Privacy News Highlights

03—08 March 2006

Contents:

UK – Passports Go Biometric. 2

JP – Japan Prepares Bill to Fingerprint Foreigners. 2

BC – Privacy Commissioner to Investigate Government Computer Leaks. 2

AB – Privacy Commissioner Issues Public Sector Outsourcing Privacy Risks Report 2

CA – BC Government Auctions Computer Tapes with Health Records. 2

CA – Poll: Identity Theft Worries Grow in Prairie Provinces. 3

WW – Privacy Fear as Google Plans ‘Super Database’ 3

WW – AOL Will Not Charge Non-Profits to Send Bulk eMail 3

US – TRUSTe / Ponemon Announce 2006 Most Trusted Companies for Privacy Award. 3

US – Microsoft Readies Windows Live Parental Controls. 3

US – California Bill Would Keep Credit Card Numbers off Receipts. 4

AB – Bill 20 Would Build More Protections into FOIP legislation. 4

US – Minnesota Governor Pawlenty Looks to Alter Privacy Law. 4

US – Florida Privacy Groups Debate Court Record Access. 4

US – Final HIPAA Enforcement Rule Published. 5

US – SSNs Posted on Secretary of State’s Web Site (SSO Loses SSNs) 5

US – Georgetown University Acknowledges Server Breach. 5

US – Stolen Laptop Contained Data on 93,000 Denver Students. 5

UK – House of Lords Blocks ID Card Bill 5

US – GAO Report: Agencies Face Challenges Implementing New Federal Employee ID. 6

CA – Ontario Police Arrest Man for Stealing Net Connection. 6

CA – T.O. Plans to Turn City's Core Into WiFi 'Hotspot' 6

AU – DPA Releases Discussion Paper on Unauthorised Photographs on the Internet 6

US – Homeland Security Gives Tiny Alaska Town a Lot of Camera Power 6

WW – Concern Over Data Security on the Rise in Outsourcing Industry. 6

EU – EU Privacy Experts Issue Opinion on E-Mail Tracking Services. 7

US – MySpace.com to Screen Members to Fight Crime, CEO Says. 7

EU – Concern over Irish Phone Tapping Legislation. 7

US – Republican CD Gathers Data on Users, Prompting Concerns. 7

EU – EU to Consult, Draw Up New Rules on RFID ‘Spy’ Technology. 7

US – Q&A with Schwab CPO Janet Chapman. 8

CA – Entrust to Secure Spain's National Electronic ID Cards for 40 Million Citizens. 8

UK – Surveillance on Drivers May Include Phone / Seat Belt Laws. 8

RU – Moscow to Deploy Lighter-than-Air Ships for Street Surveillance. 8

JP – Virus Leads to Biggest-Ever Loss of Info from Cops. 8

US – Maine Seeks to Outlaw Online Sale of Telephone Records. 9

US – Missouri AG Sues Florida Company Selling Phone Records Online. 9

US – FCC Investigating Caller-ID Spoofing Services. 9

US – Homeland Security Chief Wants Companies to Retain & Screen Customer Info. 9

US – A-G Gonzales May Be Recalled on Eavesdropping. 9

US – Senate Panel Blocks Eavesdropping Probe. 10

US – First Members Appointed to Privacy and Civil Liberties Oversight Board. 10

US – Experts Disagree Over Notification Standards. 10

US – Patriot Act Revisions Pass House, Sending Measure to President 10

US – DMA VP: Congress Will Pass Federal Breach Bill This Year 10

US – Technology May Outpace Relevancy of Breach Notification Laws. 10

US – House Committee to Consider Phone Privacy Bill This Week. 11

US – New Jersey Politician Wants to Outlaw Anonymous Speech. 11

US – New California Bills Target Identity Theft 11

CA – Resistance Forming to Hand-Scan time Clock in BC Restaurant 11

 

 


UK – Passports Go Biometric

The UK Passport Service has now issued its first biometric e-passport, it announced on 5 March 2006. The new passports will include a chip with the holder's facial biometric and will be introduced gradually over a five month period this year. Home Office minister Andy Burnham said that the government is looking to expand the use of biometrics in passports. [Source] 

