Privacy News Highlights
02—08 June 2006
Contents:
EU – New Biometric
Passports for Finland
CA – Quebec to Introduce Patriot Act Privacy
Protection
CA – Federal Privacy Commissioner Reports
on PIPEDA
CA – Federal Privacy Commissioner Reports:
The Privacy Act is Nearly Irrelevant
CA – Moncton Group Stops Posting “John”
Licence Plates
CA – Dispute Over War Amps Key Tags in
Alberta Settled
CA – Federal Anti-Terror Law to Face Major
Test in Coming Prosecutions
US – Survey: Americans Concerned About Info Offshoring
AU – Telemarketing Tops Privacy Gripe List
WW – Encryption Software May Halt Wire Tapping
EU - Hopes Grow for Deal on Airline Passenger Data
CH – Survey: Chinese Expect More Privacy
US – Judge in At&T Suit To Examine Classified
Documents
US – Plan to Build Children’s DNA Database Raises
Concerns
US – Connecticut Governor Vetoes Legislation on Adoptees’
Access to Birth Records
US – Three Years Later: No Fines but Plenty of Complaints
US – Lost Ernst & Young Laptop Contained Hotels.com
Customer Data
US – Lost Laptop Contained Retirees’ Personal Data
US – Thief Makes Off With Laptop From YMCA
US – Photo ID Now Required for Cold Medicine in Hawaii
CA – Hundreds of Canadian Artists Call for
Balanced Copyright
CA – New Alberta Government Website Tackles
Online Luring
CA – Canadian Officials Monitored Chat
Rooms in Terror Bust
WW – Brin Says Google Compromised Principles
US – Colleges Fail Online Privacy Test
US – Senate Won't Probe Telco Spying
US – New federal Rule: No Informed Consent in Public
Crisis
US – Gartner Analyst: Data Breach vs. Data Protection –
Do The Math
CA – Wal-Mart Canada to Test RFID Tags
US –Tucson, Arizona Schools Considering RFID BusPass
US – Wisconsin Governor Signs ‘Chip Implant’ Bill
US – DHS Report Questions RFID Privacy Risks; AeA
Questions DHS
CA – “VeriChip” Privacy Raised at Edmonton
Conference
AU – RFID to Track Prisoners at Canberra's First Prison
US – Veterans’ Group Files Lawsuit Stemming >From Laptop
Breach
US - Special Publication: Information Security Handbook:
A Guide for Managers
WW – Common Sense Steps to Avoid a Privacy Debacle When
Traveling
AU – Privacy Commissioner Warns New Smart Card Could Be
Used for Surveillance
UK – New Software Puts Surveillance CCTV on Steroids
HK – Hong Kong Gov’t Tweaks Wiretap Law to Address
Privacy Fears
US – Justice Department Fails to Get Agreement on Data
Retention
US – Congress Considers Several Data Protection Bills
US – Counterterror Exemption Proposed for Privacy Act
CA – Report: Border ID Cards Have a ‘long
way to go’
US – New Illinois Law Requires Businesses to Notify about
Possible ID Theft
WW – Survey: Employers Routinely Read Staff E-mails
WW – Survey: Employees Give Employers Poor Marks for
Privacy Protection
The Finnish Interior Ministry said this week that the
country will introduce new biometric passports in August. The new passports
will be more secure because of biometric identifiers, including the person’s facial
image and fingerprints. The new passports will be valid for five years. [Source]
According to the federal privacy commissioner,
Canadians have never felt more threatened about their loss of privacy and the
misuse of their personal information. The observation came in a report by commissioner
Jennifer Stoddart on PIPEDA, which is being reviewed by Parliament this year.
The report terms the need for the review “vital” and urges Parliament to reassess
the capacity of the act to protect the rights of Canadians. [Source] [Biggest
challenge to privacy is apathy says P.Commish]
The federal privacy commissioner, in her latest annual
report, argues that the Privacy Act has become a outdated in the face of new
information technologies; and over time it has become almost entirely irrelevant,
“severely restricting my office’s ability to protect the privacy rights of
Canadians.” [Source] [Cdn P.Commish tables report urging
Privacy Act reform]
A community group fighting prostitution in downtown
The
But the change will likely mean the end of the War
Amps program in
The federal Anti-Terrorism
Act is about to get a tough test in the courts. Among the possible points
of contention are defining terrorism as a crime aimed at further a political,
ideological or religious objective. “It’s unusual to try to criminalize acts
committed with a particular motivation,’’ says one law professor. Controversial
provisions on “preventive detention,’’ and “investigative hearing’’ may be
called into question, along with sections that criminalize mere membership in a
proscribed group, something critics say could violate freedom of association.
