UK – Information Commissioner Releases Guidance on Schools Fingerprinting

The UK Information Commissioner has declared that schools should ask for the consent of children and parents before they take pupil’s fingerprints, despite there being no legal obligation for them to do so. The data protection supervisor issued the informal advice this week, contrasting with previous public comments on the issue of consent, some of them related to its official guidance on school fingerprinting, which it is still drafting. Received wisdom - established by the Gillick precedent - has it that a child can decide for itself on matters of data protection when it is mature enough. This was the basis on which the ICO worked until now. Only this week, the ICO issued an official guidance note on the age at which children were deemed to be old enough to ask under the Data Protection Act to see their school records. The note accorded with its early view of fingerprinting: pupils where old enough when they were mature enough. “As a general rule, students aged 12 and over should be considered mature enough to make a request for their own personal information,” said an assistant commissioner in a written statement . [Source] [ICO Advice] [Technical Guidance Notes] [Parliament won’t debate school fingerprinting] [School fingerprinters say they don’t grab teaching cash]

US – Georgia to Restrict Fingerprinting, Ban RFID Implants and Genetic Discrimination

A state legislative study panel says Georgia should restrict who may collect biometric information - such as fingerprints and retinal scans - and set limits on how long it may be kept. The House Study Committee on Biological Privacy, for example, says employers should not be allowed to require that workers have RFID microchips implanted in their arms so their bosses may track them daily. Additionally, the panel says insurance companies should be prohibited from requiring genetic screenings for customers seeking life insurance policies. And public and private schools should be barred from requiring students to submit their fingerprints before they are admitted. “We see that as an issue with respect to individual liberties,” State Rep. Ed Setzler, chairman of the committee, said at a news conference. Setzler said he plans to introduce legislation that will include the committee’s recommendations. [Source] [Source]

RU – Russian Biometric Passports Failed

The Russian Federal Migration Service (FMS) said this week that the equipment for recording personal data of a passport’s holder turned out to be unreliable and is breaking all the time, and FMS employees simply do not have the skills of using the new equipment. Due to these problems, the beginning of mass issuing of new passports this year in St. Petersburg is postponed indefinitely. [Source]

EU – Serbia Rejects Biometric ID Cards

A grass-roots campaign in Serbia has successfully pressed the Serbian government to back off on a plan to make biometric data compulsory in the country’s new ID cards “due to privacy concerns raised by citizens.” The decision followed a pitched battle prior to the 21 January 2007 election as opponents criticized the accompanying plan for a centralized database of citizen information and the taking of fingerprints. The Serbian administration announced on 11 January 2007 that the Law on Identification Cards would be modified to ensure the chips, with a digitalized photo and fingerprint, would be included only upon the card holder’s specific request. Citizens’ groups and NGOs applauded the concession but vowed to continue the fight until the entire law was struck down, and to challenge in court the centralized database the police plan to set up as an unconstitutional invasion of privacy. [For Life without Stigma - Za zivot bez ziga] [Public revolt quashes biometric ID chips]

CA – Federal & Alberta Privacy Commissioners to Investigate TJX Data Breach

The Privacy Commissioner of Canada, Jennifer Stoddart, and the Information and Privacy Commissioner of Alberta, Frank Work, will jointly investigate how the database of TJX Companies Inc. was breached, and how it affects Canadians who shopped at Winners Merchants Inc. and HomeSense, which are owned by parent company TJX. [Source] [OPC Press Release] [Privacy Watchdog Wants To Force Disclosure of Credit Card Breaches] [Source]

CA – Ontario Government to Post Photos, Identities of “Deadbeat Parents”

The photographs of Ontario’s most elusive deadbeat parents will be posted on a government website next month, the community and social services minister announced last week. Minister Madeleine Meilleur said earlier efforts to force parents to pay court-ordered child support –such as drivers’ licence suspensions and longer jail terms – have still left as many as 63,000 refusing to pay either part or all of support payments to their families. The photos will embarrass the deadbeats, she said, “but not just an embarrassment, it will be other eyes on the street trying to find them.” [Source]

EU – Pan European Medical Records System Proposed

UK patients’ medical records could be shared across Europe in a European Commission scheme that could compound controversy over the NHS’s patient records system. The UK Department of Health has faced a barrage of criticism over its handling of the Connecting For Health computer system, and patients have been refused a vital opt-out of the system which ministers had promised. The Commission’s Framework 7 project, which funds research in the EU, contains an element called the Competitiveness and Innovation Framework Programme (CIP), which proposes a link up between the health information systems of European countries. Privacy advocates fear that the potential problems inherent in a UK-wide health information system would only be compounded by a Europe-wide system. “If it comes to the point that every one of the five million people working in healthcare in Europe, plus the CIA and hackers, can access the information, then I’ll stop using the health service,” said Ross Anderson, a security engineering professor at Cambridge university. [Source] [Anger over EC medical data-sharing scheme]

