[{"description":"From time to time, this blog will highlight initiatives, ideas, or activities coming from members, committees or special interest groups (SIGs). Today: An Update About Web Tracking Tools , by Katie Thomas, Resource and Reference Librarian, Stikeman Elliott LLP (Toronto). The CALL Knowledge Management SIG had a session on November 30 th that looked at Web Tracking Tools. There are a lot of website tracking tools out there so it helps to have a guide to get you started. I based my presentation on the AALL Cool Tools (access only for attendees of American Association of Law Libraries 2021 conference) session where eight trackers were evaluated. In our session I asked the participants to write down sites they would like to track and they were all different. So, there is a need! First, what criteria should be used for evaluating? It depends. Every workplace is different and different things needs to be monitored. However, there are three that stand out. 1.   Ease of Use You don’t want to spend time setting things up and you want to understand WHAT you are setting up 2.   Price A lot of the tools are free and you can continue to have them free forever or, you can pay. Prices vary depending on functionality. 3.   Collaboration This allows you to work with colleagues tracking the same website. Say, if someone is on vacation. What to Track? Any number of things to track. Depends what you want to track! Here’s some that are popular: Prices (book, software, flights, stocks) Are they increasing / decreasing Text tracking Articles, preprints, legislation, case law, newspapers Competitors When does a competitor post commentary on a specific case Archiving Like Wayback, but you can customize for the websites you want Features? What do you want your tracker to do? Here are the popular features: Bulk adding of urls into the tracker Captcha bypass (or I am fed up counting fire hydrants) Password protected pages Proxy support, don’t want tracker to get blocked Tracking multiple elements on one page (there might be pricing data and text you want to capture changes to on the same page) Notification. Or would you prefer Slack, Discord, mobile N.B.: Be careful of “quick” and “instant” – understand what these mean (does quick mean within an hour or 5 minutes) Data export and reports Summary of web tracking tools","titre":"Update from the Knowledge Management Special Interest Group: Web Tracking Tools","id":3241459,"pubDate":"Mon, 26 Oct 2026 07:55:47 +0100","source":"Canadian Association of Law Libraries / L'Association canadienne des bibliothèques de droit CALL/ACBD Blog","url":"https://www.callacbd.ca/CALL-Blog/12197599"},{"titre":"New Professionals SIG Article: Library School and Beyond – Job Hunting Tips for New Grads","pubDate":"Mon, 26 Oct 2026 07:55:45 +0100","id":3241437,"description":"By Erin Clupp, Research Librarian in Norton Rose Fulbright’s Vancouver office. Congratulations! You’ve successfully completed library school and are a freshly minted information professional. What is an exciting time in your life can also be overshadowed by what comes next: the dreaded job hunt, heightened by the fact that we are still struggling through the COVID-19 pandemic. Despite this being a challenging and unprecedented time to enter the workforce, there are still many exciting opportunities that await you. Here are some tips and words of advice that I hope are helpful and comforting as you navigate through this next phase of your career: 1) Manage your expectations but be kind to yourself First and foremost, job hunting can really suck. It’s important to acknowledge this and understand there will be periods of frustration, self-doubt, and worry (especially when we have bills to pay). This is normal! Rejection can be painful, and sending applications into that black hole where resumes seem to go can be demoralizing but don’t give up! When job hunting, be mindful of the following: As a new grad, you are probably eager and excited to land that first job and start working! Have some patience, the process may take longer than you would like it to be (before and during the interview process). It is also great to have goals, but realize you may not get your “dream job” right outside the gate. That is fine! Along the way, you may find you don’t have one dream job after all, and that you enjoy doing many types of work. Resist the urge to compare yourself to others. Some people may seem to have better “luck” or have more apparent success early on. We don’t always know their stories, what their past experiences are or who they may know. Just remember, we are all operating on different timelines and your opportunity will come. It doesn’t make you a failure or unworthy if it takes you a bit longer or if you end up in an area completely different than you originally thought. While job hunting can become a full time job, don’t forget to take breaks and don’t let it become all-consuming. Focus some energy on your hobbies, personal relationships, and most importantly rest! 2) Beyond the library – be flexible and think outside the box The information profession is evolving, and while there are still plenty of “traditional” LIS jobs in academic and public library settings, there are increasingly more jobs in special libraries and in larger “information teams” in government, private corporations, and non-profits. When searching for job postings, don’t just focus on the job title, be sure to also read the descriptions and position requirements. Look