What You Need to Know about the Children's Online Privacy Protection Act (COPPA)

Online privacy and information security are areas of ever-increasing concern for the Federal Trade Commission, state and federal prosecutors, plaintiff's lawyers, and consumer advocates.  There are now a smattering of laws and regulations that operators of websites, applications, and advertisers must comply with relating to these issues.  Anyone who (a) operates a website designed for kids or (b) operates a website geared to a general audience but who is aware that it is collecting information from someone under 13 should understand and comply with the Children's Online Privacy Protection Act, the FTC's rules, and the FTC's guidance.  


The Children's Online Privacy Protection Act (COPPA) became law almost 15 years ago, but in 2013, the Federal Trade Commission's revisions to the COPPA Rule, which were intended to modernize the Rule, became effective. 

image credit: Mike Licht

What Is the Children's Online Privacy Protection Act Rule?
 

The COPPA Rule requires operators of websites or online services directed to children under 13 years of age (and operators of other websites or online services that have actual knowledge that they are collecting personal information online from a child under 13 years of age, even if not by design) to provide notice to parents and obtain verifiable parental consent prior to collecting, using, or disclosing personal information from children under 13 years of age. The Rule also requires operators to keep secure the information they collect from children, and prohibits them from requiring the disclosure of more personal information than is reasonably necessary.

What Revisions Took Effect in 2013?

The lengthy 2013 revisions were designed to achieve the following:

• Modify the definition of "operator" to make clear that the Rule covers an operator of a child-directed site or service where it integrates outside services, such as plugins or advertising networks, that collect personal information from its visitors;
• Modify the definition of "Web site or online service directed to children" to clarify that the Rule covers a plug-in or ad network when it has actual knowledge that it is collecting personal information through a child-directed Web site or online service;
• Modify the definition of "Web site or online service directed to children" to allow a subset of child-directed sites and services to differentiate among users, and requiring notice and parental consent only for users who self-identify as under age 13;
• Modify the definition of "personal information" to include geolocation information and persistent identifiers that can be used to recognize a user over time and across different Web sites or online services;
• Modify the definition of "support for internal operations" to expand the list of defined activities;
• Streamline and clarify the direct parental notice requirements to ensure that key information is presented to parents in a succinct ‘‘just-in-time’’ notice;
• Expand the non-exhaustive list of acceptable methods for obtaining prior verifiable parental consent;
• Create three new exceptions to the Rule’s notice and consent requirements;
• Strengthen data security protections by requiring operators to take reasonable steps to release children’s personal information only to third parties who are capable of maintaining the confidentiality, security, and integrity of the information;
• Require reasonable data retention and deletion procedures;
• Strengthen the FTC’s oversight of self-regulatory "safe harbor" programs; and
• Institute voluntary pre-approval mechanisms for new consent methods and for activities that support the internal operations of a Web site or online service.

You can read more about the 2013 Rule changes here, here, and here.

Does Your Website Privacy Policy Pass the Test?

In the past couple of years, Facebook, Twitter, and Google each settled disputes with the Federal Trade Commission ("FTC") relating to website privacy, and Google has reportedly paid $8.5 million to settle a class action suit based on similar privacy-based claims.  Even though actions against these Internet giants capture the headlines, all organizations, regardless of size, with websites can learn valuable lessons from the FTC's recent enforcement actions (as Upromise, Inc. learned in 2012 when the FTC took action against it on similar grounds).  The following discussion presents a high-level description of various aspects of website privacy law that organizations should not overlook:

Capturing Information

If your organization has a website that collects information in any way, including through an embedded "contact" form, or even cookies, you should strongly consider establishing a website privacy policy statement to protect your organization from liability.  Privacy policies are not just for large corporations and "web-based" companies.  A myriad of laws control what must be disclosed in a website privacy policy statement and how it is presented, as well as the underlying privacy practices.

Making Promises

Organization sometimes make promises in their website privacy statements that they fail to fulfill in practice.  Allegations of broken promises can be found in most of the FTC's recent enforcement actions in this area.  This is particularly unfortunate because, in many instances, the organization created an otherwise avoidable risk by establishing privacy standards that were stricter than the law required.  This type of risk is increased if an organization (or its third-party website designer) simply copies another organization's privacy policy statement without first understanding all of the legal and practical considerations that went into the original privacy statement, including what different or additional policies an organization may need to have because of the different ways in which it does business.  To be effective in protecting your organizationfrom liability, your website privacy policy statement must be tailored to your organization's own practices. 

