Global Data & Privacy Update - 30 April 2015

Facebook is defending a lawsuit filed last week in the US alleging that its face-recognition technology breaches a law prohibiting collection of biometric data without informed written consent. At the centre of the challenge is the feature which scans faces of users' photos and suggests tags as users have not consented to the collection and storage. Damages of USD 5,000 per violation are being sought for the "intentional and reckless" violation in the class action led by plaintiff Carlo Licato.

Landmark US decision determines expert evidence subject to legal privilege

A US court has issued a decision this week following the hack of Genesco's data systems between 2009 and 2010 crucial to the treatment of cybersecurity experts' evidence in court. Visa levied fines of over USD 13 million against Genesco for PCI DSS failings and in response Genesco brought a lawsuit against Visa in the federal court. The court denied Visa's requests for discovery on the basis that cybersecurity experts' work is subject to attorney-client privilege and ratified the use of counsel as the key lead in data breach investigations.

Amazon Web Services agreement approved by Article 29 Working Party

Amazon Web Services' data protection agreement has been approved by the EU's Article 29 Data Protection Working Party. This agreement gives EU customers, who store data on Amazon servers outside Europe the same level of data protection offered to those with data stored in Europe. Amazon's web servers are widely used across Europe as they allow users temporary rental of large numbers of cloud-based virtual servers. The approval is likely to allow vendors to outsource data processing to the US where it is cheaper, without compromising consumer protection.

US Spokeo case likely to affect class-actions

The Supreme Court agreed on Monday to hear a case likely to have affect class-actions by consumers against Internet companies who violate data and privacy laws. The action concerns search site Spokeo Inc who allegedly published incorrect information about a Virginia man's age and education, harming his prospects of employment. Spokeo argue that they fall outside of the law on consumer reporting...