Privacy News Highlights
03—08 March 2006
Contents:
JP – Japan Prepares Bill to Fingerprint Foreigners
BC – Privacy Commissioner to Investigate
Government Computer Leaks
AB – Privacy Commissioner Issues Public
Sector Outsourcing Privacy Risks Report
CA – BC Government Auctions Computer Tapes
with Health Records
CA – Poll: Identity Theft Worries Grow in Prairie
Provinces
WW – Privacy Fear as Google Plans ‘Super Database’
WW – AOL Will Not Charge Non-Profits to Send Bulk eMail
US – TRUSTe / Ponemon Announce 2006 Most Trusted
Companies for Privacy Award
US – Microsoft Readies Windows Live Parental Controls
US – California Bill Would Keep Credit Card Numbers off
Receipts
AB – Bill 20 Would Build More Protections
into FOIP legislation
US – Minnesota Governor Pawlenty Looks to Alter Privacy
Law
US – Florida Privacy Groups Debate Court Record Access
US – Final HIPAA Enforcement Rule Published
US – SSNs Posted on Secretary of State’s Web Site (SSO
Loses SSNs)
US – Georgetown University Acknowledges Server Breach
US – Stolen Laptop Contained Data on 93,000 Denver
Students
UK – House of Lords Blocks ID Card Bill
US – GAO Report: Agencies Face Challenges Implementing
New Federal Employee ID
CA – Ontario Police Arrest Man for Stealing
Net Connection
CA – T.O. Plans to Turn City's Core Into
WiFi 'Hotspot'
AU – DPA Releases Discussion Paper on Unauthorised
Photographs on the Internet
US – Homeland Security Gives Tiny Alaska Town a Lot of
Camera Power
WW – Concern Over Data Security on the Rise in
Outsourcing Industry
EU – EU Privacy Experts Issue Opinion on E-Mail Tracking
Services
US – MySpace.com to Screen Members to Fight Crime, CEO
Says
EU – Concern over Irish Phone Tapping Legislation
US – Republican CD Gathers Data on Users, Prompting
Concerns
EU – EU to Consult, Draw Up New Rules on RFID ‘Spy’
Technology
US – Q&A with Schwab CPO Janet Chapman
CA – Entrust to Secure Spain's National
Electronic ID Cards for 40 Million Citizens
UK – Surveillance on Drivers May Include Phone / Seat
Belt Laws
RU – Moscow to Deploy Lighter-than-Air Ships for Street
Surveillance
JP – Virus Leads to Biggest-Ever Loss of Info from Cops
US – Maine Seeks to Outlaw Online Sale of Telephone
Records
US – Missouri AG Sues Florida Company Selling Phone
Records Online
US – FCC Investigating Caller-ID Spoofing Services
US – Homeland Security Chief Wants Companies to Retain
& Screen Customer Info
US – A-G Gonzales May Be Recalled on Eavesdropping
US – Senate Panel Blocks Eavesdropping Probe
US – First Members Appointed to Privacy and Civil
Liberties Oversight Board
US – Experts Disagree Over Notification Standards
US – Patriot Act Revisions Pass House, Sending Measure to
President
US – DMA VP: Congress Will Pass Federal Breach Bill This
Year
US – Technology May Outpace Relevancy of Breach
Notification Laws
US – House Committee to Consider Phone Privacy Bill This
Week
US – New Jersey Politician Wants to Outlaw Anonymous
Speech
US – New California Bills Target Identity Theft
CA – Resistance Forming to Hand-Scan time
Clock in BC Restaurant
The
UK Passport Service has now issued its first biometric e-passport, it announced
on 5 March 2006. The new passports will include a chip with the holder's facial
biometric and will be introduced gradually over a five month period this year.
Home Office minister Andy Burnham said that the government is looking to expand
the use of biometrics in passports. [Source]
BC’s
Information and Privacy Commissioner is looking into a breach of the Government’s
computer network earlier this year. David Loukidelis won’t call it an
investigation but will make some inquiries at request of the NDP. The issue, a
breach of 78 government computers by hackers trying to spread movies and other
files around the internet, “The only role that we have here is to make those
inquiries about what did or did not happen, and also to take any further action
only if personal information of individuals might have been involved.” Loukidelis
says it’s not his job to investigate IT breaches, which is what Labour Minister
Mike de Jong says this boils down to, “This was not a case of privacy being compromised.”