EU – E.U. and U.S., Divided on Air Passenger Data, Seek Deal

European Union president Germany said last week it would work hard to strike a deal quickly on sharing air passenger data with the U.S., which is pushing for easier access to European records. Germany is under pressure to negotiate the agreement, designed to help fight terrorism, because a temporary deal signed last October expires in July. But the two sides disagree over how the data should be used. [Source] [EU wants to keep limits on U.S. passenger data use] [EU expects tough talks with U.S. on air passenger data agreement] [Brussels to fight for EU passenger privacy on US flights]

EU – Dutch DPA Advises Negatively on Dutch Draft Data Retention

The Dutch Data Protection Authority (DPA) has made a strong case against the Dutch draft law that seeks to implement the EU data retention directive (the draft law would introduces a retention period of 18 months, both for telephone and Internet traffic data). In its advice of 22 January 2007 the DPA concludes that the draft disregards the requirements of article 8 of the European Convention on Human Rights. By extending the retention of mobile telephone location data to all the location data generated during a communication the draft goes beyond the demands of the directive. The DPA notes that this extension implies surveillance of the movement of large amounts of innocent citizens and points to the agreement in the European Parliament and the German implementation draft, where it is explicitly stated that the directive does not demand the retention of these location data generated during a mobile communication. Another point of critique of the DPA are the limitations on access to the retained data. The DPA concludes that these provisions are too broad and need to be drafted more strictly and precisely. The Dutch DPA finally criticizes the use of delegation provisions. According to the DPA, the details on the specific data to be retained should be included in the law itself. The law should also be more specific about the obligation to provide the statistical data on the actual use of the retained data. The draft law is not at all clear about these essential ingredients of the data retention regime and delegates these matters power to the government. The draft, now in the phase of consultation, was made public on 21 December 2006. It also provoked a strong reaction of a large coalition of telecom companies and ISPs. [Advice Dutch Data Protection Authority (in Dutch only, 22.01.2007)] [Draft law implementation data retention directive (in consultation), (in Dutch only, 21.12.2006) ] [EU Data Retention - documentation, news and links] [Key documents on “the making of” data retention 1997 - 2006] See also: [Ireland DRI challenges EU’s Data Retention law]

EU – Greece Vodafone Fined € 76 Million Over Security Breach And Wiretap Scandal

The Hellenic Authority for the Information and Communication Security and Privacy has fined Vodafone € 76 Million (approx. US $100 Million) over a security breach and wiretapping scandal that saw the illegal monitoring of the mobile calls of top government officials. Vodafone was ruled at fault for not preventing unknown hackers from subverting a legitimate surveillance system to spy on Greek officials around the time of the 2004 Athens Olympics. The Authority said that Vodafone had failed to take adequate measures to protect its network and had not informed subscribers that their phones were being tapped. It further criticized Vodafone for obstructing its investigation by failing to admit the existence of the surveillance system itself. [Source]

EU – France CNIL Warns ISP Free against Data Breaches

On January 4, 2007, the French Data Protection Authority (CNIL) announced that leading ISP Free SAS erroneously transferred personal data, including unlisted phone numbers, from more than 120,000 customers to third-party operators of web-based and phone-based directory services. The CNIL decided not to impose any fines as it was satisfied that Free SAS took measures to correct its internal security controls. The CNIL however considered that this was a particular threat to privacy which justified a public warning. [CNIL Decision]

EU – Spain Adopts New Video Surveillance Legislation

The first Spanish legislative instrument dealing with video surveillance of private individuals entered into force on December 12, 2006. Instruction 1/2006, adopted by the Spanish Data Protection Agency on November 8, 2006 applies to images recorded by cameras when the purpose of processing is the security of individuals. The Instruction is the consequence of the growing increase in the use of these devices in Spain. This Instruction is in line with the data protection principles set forth by the Spanish Data Protection Act. [Instruction] and [Annex]

UK – Royal Data Breach Lands Journalist Jail Time

A journalist has been jailed for tapping the mobile phone voicemail services of royal employees. Clive Goodman was royal editor of the News of the World at the time. Goodman admitted hacking into the phones 487 times in just one eight month spell ending in June of last year. He was sentenced to four months in prison. Goodman breached the Regulation of Investigatory Powers Act (RIPA), committing a criminal offence. The case comes in the wake of calls from Information Commissioner Richard Thomas for tougher penalties for journalists who invade people's privacy. Thomas wants people who breach the Data Protection Act to face two years in jail. Currently there can be no jail term because those activities are not criminal acts. [Source]

