Privacy News Highlights
29 September–05
October 2006
Contents:
CA – Poll Shows Most Canadians in Favor of Biometrics
CA – OPC Releases Report on Plans and
Priorities for 2006-2007
CA – Bill to Curb ID Theft Under
Consideration
NZ – NZ Commission Calls for Tenders In Largest State
Sector IT Programme
CA – Study: Canadian Doctors Slow to
Embrace IT
EU – U.S., E.U. Fail to Reach Agreement on Sharing
Passenger Data
US – Court Orders Online Payment Processor Offline
CA – Service Canada Tells Ontario Staff to
Fudge Service Performance Statistics
CA – Study: Canadian Public Info Suddenly a
Military Secret
US – GAO Report: Health Records For Millions At Risk Of
Improper Disclosure
US – Supreme Court Rejects Medical Privacy Case
CA – Cabinet Filled With Census Files Sold
at Alberta Auction
US – 146,000 Kentucky State Workers Warned of ID Theft
CA – RCMP Buying Canadians’ Personal Info
IN – Investigation Indicates Indian Call Center Data is
Being Stolen and Sold
SP – Survey: ID Theft Main Concern for Singaporeans
JP – Yahoo Japan to Sue for Damages From Phishing
EU – Swedish Appellate Court Overturns P2P Conviction
US – Cingular Sues Private Eye for Pretexting
US – California Governor Terminates RFID ID Bill
US – Survey Says Consumer Data Breaches Will Get Worse
WW – McAfee Knocks Microsoft Over Vista Roadblocks
CA – Study: Canadian Enterprises an Open
Target for IT Disaster
AU – Facial Recognition Cams at Australian Sydney Train
Stations
EU – Greek DPA Fines Police for Street Surveillance
Cameras
CA – Mixed Views on Public Surveillance
Cameras in Alberta
US – DC Police: Cameras Not Helping Fight Crime Much,
Residents Split
CA – Feds’ Cameras Target Canadian Airports
UK – Black Box to Cut Car Insurance
US – California Gov. Signs Telephone Privacy (Pretexting)
Bill
US – Legislation Exempts CPAs from Sending Privacy
Notices
US – House Votes to Expand Electronic Spying Powers
US – Federal Lawmakers Break, Leaving Pretexting Bill on
Hold
US – New North Carolina Law: Gov’t Agencies Must Disclose
Data Breaches
Most Canadians don’t understand what biometrics are,
but think the government should use them to prevent prospective immigrants from
using bogus identity documents to enter the country, according to a Ipsos Reid
survey conducted for Citizenship & Immigration Canada. Fraudulent identity
documents are a “very serious problem” and biometrics should be used to prevent
people from abusing government programs, including the immigration and refugee
systems, said more than half the respondents. “Four out of five Canadians
believe that by the end of this decade, it is likely almost every adult
Canadian will have at least one biometric ID on file to verify their identity,”
the survey notes. “67% support conducting background checks to verify the identity
of non-Canadians applying for an immigration visa to enter
The Office of the Privacy Commissioner of
1. Improve
and expand service delivery (Ongoing)
2. Respond
to Parliament (Ongoing)
3. Participate
in PIPEDA review and Privacy Act reform (Ongoing)
4. Plan
and prepare for 2007 International Data Protection & Privacy Commissioners
Conference (New)
5. Build
organizational capacity; hire and integrate new staff, engage and train
existing staff (New)
6. Develop
results-based systems and baselines (New) [Source]
The Liberals said they will study an ID theft bill
proposed by Tory MPP Joe Tascona as Canadians are increasingly victimized by
identity theft and mortgage fraud - estimated to be worth $1.5 billion. In the
meantime, insurance companies and banks are offering services to help consumers
take steps to protect themselves. [Source]
Providing further proof the days of Username and
Password security authentication are over, the State Services Commission today
sought proposals for the supply of a token-based, moderate strength logon
service to the Government Logon Service (GLS). The GLS is after a
one-time-password (OTP) system that combines with a GLS password to provide a
logon of medium range security. The key fob or similar device will carry the
commission’s brand, and be a self-contained, standalone OTP generator. The
device will be sealed, have a lifetime battery and require no user maintenance.
