We use cookies to give you the best online experience. By using our website you agree to our use of cookies in accordance with our cookie policy. Learn more here.Close Me
Ever on the forefront of consumer privacy protection, California
is again making news in the privacy world with the California
Attorney General's recent publication of "Privacy on the Go: Recommendations for the Mobile
Ecosystem," which includes privacy recommendations for app
developers, app platform providers, mobile ad networks, makers of
operating systems and mobile carriers. With this publication,
California joins the FTC and the GSMA as entities that have
published non-binding guidance with respect to mobile privacy
(which we blogged about
here and
here, respectively).
In the publication, the Attorney General notes that these
recommendations often ". . . offer greater protection than
afforded by existing law, [and] are intended to encourage all
players in the mobile marketplace to consider privacy implications
at the outset of the design process." The report
outlines the following specific recommendations:
For App Developers:
Start with a data checklist to review the personally
identifiable data your app could collect and use it to make
decisions on your privacy practices.
Be transparent with respect to your privacy practices.
Avoid or limit collecting or retaining personally identifiable
data not needed for your app's basic functionality.
Give users access to personally identifiable data the app
collects and retains about them.
Use security safeguards.
Be accountable for compliance with applicable laws.
Develop a privacy policy that is clear, accurate, and
conspicuously accessible to users and potential
users.
Use enhanced measures – "special notices" or
the combination of a short privacy statement and privacy controls
– to draw users' attention to data practices that maybe
unexpected and to enable them to make meaningful choices.
ForApp Platform
Providers:
Make app privacy policies accessible from the app platform so
that they may be reviewed before a user downloads an app.
Use the platform to educate users on mobile privacy.
For Mobile Ad Networks:
Avoid using out-of-app ads that are delivered by modifying
browser settings or placing icons on the mobile desktop.
Have a privacy policy and provide it to the app developers who
will enable the delivery of targeted ads through your network.
Move away from the use of unchangeable device-specific
identifiers and transition to app-specific or temporary device
identifiers.
For Operating System Developers:
Develop global privacy settings that allow users to control the
data and device features accessible to apps.
For Mobile Carriers:
Leverage your ongoing relationship with mobile customers to
educate them on mobile privacy and particularly on children's
privacy.
While the California Attorney General acknowledges that the
recommendations are just that – recommendations – it is
clear that as "smart phones" become ubiquitous, more
federal and state regulation will impact, in one way or another,
all participants in the mobile ecosystem.
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
In this environment of growing attention to the risks of data security breaches, and in the midst of an explosion of mobile applications that make data storage an increasingly far-flung proposition, many organizations assume that the first line of defense for a company with a Web site or a mobile app is a good privacy policy.
The National Institute of Standards and Technology has released the fourth revision of its standard-setting computer security guide, Special Publication 800-53 titled Security and Privacy Controls for Federal Information Systems and Organizations, and this marks a very important release in the world of data privacy controls and standards.
The obligations of hedge funds, investment managers and service providers to protect confidential information relating to investors and avoid breaches of data privacy legislation is increasingly in focus.
In a recently released decision from the U.S. District Court for the Southern District of Florida, Mais v. Gulf Coast Collection Bureau, et al., Judge Robert N. Scola, Jr., granted in part and denied in part cross motions for summary judgment in a putative class action before considering the issue of class certification.
The report also found that most utilities only comply with mandatory cybersecurity standards, and have not implemented voluntary NERC recommendations regarding general or specific threats (e.g., Stuxnet).
Steven Tyler: Paparazzi Problem In Hawaii Shouldn’t Be Ignored (Video Content)