for buzz words like “information analyst”, “knowledge management”, “content creation”, “competitive intelligence”, “prospect research”, “information architecture”, or “data curation”, all of which use the skills of an LIS professional and are increasingly in demand as businesses recognize the need for improved information governance and user experience. I know people with LIS backgrounds who work in academic institutions, museums, archives, law firms, government, telecommunications companies, non-profit organizations, healthcare, and international organizations doing a variety of work including research, privacy, information security, instruction, technical writing, and management. Basically any organization that deals with information and people (read: all of them) may have a position that you can apply for. Now is the time to experiment and try new opportunities. Don’t worry about pigeonholing yourself, because you can always leverage your transferable skills and move within industries and organizations. 3) Take a leap – consider a move! While not possible (or desirable) for some, consider moving to a new city (or country!), especially if you are in a very competitive market","source":"Canadian Association of Law Libraries / L'Association canadienne des bibliothèques de droit CALL/ACBD Blog","url":"https://www.callacbd.ca/CALL-Blog/10326333"},{"titre":"i-Dressup and a data security mess-up","pubDate":"Thu, 08 Oct 2026 08:06:59 +0200","id":3203250,"description":"i-Dressup and a data security mess-up lfair April 24, 2019 | 3:08PM i-Dressup and a data security mess-up By Lesley Fair Kids love to play dress-up, but parents wouldn’t want them rummaging through the attic or climbing to the top shelf of the wardrobe without permission and proper supervision. The i-Dressup.com website offered users – including children – a virtual way to play dress-up and design clothes without those potential dangers. But according to an FTC complaint, Unixiz, Inc. , the company behind i-Dressup, violated the Children’s Online Privacy Protection Act in ways that created different kinds of risks. COPPA puts two separate sets of protections in place to help keep parents in control of personal information collected from their kids online. First, COPPA-covered companies must clearly disclose their information policies and get parental consent before collecting personal information from children under 13. Second, companies must provide reasonable and appropriate security for the data they collect. According to an FTC settlement, i-Dressup fell short on both COPPA requirements. The complaint alleges i-Dressup failed to provide sufficient notice on its site of the information it collected online from kids, how it used it, its disclosure practices, and other specifics required by the COPPA Rule. The company’s direct notices to parents were deficient, too. Among other things, they didn’t include the COPPA-required statement that if parents don’t provide consent within a reasonable time, i-Dressup will delete their online contact information from its records. Stick with the story because that failure turned out to be particularly troubling. In addition to letting users play online games, i-Dressup featured a community where they could “explore their creativity and fashion sense with unique personal profiles” and interact with others. To register, i-Dressup required people to submit a user name, password, birthdate, and email address. If the birthdate indicated the person was under 13, the email field changed to “Parent’s Email.” Once the under-13 user filled in the required fields and clicked “Join Now,” i-Dressup collected the personal information and sent a message to the address entered into the Parent’s Email field. The person receiving the email could consent by clicking the “Activate Now!” button. However, if the parent didn’t give consent, i-Dressup retained the personal information it had collected from the child online. The FTC says the company’s failure to delete that information violated Section 312.5(c)(1) of the COPPA Rule. In addition to violating COPPA’s parental consent provisions, i-Dressup allegedly violated the Rule’s data security requirements . According to the FTC, i-Dressup stored and transmitted users’ personal information (including passwords) in plain text. In addition, the company failed to perform network vulnerability testing of its network, even for well-known threats like SQL attacks; it didn’t implement an intrusion detection and prevention system; and it didn’t monitor for potential security incidents. The upshot? The company learned that a hacker had gained entry to its network and accessed information about 2.1 million users, including approximately 245,000 users who indicated they were under 13. To settle the case , i-Dressup and its owners will pay a $35,000 civil penalty. They’re also prohibited from violating COPPA in the future, and can’t sell, share, or collect any personal information until they implement a comprehensive data security program and get independent biennial assessments. In addition, they’ll have to provide the FTC with an annual certification of compliance. The message for sites and operators covered by COPPA is that an effective system of parental consent is only the first step toward compliance. Section 312.8 of the COPPA Rule also requires you to “establish and maintain reasonable","source":"FTC USA Business Blog Posts","url":"https://www.ftc.gov/business-guidance/blog/2019/04/i-dressup-data-security-mess"},{"description":"Nixing