The GLS is an all-of-government service that provides ongoing re-confirmation
of online identity and follows standards developed by the All-of-government
Authentication Programme. This is one of the largest IT programmes within the
A recent Infoway study of the IT
use by general practitioners in 11 industrialized countries, found Canadian
doctors lagged well behind their international counterparts. In
The
A federal judge has ordered online payment processor
Qchex to cease its current method of online payment processing, which
The union representing employment insurance processing
staff is blowing the whistle on a move by Service Canada to fudge its
performance figures by ordering
The Defence Department has invoked a new wave of
secrecy in the last 18 months using national security provisions in federal
Access to Information legislation to censor details of financial bungling and
what some critics are calling questionable uses of military resources. The
department also tried to hide records detailing how it is keeping tabs on a
security analyst who is an outspoken critic of
The Government Accountability Office said yesterday
that security weaknesses have left millions of elderly, disabled, and poor
Americans vulnerable to unauthorized disclosure of their medical and personal
records. The GAO said it discovered 47 weaknesses in the computer system used
by the Centers for Medicare and Medicaid Services to send and receive bills and
to communicate with health care providers.
[Source]
[GAO Report: Information
Security: The Centers for Medicare & Medicaid Services Needs to Improve
Controls over Key Communication Network. GAO-06-750, August 30] [Highlights]
The Supreme Court this week rejected a lawsuit by
privacy advocates who say the Bush administration’s rules for disclosing
medical records are too lax. Ten groups representing 750,000 consumers, medical
practitioners and their patients challenged a federal rule that encourages
development of an information system for electronic transfer of health data. An
initial proposal would have required health-care providers to obtain patients’
consent before disclosing health information. That approach prompted complaints
from professionals in the health care sector, who said it would significantly
impair the industry’s ability to provide timely and efficient medical services.
The final rule put in place in 2003 leaves it up to health-care providers
whether to seek patients’ consent to use or disclose information for routine
uses. The rule requires that disclosure must be limited to the “minimum
necessary” information to accomplish the intended purpose. It also allows
states to have more stringent standards if they wish. In a decision the privacy
advocates had sought to reverse, the 3rd U.S. Circuit Court of Appeals said
that any privacy violations could not properly be blamed on the government. The
federal rule did not “compel” or “command” any privacy violations, said the
appeals court. The rule does not displace existing privacy protections, the
government argued. [Source]
Personal files of some of this year’s census workers
turned up in a filing cabinet at an
Letters sent to 146,000 government employees in
Since September 2001, the Mounties have been buying
and storing personal information on Canadians from private data brokers, which
have been used by
According
to a program scheduled to air on British television on Sunday, October 1,
sensitive personal data belonging to
Security consulting firm Unisys has conducted a survey
of 900 Singaporeans which found that 81% were extremely concerned about
unauthorized access to personal information. The survey also found that 80% of
the respondents said they were very concerned about others obtaining personal
credit card information and nearly half said they were wary about the security
of online shopping and banking. [Source]
Yahoo
A 29-year-old man suspected of sharing files from his
computer has been acquitted by the Swedish Court of Appeal. Last year the man
was the first person in
Cingular Wireless, the nation’s largest cell phone
provider, on Friday sued a private eye caught up in the scandal over the HP
leak investigation, seeking to make him pay for allegedly obtaining
customer-call records under false pretenses. The company said in federal court
papers it wants Charles Kelly, his firm CAS Agency and any of its agents to
return all Cingular customer information they may have, give up any profits
they made for getting the data and pay unspecified damages for their conduct. [Source]
On Saturday, California Governor Arnold Schwarzenegger
vetoed SB 768, the Identity Information
Protection Act of 2006, which would have been the first state bill to
address how RFID technology may be used in identification documents issued by
state and local governments and agencies. In vetoing the bill, Schwarzenegger
said it could “inhibit various state agencies from procuring technology that
could enhance and streamline operations, reduce expenses and improve customer
service to the public, and may unnecessarily restrict state agencies.” Senator
Simitian plans to reintroduce the bill next year. [Source]
A new survey finds that the current epidemic of data