 

JP – Japan Prepares Bill to Fingerprint Foreigners

Japan’s government has endorsed legislation requiring foreigners to be photographed and fingerprinted on arrival as part of measures to prevent terrorism. The cabinet approved a revised immigration bill, defying opposition from a lawyers’ group and human rights activists who argue that such steps would risk breaching human rights and invading privacy. The bill, due to be submitted to parliament soon, exempts children under 16, diplomats and “special permanent residents” including ethnic Koreans. The revised law would allow Japan to deport any arriving foreigner it considers to be a terrorist. It also would require planes and ships arriving in Japan to submit lists of passengers before arrival. [Source]

 

BC – Privacy Commissioner to Investigate Government Computer Leaks

BC’s Information and Privacy Commissioner is looking into a breach of the Government’s computer network earlier this year. David Loukidelis won’t call it an investigation but will make some inquiries at request of the NDP. The issue, a breach of 78 government computers by hackers trying to spread movies and other files around the internet, “The only role that we have here is to make those inquiries about what did or did not happen, and also to take any further action only if personal information of individuals might have been involved.” Loukidelis says it’s not his job to investigate IT breaches, which is what Labour Minister Mike de Jong says this boils down to, “This was not a case of privacy being compromised.” But the NDP says there are a number of troubling questions around this breach they’re hoping Loukidelis can answer. [Source] [Hackers got into province’s system]

 

AB – Privacy Commissioner Issues Public Sector Outsourcing Privacy Risks Report

In late February the Alberta Privacy Commissioner released a report into Public Sector Outsourcing and security concerns associated with the practice. The conclusion is that: “Information Communication Technology (ICT) outsourcing has become a mainstream service delivery strategy for public bodies in Alberta. Through generally cautious management and policy foresight, information resources entrusted to Alberta public bodies are for the most part secure within Alberta or Canada and not exposed to unintended users in foreign jurisdictions. The ICT outsource industry is made aware of Alberta’s access and privacy law requirements through express contract language and through interaction with public body administrators. The position of Canadian ICT outsourcers linked to U.S.-based companies remains unclear and would benefit by reinforcement in law and in model contract provisions. These improvements to legal and contractual frameworks should be matched by more rigorous attention to outsource agreements management by public bodies which choose to use them.” [Full report]

 

CA – BC Government Auctions Computer Tapes with Health Records

The British Columbia government has auctioned off computer tapes containing thousands of highly sensitive records, including information about people’s medical conditions, their social insurance numbers and their dates of birth. Sold for $300 along with various other pieces of equipment, the 41 high-capacity data tapes were auctioned in mid-2005 at a site that routinely sells government surplus items to the public.

[Source] [Source] [B.C. to probe auctioned health records] [B.C. Gov’t made no attempt to erase files, tech expert says] [Privacy Breach ‘A Wake-Up Call’] [BC Government Bans Sale of Used Computer Gear] [Minister offers plan to address health-data ‘screw-up’] [In future, tapes to be destroyed, de Jong says] [Tapes show BC Welfare worker was escort, stole rent cheques]

 

CA – Poll: Identity Theft Worries Grow in Prairie Provinces

Nearly a quarter of people in Manitoba and Saskatchewan say they or someone they know has been a victim of identity theft, according to a new poll released yesterday. The poll, conducted by Ipsos-Reid last month, also found nearly three-quarters of Manitoba and Saskatchewan residents – the two provinces are lumped together in the survey – are either “very” or “quite” concerned they will have their identities stolen for criminal purposes. [Source]

 

WW – Privacy Fear as Google Plans ‘Super Database’

Google is planning a massive online facility that could store copies of users’ hard drives - a move set to spark alarm among civil liberties campaigners. Plans for the “GDrive”, previously the subject of rumour among computer experts, were revealed accidentally after notes in a slideshow were wrongly published on Google’s site. The device would create a mirror image of data stored on consumers’ computer hard drives, letting users search data stored on other computers via Google accounts. [Source]

