Risk
12/29/2010
06:39 PM
50%
50%

Apple May Face More Privacy Lawsuits

Without definitive laws defining data privacy rights, Apple and other companies involved in developing mobile applications are likely to be targeted by consumers turning to the courts for protection.

Top 10 Apple Stories Of 2010
(click image for larger view)
Slideshow: Top 10 Apple Stories Of 2010

Apple and several application developers sued for allegedly misusing the personal data of iPhone and iPad users are likely to face more lawsuits in the future as consumers turn to the courts for privacy protection.

Apple and the creators of Backflip, Dictionary.com, Pandora, The Weather Channel, and other applications were named in two class action lawsuits filed last week in U.S. District Court in San Jose, Calif., The Washington Post reported. The suits seek to prevent the applications from sharing personal data found on iPhones and iPads, including ages, gender, location, and a unique device identifying number that Apple assigns to each of its mobile devices.

The lawsuits come as federal officials debate over what actions government should take to protect privacy as companies look to profit from ad-supported application services on smartphones and other mobile devices. The Federal Trade Commission recommended this month that consumers be offered a no-tracking option before signing up for services, while the Commerce Department favors establishing a code of conduct that businesses could voluntarily agree to follow. Once the commitment is made, businesses would be monitored to ensure the rules are followed.

While privacy is being debated in government, the latest suits are an indication that consumers are turning to the courts for protection and that trend is likely to continue. "I would not be surprise if there were more lawsuits," Kevin D. Pomfret, a lawyer who advises businesses on privacy issues for the national law firm LeClairRyan, told InformationWeek Wednesday. "This is an area where the law is unclear."

Apple did not respond to a request for comment.

One of the lawsuits was filed by the firm KamberLaw on behalf of Jonathan Lalo of Los Angeles County. KamberLaw specializes in digital privacy cases. The second suit was filed by Dallas lawyer Majed Nachawati of Fears and Nachawati, which is looking to represent Texas and California iPhone and iPad users in the class-action complaint. Both lawsuits accuse the companies of violating federal computer fraud and privacy laws.

To avoid being named in a privacy suit, Pomfret is advising companies to consider carefully why they need user data and be sure to use it only for the purposes approved in advance by the owners of that data. In addition, companies need to be sure that data shared with other companies is not used for other purposes without prior approval. "Unfortunately, there's no clear-cut answer right now, because of the uncertainty," he says.

SEE ALSO:

Obama Administration Urges Online Privacy Bill Of Rights

FTC Proposes 'Do Not Track' Option For Internet

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8893
Published: 2015-01-28
Multiple cross-site scripting (XSS) vulnerabilities in (1) mainpage.jsp and (2) GetImageServlet.img in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-8894
Published: 2015-01-28
Open redirect vulnerability in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the out parameter.

CVE-2014-8895
Published: 2015-01-28
IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote attackers to bypass intended access restrictions and read the image files of arbitrary users via a crafted URL.

CVE-2014-8917
Published: 2015-01-28
Multiple cross-site scripting (XSS) vulnerabilities in (1) dojox/form/resources/uploader.swf (aka upload.swf), (2) dojox/form/resources/fileuploader.swf (aka fileupload.swf), (3) dojox/av/resources/audio.swf, and (4) dojox/av/resources/video.swf in the IBM Dojo Toolkit, as used in IBM Social Media A...

CVE-2014-8920
Published: 2015-01-28
Buffer overflow in the Data Transfer Program in IBM i Access 5770-XE1 5R4, 6.1, and 7.1 on Windows allows local users to gain privileges via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If youíre a security professional, youíve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.