Data & Privacy Update - 27th February 2014

Dating app revealed users' exact location

The popular smartphone app Tinder has revealed that a recent security vulnerability has led to users' locations being divulged to others without their consent. The app, which shows users a range of potential matches in their immediate vicinity, usually rounds distance to the nearest mile. Servers were found to instead have been pinpointing users' locations to within 100 feet.

EU privacy watchdogs concerned by Facebook's Whatsapp purchase

Jacob Kohnstamm, leader of the EU Article 29 Data Protection Working Party and the Dutch data protection authority has said that "twenty-eight data protection regulators could open an investigation" into the purchase. The Dutch DPA has already begun examining how WhatsApp's client data is likely to be used by Facebook and only a day after the deal was announced, the German regulator also expressed concern. Thilo Weichert urged WhatsApp users to change to a "more secure messaging service" and said that the deal is likely to lead to serious data protection issues due to the merging of the two companies' data.

Nationwide Mutual data breach case dismissed for lack of standing

The case was brought against Nationwide Mutual Insurance Company after a 2012 data breach involving around 1 million policyholders and non-policyholders. Plaintiffs sued for violations of the Fair Credit Reporting Act, negligence, invasion of privacy and bailment. The US District Court for the Southern District of Ohio found that the plaintiffs' injuries (an increased risk of harm, the costs of mitigating that risk and loss of privacy) failed to satisfy the requirements necessary to constitute 'injuries in fact'.

Insurers off the hook in Sony cyber attack ruling

A New York Supreme Court judge has ruled that Zurich American Insurance Co. and Mitsui Sumitomo Insurance Co. of America do not have a duty to defend Sony Corp. in relation to the numerous cases it is embroiled in as a result of the 2011 PlayStation cyber-attack. Sony was relying on a policy provision which provided litigation coverage for the oral or written publication of materials which violate a person's right to privacy, but the judge found that this provision applied only to the actions of Sony, and not to the actions of the hackers who actually stole the confidential information. The order is likely to be appealed.

Australian Information...