 

WW – AOL Will Not Charge Non-Profits to Send Bulk eMail

Following protests from activist groups, AOL will not charge legitimate non-profit and advocacy groups a tax on bulk email.” AOL’s original plan would have charged companies to have their bulk email certified and delivered with images and hyperlinks. Hyperlinks and images would be blocked if they come from organizations that are not part of AOL’s Enhanced Whitelist. [Source] [Source] [Source]

 

US – TRUSTe / Ponemon Announce 2006 Most Trusted Companies for Privacy Award

TRUSTe and The Ponemon Institute today released the names of the companies that ranked first, second and third in the annual Most Trusted Company for Privacy Award, P&G, HP and E-LOAN respectively. The winners will be recognized at an award ceremony officiated by Representative Mary Bono of California on Tuesday, March 7 in Washington, D.C.. The survey was conducted in two stages. The 20 companies rated most trusted in an unaided consumer survey moved on to the expert review where policies, practices, and execution were tested for consistent care with regard to privacy issues. [Source]

 

US – Microsoft Readies Windows Live Parental Controls

Microsoft is inviting testers to try an early version of new parental control software for Windows XP called Windows Live Family Safety Settings. The parental controls software lets people filter online content, Microsoft said in an e-mail invitation to testers. It is designed to help keep Web content that parents deem inappropriate from reaching their children –such as items on alcohol, pornography, gambling and tobacco. [Source]

 

US – California Bill Would Keep Credit Card Numbers off Receipts

Saying careless merchants are exposing countless Californians to fraud, state Sen. Debra Bowen has introduced legislation to prevent credit card numbers from appearing on receipts. “The fewer places that a person’s sensitive financial information appears in print, the more we reduce the odds that they’ll become the state’s next identity-theft victim,” said Bowen. The measure, SB 1699, also would prohibit financial institutions from printing account numbers on customer statements. Existing law prohibits credit card numbers from being printed on customer receipts, but the information is routinely kept on the merchant copies. [Source]

 

AB – Bill 20 Would Build More Protections into FOIP legislation

Proposed amendments to Alberta’s Freedom of Information and Protection of Privacy Act (FOIP) would increase penalties for individuals or corporations that improperly release the personal records of Albertans. They would also speed the process of bringing new government boards and committees under the FOIP Act. Bill 20, the Freedom of Information and Protection of Privacy Amendment Act, was introduced in the Legislative Assembly on March 7. The proposed changes would seek to protect Albertans' personal information from improper access by foreign governments (such as the United States under its USA PATRIOT Act). The proposals create fines of up to $500,000 for violating our laws governing disclosure of records. Other amendments would allow newly created government boards and committees to be brought under the FOIP Act more quickly and clarify how the Act applies to some categories of records including library collections and certain records of the internal auditor and ministers. [Source]

 

US – Minnesota Governor Pawlenty Looks to Alter Privacy Law

Minnesota Governor Pawlenty has proposed revisions to a state law that for years has acted on the presumption that government records should be open to the public. His proposal, aimed at protecting citizens from identity theft, includes calls to limit the use of SSNs as well as access to driver’s license data and personal phone records. Pawlenty said the presumption all information held by the government is public unless a specific law designates it as private is “backwards.” Jane Kirtley, a professor of media ethics and law, does not agree. “It’s absolutely un-American to start from the presumption that government information should be secret unless the government chooses to make it public,” she said, adding that it was one of the most “irresponsible” statements she’s heard a government official make. Kirtley said there is an inherent problem with the government deciding when records should be made public. It undermines public oversight of the government, she said, as well as makes the government extremely powerful. “For the chief executive of a state to say that he doesn’t believe in the principle of open government is pretty shocking,” she said. [Source] [Source]

 