Conducting Business On-Line  

If your organization does business through its website, it may well have additional financial privacy protection obligations and disclosure requirements under various federal and state financial privacy laws, particularly if credit is extended for online transactions.  Any organization engaging in credit transactions through its website needs to be aware of the many additional legal obligations created by the patchwork of financial privacy laws.

Protecting Children

Websites directed at children are subject to additional restrictions and requirements under the Children's Online Privacy Protection Act ("COPPA").  If your organization's website, or a section of the website, is designed for children, COPPA disclosures and policies are necessary.

Opt-Out Requirements for Advertising

A federal law, the Controlling the Assault of Non-Solicited Pornography and Marketing Act, commonly known as the "CAN-SPAM Act," limits electronic advertising.  Although it is not a privacy law per se, it does require Internet and email advertisers to provide an opt-out mechanism for electronic marketing, among other things.  If your company advertises through its website or by email, you must have CAN-SPAM policies and an opt-out procedure.  It is customary and advisable to address the CAN-SPAM Act and opt-out rights in a website privacy policy.

Don't Forget State Laws

A few states have their own website privacy laws with which your organization must comply if you are directing your website to residents of any of those states.  For example, if your organization's website is directed at California residents, or at U.S. audiences generally, your website will need to comply with California's rules, which are reputed to be the most rigorous and which include specific requirements that go beyond the requirements of the federal rules.

Conclusion

Internet privacy is gaining increasing attention from governmental entities, consumer groups, and plaintiffs' class action attorneys, and is expected to be an emerging source of risk for many companies.  Fortunately, much of that risk is avoidable if care is taken to observe the patchwork of applicable legal requirements.

Privacy Benefits of a Limited Liability Company

Everyone knows that a Limited Liability Company can help shield its owner(s) from liability, but did you realize that an LLC can also shield its owner(s) from prying eyes? 

photo by Roo Reynolds

LLCs are among the most useful and versatile tools in a business lawyer's toolkit, and one of the lesser-known uses of a limited liability company is to facilitate privacy for its owner(s).  In many states, including North Carolina, an LLC can be formed by an "organizer" (usually an attorney) without the signature or public disclosure of the name of the owner(s) or even the manager(s).  In North Carolina, the manager's name is not required to be disclosed until the first Annual Report is filed.  (Annual Reports become immediately public upon filing, and can be accessed for free online by anyone.)  An Annual Report is due on April 15 on the year following the year the LLC is formed.  Therefore, an LLC formed in January may have as many as 15 months before a manager must be named on an Annual Report.

Furthermore, a single member LLC can be disregarded for tax purposes, thereby creating no additional tax complications for the owner.  Because an LLC can be formed quickly, easily, and inexpensively, it can be a useful took for preserving privacy. 

We have formed LLCs to allow people to buy and sell real estate when the circumstances were such that the person's identity, if disclosed, would affect the price or otherwise cause issues.  There are a host of perfectly legitimate reasons to use an LLC for privacy purposes.

Trusts can also be used to create privacy, although they tend to be more expensive to create and slightly more complex.  Trusts may be a good solution for longer-term privacy needs, whereas LLCs can address short term privacy concerns.

Information Security Breaches Can Be Low-Tech Too

With all the media attention focused on high-tech hackers (such as the Russian teen who reportedly perpetrated the Target mega-breach), it might be easy to forget that information security breaches are often distinctly low-tech.  They frequently occur simply because of dishonest or inept employees and contractors.


credit: dullhunk

This week, Duke Energy disclosed an information security breach of the low-tech variety.  A former contract worker was stopped by police outside Atlanta, and found to be in possession of credit card and checking account numbers of Duke Energy customers.  The suspect had worked in a call center and had handled accounts of customers whose information was found in the car.  Upon learning of the incident, Duke did the right thing by reporting and offering free credit monitoring to affected customers.  Duke also reported it would be reviewing its internal controls and procedures.

The Duke Energy incident isn't the only local (N.C.) breach arising from employee theft of data already this year.  According to the Identity Theft Resource Center's 2014 breach list, an employee of the Alamance County Department of Social Services whose job had been to investigate claims of abuse and neglect against minors and disabled adults, stole and then sold the personal information of abuse victims.  The Greensboro News & Record reported that the DSS employee sold personal information to two tax return preparers in Greensboro, who listed them on their client's returns in order to claim inflated tax refunds on the clients’ behalf.   The preparers paid the DSS employee $200 to $300 per identity. 