But the NDP says there are a number of troubling questions around this breach
they’re hoping Loukidelis can answer. [Source]
[Hackers
got into province’s system]
In
late February the Alberta Privacy Commissioner released a report into Public Sector
Outsourcing and security concerns associated with the practice. The conclusion is
that: “Information Communication Technology (ICT) outsourcing has become a mainstream
service delivery strategy for public bodies in
The
[Source] [Source] [B.C.
to probe auctioned health records] [B.C.
Gov’t made no attempt to erase files, tech expert says] [Privacy
Breach ‘A Wake-Up Call’] [BC
Government Bans Sale of Used Computer Gear] [Minister
offers plan to address health-data ‘screw-up’] [In
future, tapes to be destroyed, de Jong says] [Tapes
show BC Welfare worker was escort, stole rent cheques]
Nearly
a quarter of people in
Google
is planning a massive online facility that could store copies of users’ hard
drives - a move set to spark alarm among civil liberties campaigners. Plans for
the “GDrive”, previously the subject of rumour among computer experts, were
revealed accidentally after notes in a slideshow were wrongly published on
Google’s site. The device would create a mirror image of data stored on
consumers’ computer hard drives, letting users search data stored on other
computers via Google accounts. [Source]
Following
protests from activist groups, AOL will not charge legitimate non-profit and
advocacy groups a tax on bulk email.” AOL’s original plan would have charged
companies to have their bulk email certified and delivered with images and
hyperlinks. Hyperlinks and images would be blocked if they come from organizations
that are not part of AOL’s Enhanced Whitelist. [Source] [Source] [Source]
TRUSTe
and The Ponemon Institute today released the names of the companies that ranked
first, second and third in the annual Most Trusted Company for Privacy Award,
P&G, HP and E-LOAN respectively. The winners will be recognized at an award
ceremony officiated by Representative Mary Bono of
Microsoft
is inviting testers to try an early version of new parental control software for
Windows XP called Windows Live Family Safety Settings. The parental controls software
lets people filter online content, Microsoft said in an e-mail invitation to testers.
It is designed to help keep Web content that parents deem inappropriate from reaching
their children –such as items on alcohol, pornography, gambling and tobacco. [Source]
Saying
careless merchants are exposing countless Californians to fraud, state Sen.
Debra Bowen has introduced legislation to prevent credit card numbers from
appearing on receipts. “The fewer places that a person’s sensitive financial
information appears in print, the more we reduce the odds that they’ll become
the state’s next identity-theft victim,” said Bowen. The measure, SB 1699, also
would prohibit financial institutions from printing account numbers on customer
statements. Existing law prohibits credit card numbers from being printed on
customer receipts, but the information is routinely kept on the merchant
copies. [Source]
Proposed
amendments to
Minnesota
Governor Pawlenty has proposed revisions to a state law that for years has
acted on the presumption that government records should be open to the public.
His proposal, aimed at protecting citizens from identity theft, includes calls
to limit the use of SSNs as well as access to driver’s license data and
personal phone records. Pawlenty said the presumption all information held by
the government is public unless a specific law designates it as private is “backwards.”