US – Florida Privacy Groups Debate Court Record Access

An ongoing debate in Florida over Internet access to court records has allies lined up in opposition over information access and privacy rights. At issue is personal information often included in legal filings, such as SSNs, financial records, medical details and other information that could be used to identify or track people. Last week, several public interest groups spoke at a hearing over new rules about public posting of court records. Few Florida court records have been available online since the Florida Supreme Court issued a 2003 order preventing the Internet posting of nearly all court-related information until a court-appointed committee could recommend rules for addressing privacy issues. The committee’s findings and public comment will influence new rules to become administrative law in 2007. Under the committee’s recommendations, issued last August, most medical information included in court records would be redacted from electronic versions. In addition, the committee said non-transactional financial records should not be provided online, where they may fall prey to identity thieves. [Source]

 

US – Final HIPAA Enforcement Rule Published

The Final HIPAA Enforcement Rule (“Final Rule“), which takes effect March 16, 2006 has been published. The Final Rule adopts unified enforcement procedures for the Privacy Rule and the other HIPAA Administrative Simplification rules, such as the Security Rule. In addition, the Final Rule establishes procedural and substantive requirements for the imposition of civil money penalties for violations of the HIPAA provisions. The adoption of the Final Rule completes the regulatory enforcement structure begun when the Privacy Rule was issued in 2000 and expanded by the interim final procedural enforcement rules issued in 2003. [HIPAA Enforcement Rule]

 

US – SSNs Posted on Secretary of State’s Web Site (SSO Loses SSNs)

The Secretary of State has documents containing Ohioans’ personal information, including Social Security numbers, posted on its Web site. The Secretary of State’s Office said the forms are used nationally and providing a Social Security number is optional. A taxpayer rights activist notified The Enquirer about the availability of the personal information. [Source] [Ohio Secretary of State Sued Over SSNs on Web Site] [Lawsuit coverage]

 

US – Georgetown University Acknowledges Server Breach

Georgetown University has acknowledged that a security breach of one of its servers compromised personal data belonging to as many as 41,000 District of Columbia residents. The breach was discovered on February 12 during a routine internal inspection, but was not disclosed until Friday, March 3. The lag time has been attributed to the need for the US Secret Service to examine the server and establish a web site and hotline to help those affected by the attack. [Source] [Source]

 

US – Stolen Laptop Contained Data on 93,000 Denver Students

A laptop stolen from the home of a Metropolitan State College employee in Denver held sensitive personal information belonging to more than 93,000 students. The employee was using the data, which include names and Social Security numbers (SSNs), to write a grant proposal and to write his masters thesis. The theft occurred on February 25, but was not made public until March 1 at the request of local police. The data belong to people who were registered for classes at the Denver school between fall 1996 and summer 2005; they are being notified by mail. The school is looking into whether or not the employee had permission to use the data in his thesis. The employee was authorized to have the data on his workstation at the college and on the laptop. [Source] [Source]

 

UK – House of Lords Blocks ID Card Bill

Tony Blair’s plans to introduce identity cards have been attacked as “grandiose” and “dangerous” by peers who voted overwhelmingly to reject the Government’s proposals obliging everyone renewing their passports to register on the database that will underpin the ID card scheme. [Source] [Source] [Source] [Government defeated on compulsory ID cards] [Clash over compulsory ID cards] [Lords reject Blair’s ID card plans again] [Government defeated again as Lords block compulsory ID cards by ‘back door’] [Joint ID card and passport scheme ‘will rack up £1.8bn deficit’] [‘Fascist’ ID database worries Lords] [Clarke vows to overturn ID cards defeat] [Lords reject ID card amendment]

 

US – GAO Report: Agencies Face Challenges Implementing New Federal Employee ID

Many forms of identification (ID) that federal employees and contractors use to access government-controlled buildings and information systems can be easily forged, stolen, or altered to allow unauthorized access. In an effort to increase the quality and security of federal ID and credentialing practices, the President directed the establishment of a government-wide standard--Federal Information Processing Standard (FIPS) 201--for secure and reliable forms of ID based on "smart cards" that use integrated circuit chips to store and process data with a variety of external systems across government. GAO was asked to determine (1) actions that selected federal agencies have taken to implement the new standard and (2) challenges that federal agencies are facing in implementing the standard. [Source]

