Privacy-on-the-Go: California Attorney General and Major Mobile Application Platforms Agree to Privacy Principles for Mobile Applications

Recently The National Law Review featured an article written by Cynthia J. Larose and Jake Romero of Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. regarding Mobile Apps and Privacy:

Application developers have been put on notice by the State of California. It is time to pay attention to user privacy and collection of information from user devices.

In an effort led by the office of California Attorney General Kamala D. Harris, the state has reached an agreement committing the six largest companies offering platforms for mobile applications (commonly referred to as “apps”) to a set of principles designed to ensure compliance with California’s Online Privacy Protection Act. The agreement with Apple Inc., Google Inc., Microsoft Corp., Amazon.com Inc., Hewlett-Packard Co., and Research In Motion Ltd., who collectively represent over 95% of the mobile application market, is significant for two reasons. First, it operates as an acknowledgement that California’s Online Privacy Protection Act applies to app developers as well as platform providers. Second, the agreement may effectively create a minimum standard for disclosures and transparency with regard to the collection of personal information by mobile applications. Because of the global nature of the Internet, the law will apply to every mobile app provided through the six firms’ app stores even though it is a state law.

This alert includes a description of the principles underlying this agreement, as well as certain best practices to help mobile app developers ensure compliance. The full text of the agreement, as well as comments from the Office of the Attorney General, can be accessed online at http://ag.ca.gov/newsalerts/print_release.php?id=2630.

Mobile Applications and Data Privacy

The most recent data from the Pew Research Center shows that 50% of all adult cell phone owners have apps on their mobile phones, a percentage that has nearly doubled over the past two years. This same survey also indicated that approximately 43% of those surveyed purchased a phone on which apps were already installed. Many of these mobile applications, in order to facilitate the functionality of the app, allow the app developer broad access to data held on the user’s mobile device. However, as noted by Attorney General Harris in a press conference announcing the agreement, many mobile applications, including twenty-two of the thirty most popular apps, lack a privacy policy to explain how much of the user’s data is accessible by the developer, and how and with whom that data is shared.

California’s Online Privacy Protection Act provides that “[a]n operator of a commercial Web site or online service that collects personally identifiable information through the Internet about individual consumers residing in California who use or visit its commercial Web site or online service shall conspicuously post its privacy policy on its Web site,” or in the case of an operator of an online service, make that policy reasonably accessible to those consumers. In entering into this agreement, the six major platform providers have acknowledged that this requirement applies equally to mobile app developers (as “online services”) and the platform providers have agreed to, among other things, implement a means for users to report apps that do not comply with this requirement and a process for investigating and responding to those reports.

The New Privacy Standard and Ensuring Compliance

A likely outcome of this agreement is that compliance with California’s Online Privacy Protection Act will become a minimum standard for the mobile application industry, because even those developers located outside the state of California will likely conclude that it is easier to have a single policy that meets California’s requirements, rather than risk inadvertent non-compliance.

To ensure compliance, developers or providers of mobile apps that collect personal data from users’ mobile devices will be required to have a privacy policy that meets the requirements set forth in Section 22575(b) of California’s Business and Professions Code (as an incorporated portion of the Online Privacy Protection Act, Section 22575(b) can be accessed in full by following the link provided above). Specifically, the privacy policy must:

·         Identify the categories of personally identifiable information that the operator collects through the Web site or online service about individual consumers who use or visit its commercial Web site or online service and the categories of third-party persons or entities with whom the operator may share that personally identifiable information.

·         If the operator maintains a process for an individual consumer who uses or visits its commercial Web site or online service to review and request changes to any of his or her personally identifiable information that is collected through the Web site or online service, provide a description of that process.

·         Describe the process by which the operator notifies consumers who use or visit its commercial Web site or online service of material changes to the operator’s privacy policy for that Web site or online service.

·         Identify its effective date.