Jane Kirtley, a professor of media ethics and law, does not agree. “It’s
absolutely un-American to start from the presumption that government information
should be secret unless the government chooses to make it public,” she said, adding
that it was one of the most “irresponsible” statements she’s heard a government
official make. Kirtley said there is an inherent problem with the government
deciding when records should be made public. It undermines public oversight of
the government, she said, as well as makes the government extremely powerful. “For
the chief executive of a state to say that he doesn’t believe in the principle
of open government is pretty shocking,” she said. [Source] [Source]
An
ongoing debate in
The Final
HIPAA Enforcement Rule (“Final Rule“),
which takes effect March 16, 2006 has been published. The Final Rule adopts unified
enforcement procedures for the Privacy Rule and the other HIPAA Administrative Simplification
rules, such as the Security Rule. In addition, the Final Rule establishes procedural
and substantive requirements for the imposition of civil money penalties for violations
of the HIPAA provisions. The adoption of the Final Rule completes the regulatory
enforcement structure begun when the Privacy Rule was issued in 2000 and expanded
by the interim final procedural enforcement rules issued in 2003. [HIPAA Enforcement Rule]
The Secretary
of State has documents containing Ohioans’ personal information, including Social
Security numbers, posted on its Web site. The Secretary of State’s Office said the
forms are used nationally and providing a Social Security number is optional. A
taxpayer rights activist notified The Enquirer about the availability of the personal
information. [Source]
[Ohio
Secretary of State Sued Over SSNs on Web Site] [Lawsuit
coverage]
A
laptop stolen from the home of a Metropolitan State College employee in
Tony
Blair’s plans to introduce identity cards have been attacked as “grandiose” and
“dangerous” by peers who voted overwhelmingly to reject the Government’s
proposals obliging everyone renewing their passports to register on the
database that will underpin the ID card scheme. [Source]
[Source]
[Source]
[Government
defeated on compulsory ID cards] [Clash over
compulsory ID cards] [Lords
reject Blair’s ID card plans again] [Government
defeated again as Lords block compulsory ID cards by ‘back door’] [Joint
ID card and passport scheme ‘will rack up £1.8bn deficit’] [‘Fascist’
ID database worries Lords] [Clarke
vows to overturn ID cards defeat] [Lords reject ID card amendment]
Many
forms of identification (ID) that federal employees and contractors use to
access government-controlled buildings and information systems can be easily
forged, stolen, or altered to allow unauthorized access. In an effort to
increase the quality and security of federal ID and credentialing practices,
the President directed the establishment of a government-wide standard--Federal
Information Processing Standard (FIPS) 201--for secure and reliable forms of ID
based on "smart cards" that use integrated circuit chips to store and
process data with a variety of external systems across government. GAO was
asked to determine (1) actions that selected federal agencies have taken to
implement the new standard and (2) challenges that federal agencies are facing
in implementing the standard. [Source]
Ontario
Provincial Police charged a 25-year-old man last week under Section 326 of the
Criminal Code for theft of communications. The OPP allege the man was using his
laptop computer to steal a wireless Internet connection. [Source]
Toronto
Hydro Telecom Inc. announced this week it is turning
The
Australian Privacy Commissioner has released a discussion paper on the privacy
issues inherent in the posting of photos on the internet by third parties. It
suggests following the lead set by the Dutch copyright law that would prohibit
the use of a photo if it is against the reasonable interests of the subject of
the photo. [Unauthorised
Photographs on the Internet and Ancillary Privacy Issues: Discussion Paper]
Dillingham,
a quiet fishing village in
The
International Association of Outsourcing Professionals (IAOP), the global,
standard-setting organization and advocate for the outsourcing profession, and
Vormetric, a leading provider of security solutions for protecting sensitive
information from unauthorized access, announced today that a survey of
attendees at Feb 20th’s successful Outsourcing World Summit(R) pointed to
increasing concerns over data security while outsourcing. [Source]
Services
that track whether an email has been opened will breach EU data protection laws
unless the recipient has given unambiguous consent to the service, according to
an opinion from the Article 29 EU Working Party (WP) on Data Protection. The EU
WP singled out the Did they read it? service as an example of a new type of
service that offers e-mail recipients no opportunity to accept or refuse the
tracking. It also provides additional details to senders: the date and time
when the email was opened; where, geographically, the email was opened; for how
long; and whether it was forwarded. The independent WP expressed “the strongest
opposition” to such services in a wider report on privacy issues related to the
provision of email screening services. Consent must be given. “No other legal
grounds justify this processing,” warns the Working Party. The report also
considers how virus detection, spam filtering and processes used by ISPs and
email service providers (ESPs) to pre-determine content are impacted by rules
such as the European Convention on Human Rights, the Data Protection Directive
and the Privacy and Electronic Communications Directive. [Working
Party Opinion] [Didtheyreadit.com]
[Source]
MySpace.com,
the online virtual-community run by Rupert Murdoch’s News Corp., will soon add technology
to screen how its 60 million members use the Web site to prevent crime, the company’s
chief executive said. He discussed the enhanced security plan in an interview, several
hours after federal authorities announced the arrests of two men charged with using
MySpace to arrange illegal sexual encounters with minors. [Source]
[Source]
Irish
Opposition deputies have expressed concern about proposed new legislation introduced
last week that would allow police in EU member states to tap phones and access internet
records and text messages in their efforts to combat international terrorism
and crime. It is feared the measures could lead to an erosion of civil liberties.