 

CA – Ontario Police Arrest Man for Stealing Net Connection

Ontario Provincial Police charged a 25-year-old man last week under Section 326 of the Criminal Code for theft of communications. The OPP allege the man was using his laptop computer to steal a wireless Internet connection. [Source]

 

CA – T.O. Plans to Turn City's Core Into WiFi 'Hotspot'

Toronto Hydro Telecom Inc. announced this week it is turning Toronto's downtown core into one giant wireless hotspot, thrusting itself into the $8-billion-a-year Canadian wireless market. The wireless fidelity –or WiFi– network will allow Internet surfers to browse the Web from almost anywhere in the zone, which will include park benches, restaurants and cars. Company president David Dobbin said the initiative is revolutionary, noting there are currently only designated “hotspots” –like certain hotel lobbies and cafe. “What we're proposing is something completely different. This is a blanket of WiFi coverage that will be everywhere – every street corner, every restaurant, everywhere in downtown Toronto – and nobody does that today,” Dobbin said. [Source]

 

AU – DPA Releases Discussion Paper on Unauthorised Photographs on the Internet

The Australian Privacy Commissioner has released a discussion paper on the privacy issues inherent in the posting of photos on the internet by third parties. It suggests following the lead set by the Dutch copyright law that would prohibit the use of a photo if it is against the reasonable interests of the subject of the photo. [Unauthorised Photographs on the Internet and Ancillary Privacy Issues: Discussion Paper]

 

US – Homeland Security Gives Tiny Alaska Town a Lot of Camera Power

Dillingham, a quiet fishing village in Southwest Alaska, is home to 2,400 people and not a single streetlight. What it does have, however, is 80 surveillance cameras, focused on the port and the town, courtesy of a $202,000 Homeland Security federal grant. Dillingham Police Chief said the cameras could stop terrorism in Southwest Alaska someday. More to the point, they may also put an end to the drinking, deaths and drug deals that go down at the port every summer when the town fills up with commercial fishermen. [Source]

 

WW – Concern Over Data Security on the Rise in Outsourcing Industry

The International Association of Outsourcing Professionals (IAOP), the global, standard-setting organization and advocate for the outsourcing profession, and Vormetric, a leading provider of security solutions for protecting sensitive information from unauthorized access, announced today that a survey of attendees at Feb 20th’s successful Outsourcing World Summit(R) pointed to increasing concerns over data security while outsourcing. [Source]

 

EU – EU Privacy Experts Issue Opinion on E-Mail Tracking Services

Services that track whether an email has been opened will breach EU data protection laws unless the recipient has given unambiguous consent to the service, according to an opinion from the Article 29 EU Working Party (WP) on Data Protection. The EU WP singled out the Did they read it? service as an example of a new type of service that offers e-mail recipients no opportunity to accept or refuse the tracking. It also provides additional details to senders: the date and time when the email was opened; where, geographically, the email was opened; for how long; and whether it was forwarded. The independent WP expressed “the strongest opposition” to such services in a wider report on privacy issues related to the provision of email screening services. Consent must be given. “No other legal grounds justify this processing,” warns the Working Party. The report also considers how virus detection, spam filtering and processes used by ISPs and email service providers (ESPs) to pre-determine content are impacted by rules such as the European Convention on Human Rights, the Data Protection Directive and the Privacy and Electronic Communications Directive. [Working Party Opinion] [Didtheyreadit.com] [Source]

 

US – MySpace.com to Screen Members to Fight Crime, CEO Says

MySpace.com, the online virtual-community run by Rupert Murdoch’s News Corp., will soon add technology to screen how its 60 million members use the Web site to prevent crime, the company’s chief executive said. He discussed the enhanced security plan in an interview, several hours after federal authorities announced the arrests of two men charged with using MySpace to arrange illegal sexual encounters with minors. [Source] [Source]

 