In establishing a compliant privacy policy, an app developer or provider should take great care to ensure that the descriptions and processes contained therein match the actual operations of the company and the information it collects, and the policy should be reviewed periodically by both legal counsel and the app developer’s technical experts so that it can be updated as necessary. The policy should be clear and easy to understand, especially with regard to the collection and sharing of personal data. For those companies who may be affected by this agreement and already have a privacy policy in place, that policy should be reviewed to determine whether it should be updated. Developers and platform providers that do not comply with the law can be prosecuted under California’sUnfair Competition Law and/or False Advertising Law, which has penalties of up to $500,000 per use of the app in violation, Harris said. “If developers do not follow the privacy policies we will sue,” she added.

Anticipated Developments

Per their agreement with Attorney General Harris, the six major mobile app platforms will commence working with app developers to ensure compliance and provide education regarding privacy and data sharing. To increase awareness and promote transparency, mobile app developers will be required, as part of the application submitting an app to the platform, to provide either a link to that developer’s privacy policy, a statement describing the policy, or the full text of the policy itself. In each case, a user who is considering downloading the developer’s app will be provided access to the privacy policy associated with that app prior to downloading it.

The six major platforms have agreed to reconvene within six months to further evaluate any required changes), but no specific timeline has been stated with regard to implementing the changes described above. However, for mobile app developers who hope to continue to be a part of this quickly growing and highly lucrative market, there may not be a more opportune time to take advantage of the resources being provided on both a state and industry level.

©1994-2012 Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C.

Cybersecurity Act of 2012 Introduced

On February 14, a bipartisan group of senators introduced to the U.S. Senate the Cybersecurity Act of 2012, under which the Department of Homeland Security (DHS) would assess the risks and vulnerabilities of critical infrastructure systems and develop security performance requirements for the systems and assets designated as covered critical infrastructure. The bill is sponsored by Homeland Security and Governmental Affairs Committee Chairman Joe Lieberman (I-CT), committee ranking member Susan Collins (R-ME), Commerce Committee Chairman Jay Rockefeller (D-WV), and Select Intelligence Committee Chairman Dianne Feinstein (D-CA). As explained in the statement announcing the measure, “[t]he bill envisions a public-private partnership to secure those systems, which, if commandeered or destroyed by a cyber attack, could cause mass deaths, evacuations, disruptions to life-sustaining services, or catastrophic damage to the economy or national security.”

Infrastructure Protection Obligations

Title I of the bill provides the key provisions of the critical infrastructure protection obligations that would be imposed by the bill. Under Title I, DHS, in consultation with entities that own or operate critical infrastructure, the Critical Infrastructure Partnership Advisory Council, the Information Sharing and Analysis Organizations, and other appropriate state and local governments, is required to conduct an assessment of cybersecurity threats, vulnerabilities, and risks to determine which sectors pose the most significant risk. Once the sectors have been prioritized based on risk, DHS, along with the other agencies and organizations, must conduct a cybersecurity risk assessment of the critical infrastructure in each sector. These risk assessments must consider the actual or assessed threat, the threatened harm to health and safety, the threat posed to national security, the risk of damage to other critical infrastructure, the risk of economic harm, and each sector’s overall resilience, among other factors. In conducting these assessments, DHS is called upon to cooperate with owners and operators of critical infrastructure.

DHS, in conjunction with the same agencies and organizations, must also develop procedures that will be used to designate certain critical infrastructure at the system or asset level as “covered critical infrastructure,” therefore making those systems and assets subject to the cybersecurity requirements developed under the bill. This infrastructure is to be identified based on an analysis of whether damage or unauthorized access to the system or asset could result in any of the following:

  • Harm to life-sustaining services that could result in mass casualties or mass evacuation
  • Catastrophic economic damage to the United States
  • “Severe degradation” of national security

Technology products themselves or services provided in support of such products may not be designated as covered critical infrastructure based solely on the finding that the products are capable of being used in covered critical infrastructure.