Also contentious are sections that outlaw financial support for a terrorist
cause and allow seizure of assets based on secret intelligence. Critics have
also objected to broad wiretap and electronic eavesdropping powers under the
law. [Source]
A majority of the
A two-day phone-in conducted by the Australian Law
Reform Commission uncovered widespread criticism of telemarketing calls. The
phone-in was held to gauge the public’s concerns and views on privacy
protection. Other issues that came up during the phone-in included the
government’s handling of personal information, the security of health records
and camera surveillance in public places. [Source]
The creator of the most popular e-mail encryption
program has a new application for Voice-over-Internet-Protocol phone calls.
E-mail encryption creator Phil Zimmermann hopes to bring the same level of privacy
to Voice-over-Internet-Protocol phone calls. [Source]
US and European officials hope that legal tweaks can
be made to a pact that gives US authorities access to detailed information on
passengers flying from Europe to the US, in order to prevent the imposition of
measures that could slow down transatlantic air travel. European Commission
officials said they believed they could leave the substance of the agreement
largely untouched, as long as member states did not change their mind about the
pact. [Source]
Changes in
The district court judge presiding over the
class-action lawsuit over AT&T said it would examine classified government
documents to determine if they warrant state secrets protection. The documents
relate to a lawsuit filed by privacy advocate Electronic Frontier Foundation in
US District Court accusing AT&T of illegally cooperating with the National
Security Agency to make information on communications on its networks available
to the spy agency without warrants. [Source]
Why do some children become obese when they eat junk
food, while others don’t? Which kids are most susceptible to asthma? Attempting
to answer such questions, the Children’s Hospital of Philadelphia, the nation’s
oldest pediatric medical center, is launching a major effort to collect and
analyze detailed DNA profiles on as many as 100,000 of its child patients, the
first effort to collect DNA on so many children. CHOP plans to create a database
which hospital researchers can use to study children’s genetic profiles,
research that could guide the development of diagnostic tests and drugs. [Source]
Gov. M. Jodi Rell has vetoed legislation that would
have allowed adopted children to obtain their birth certificates when they turn
21, a move criticized by a key lawmaker as an insult to adoptees and their parents.
The legislation would have applied to people whose adoptions are finalized
after Oct. 1 of this year. Rell called the bill “well-intentioned and much
needed in certain respects,” but said it could have led to the violation of
privacy rights of birth mothers who place their children up for adoption
believing their identities would remain confidential. [Source]
[Source]
It has been three years since HIPAA guaranteed
Americans a national standard to govern the confidentiality of their medical records.
Despite nearly 20,000 complaints, federal authorities have prosecuted just two
criminal cases and have not levied any civil fines. The head of the Department
of Health and Human Services’ Office of Civil Rights, which enforces the law,
said the agency works toward voluntary compliance. Privacy advocates, however,
are dismayed about the approach, questioning whether providers and insurers are
becoming complacent about following the law. [Source]
Hotels.com says Ernst & Young has informed them
that a laptop computer stolen from an employee contained data belonging to
243,000 Hotels.com customers. Hotels.com and E&Y, the company’s outside
auditor, sent a joint letter notifying those affected by the data security
breach. A number of E&Y laptops have been reported stolen this year,
affecting employees of Sun, IBM and other companies. It is not known if the
Hotels.com data were on one of these computers or if there has been another
theft. [Source]
A laptop computer containing the pension data of
former employees of supermarket chains Stop & Shop, Giant and Tops,
including their Social Security numbers, was stolen during a commercial flight,
according to the supermarkets’ parent company. The U.S. subsidiary of Dutch
parent company Royal Ahold NV and a contractor whose employee lost the computer
early last month declined to say how many former supermarket employees were
affected. [Source]
[Source]
Debit card, credit card and Social Security numbers
for 68,000 YMCA members in Greater Providence, R.I., have been compromised
after the theft of a laptop from a locked office. The computer also contained
the names, addresses and other information for children who attend the Y’s day
care programs, according to a spokeswoman. There is no indication that any of
the information has been misused, but police are investigating the theft, which
employees discovered on May 24. [Source]
[When it
comes to laptop security, we’re all disasters waiting to happen] [Source]
Anyone buying common cold medicines that contain
pseudoephedrine, used to make crystal methamphetamine, will have to show photo
identification and sign a logbook at the store, under a new Hawaiian law signed
this week. [Source]
More than 500 members of the Canadian art community
have established a new coalition to call for balanced copyright reform. The
group, featuring dozens of award winners from the art world, are seeking fair
use provisions and a rejection of anti-circumvention provisions. [Open letter]
The
When a shadowy group of disaffected urban youth began
talking in an Internet chat room in the fall of 2004 espousing anti-Western
views, the Canadian Security Intelligence Service was listening. The spy
agency, and an alphabet soup of other security agencies across the continent,
closely monitor such sites, where talk may sometimes turn to buildings and
bombs and bringing global jihad home to North America, to
Google co-founder Sergey Brin acknowledged that Google
has compromised its principles by accommodating Chinese censorship demands.