EU – Concern over Irish Phone Tapping Legislation

Irish Opposition deputies have expressed concern about proposed new legislation introduced last week that would allow police in EU member states to tap phones and access internet records and text messages in their efforts to combat international terrorism and crime. It is feared the measures could lead to an erosion of civil liberties. [Source]

 

US – Republican CD Gathers Data on Users, Prompting Concerns

A computer disk that the Minnesota Republican Party prepared to support a ban on gay marriage has another purpose: gathering data on the politics of the people who view it. And that’s stirred up a technological tempest on the Internet and among Democrats who say the disk will improperly gather data from people who run it on their computers. [Source]

 

EU – EU to Consult, Draw Up New Rules on RFID ‘Spy’ Technology

European information technology commissioner Viviane Reding will unveil plans this week for a public consultation on RFID, including the privacy issue. The feedback will be used when the commission draws up new rules on RFID technology later this year - most likely through updates to existing privacy laws. Brussels is keen to allow the private sector to develop RFID without too much regulation, but believes that issues such as data protection and spectrum management - since the tags are radio-controlled - can best be managed centrally. It will also decide whether to push for an EU-wide standard for RFID chips, allowing then to be read in any EU member state. The technology is seen as a positive driver of economic growth by the commission. [Source]

 

US – Q&A with Schwab CPO Janet Chapman

In response to the announcement of Charles Schwab’s security guarantee, Janet Chapman, the company’s chief privacy officer, was interviewed about Schwab’s view of privacy, how closely the privacy organization interacts with marketing, and the connection between communications and trust. [Source]

 

CA – Entrust to Secure Spain's National Electronic ID Cards for 40 Million Citizens

Entrust has announced that the company's security technology will be imbedded in the Spanish national electronic identity cards for over 40 million Spanish citizens. The project, awarded in Q2 of 2005, is one of the most ambitious government-wide efforts in the world, and went to the consortium of companies including Telefonica, Indra, Software AG and SIA Group. SIA Group, a multinational corporation specializing in the implementation and development of state-of-the-art technological infrastructures, was chosen to supply the Public Key Infrastructure by Entrust. In addition to the many physical security measures to be implemented for information security, the electronic ID card will have a digital certificate for authentication and digital signature capabilities. [Source]

 

UK – Surveillance on Drivers May Include Phone / Seat Belt Laws

Drivers talking on mobile phones or failing to wear seatbelts could find themselves tracked down through a widened use of road surveillance cameras, under proposals due to be floated in the U.K. parliament tomorrow. The plans would form part of a major expansion of camera surveillance which critics say is already transforming Britain into the most watched country in the world. The case for cameras to be focused on people using mobiles as they drive is made by the independent adviser to the transport select committee, Robert Gifford, of the Parliamentary Advisory Council for Transport Safety. [Source]

 

RU – Moscow to Deploy Lighter-than-Air Ships for Street Surveillance

Russian police are to tackle Moscow’s crime and traffic problems from airships. The Moscow mayor has ordered the purchase of two gas airships and three balloons to help authorities track fugitive criminals, monitor traffic flows and thwart terrorist threats. Russian-made Au12 airships and Au27 tethered balloons, known as aerostats, will soon be gliding into place over the busiest roads and most dangerous districts of the capital as part of a £1.4 million project to ease the city’s problems from the air. With an estimated 11 million residents, Moscow is Europe’s most populous city and suffers escalating crime and acute congestion. The airships and aerostats are being equipped with surveillance and recording systems and police will direct units on the ground to problems and emergencies. [Source]

 

JP – Virus Leads to Biggest-Ever Loss of Info from Cops

Investigation information on about 1,500 individuals kept by an Okayama Prefectural Police investigator have leaked onto the Internet from his personal computer infected with a computer virus, officials said. It was the largest amount of information held by Japanese police to have leaked online. Even though prefectural police are withholding details of the information lost because they say they are protecting the privacy of the individuals affected, the Mainichi has obtained documents that show the leak contained such information as the names of sex crime victims and a membership list of a supporting organization for a legislator. The leak will certainly develop into a serious infringement of human rights although the prefectural police say they have not confirmed any case in which the information was illegally used. [Source]