The lesson here is fairly straightforward: Even the best software will not protect an organization from a breach at the hands of a dishonest (or foolish) employee or contractor.  Therefore, it is important to focus not only on preventing hackers from penetrating your organization's computer systems, but also to recognize the very real possibility of a breach and establish a response plan that complies with the law and mitigates the liability and reputational risk to the organization.

When an employee obtains unauthorized access to customer information about N.C. residents, the employer must quickly determine the following:

1. Which laws apply?  (North Carolina's general ID theft statute and/or industry-specific statutes, such as federal financial institution law or healthcare law)
2. Does the information accessed include protected information?
3. Has a "breach" actually occurred as defined under the applicable law(s)?
4. Does the law require a notice to customers?
5. What must, or should, the customer notice include?
6. Does the law require a report to authorities?  If so, which authorities?
7. What must, or should, the report to authorities contain?
8. What steps can be taken to mitigate losses?
9. What immediate steps can be taken to prevent similar incidents?
10. What steps does any existing breach response policy require?
11. What steps do existing contracts require, if any?
12. Who will be responsible to take these steps?

Addressing these issues in a well-crafted policy and procedures prior to a breach can help limit losses and provide much-needed direction in the event of a breach.

My Sincere Thanks

I would like to take a moment to thank the lawyers across North Carolina who participated in the peer review processes conducted by Business North Carolina magazine and Super Lawyers (a Thompson Reuters publication).  Thank you for your votes of confidence.  While there are many stellar lawyers who were not included in these lists, it is a great honor to be named along with the exceptional lawyers who were listed this year, including several of my colleagues at Ward and Smith. 

I was very honored to have been included among the Business North Carolina Legal Elite for 2013 in the "Young Guns" category (for lawyers under 40 from all practice areas).   For 2014, I was named in the "Business Law" category.  I was also named a "Super Lawyers Rising Star" by Super Lawyers in 2014, a distinction reserved for just 2.5% of eligible lawyers across the state.

What Does Inclusion in the "Legal Elite" Mean?

When Business North Carolina magazine surveyed more than 20,000 North Carolina attorneys, they asked only one question: "Whom would you rate among the current best in these categories?" Fewer than 3% of the lawyers in North Carolina were selected for the distinction.

What Does Inclusion in "Super Lawyers" Mean?

 

Super Lawyers' stated objective is to create a credible, comprehensive listing of outstanding attorneys. Super Lawyers compiles its list each year using peer nominations from lawyers around the state, peer evaluations, and independent, third-party research. Each candidate receiving sufficient nominations from across the state is evaluated on 12 criteria of professional achievement.

The selection process for the "Rising Stars" list is the same as the ordinary Super Lawyers selection process, with one exception: to be eligible for inclusion in Rising Stars, a candidate must be either 40 years old or younger or in practice for 10 years or less. The idea is that it is very difficult for young lawyers to develop a significant statewide reputation within the first ten years of practice, so a separate process is used for them. While up to 5 percent of the lawyers in the state are named to Super Lawyers, no more than 2.5 percent of eligible lawyers are named to the Rising Stars list.

To the lawyers who take the time to participate in this and other peer review surveys, I offer you my sincere thanks.  May 2014 bring you all the success and recognition you have earned!

Is a Nationwide Information Security Law in the Works?

A nationwide "bipartisan and comprehensive approach" to information security may be making its way through the Senate soon. 

Senators Tom Carper and Roy Blunt unsuccessfully attempted in the last Congressional session to push through a comprehensive data security bill. Yesterday (January 15) they introduced a revised version of the bill, titled the Data Security Act of 2014. In the wake of the massive Target breach, it might stand a better chance of passage. 

The bill would go farther than the privacy and data security provisions of the Gramm-Leach-Bliley Act, which have been in effect for more than a decade. It would require businesses, governments, and other organizations to take further steps to protect private information, address security breaches, and quickly notify customers of breaches than under existing law. Currently, nearly every state has privacy and data security laws that create a maze of compliance issues for organizations that are active in more than one state. One aim of the Data Security Act is to standardize the law throughout the nation.

The Data Security Act of 2014 has been assigned to the Senate Banking, Housing and Urban Affairs Committee for review. Similar bills by Senator Patrick Leahy and Senator Pat Toomey are being considered by the Senate Judiciary Committee and the Senate Commerce Committee, respectively.

You can read the full text of the Data Security Act of 2014 here. 

