Is There A Privacy Expert In The House

I recently attended an online privacy debate/discussion presented by Gotham Media at Frankfurt Kurnit.  I want to thank both of them for putting this type of program together: a mix of legal and non-legal and very cutting edge. Unfortunately, I left unsatisfied.

Each panel member was smart and specialized (government lawyer, Wired editor, journalism professor and ex-Microsoft lawyer) and the conversation was lively for the most part.  But, the panelists appeared to generally agree that (1) people want more privacy, (2) consumers need to be protected online (from advertisers? others, besides crooks? not sure who), and (3) the government is the entity that should police privacy.

I left the talk unsatisfied because I don't agree with any of those premises. (1) my public online presence is something I chose and am happy with, (2) I much prefer to get ads targeted to what I am looking for, especially if it includes a better price--I don't like to window shop, and (3) the discussion centered around privacy regulations that remain on the drafting boards since 2000. Social media and sharing sites (facebook, twitter, foursquare, flickr etc) were, of course, not even around in 2000. Which begs the question, who is writing the regs and do they have enough of an online presence to understand social media?

I prefer to be vigilant (not necessarily restrictive) about my own settings, so I can benefit from sharing and what is shared on my terms.


I am not a privacy lawyer, it is just an area of interest to me. If anyone can set my understanding straight, please comment, I would be grateful to hear why I am misinformed.

No Red Flags Rule for Lawyers

On October 29, the U.S. District Court for the District of Columbia ruled that the FTC's Red Flags Rules cannot be enforced against lawyers, saying that the FTC's interpretation of the Fair and Accurate Credit Transactions Act overreaches and its application to lawyers is unreasonable.

NYCLA organized a CLE Program on November 5 which discussed the decision and its significance for the independance of the legal profession.

Red Flags Rule Update

A bill to exclude some lawyers from the Federal Trade Commission’s Red Flags Rule has passed the U.S. House of Representatives and awaits action in the Senate.

On October 20, the House of Representatives voted in favor of H.R. 3763 to exclude from the meaning of “creditor” any health care practice, accounting practice, or legal practice with 20 or fewer employees. The bill would also excludes any other business which the FTC determines: (1) knows all its customers or clients individually; (2) only performs services in or around the residences of its customers; or (3) has not experienced incidents of identity theft, and identity theft is rare for businesses of that type.

With only three days left before November 1 -- the date the FTC will begin enforcement -- whether or not your firm will be affected is still an open question.

Red Flags Rule reprise

In case you have forgotten about theFTC's Red Flags Rule (we haven't). In the summer, the FTC delayed enforcement of the rule until 11/1/09. Mark your calendars, the date is coming up...

More on the Red Flags Rule

The Law Journal has recently picked up on this very important issue. See Daniel Wise's article "FTC Rule on Identity Theft Draws Strong Criticism From Bar Groups" from July 01, 2009. He writes "The New York State Bar Association Monday became the latest bar group to protest new Federal Trade Commission rules requiring lawyers to become involved in preventing identity theft . . . . The state bar's objections follow those submitted last week by the American Bar Association and the New York County Lawyers' Association.


The article also mentions our blog (thanks, Daniel): "The New York County Lawyers' has set up a platform on its Web site . . . where its more than 10,000 lawyers [as well as other members of the legal community] can vote on whether they support or oppose the FTC rule." So, step up and vote, we want to hear from more of our 10,000 NYCLA members and from other members of the legal community who happen to be surfing the site.

Should the FTC regulate your firm?

In order to combat identity theft, the Federal Trade Commission issued regulations requiring, inter alia, financial institutions and creditors to develop and implement "written identity theft programs," as part of the Fair and Accurate Credit Transactions Act of 2003. In April 2009, the FTC informed the American Bar Association that it intends to require lawyers and law firms to abide by the rules because lawyers and law firms fall into the category of creditors under the law.

The "written identity theft programs" must provide for the identification, detection, and response to patterns, practices or specific activities that could indicate identity theft. The programs must describe responses that a firm would undertake to mitigate or prevent identity theft, and require management by senior employees of the firm.

Compliance with the FTC rules would undoubtedly be burdensome in time and expense for the legal community. In addition, the FTC rules threatens the autonomy of the legal profession, which is the only service provider that remains self-regulated and nearly free from federal oversight. But perhaps compliance with the FTC rules is a fair price for firms to pay to ensure the safety of their client's identity (bearing in mind that there have been no reported instances of identity theft arising from providing legal services).

In less than two months the Federal Trade Commission's "Red Flags Rule" will go into effect, which may mean yet more regulation of your law firm. NYCLA wants to know your opinion as to whether or not to endorse the "Red Flags Rule" regulations and get your views on a course of action to address the issue.

Please leave your comment by clicking the "Comment" link below.