 

US – Maine Seeks to Outlaw Online Sale of Telephone Records

Rep. John Brautigam (D-Falmouth) has filed a bill that would make it a crime as well as a civil violation to sell or disclose cell phone records. The bill has the support of the state’s attorney general. Lawmakers in at least 12 states are considering bills this year related to access to cell phone records or a requirement that customers provide their consent before their telephone numbers are listed in directories, according to the National Conference of State Legislatures. [Source]

 

US – Missouri AG Sues Florida Company Selling Phone Records Online

Attorney General Jay Nixon has filed suit against a Florida-based company that sold phone records online, claiming it obtained the records illegally. Datatraceusa.com is the third such Web site Nixon has sued since January. Two of the Web sites, locatecell.com and completeskiptrace.com, already have been ordered to stop doing business in Missouri and with the state’s residents. Several such Web sites stopped doing business last month following negative publicity and government pressure. [Source]

 

US – FCC Investigating Caller-ID Spoofing Services

The Federal Communications Commission (FCC) has launched an investigation into companies offering Caller-ID spoofing services. Paying customers provide the companies with the number they wish to call, their real phone number and the number they wish to have appear on the Caller-ID screen. The FCC’s investigation is focused on whether or not the services are violating the federal Communications Act, which requires that interstate calls send accurate “originating calling party telephone number information.” The FCC has demanded business records as well as the names of all customers and data regarding the calls they have made. Recent Congressional testimony indicates that people have been using the services to social engineer private customer information from other companies and the services have hurt companies that rely on Caller-ID as a form of authentication. [Source]

 

US – Homeland Security Chief Wants Companies to Retain & Screen Customer Info

The secretary of the Homeland Security Department this week proposed a screening system that would require companies to retain information about their customers but only require them to surrender information filtered by software. “One of the proposals that was floated and shot down before I got here was screening for protection,” Secretary Michael Chertoff said in answering a question posed by a member of the department’s privacy committee. “Instead of the government retaining data, and collecting it, we would screen against the data, [using a] civilian name, pinging it against a private database and then having the private data holder who has it anyway say ‘yea’ or ‘nay, ‘red flag’ or ‘green flag.’ ... That might be a model for some kind of data-retention issue.” Chertoff spoke at a meeting of the Data Privacy and Integrity Advisory Committee. [Source]

 

US – A-G Gonzales May Be Recalled on Eavesdropping

Attorney General Alberto Gonzales’ written answers to questions about the Bush administration’s eavesdropping program may require him to testify a second time before the Senate Judiciary Committee, the panel’s Republican chairman said this week. “There is a suggestion in his letter there are other classified intelligence programs that are currently under way,” Senate Judiciary Committee Chairman Arlen Specter, R-Pa., told reporters. The comments from the moderate Republican come as the Bush administration is trying to quell criticism of its surveillance operations and work with the Senate on legislation that would write the program into law. [Source]

 

US – Senate Panel Blocks Eavesdropping Probe

The Senate Select Committee on Intelligence voted along party lines yesterday to reject a Democratic proposal to investigate the Bush administration’s domestic surveillance program and instead approved establishing, with White House approval, a seven-member panel to oversee the effort. [Source] [Source] [Source]

 

US – First Members Appointed to Privacy and Civil Liberties Oversight Board

Initially proposed by the bipartisan commission that investigated the 9/11 attacks, the Privacy and Civil Liberties Oversight Board was created by the intelligence overhaul that President Bush signed into law in December 2004. After months of delay, the Senate Judiciary Committee last week took a first step toward starting up the fledgling watchdog, approving the two lawyers Bush nominated to lead the panel. The board chairwoman is Carol Dinkins, a partner in the Houston law firm of Vinson & Elkins who was a Justice Department official in the Reagan administration. The board vice chairman is Alan Charles Raul, a Washington lawyer who first suggested the concept of a civil-liberties panel in an opinion article in the L.A. Times in December 2001. [Full press report]

