The Office of Civil Rights (OCR), the enforcement arm of the Department of Health & Human Services (HHS), announced that a Tennessee diagnostic medical imaging services company has agreed to pay $3 million to settle potential HIPAA violations arising from a data breach that exposed over 300,000 patients’ protected health information. As part of the

The Federal Aviation Administration (FAA) is expected to award its first license to operate a drone airline in May. Last year, the FAA determined that large-scale commercial package delivery drone operations would require certain safety and economic certification standards like other licensed U.S. airlines. The FAA has not yet announced which company will receive that

France’s data protection authority (DPA) (CNIL) recently announced that it has fined Google $57 million for violations of the General Data Protection Regulation (GDPR). This is the first fine by a European DPA of an American company for alleged violations of the sweeping EU privacy law.

According to the CNIL, Google did not tell consumers

Last week, two Senators, Senator Edward J. Markey of Massachusetts and Senator Richard Blumenthal of Connecticut sent a letter to the Federal Trade Commission (FTC) regarding apps designed for children and whether they are in compliance with the Children’s Online Privacy Protection Act (COPPA), See 15 U.S.C. 6501 and regulations at 16 C.F.R. Part 312 et. seq.  The Senators stated that they are concerned that thousands of apps may “improperly track children and collect their personal information.” The Senators requested a response from the FTC by October 31. The letter also asked that the FTC “investigate whether these apps, and the advertising companies they work with, are in fact tracking children with persistent identifiers and collecting their personal information in violation of COPPA…”
Continue Reading Protecting the Privacy of Children Online – More Updates on COPPA

Russian company, Yandex (often compared to Google here in the United States), recently debuted their very own self-driving car. Last week, Yandex released a video depicting its self-driving car driving through snowy streets of Moscow–an extraordinary feat navigating inclement weather and adverse driving conditions. The video shows a driver with his hands in his lap

By now most smartphone users are aware of location tracking used by both Apple and Android operating systems.  Basic location tracking is a system which uses GPS data to know the phone user’s location.  However, according to a recent article published by Quartz, Google’s data collection goes far beyond basic location tracking.  Not only does the data collected go beyond simple location information, but the ‘Opt In’ service Google uses to collect that data, Location History, isn’t as truly Opt In as users might expect.  According to Quartz, Google’s Location History underlies many of Android’s main apps, including Google Assistant and Google Maps.  Furthermore, Opting In to Location History for one app may actually give many apps access to Location History’s data and the ability to send that data to Google.
Continue Reading Google Tracking of Android Users Goes Beyond the Expected

A new study by Google, the University of California Berkeley and the International Computer Science Institute has concluded that email users are being threatened by massive credential theft and phishing schemes are the primary way hackers are stealing credentials.

According to the study, phishing victims are 400 times more likely to have their email accounts

Back in 2015, DeepMind, a Google company, signed a deal with the Royal Free NHS Foundation Trust. The deal allowed DeepMind access to 1.6 million patients health information as well as the ability to develop an app called Streams. The Streams app focus was to monitor patients with kidney disease and alert the right clinician when a patient’s condition deteriorates.

However, it was discovered that the Streams app had access to other health information such as a patient with HIV and drug overdoses.

After a yearlong investigation, The Information Commissioner’s Office (ICO), who is the U.K.’s data protection watchdog, found that the deal between the two parties failed to comply with the data protection law.
Continue Reading DeepMind Deal with NHS Trust Reveals Privacy Concerns

Last October, the Federal Communications Commission (FCC) approved new privacy rules governing how Internet Service Providers (ISPs) are permitted to use and share its customers’ personal information. The rules have been fiercely contested by telecom companies that contend they are being unfairly held to more stringent regulations than so-called edge providers (Google, Facebook, etc.), which are subject only to less restrictive guidelines established by the Federal Trade Commission (FTC). In particular, the FCC rules go beyond FTC regulations in defining “sensitive” customer information to include web browsing and application usage history and requiring ISPs to obtain affirmative “opt-in” consent before using or sharing such information. Certain data security obligations under the rules were scheduled to go into effect on March 2nd, with the remaining provisions relating to data breach notification and opt-in requirements slated for implementation later this year.
Continue Reading Congress, FCC Weigh Measures to Repeal ISP Privacy Rules