A Resolution for Your Organization for 2014: Understand and Manage Privacy and Information Security Risks

(c) Matt Cordell

As a business owner, manager, or executive, you probably have a long list of things you'd like to see your organization accomplish in 2014.  Perhaps you've even come up with some New Year's Resolutions for your organization.  Maybe you're like most of us, and your goals for 2014 are not quite so precisely defined.  I'd like to encourage you to consider making a resolution to ensure that your organization has a firm grasp on privacy and information security issues so that you can take control of the risks they present.  You'll feel much better once you have a handle on these issues.

Recent headlines have been replete with disastrous news of privacy and information security breaches.  Target's breach, affecting 40 million credit and debit card accounts, reportedly resulted in customer information being sold on the black markets.   Millions of users of Snapchat (one of the fastest-growing social media platforms) saw their private information leaked online this week.   Living Social, Evernote, and Adobe each experienced major data breaches in 2013, resulting in tens of millions of user accounts being compromised.   Other companies reporting breaches in 2013 include T-Mobile, Travelocity, Cracker Barrell, Facebook, JP Morgan, Bed, Bath & Beyond, UNC-Chapel Hill, the federal Food and Drug Administration, and hundreds of charities, government entities, medical providers, and educational institutions.  

Records compiled by the Identity Theft Resource Center show that in 2013 there were at least 619 reported breaches affecting more than 57 million individual records.  (Most breaches are probably unreported.)  A study conducted by online risk management firm NetDiligence reported that in 2013, the average total cost to a company of a security breach was $954,253, with an average legal settlement cost of $258,099 and average legal fees of $574,984.  

As diligently as companies try to prevent incidents of privacy and information security, there will always been gaps in the armor that will result in unintended disclosures, whether intentional or unintentional, internal (employee) or external (hackers).  It is unreasonable to simply assume that all of these risks can be eliminated.  Instead, it is wise to take steps now to proactively address the legal risks.   

To make it easy (okay--less overwhelming), I have created a short list that will help you get started on your way to understanding and managing your legal risks associated with privacy and information security:

1. Establish Commercially Reasonable Security Measures and Policies.  
 
Identify the most common types of threats to your organization and take commercially reasonable measures to prevent them. This should include adopting technological standards and complying with all applicable laws.  

• You may have a sense of the risks your organization faces and the weaknesses in your existing systems, but I strongly encourage you to consult the studies of reported breaches to see what, statistically speaking, are the major sources of breaches.  You might be surprised.  For example, according to a study by NetDiligence of cybersecurity claims filed, the most common cause of an information security breach in 2013 was a lost or stolen laptop or device (accounting for more than 20% of reported incidents) followed closely by malicious hackers (accounting for more than 18% of reported incidents).
• Review existing contracts to identify any contractual data security obligations you already have.  What standards and requirements are imposed by those contracts? Confirm that you are in compliance with contractual obligations.  For example, confirm you are complying with the Payment Card Industry Data Security Standards (better known as PCI-DSS) if you accept payments by card.  
• Identify the best practices in your industry for organizations with similar risk profiles.  If your policies and procedures do not meet the industry standards, you are much more likely to suffer liability in the event of a breach.
• Understand the various privacy and information security laws that apply to your organization.  (Ignorance of the requirements will not be a defense.) 
• Establish a comprehensive privacy policy for your organization that complies with applicable laws and mitigates the organization's risk of loss.  Also establish a privacy policy statement to share with customers, website visitors, etc.

2.  Adopt a Data Security Breach Response Plan and Train Staff. 

Decide now how your organization will respond to a breach, and document your response plan in a writing. Involve IT professionals and knowledgeable legal counsel to ensure that the plan is feasible and complies with the law. Having a plan in place, and following it, can mitigate losses and help protect your company from subsequent liability if lawsuits or government actions follow the breach.

3.  Due Diligence on Third Parties.  

With whom are you sharing customer, client, shareholder, or employee information?  Several recent major data security breaches have taken place within third-party vendors who had no direct relationship with the customer, and the customers typically sue the company with which they have a direct relationship, in addition to the vendor. Conduct a commercially reasonable due diligence process to ensure only responsible vendors are deemed eligible.  Knowing the right questions to ask is key.