[Source]
A computer
disk that the Minnesota Republican Party prepared to support a ban on gay marriage
has another purpose: gathering data on the politics of the people who view it. And
that’s stirred up a technological tempest on the Internet and among Democrats who
say the disk will improperly gather data from people who run it on their computers.
[Source]
European
information technology commissioner Viviane Reding will unveil plans this week
for a public consultation on RFID, including the privacy issue. The feedback
will be used when the commission draws up new rules on RFID technology later
this year - most likely through updates to existing privacy laws.
In
response to the announcement of Charles Schwab’s security guarantee, Janet
Chapman, the company’s chief privacy officer, was interviewed about Schwab’s
view of privacy, how closely the privacy organization interacts with marketing,
and the connection between communications and trust. [Source]
Entrust
has announced that the company's security technology will be imbedded in the
Spanish national electronic identity cards for over 40 million Spanish
citizens. The project, awarded in Q2 of 2005, is one of the most ambitious
government-wide efforts in the world, and went to the consortium of companies
including Telefonica, Indra, Software AG and SIA Group. SIA Group, a
multinational corporation specializing in the implementation and development of
state-of-the-art technological infrastructures, was chosen to supply the Public
Key Infrastructure by Entrust. In addition to the many physical security
measures to be implemented for information security, the electronic ID card
will have a digital certificate for authentication and digital signature
capabilities. [Source]
Drivers
talking on mobile phones or failing to wear seatbelts could find themselves
tracked down through a widened use of road surveillance cameras, under
proposals due to be floated in the U.K. parliament tomorrow. The plans would form
part of a major expansion of camera surveillance which critics say is already
transforming
Russian
police are to tackle
Investigation
information on about 1,500 individuals kept by an Okayama Prefectural Police
investigator have leaked onto the Internet from his personal computer infected
with a computer virus, officials said. It was the largest amount of information
held by Japanese police to have leaked online. Even though prefectural police
are withholding details of the information lost because they say they are
protecting the privacy of the individuals affected, the Mainichi has obtained
documents that show the leak contained such information as the names of sex
crime victims and a membership list of a supporting organization for a
legislator. The leak will certainly develop into a serious infringement of
human rights although the prefectural police say they have not confirmed any
case in which the information was illegally used. [Source]
Rep. John
Brautigam (D-Falmouth) has filed a bill that would make it a crime as well as a
civil violation to sell or disclose cell phone records. The bill has the support
of the state’s attorney general. Lawmakers in at least 12 states are considering
bills this year related to access to cell phone records or a requirement that customers
provide their consent before their telephone numbers are listed in directories,
according to the National Conference of State Legislatures. [Source]
Attorney
General Jay Nixon has filed suit against a Florida-based company that sold
phone records online, claiming it obtained the records illegally.
