Law and legal affairs: Techno File

Published on Sunday 29 August 2010 20:30

Failings fine

The Financial Services Authority (FSA) has fined Zurich Insurance 2,275,000 after a back-up tape containing unencrypted personal details on 46,000 policy holders went missing in transit. The FSA said Zurich had inadequate systems and controls in place.

The fine is the highest levied to date on a single firm for data security failings, according to the UK regulator.

Zurich UK outsourced the processing of some of its general insurance customer data to Zurich Insurance Company South Africa Limited (Zurich SA). The FSA reported that in August 2008 an unencrypted back-up tape was lost during a routine transfer from a data centre in South Africa to a third party data storage facility.

The tape was lost by a subcontractor engaged by Zurich SA. The FSA found that the subcontractor had been engaged without Zurich UK's written consent.

The missing tape included identity details and in some cases bank account and credit card information. Zurich UK did not learn of the incident until a year later.

The FSA said the loss could have led to serious financial detriment for customers and exposed them to the risk of burglary. It found that the insurer had failed to take reasonable care to manage the risks relating to the security of customer data. The firm also failed to ensure that it had effective systems and controls to prevent the lost data being used for financial crime.

Search rule

An appeals court in Argentina has ruled that search engines are not responsible for the content of sites that they index. The court overturned a lower court's ruling against Google and Yahoo! Argentina.

That court had found the search firms liable for damaging the "moral character" of Virginia Da Cunha, a model, singer and actress, by linking to pages that named her and used her image in a sexual context.

Each company was ordered to pay 50,000 pesos (approximately 8,200) plus interest. It was just one of more than 100 similar lawsuits that demanded search engines block links to pages relating to famous people, including football legend Diego Maradona, models, actors and public servants. According to The New York Times, Da Cunha's case was the furthest along.

Argentine lawyer Martin Leguizamn Pea was behind 108 of the court applications that resulted in temporary orders being issued against the search companies in 2008. He told Argentina's News Magazine that he was acting to protect his clients' image rights, privacy and honour.

Yahoo! blocked all search results for the individuals.

The National Chamber of Civil Appeals has now ruled that search engines become liable for the content of third parties only if they negligently fail to remove content upon being made aware of its illegality.

Social snooping?

Employers in Germany will be allowed to enter job applicants' names into search engines and professional networking sites but must not look at their profiles on Facebook, under a draft law approved by the Federal Cabinet last week.

They may collect data in the public domain as a means of researching a job candidate, except where the legitimate interests of the employee in that data outweigh the legitimate interests of the employer.

It specifies that social networks used for electronic communication may not be used for research, except for those that exist to represent the professional qualifications of their members. Official guidance accompanying the law cites Facebook as an example of a service used for communication, which must not form part of a "private fishing expedition" and LinkedIn as one used to represent professional qualifications which can be explored.

Kirsty Ayre, a partner in the employment law team of Pinsent Masons, the law firm behind OUT-LAW.COM, said UK law is more tolerant of online research. "A lot of employers will put an applicant's name into Google to see what comes up, and nothing in UK law prevents that," she said.

"In terms of how employers use the information they find, they have to be conscious of a person's rights, particularly under the Data Protection Act."