Brin also addressed Internet users’ expectations of privacy in an era of
increased government surveillance, saying Americans misunderstand the limited
safeguards of their personal electronic information. “I think it’s interesting
that the expectations of people with respect to what happens to their data
seems to be different than what is actually happening,” he said. [Source]
How well do educational sites handle people’s private
information? To find out, researchers assessed the privacy practices of the top
236
The U.S. Senate is backing away from plans to ask the
heads of major telecommunications companies to testify about the National
Security Agency's domestic spying program. Verizon, BellSouth and AT&T were
accused in a USA Today report last month of sharing customer data with the NSA.
[Source]
In a public health emergency, suspected victims would
no longer have to give permission before experimental tests could be run to determine
why they're sick, under a federal rule published Wednesday. Privacy experts
called the exception unnecessary, ripe for abuse and an override of state informed-consent
laws. [Source]
Gartner Analyst Avivah Litan said recently that data
protection, such as encryption, is markedly less expensive than cleaning up
after a breach. Litan, who testified during a Senate hearing after the
Department of Veterans Affairs’ laptop breach, estimated that a company with at
least 10,000 accounts to protect would spend about $6 per customer account to
encrypt data. Litan recommends that companies and government agencies should
invest in data encryption rather than pay the estimated $90 per customer
account after data is exposed during a breach. [Source]
Wal-Mart Canada Corp. will launch a test this fall of
controversial new technology that can track products from the supplier to the
store, in an attempt to ensure that the shelves are never empty. Looking to improve
its bottom line, the discount retailer will roll out the pilot in 20 of its 272
stores and one distribution centre, a spokeswoman said in an interview. About
16 suppliers will be asked to volunteer, picked from among a number who are
already participating in similar
In the Tucson Unified School District (TUSD), one of
the nation’s largest school systems, students might be carrying RFID-enabled ID
cards as soon as next fall. The TUSD is testing a system called BusPass. that
combines RFID and GPS to track when and where students board each school bus,
and where and when they get off. With 120 schools and 60,000 students, the
district is interested in deploying the technology to bolster children’s safety
by better accounting for their locations outside of school premises. Parents
could arrange to receive text phone messages or e-mail alerts telling then when
their children’s bus will arrive, or if their children fail to catch the bus. [Source]
In
A leading industry group blasted a DHS draft report
that highlighted potential privacy problems with RFID technology and downplayed
the value of the wireless technology. Concluded the DHS’ Emerging Applications
and Technology Subcommittee in a 15-page report: “RFID technology may have a
small benefit in terms of speeding identification processes, but it is no more
resistant to forgery or tampering than any other digital technology … The use
of RFID would predispose identification systems to surveillance uses. Use of
RFID in identification would tend to deprive individuals of the ability to
control when they are identified and what information identification processes
transfer. Finally, RFID exposes identification processes to security weaknesses
that non-radio-based processes do not share.” The American Electronics
Association, said the DHS draft report fails to note that certain RF-enabled
technologies actually enhance the security and privacy of Americans’ personal
information and data. “Although the high-tech industry takes great exception to
the tenor and tone of the draft report,” said an AeA spokesperson, “we
nevertheless applaud DHS’ efforts to establish a solid policy foundation and
strong best practices when implementing any technology for use in
identification credentials. Any policy statement should reinforce, ‘Don’t ban
technology, ban bad behavior.’ “ [Source]
The ethics behind planting microchips in humans is
under debate at the Access and Privacy Conference being held from June 7 to 9
in a downtown
Inmates at
Claiming their privacy rights were violated after a
laptop was stolen that contained the personal information of 26.5 million
veterans, a coalition of veterans’ groups this week filed a class-action suit
against the federal government in U.S. District Court in
This Information Security Handbook provides a broad
overview of information security program elements to assist managers in
understanding how to establish and implement an information security program.