Following the identification of covered critical infrastructure, DHS must also develop, on a sector-by-sector basis, cybersecurity performance requirements that require the owners of covered critical infrastructure to remediate the cybersecurity risks identified through the risk assessment performed by DHS for that sector. The bill requires that, in establishing the performance requirements, DHS have a process through which it considers performance requirements proposed by asset owners, voluntary standards development organizations, and other groups, as well as existing industry practices, standards, and guidelines. If DHS determines that the existing or proposed performance requirements are insufficient, DHS is required to develop performance requirements on its own.

Once the covered critical infrastructure is identified and the performance requirements defined, asset owners will be required to take steps to secure the covered critical infrastructure assets and systems, and to that end the bill tasks DHS with promulgating regulations to require covered critical infrastructure owners to do the following:

  • Receive notifications of cybersecurity risks
  • Implement cybersecurity protections that the owner “determines to be best suited to satisfy” the performance requirements
  • Maintain continuity of operations and incident response plans
  • Report cybersecurity incidents

Each owner of covered critical infrastructure will be required to certify yearly that it has implemented cybersecurity protections sufficient to satisfy DHS’s approved security performance requirements or to submit a third-party assessment regarding compliance with those performance requirements that satisfies certain standards for the training, certification, and independence of the assessors.

The bill provides that DHS may exempt from the performance requirements any system or asset if the owner can demonstrate that the system or asset is sufficiently protected against the risks identified by DHS or that compliance with the performance requirements would not “substantially” improve the security of the system or asset.

Enforcement

The enforcement regime proposed by the bill provides that any federal agency with responsibility for security of the covered critical infrastructure at issue may enforce the regulations. However, DHS itself may enforce the regulations (i) if there is no other appropriate agency, (ii) if DHS is requested to do so by the agency with responsibility for the security of the covered critical infrastructure in question, or (iii) if the agency with responsibility for the security of the covered critical infrastructure fails to take enforcement action as requested by DHS. Civil penalties are available for violations of section 105 of the bill, under which the performance requirements are established. However, no private right of action would exist.

Owners and operators of covered critical infrastructure would be exempt from punitive damages related to identified cybersecurity risks so long as they have implemented security measures that satisfy the performance requirements, are substantially compliant with the performance requirements, and have completed the annual assessments.

Avoiding Duplicative Regulation

While the cybersecurity obligations imposed by this bill would be far-reaching and could conceivably overlap with the Critical Infrastructure Protection (CIP) Reliability Standards approved by the Federal Energy Regulatory Commission (FERC) for certain bulk-power system infrastructure, the bill attempts to carve out existing cybersecurity protections, and provides several mechanisms to ensure that critical infrastructure that is already regulated will not receive duplicative regulation under this proposal.

When developing performance requirements, DHS is required to determine whether there are existing regulations in effect that cover the identified critical infrastructure and address the risks identified by DHS. If such regulations are in place, DHS is instructed to develop performance requirements only if the existing regulations do not provide an appropriate level of security. This will likely require an analysis of the existing CIP Reliability Standards by DHS, including an analysis of whether those standards cover all of the covered critical infrastructure for the electric sector identified by DHS, and whether those standards provide a sufficient level of security to protect against the risks identified by DHS.

Another method by which the existing CIP Reliability Standards framework may remain unchanged is the presidential exemption authority provided under the bill. Pursuant to that provision, the President is authorized to exempt critical infrastructure from these requirements if the appropriate “sector-specific regulatory agency” (FERC for electric infrastructure) “has sufficient specific requirements and enforcement mechanisms to effectively mitigate” the risks identified by DHS.

Additionally, DHS and the other “sector-specific agencies” with responsibility for regulating critical infrastructure security are required to coordinate their efforts to eliminate duplicative reporting or compliance requirements. Similarly, any new rules developed by sector-specific agencies must be coordinated with DHS to ensure that they are consistent with DHS’s efforts.

Copyright © 2012 by Morgan, Lewis & Bockius LLP.