4.  Sign Only Well-Drafted Contracts. 

Some risks of loss arising from data security can be reduced through well-drafted contracts with customers, third-party vendors or financial institutions.  If you merely assume that your vendors or financial institutions will make your organization whole in the event of a breach (wherever the breach takes place), you are probably mistaken.  Most of the proposed contracts I have seen presented to companies by third party vendors are woefully inadequate to protect the company if the vendor fails to prevent a breach of the company's customer data.  Involving knowledgeable legal counsel when entering into, or re-negotiating, agreements with third-party vendors that will have access to your customer's information can save potentially massive amounts of money down the road.  Even if agreements are already in place, it may be worthwhile to have them reviewed by legal counsel to (i) understand the risks, and (ii) determine whether it is necessary to attempt to re-negotiate.

5.  Cybersecurity Insurance. 

A number of firms now offer insurance against losses arising from data security breaches, either as a separate line or as an addition to directors and officers liability insurance coverage. This is another opportunity to spend a small amount that may ultimately save a company massive amounts later.


My hope is that this brief summary will enable you to identify the steps needed to get a firm grasp on some of the fastest-growing risks facing organizations today.  Subsequent blog posts will elaborate on some of the topics identified here.


 

How to Prepare for a Data Security Breach Before It Happens

Don Hankins / Foter.com

Just days ago, Target released a statement confirming an information security breach affecting 40 million credit and debit card accounts.  Already, card information has reportedly flooded the black markets.  Several million usernames and phone numbers of Snapchat users were apparently leaked online this week.  It was reported that  Living Social, Evernote, and Adobe each experienced major data breaches in 2013, resulting in tens of millions of user accounts being compromised.  At least one commenter has estimated that the top five largest breaches alone in 2013 affected about 450 million user records.  If even large organizations with significant resources and tech-savvy IT companies cannot always prevent data security breaches, what are the odds your company will be 100% successful in avoiding a breach?  It seems almost irresponsible these days to assume that you can stop every attack indefinitely.  Instead, we must face the reality that an information security breach is possible, and therefore take steps now to address the risk. 
 
In April, I wrote a blog post for the North Carolina Business and Banking Law Blog on this topic.  You can read the full piece here.  Below are some key points to consider:

• Approximately 46 states and the District of Columbia have data breach notification laws.
• Data breach notification laws usually require a company to notify the affected customers, the attorney general, and the consumer reporting bureaus.
• Breaches affecting a small number of customers may not be required to be reported to officials.
• According to the Identity Theft Resource Center, a nonprofit group that tracks data security breach reports, there were 447 (reported) data security breaches reported in 2012, covering 17,317,184 individual records.
• A study conducted by online risk management firm NetDiligence reported that in 2011, the average total cost to a company of a security breach was $3.7 million, with an average legal settlement cost of $2.1 million and average legal fees of $582,000.
• 26% of data breach lawsuits were brought against companies in the financial services sector, with 20% in the health care sector and 10% in the retail sector.

What can a company do now--before a breach--to address this risk?

• Commercially Reasonable Security Measures and Policies.  Companies should know the most common types of threats and take commercially reasonable measures to prevent them.  This should include adopting technological standards and complying with all applicable laws.  
• Adopt a Data Security Breach Response Plan and Train Staff.  Prepare now for how your company will respond to a breach.  Involve IT professionals and knowledgeable legal counsel.  Having a plan in place, and following it, can mitigate losses and help protect your company from subsequent liability if lawsuits result.
• Due Diligence on Third Parties.  Several recent major data security breaches have taken place within third-party vendors who had no direct relationship with the customer, and the customers typically sue the company with which they have a relationship in addition to the vendor.  Conduct a commercially reasonable due diligence process to ensure only responsible vendors are deemed eligible.  Knowing the right questions to ask is key.
• Well-Drafted Contracts.  Some risks of loss arising from data security can be reduced through well-drafted contracts with customers, third-party vendors or financial institutions.  Most of the proposed contracts I have seen presented to companies by third party vendors are woefully inadequate to protect the company if the vendor fails to prevent a breach of the company's customer data.  Involving competent legal counsel when entering into agreements with third-party vendors that will have access to your customer's information can save potentially millions of dollars down the road. 
• Cybersecurity Insurance.  A number of firms now offer insurance against losses arising from data security breaches, either as a separate line or as an addition to directors and officers liability insurance coverage.   This is another opportunity to spend a small amount that may ultimately save a company massive amounts later.

Given the enormous losses sustained as a result of the reported breaches, it is imperative that businesses recognize the risks presented by data security breaches and take steps to mitigate them before a breach occurs.