 

US – Experts Disagree Over Notification Standards

Companies agree that breach notification laws have forced them to take steps to better safeguard personal data. But consensus is elusive on when companies should be required to notify consumers that their information has been exposed during a breach. One insurance industry CPO said the notification standard should be “a clear risk of danger to the consumer.” Another legal expert agreed that notification laws are “motivating companies to do a better job of protecting data.” However, there is little to be gained by “overnotification” of consumers. Other experts disagree, saying companies should not control under what circumstances and when consumers should be notified of a breach or potential harm. [Source]

 

US – Patriot Act Revisions Pass House, Sending Measure to President

The House passed revisions to the broad antiterrorism law known as the USA Patriot Act on Tuesday, clearing the way for President Bush to sign legislation making permanent most of the major provisions of the original 2001 law. The bill passed, 280 to 138, with just two more votes than needed under special rules requiring a two-thirds majority. The vote was the last step in a tortuous journey through Congress. The House action approved amendments to a bill revising the original act; the revised bill passed the House last year and was adopted last week by the Senate after having been bottled up there for months. [Source] [Source] [Source] [Source] [Source]

 

US – DMA VP: Congress Will Pass Federal Breach Bill This Year

Jerry Cerasale, senior VP of government affairs for the Direct Marketing Association (DMA), predicts that Congress will pass a federal security breach law before October. The DMA supports many of the provisions contained in four pending bills, all of which would trigger the mandatory consumer notification standard of “significant risk” of harm to consumers. Any of the four pending bills would preempt state breach notification laws already on the books. [Source]

 

US – Technology May Outpace Relevancy of Breach Notification Laws

Thomas Oscherwitz, CPO for ID Analytics, predicts in a column for CNET News.com that the “shelf life for data-breach protection laws could be remarkably short.” These laws could easily become obsolete, Oscherwitz says, because of the advances in validating identities with the use of “scoring technologies, behavioral analysis and other risk-based analytical approaches.” [Source]

 

US – House Committee to Consider Phone Privacy Bill This Week

The U.S. House Energy and Commerce Committee is scheduled to consider legislation that would ban misrepresenting a person’s identity to obtain and sell telephone records. The committee’s chairman, Rep. Joe Barton (R-Texas), said he is concerned that telecommunications companies are not “doing enough to protect consumer privacy.” The publicity around the sale of cell-phone records has forced many Internet sites to stop taking new orders, according to the Federal Trade Commission. [Source]

 

US – New Jersey Politician Wants to Outlaw Anonymous Speech

A New Jersey politician is hoping to outlaw anonymous speech on the Internet, claiming that civility must be mandatory in political debate. Republican State Assemblyman Peter Biondi recently introduced legislation that would require any “public forum Web site” to solicit the legal name and addresses of everyone who can post messages to it. [Source] [Draft bill]

 

US – New California Bills Target Identity Theft

Identity thieves could be in for more than a slap on the wrist if a package of new state Senate bills is approved. Sen. Chuck Poochigian (R-Fresno) introduced four bills at Gov. Arnold Schwarzenegger’s second annual Identity Theft Summit in Los Angeles last week. Senate bills 1387, 1388, 1389 and 1390 would amend the state’s Penal Code to strengthen the penalties for stealing, selling and misusing personal information and would expand the range of prosecutorial options. [Source]

 

CA – Resistance Forming to Hand-Scan time Clock in BC Restaurant

Some of the staff at a Kelsey’s restaurant at Kimberley Alpine Resort are not applauding the replacement of time sheets with hand scans. Employees’ hands are now being scanned at the beginning and end of each shift they work. “It’s just a new form of time clock,” said general manager Andy Cohen of the East Kootenay resort where Kelsey’s operates. For Kelsey’s employee Christopher Thornton, however, it’s an invasion of privacy. He’s sent a protest letter to resort management. “I don’t like where this is leading. I don’t want to get to a point where you need a retina scan to wait tables,” Thornton said. [Source]

 

 

--------