the Fix: Warranties, Mag-Moss, and restrictions on repairs lfair March 18, 2019 | 10:24AM Nixing the Fix: Warranties, Mag-Moss, and restrictions on repairs By Lesley Fair First, the bad news: That nifty purchase needs a repair. Now the good news for consumers: It’s still under warranty. But where can they go to get it fixed? Can the manufacturer restrict a consumer’s ability to go to the independent repair shop of their choice? Can the manufacturer use glue, non-standard screws, and proprietary diagnostic software that make it difficult for independent repair shops to fix things? Do limitations like these affect consumers’ rights under the Magnuson-Moss Warranty Act ? That’s the topic of Nixing the Fix: A Workshop on Repair Restrictions , an FTC event scheduled for July 16, 2019 . Enforced by the FTC, the Magnuson-Moss Warranty Act helps consumers make informed buying decisions and gives them access to remedies if the widget starts to fidget during the warranty period. One key consumer protection under Mag-Moss is that the law prohibits manufacturers from conditioning warranty coverage on the use of particular products or services. Here are some of the questions FTC staff intends to ask at Nixing the Fix : What’s the interplay between repair restrictions and the Magnuson-Moss Warranty Act’s anti-tying provision, which establishes that manufacturers can’t condition coverage on the use of parts or services identified by brand, trade, or corporate name? Do repair restrictions affect the market for extended warranties and service agreements? What types of restrictions are consumers running into when they try to get their stuff repaired? Are manufacturers’ restrictions having an impact on small fix-it businesses? Are manufacturers using software that may render products obsolete or unfixable if consumers engage in DIY or go to a local repair shop? Are repair restrictions necessary to reduce the risk of physical injury or to protect manufacturers from liability for products improperly repaired by others? Do consumers understand the effects of repair restrictions? We’re also looking for empirical research and data about the prevalence and impact of manufacturers’ repair restrictions. For example, what can you tell us about code that disables products that have been repaired by someone other than the manufacturer, product designs that make third-party repairs difficult (like attaching batteries with glue only the manufacturer can remove), contractual post-sale or licensing restrictions, or proprietary diagnostic software and replacement parts? Please send us your research and data by April 30, 2019. Do you have suggestions about possible panelists? Email us at nixingthefix@ftc.gov . Nixing the Fix will take place on July 16th at the FTC’s Constitution Center conference facility, 400 7th Street, S.W., in Washington, DC. It’s free and open to the public. You can file public comments online and we’ll keep the record open until September 16, 2019. Follow the Business Blog for more information about the agenda and for watch-the-webcast instructions.","titre":"Nixing the Fix: Warranties, Mag-Moss, and restrictions on repairs","id":3199073,"pubDate":"Tue, 06 Oct 2026 08:06:23 +0200","source":"FTC USA Business Blog Posts","url":"https://www.ftc.gov/business-guidance/blog/2019/03/nixing-fix-warranties-mag-moss-restrictions-repairs"},{"description":"Practice Fusion case suggests 6 health privacy pointers lfair June 8, 2016 | 9:01AM Practice Fusion case suggests 6 health privacy pointers By Lesley Fair Combine two of the most talked-about consumer protection topics – health privacy and consumer-generated online content – and what do you get? A proposed FTC settlement with Practice Fusion, the largest cloud-based electronic health records company in the country, and six compliance tips for others in the industry. One of San Francisco-based Practice Fusion’s primary products is an electronic records system for outpatient providers. In 2009, the company launched “Patient Fusion,” an online portal where patients whose providers were already using Practice Fusion could view or download their health information or transmit it to another provider. Patient Fusion also let patients send and receive secure messages from their providers. Fast forward several years and the company decided to expand Patient Fusion to include a public directory where current and prospective enrollees could search for doctors geographically or by specialty, read patient reviews of providers, and request appointments. But Practice Fusion had to ask itself a question familiar to many online companies: How do we get the content – in this case, patient reviews? That’s the focus of the FTC’s lawsuit. According to the complaint , Practice Fusion solicited data in a misleading way that led some patients to believe they were sending follow-up messages directly to their doctors about their diagnosis, medical treatment, prescriptions, etc. – and not contributing content to a public website. Practice Fusion, however, populated its new site with the information those people provided, some of which was highly sensitive. Here’s what happened. After appointments with their doctors, patients received emails titled “How was your visit?” The message continued, “To help improve your service in the future, please let us know how your visit went” and included a link with rating stars. The message ended this way: Thank you, Dr. [Name] In a footer, the