breaches and identity theft resulting from stolen corporate laptops and other
mobile devices will continue until more companies take aggressive action to protect
the privacy of personal information they routinely collect on their customers –
and ultimate victims. Credant Technologies’ annual survey uncovers that – 88%
of 426 respondents, representing IT organizations world-wide, say they know
that large amounts of personally identifying and other sensitive information
reside on employee’s mobile devices, and 72% cite that encryption is required
to protect personal identifiable information, yet less than 20% have implemented
encryption. [Source]
[Press Release]
McAfee charged in a full-page ad in Monday’s Financial
Times that Microsoft is working to hamstring software companies trying to
overcome “inherent weaknesses” in Windows security. McAfee, Symantec and other
security software companies argue that Microsoft’s new
Nearly half of Canadian companies have suffered from a
disaster such as a power outage or IT failure, according to statistics released
this week – but almost three quarters of the country’s businesses are unprotected
by a business continuity plan. The survey, conducted by Leger Marketing, also
reveals that only half of the companies with a disaster recovery plan consider
it to be “full-blown,” with nearly one in three firms admitting to an “unofficial”
program. 12% of firms rely on a phone tree as their primary means of continuing
business in the event of a disaster. [Source]
Hundreds of cameras with facial recognition
capabilities will be installed at
The Greek police have been fined by the country’s Data
Protection Authority for the use of street surveillance cameras for crime
fighting.
Many D.C. police said they had hoped that installing
dozens of new surveillance cameras across the city would assist them in
cracking down on crime, but the system does not appear to be working as
planned. It was a very violent weekend across the D.C. area, with 11 people
shot, four of them fatally. One of the shootings in the District was caught on
one of the new cameras, but police said so far, the cameras have not been much
help in any other case. [Source]
Canadian airports have been outfitted with a
state-of-the-art camera system allowing officials at an operations centre in
UK Drivers will be charged for insurance in accordance
with the distance and time of day they travel under a radical overhaul of
motoring policies. Cars will be fitted with black boxes to log details of all
journeys, resulting in lower bills for those who drive less frequently and
during daylight hours. Those who often drive at night, when serious accidents
are more likely, will face higher premiums under the scheme. Norwich Union, one
of
California Gov. Arnold Schwarzenegger signed a law last
week making it a crime to buy telephone records or obtain them through deceit,
an issue that has become important amid a furor over HP’s attempts to track
down boardroom leaks to the press. The new law punishes violators with a fine
of up to $2,500 and a year in prison, with the maximum fine rising to $10,000
for repeat offenders. It applies to anyone who sells, buys, or conspires to buy
or sell any records of telephone-calling patterns without the written consent
of the subscriber, or anyone who obtains such records through fraud or deceit.
[Source]
[Source] [Source]
CPAs are exempted from the Gramm-Leach-Bliley Act’s
requirement to send clients an annual privacy notice under legislation the
House and Senate passed recently. The American Institute of CPAs said the
annual privacy notice was unnecessary because CPAs are already subject to state
laws and regulations that prevent them from disclosing nonpublic personal
information without their clients’ consent. [Source]
Amid serious misgivings from opponents, the U.S. House
of Representatives has approved a bill that would expand the government’s
electronic spying powers in terrorism investigations. The Electronic Surveillance Modernization Act passed late last week by
a 232 to 191 vote, with 177 Democrats voting against it and 18 siding with the
Republican majority on the vote. Under the House’s bill, the president would have
the authority to authorize electronic surveillance without a court order for up
to one year, if it is directed at the communications of foreign powers or their
agents. [Source] [Warrantless
Wiretapping Bill Becoming Campaign Issue: being used by Republicans to paint
Democrats as weak on terror]
The congressional hearings this week into
Hewlett-Packard’s leak investigation shined a light on lawmakers’ attempts to
make a practice known as pretexting clearly illegal and punishable by federal
law, but their efforts were stymied Friday as Congress got ready to break and
campaign for the November elections. That outcome stands in contrast to that in
State
and local government agencies must tell consumers when their information has
been lost or stolen under a new law that takes effect this week. Also starting
this week, businesses can no longer print Social
Security numbers on mailings or on cards needed to
receive services, such as health insurance. Both laws are aimed at reducing
identity theft. [Source]
[Source]
--------