Legal Aspects of Security Breaches, Unauthorized Transfers, and Corporate Account Takeovers

Last month, the CEO of BNY Mellon told the American Banker that his bank's greatest single concern is cybersecurity.  We live in an era where a security breach can be devastating to a variety of businesses, whether through a direct loss of funds, civil liability, or massive reputational harm to a brand.

Some of the fastest-developing topics I encounter in my law practice involve security breaches, unauthorized transactions, and corporate account takeovers.  Several weeks ago, I addressed the legal aspects of these issues in a presentation delivered at the North Carolina Bankers Association's Security Summit.  Some of the questions addressed in the presentation included the following:

• What obligations under federal and North Carolina law do businesses have when there has been a security breach involving customer information?
  
• At what point does an incident involving customer information rise to the level of a "security breach" for which the applicable laws require specific responses? 
  
• Who must bear the loss when there is an unauthorized transfer of funds in a consumer's bank account?
  
• If a company's bank account is compromised (hacked) in a "corporate account takeover" and funds are transferred from the account without authorization, is the bank required to refund the company's money?

I am posting the slides from my presentation here so those who were not able to attend the Security Summit will be able to see the highlights of the talk.*  I hope you find this information helpful.  (Please feel free to share this blog post with others who might benefit from this information.)

The importance of these issues continues to grow, and I intend to speak and write more about these and related topics in the coming days. 

 

[*As with all of the information I post here on the blog, this is shared for general educational purposes only, and does not constitute legal advice.  I will not be updating this information as the law develops, and I reserve the right to change my position on any issue addressed in these materials in the future.]

 

Introducing the North Carolina Privacy & Information Security Law Blog

In the course of writing for the North Carolina Business & Banking Law Blog since 2011, I occasionally addressed  privacy and data security issues.  These topics have become a growing part of my law practice as well.  It has become clear that there is a great deal of interest in practical legal analysis of privacy-related topics. Therefore, I have decided to create a new blog dedicated solely to these issues: the North Carolina Privacy & Information Security Law Blog (PrivacyLawNC.com).

Why Are Privacy Law and Information Security Law Important?

Privacy and information security issues are among the most challenging and rapidly-evolving areas of risk for companies across a wide spectrum of industries. The ability to collect, use, and, share customer information has become increasingly important to all kinds of businesses, and in many cases, it is absolutely critical to business success. In recent years, however, statutes, regulations, and civil lawsuits have collectively resulted in significantly greater compliance obligations and higher risks associated with handling customer or employee information. 

What Is "Privacy Law" and "Information Security Law"?

When we refer to "privacy law" or "information security law," we are not describing a single, cohesive body of law.  Instead, we refer to a wide assortment of federal and state statutes, regulations, and cases from areas that are most commonly referred to as "healthcare law," "financial regulation," "employment law" and other traditionally-defined areas of law.  Privacy and information security issues arise in a number of contexts, including the following:

• Electronic signatures and records, including the Electronic Signatures in Global and National Commerce Act (E-SIGN Act) and the Uniform Electronic Transactions Act (UETA)
• E-commerce requirements, including the Payment Card Industry Data Security Standards (PCI-DSS)
• Data breach response laws and data disposal laws
• Password theft, hacking, and wiretapping, including the Stored Communications Act, the Wiretap Act, and other anti-interception laws
• Website privacy policies and practices, including the Children's Online Privacy Protection Act (COPPA)
• Email marketing, including the CAN-SPAM Act
• International privacy compliance, including the European Union Directive on Data Protection Safe Harbor
• Social media policies for employers
• Financial privacy, including the Gramm-Leach-Bliley Act, the Financial Privacy Act, the Bank Secrecy Act, and other federal and state financial institution laws
• Unauthorized transactions and funds transfers, including the Electronic Funds Transfer Act and Regulation E, as well as the Uniform Commercial Code
• Financial account takeover statutes and the cases that control the allocation of losses when financial accounts are compromised
• Credit reporting laws and other "background check" laws, including the Fair Credit Reporting Act
• Identity theft laws, including the North Carolina Identity Theft Protection Act and the Federal Trade Commission's "Red Flags" regulations
• Health information privacy, including HIPAA and HITECH
• Educational privacy, including the Federal Education Rights Privacy Act (FERPA)
• Employment privacy and non-disclosure agreements
• Trade secrets

This blog will periodically address hot topics and emerging issues involving these areas.  Check back for updates, or--even better--follow the blog on Twitter: @PrivacyLawNC. 

I look forward to exploring these issues with you in the days, weeks, months, and years to come!