Datatraceusa.com is the third such Web site Nixon has sued since January. Two
of the Web sites, locatecell.com and completeskiptrace.com, already have been
ordered to stop doing business in
The
Federal Communications Commission (FCC) has launched an investigation into
companies offering Caller-ID spoofing services. Paying customers provide the
companies with the number they wish to call, their real phone number and the
number they wish to have appear on the Caller-ID screen. The FCC’s
investigation is focused on whether or not the services are violating the
federal Communications Act, which requires that interstate calls send accurate “originating
calling party telephone number information.” The FCC has demanded business
records as well as the names of all customers and data regarding the calls they
have made. Recent Congressional testimony indicates that people have been using
the services to social engineer private customer information from other
companies and the services have hurt companies that rely on Caller-ID as a form
of authentication. [Source]
The
secretary of the Homeland Security Department this week proposed a screening
system that would require companies to retain information about their customers
but only require them to surrender information filtered by software. “One of
the proposals that was floated and shot down before I got here was screening
for protection,” Secretary Michael Chertoff said in answering a question posed
by a member of the department’s privacy committee. “Instead of the government
retaining data, and collecting it, we would screen against the data, [using a]
civilian name, pinging it against a private database and then having the
private data holder who has it anyway say ‘yea’ or ‘nay, ‘red flag’ or ‘green
flag.’ ... That might be a model for some kind of data-retention issue.” Chertoff
spoke at a meeting of the Data Privacy and Integrity Advisory Committee. [Source]
Attorney
General Alberto Gonzales’ written answers to questions about the Bush
administration’s eavesdropping program may require him to testify a second time
before the Senate Judiciary Committee, the panel’s Republican chairman said this
week. “There is a suggestion in his letter there are other classified
intelligence programs that are currently under way,” Senate Judiciary Committee
Chairman Arlen Specter, R-Pa., told reporters. The comments from the moderate
Republican come as the Bush administration is trying to quell criticism of its
surveillance operations and work with the Senate on legislation that would
write the program into law. [Source]
The
Senate Select Committee on Intelligence voted along party lines yesterday to
reject a Democratic proposal to investigate the Bush administration’s domestic
surveillance program and instead approved establishing, with White House approval,
a seven-member panel to oversee the effort. [Source]
[Source] [Source]
Initially
proposed by the bipartisan commission that investigated the 9/11 attacks, the Privacy
and Civil Liberties Oversight Board was created by the intelligence overhaul that
President Bush signed into law in December 2004. After months of delay, the Senate
Judiciary Committee last week took a first step toward starting up the fledgling
watchdog, approving the two lawyers Bush nominated to lead the panel. The board
chairwoman is Carol Dinkins, a partner in the
Companies
agree that breach notification laws have forced them to take steps to better safeguard
personal data. But consensus is elusive on when companies should be required to
notify consumers that their information has been exposed during a breach. One
insurance industry CPO said the notification standard should be “a clear risk of
danger to the consumer.” Another legal expert agreed that notification laws are
“motivating companies to do a better job of protecting data.” However, there is
little to be gained by “overnotification” of consumers. Other experts disagree,
saying companies should not control under what circumstances and when consumers
should be notified of a breach or potential harm. [Source]
The House passed revisions to
the broad antiterrorism law known as the USA Patriot Act on Tuesday, clearing
the way for President Bush to sign legislation making permanent most of the
major provisions of the original 2001 law. The bill passed, 280 to 138, with
just two more votes than needed under special rules requiring a two-thirds
majority. The vote was the last step in a tortuous journey through Congress.
The House action approved amendments to a bill revising the original act; the
revised bill passed the House last year and was adopted last week by the Senate
after having been bottled up there for months. [Source] [Source] [Source]
[Source]
[Source]
Jerry
Cerasale, senior VP of government affairs for the Direct Marketing Association (DMA),
predicts that Congress will pass a federal security breach law before October. The
DMA supports many of the provisions contained in four pending bills, all of which
would trigger the mandatory consumer notification standard of “significant risk”
of harm to consumers. Any of the four pending bills would preempt state breach notification
laws already on the books. [Source]
Thomas
Oscherwitz, CPO for ID Analytics, predicts in a column for CNET News.com that the
“shelf life for data-breach protection laws could be remarkably short.” These laws
could easily become obsolete, Oscherwitz says, because of the advances in validating
identities with the use of “scoring technologies, behavioral analysis and other
risk-based analytical approaches.” [Source]
The U.S.
House Energy and Commerce Committee is scheduled to consider legislation that would
ban misrepresenting a person’s identity to obtain and sell telephone records. The
committee’s chairman, Rep. Joe Barton (R-Texas), said he is concerned that telecommunications
companies are not “doing enough to protect consumer privacy.” The publicity around
the sale of cell-phone records has forced many Internet sites to stop taking new
orders, according to the Federal Trade Commission. [Source]
A
Identity
thieves could be in for more than a slap on the wrist if a package of new state
Senate bills is approved. Sen. Chuck Poochigian (R-Fresno) introduced four
bills at Gov. Arnold Schwarzenegger’s second annual Identity Theft Summit in
Some
of the staff at a Kelsey’s restaurant at Kimberley Alpine Resort are not
applauding the replacement of time sheets with hand scans. Employees’ hands are
now being scanned at the beginning and end of each shift they work. “It’s just
a new form of time clock,” said general manager Andy Cohen of the
--------