message said “This email was sent to you by Patient Fusion®, a tool Doctor [Name] uses to deliver the highest quality of care to patients.” Below that in smaller print it said “Sent on behalf of Doctor [Name]’s office by: Practice Fusion.” If patients clicked the link, they were taken to a page that asked for feedback about things like how long they had to wait for their appointment, the doctor’s bedside manner, and whether their medical concern was addressed. There also was a text box where patients were invited to “leave a review for your provider.” Below that was a pre-checked box with the phrase “Keep this review anonymous.” What did some people put in that box? Highly sensitive information directly addressed to their doctors, not evaluations meant to be shared publicly. Here are just a few examples: “Dr [name], My Xanax prescription that I received on Monday was for 1 tablet a day but usually it’s for 2 tablets a day. I have not taken it to the pharmacy yet. Can I pick up a new one, or can I get a prescription called into a pharmacy? Thanks, [patient’s full name] “I called today and left a message regarding my daughter and no one has returned my call. I think she is depressed and has stated several times this week that she wishes she was dead. Could someone please call me [phone number]?” “The cefuroxime axetil does not seem to be doing anything for me. I did a little research and I think I have a yeast infection called candida. Not sure what to do about it yet. I guess I will first try to change my diet. Medication? [patient’s full name] “I would like to make an appointment for my back pain and possible shingles. Can you please call me @ [phone number]? Thank you! [patient's full name]” “I HAVE NO INFECTION [healthcare provider name].  EVERYTHING WENT","titre":"Practice Fusion case suggests 6 health privacy pointers","pubDate":"Sat, 03 Oct 2026 08:09:37 +0200","id":3194910,"source":"FTC USA Business Blog Posts","url":"https://www.ftc.gov/business-guidance/blog/2016/06/practice-fusion-case-suggests-6-health-privacy-pointers"},{"description":"The Federal Trade Commission finalized orders requiring Cox Media Group (CMG) and two other firms to pay a total of $930,000 to settle allegations they deceived customers by falsely claiming to offer an AI-powered service that could target localized ads based on conversations captured from consumers’ smart devices and that consumers had opted into such targeting. In three separate complaints first announced in May , the FTC alleged that Georgia-based media and marketing company CMG Media Corporation, which does business as  Cox Media Group , and two marketing firms it worked with, New Hampshire-based MindSift LLC  and Wisconsin-based  1010 Digital Works LLC ,  deceived customers by claiming they used a special algorithm to listen in on and detect pertinent conversations from smart devices in order to target ads to consumers within a specific geographic region. Contrary to these companies’ claims, however, the marketing service wasn’t based on voice data, and consumers hadn’t opted into this service. If the service had functioned as advertised, this collection and use of consumers’ voice data without adequate consent would itself violate the FTC Act. Under the proposed orders settling the FTC’s allegations,  CMG must pay $880,000 while both  MindSift and  1010 Digital Works  must each pay $25,000, which will be used to provide redress to CMG customers impacted by these practices. In addition, each defendant is prohibited from making any misrepresentation about the qualities or features of its advertising or marketing services; the collection and use of voice data and whether consumers have provided their consent to collect, use or disclose their voice data; and the geographic targeting capabilities of its advertising or marketing services. After receiving two comments on the proposed settlement orders, the Commission voted 2-0 to give final approval to the consent","id":3120376,"pubDate":"Fri, 28 Aug 2026 08:07:59 +0200","titre":"FTC Finalizes Orders with Cox Media Group, Two Other Firms Settling Charges They Deceived Customers About “Active Listening” AI-Powered Marketing Service","url":"https://www.ftc.gov/news-events/news/press-releases/2026/08/ftc-finalizes-orders-cox-media-group-two-other-firms-settling-charges-they-deceived-customers-about","source":"Federal Trade Commission - Protecting America's Consumers"},{"url":"https://www.edpb.europa.eu/news/news/2026/cef-2026-edpb-launches-coordinated-enforcement-action-transparency-and-information_en","source":"EDPB News","description":"Brussels, 19 March - The EDPB has launched its Coordinated Enforcement Framework (CEF) action for 2026*. Following a year-long coordinated action on the right to erasure in 2025 , the CEF's focus this year will shift to compliance with the obligations of transparency and information under the GDPR . The GDPR ensures that individuals are informed when their data is being processed (under Art. 12, 13 and 14). This right to be informed is a core element of transparency and ensures that individuals have more control over their data. Next steps During 2026, 25 Data Protection Authorities (DPAs) across Europe will take part in this initiative. They will look closely to assess the compliance of controllers with their transparency obligations under the GDPR. Participating DPAs will soon contact controllers from different sectors across Europe, either through enforcement actions or fact-finding exercises. In