Terms Of Use Try To Gut Your Privacy Policy Promises?

Sunday, May 18th, 2008

I see a growing trend in organizations trying to gut the promises made in their website privacy policies through sneaky wording they place in their rarely read “Terms of Use” statements.
Over the past few months I have heard from some CISOs and CPOs who are concerned at some of the wording that their legal counsels are suggesting they put on their web sites. And rightly so. Why? Because the considered “Terms of Use” statements seem to be, 1) trying to eliminate all liability to the organization for anything bad that happens to the personally identifiable information (PII) submitted to or accessed from the site; 2) basically nullifying the posted privacy policy; and 3) trying to require the website user to agree to these terms just by using the site…no active acknowledgment or agreement necessary.
Here is a composite from around half of a dozen of these worrisome passages from the considered drafted Terms of Use statements that I’ve seen…

(more…)

SEC Regulation S-P Proposals To Improve The Security Of Customer Information Within Brokerage Shops

Friday, May 16th, 2008

Do you work for a brokage house, have a subsidiary that is a brokerage house, or do any type of work with a brokerage house? If so, then you should be aware of the Securities and Exchange Commission (SEC) proposed changes to Regulation S-P in March of this year.
In general, the proposed amendments to Regulation S-P…

(more…)

At the Secure 360 Conference

Monday, May 12th, 2008

Tomorrow and Wednesday I’m doing some sessions at the Secure 360 conference in St. Paul, Minnesota. I’m really looking forward to also seeing the other sessions while here (yes, I’ve arrived and getting some work done in my room)!

(more…)

A Couple Of Little Known HIPAA Facts

Thursday, May 8th, 2008

Last week I was contacted by Corey Goodman, a reporter for HCPro, about a story he is doing that sounds like it will be quite interesting! He is collecting examples and anecdotes about “little know HIPAA facts” and asked me to contribute some for his article.
I anticipate that he will be cutting the couple of little known facts I provided to him down quite a bit, so I wanted to provide them here not only as a future reference for myself, but also for those of you who may be interested!

(more…)

Another Example Of How Internet Information Impacts Employment Decisions

Wednesday, May 7th, 2008

I’ve blogged several times about how employers are inreasingly using information found on the Internet to make hiring, and firing, decisions, such as here and here.
I’ve also written about it several times, such as here.
Here’s another example to add to your files for how information posted to social networking sites, such as MySpace and Facebook, can impact your employment situation where a woman graduating with an education degree was denied teaching credentials, and this is not the first time a situation has occurred similar to this…

(more…)

Click Wrap Contracts: Creating Them And Agreeing To Them

Monday, May 5th, 2008

There was an interesting article in this week’s issue of Privacy and Security Law, “Clickwrap Notifying Software Recipients Of Pop-Up Installation Is Valid, Enforceable” (a subscription site).

(more…)

What Business Leaders Need To Know About Employee Privacy

Sunday, May 4th, 2008

Here it is May, and I’m just now getting all of my April IT Compliance in Realtime Journal articles blogged about! Being in Las Vegas for a week at CSI SX / Interop really put a monkey wrench in my blogging activity last week.
While at the conference I spoke with many information security and IT leaders about privacy. Most have customer privacy on their minds, but a significant portion have not thought about employee privacy issues.
So, this article, “What Business Leaders Need To Know About Employee Privacy,” which is the third in my April IT Compliance in Realtime Journal issue, is pretty timely.
Download the April issue to get a much prettier, formatted version. Here is the unformatted article…

(more…)

Using DNA Of Family Members To Catch Criminals

Thursday, May 1st, 2008

I just read an interesting article, “Using kin’s DNA to track suspects.”

(more…)

Do We REALLY Need Doctors To Do Consultations Via Email?

Friday, April 25th, 2008

A few months ago I had some lively back-and-forth blog postings with a doctor who used email and instant messaging (IM) a lot in his practice; here, here and here.
Today my good friend Alec forwarded me another interesting news article (thanks Alec!) about the use of email by doctors; “It’s no LOL: Few US doctors answer e-mails from patients.”

(more…)