The purpose of this publication is to inform members of the information
security management team [agency heads, chief information officers, senior
agency information security officers, and security managers] about various
aspects of information security that they will be expected to implement and
oversee in their respective organizations. This handbook summarizes and
augments a number of existing NIST standard and guidance documents and provides
additional information on related topics. [Source]
PCWorld’s Contributing Editor James A. Martin offers
laptop users some common-sense precautions to thwart thieves and avoid
jeopardizing sensitive data in the first of this two-part series. Martin offers
some examples of laptop thefts, including an armed holdup in
Victorian Privacy Commissioner Paul Chadwick is
warning the public that the new government Access Card could be used to help
conduct surveillance in crowds. Chadwick made the comments last week, pointing
out that there are cameras that could pick a face out of a crowd and then
identify the person after linking it with a picture held on a database. [Source]
The federal government’s new smartcard will reduce fraud but may pose a risk to
privacy, a business report says. Human Services Minister Joe Hockey released
KPMG’s business case for the new health and social services smartcard. [Source]
[Smartcard
Taskforce includes past privacy commissioner]
Nice Systems, an
Government officials have revealed that they are
working on a “limited” notification system for victims of wrongful
surveillance. It is the first hint of such a move by the administration, which
has until now brushed aside privacy concerns raised by lawmakers over a
proposed covert surveillance law. They fear that targets of wrongful wiretaps
will never know if they have been spied on. [Source]
[Hopes
rise for more privacy clout]
A meeting at the U.S. Justice Department to discuss
forcing Internet providers to record Americans’ online activities ended without
reaching an agreement, according to multiple participants. The meeting of about
15 industry representatives and 10 government officials followed an earlier
one, at which Attorney General Alberto Gonzales and FBI Director Robert Mueller
pressed Internet and telecommunications companies to store data on their users
for two years. [Source]
[TelCos
and ISPs girding to fight user data retention] [Justice
Dept Asks Companies ot Keep Internet Records for Investigators] [CDT Memo: Data
Retention]
The recent theft of the names, birth dates and Social
Security numbers of 26.5 million veterans has given new urgency to
congressional passage of data security legislation. One bill would give the
Justice Department an array of new criminal tools with which to prosecute
hackers and botnet creators. On May 25, the House Judiciary Committee passed
the Cyber-Security Enhancement and Consumer Protection Act (H.R. 5318), a
day after the House Financial Services and Energy and Commerce Committees voted
to substitute their own bills (H.R.
3997 and H.R.
4127 ) for the other’s. In all three pieces of legislation, consumer
notification of identity theft is the big political issue. [Source]
A little-noticed proposal from the Senate intelligence
committee would exempt federal agencies from important provisions of the Privacy
Act in the name of the war on terrorism. The committee’s annual authorization
bill, which was sent to the Senate last month after a unanimous vote, would
initiate a three-year pilot program, during which U.S. intelligence agencies
would be able to access personal information about Americans held by other
federal departments or agencies if it is thought to be relevant to counterterrorism
or counterproliferation. Said the ACLU: “If this is enacted, the Privacy Act
will look like Swiss cheese.” [Source]
A top
Businesses must notify customers of computer-security
breaches that could put them at risk for identity theft under a new law that
goes into effect in
According to a new study, about a third of big
companies in the
The Ponemon Institute LLC has released a report that
shows employees don’t trust that their employers are protecting their privacy
at work. Of the 945 people surveyed, less than half of them said they “strongly
agree” or “agree” that their companies are concerned about their privacy. 46%
of the respondents who were asked whether more government regulations are
needed to protect workers’ privacy answered “yes” and 37% said “no.” [Source]
--------