the latter case, they might also decide to undertake additional follow-up actions if needed. During the second half of the year, participating DPAs will share and discuss their findings together, with a view to aggregate the results of their national actions and generate deeper insight into the topic. A consolidated report will then be drafted and submitted for adoption by the EDPB, allowing for targeted follow-ups on both national and EU levels. Background The CEF is a key action of the EDPB under its 2024-2027 Strategy , aimed at streamlining enforcement and cooperation among DPAs. In 2023, the EDPB published the report on its first coordinated action on the use of cloud-based services by the public sector . In 2024, the EDPB also published the report on the outcome of the second coordinated action on the designation and position of Data Protection Officers . In 2025, the EDPB issued the report on its third coordination action on the implementation of the right of access . In 2026, the EDPB has adopted a report on its Coordinated Enforcement Framework (CEF) action on the right to be forgotten (Art.17 GDPR) .   Note to editors: *The Board selected this topic during its October 2025 plenary","pubDate":"Thu, 19 Mar 2026 14:12:59 +0100","id":2769535,"titre":"CEF 2026: EDPB launches coordinated enforcement action on transparency and information obligations under the GDPR"},{"titre":"European Patent Organisation and extension of adequacy decisions for the UK: EDPB adopts opinions","pubDate":"Tue, 06 May 2025 15:51:59 +0200","id":2099053,"description":"Brussels, 06 May - During its latest plenary, the European Data Protection Board (EDPB) adopted an opinion on the European Commission’s draft adequacy decision under the GDPR concerning the European Patent Organisation (EPO) . In addition, the Board adopted an opinion on the European Commission’s proposal to extend the validity of the UK adequacy decisions under the GDPR and the Law Enforcement Directive (LED) . Finally, the EDPB agreed to grant the status of observer to the Personal Data Protection Agency of Bosnia and Herzegovina.   Adequate protection of personal data by the EPO At the European Commission’s request, the Board adopted an opinion on the Commission’s draft adequacy decision regarding the European Patent Organisation (EPO). Once formally adopted by the Commission, this will be the first adequacy decision concerning an international organisation and not a country or a region. An adequacy decision is a key-mechanism in EU data protection legislation which allows the European Commission to determine whether a third country or an international organisation offers an adequate level of data protection. The effect of such a decision is that personal data can flow freely from Europe to that third country or international organisation. EDPB Chair, Anu Talus, said: “The EDPB welcomes the Commission’s initiative to work on the first adequacy decision concerning an international organisation. This decision shows how the legal framework of such organisations can be recognised as ensuring an adequate level of protection on the basis of Art.45 GDPR. The EDPB underlines the importance of ongoing dialogue between the Commission and international organisations, with a view to developing this category of adequacy decisions in addition to those relating to third countries.” In its opinion, the Board positively notes that the EPO data protection framework is largely aligned with the European Union data protection framework, including on data protection rights and principles. This shows that the GDPR and, in particular, its transfer provisions, can facilitate safe data flows from Europe to international organisations, while taking into account their status.   Six-month extension of the UK adequacy decisions The EDPB opinion, requested by the European Commission, addresses the proposed extension of the two UK adequacy decisions under the GDPR and the LED, which are set to expire on 27 June 2025. The opinion only concerns the proposed 6-month extension of these adequacy decisions and does not address the level of protection for personal data afforded in the UK, which will be examined by the EDPB following the Commission’s assessment, and if the renewal of the UK adequacy decisions is proposed. Since the UK‘s data protection reform is still pending in the UK parliament, the EDPB recognises the need for a technical and time-limited extension of the adequacy decisions until 27 December 2025.This will give the European Commission sufficient time to evaluate the updated UK legal framework once it has been adopted.   The EDPB stresses that this extension is exceptional and is due to the ongoing legislative developments in the UK. It should not, in principle, be further prolonged. The Board recalls the validity of its opinions 14/2021 and 15/2021 on the two UK adequacy decisions, adopted in April 2021, and invites the European Commission to take them into account in its future assessments.  The Board also recalls the Commission’s obligation to monitor all relevant developments in the UK during the extension period.   New observer to the EDPB’s activities Finally, EDPB members agreed to grant observer status to the EDPB’s activities to the Bosnia and Herzegovina Data Protection Authority, in line with Art. 8 EDPB Rules of Procedure .","source":"EDPB News","url":"https://www.edpb.europa.eu/news/news/2025/european-patent-organisation-and-extension-adequacy-decisions-uk-edpb-adopts_en"}]