PRIVACY + SECURITY BLOG

News, Developments, and Insights

high-tech technology background with eyes on computer display

“Privacy”: A Unique Play Starring Your Smart Phone

Privacy Awareness

I was fortunate to see James Graham’s incisive play “Privacy” this past Sunday at the Public Theater in New York City.  The play is a witty and immensely engaging examination of all the data being collected about us and being assembled into digital dossiers.  Technology is adeptly woven into the play.  At many points during the production, audience members are asked to use their smart phones.  The script is entertaining and intelligent.  There is never a dull moment, and I was laughing throughout. Continue Reading

Microsoft Just Won a Big Victory Against Government Surveillance — Why It Matters

eye

Yesterday, Microsoft won a huge case against government surveillance, a case with very important implications: In the Matter of a Warrant to Search a Certain E‐Mail Account Controlled and Maintained by Microsoft Corporation.

Continue Reading

HIPAA’s Long Arm — and Why It’s a Good Thing

HIPAA Training

Recently, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) issued its first HIPAA resolution agreement and monetary penalty against a business associate (BA).

Continue Reading

Ransomware Growing Out of Control

Security experts are sounding the alarm bell as ransomware attacks continue to increase rapidly since my last post on the subject.

Continue Reading

Attorney Confidentiality, Cybersecurity, and the Cloud

Law firm data security

There is a significant degree of confusion and lack of awareness about attorney confidentiality and cybersecurity obligations.  This issue is especially acute when it comes to using the cloud to store privileged documents.  A common myth is that storing privileged documents in the cloud is a breach of attorney-client confidentiality.  In other instances, many attorneys and firms are not paying sufficient attention to their obligation to protect the confidentiality and security of the client data they maintain.

Continue Reading

6 Great TV Series About Privacy and Security

TVIn previous posts, I have listed some of my favorite novels and movies about privacy and security issues.  I don’t want to leave out TV, as there are some great TV series too.

 

Continue Reading

New Resource Page: How to Make Security Training Effective

Effective Security Training

I recently created a new resource page —  How to Make Security Training Effective.  The page contains my advice for how  to make security training memorable and effective in changing behavior.

Training the workforce is an essential way to protect data security, but not all training endeavors are successful.  Poor training is akin to shouting into the void.  This resource page is designed to provide some tips and advice about training that I’ve learned from being an educator for more than 15 years.  Continue Reading

New Resource Page: Security Awareness Training FAQ

Security Awareness Training FAQ 01

What laws require security awareness training?  What topics do the laws require to be covered?  What should be covered?  How frequently should training be given?

I recently created a new resource page — Security Awareness Training FAQ — to answer the above questions and more.  I discuss various legal and industry requirements for security awareness training.  I also discuss best practices.  I hope that you find this resource to be useful.

Continue Reading

When Is a Person Harmed by a Privacy Violation? Thoughts on Spokeo v. Robins

privacy

When is a person harmed by a privacy violation?

The U.S. Supreme Court just handed down a decision in an important case, Spokeo Inc. v. Robins.  

Spokeo Logo

Plaintiff Thomas Robins sued Spokeo under the Fair Credit Reporting Act (FCRA) because Spokeo had inaccurate information about him in its profile.  Spokeo’s profiles are used by potential employers and others to search for data about people.  FCRA requires that information in profiles for these purposes be accurate, and it allows people to sue if information is not.

 

Continue Reading

The Need for a Privacy Profession Pathway: An Open Call for Privacy Law Fellowships

Privacy Profession Pathway

The privacy law profession is growing tremendously, but there is a challenge that we’re facing, one that I’d like to enlist your help in addressing – the bottleneck problem.  There is a huge bottleneck at the entry point to the field.  So I am calling on organizations to address this bottleneck by offering fellowships to recent law school graduates interested in privacy law.

Each year, I teach about 60-70 privacy law students, and there are many other professors teaching similar courses with large enrollments.  Many great students want to enter the field, but they find it very hard to do so because nearly every position requires a number of years of experience.

Bottleneck Problem

Unlike other field with a more developed entry point, privacy lacks an easy way in.  People have to do all sorts of career gymnastics to lateral sideways or slip in from other areas.  A while ago, I solicited advice on entering the profession and provided advice of my own, and I posted about it in my post, How to Enter the Privacy Profession.

On the other side, many organizations are seeking to fill privacy law positions but are having a hard time finding enough people with experience.

A Call to Create Privacy Law Fellowships

The privacy profession must address the bottleneck problem and develop a reliable pathway to the profession.

I am therefore calling on companies and organizations to create privacy law fellowships that would last 1-2 years.   If you create one, I will list it in my list of privacy law fellowships. Right now, the list is short, and most of the opportunities are in NGOs and the government, with a handful from the private sector.  I’d like to triple or quadruple this list . . . and hopefully make it even longer than that.

So if you’re on the privacy team at an organization, please look into creating a fellowship position.  If you’re a privacy law professor, please join in my call.  A mature profession needs an entry point and a reliable pathway.  It’s time to make that happen for privacy law.

Continue Reading