US – Poll Exposes Generational Divide on Expectations of Privacy

Nine out of 10 Americans believe the Internet has changed our expectations of privacy, according to a new poll conducted on behalf of the Congressional Internet Caucus Advisory Committee in advance of its annual policy conference in Washington. But a vast chasm exists between what 18-24 year-olds believe is an invasion of privacy and what other Americans consider to be an intrusion. For example: Only 35.6% of 18-24 year-olds consider someone posting a picture of them in a swimsuit to be an invasion of their privacy, compared to 65.5% of other respondents. Only 19.6% of 18-24 year-olds consider their dating profile to be an invasion of their privacy, compared to 54.6% of other respondents. “Whether health care, e-commerce or social networking, privacy is at the forefront of every major policy debate,” said Tim Lordan, executive directorof the Congressional Internet Caucus Advisory Committee. “This survey raises questions that could significantly impact our policymaking on privacy in years to come, assuming the MySpace generation maintains their privacy views as they age.” [Source] [Source]

EU – German High Court Rules that Disclosure of Consumer Credit Data Is illegal

In its decision of December 14, 2006, the Düsseldorf High Court (OLG Düsseldorf) ruled that the transfer of consumer data to the Schufa Holding AG on the basis of the general acceptance of the terms and conditions of a contract without further consideration of a data subject’s interests or without obtaining their prior consent is illegal. The Schufa Holding AG is a credit association set up by the credit services sector in Germany, which makes information available to its contract partners so that they are protected against losses arising from consumer credit. The case involved a leasing company that had transferred a customer’s personal data to the Schufa after the customer had challenged the amounts still due after expiration of the leasing contract. In first instance, a regional court ruled in favor of the leasing company. However, the OLG acting as appellate court invalidated this decision and forced the leasing company to have the consumer’s data deleted from the Schufa files. [Press Release]

WW – Survey: Consumers Favor Stronger Authentication Methods For Online Banking

The fourth annual Financial Institution Consumer Online Fraud Survey has found that 91% of the 1,678 adults surveyed from eight countries say they would use a new authentication method if their banks decided to offer stronger security. The survey also found that 6% said they believe that banks should ditch usernames and passwords in favor of stronger authentication methods for online banking. More than 90% of bank customers favor the use of two-factor authentication for their online banking, conducted by IT security company RSA Security. The survey also found that 58% of banking customers wanted their bank to adopt stronger authentication for telephone banking. [Source] [Source]

US – 50 State Guide to Open Records Laws Released

Find out which government records are available to the public in each state in the revised, Open Government Guide , produced by The Reporters Committee for Freedom of the Press. The access to public records for private investigators, lawyers or journalists is more often than not the same as that accorded to the unwashed masses. [Source] [Guide to Open Records]

US – IBM Calls on Congress to Act on Genetic Non-Discrimination Legislation

IBM’s Chief Privacy Officer, Harriet Pearson, testified before the House Education and Labor Subcommittee on Health, Employment, Labor and Pensions about the subject of genetic non-discrimination. IBM filed its testimony on the Genetics Information Non-Discrimination Act last week and called on Congress to enact laws that prevent discrimination based on genetic information which is increasingly prevalent in the diagnosis and treatment of many medical conditions, as well as in research to discover the fundamental genetic mechanisms of major diseases. In October 2005, IBM became the first major corporation in the world to establish a genetics privacy policy that prohibits current or prospective employees’ genetic information from being used in any employment decisions. [Source]

UK – Info Commissioner Richard Thomas Issues Report on Patient Record System

In a recent report, Information Commissioner Richard Thomas has assured patients that they will have the chance to opt-out of the new NHS medical records system. In trial areas where the records will first be uploaded to the system, NHS will contact the patients first, and give them their options to limit the scope of information or to opt-out entirely, according to the report. They also will be given the opportunity to view their information before it is uploaded to the system. [Source] [Report]

US – GAO Issues Report on Health Information Technology and Privacy

The Government Accountability Office has released a report entitled Health Information Technology: Early Efforts Initiated but Comprehensive Privacy Approach Needed for National Strategy. GAO-07-238. GAO has identified key challenges associated with protecting electronic personal health information in four areas: (1) Understanding and resolving legal and policy issues; (2) Ensuring appropriate disclosure; (3) Ensuring individuals’ rights to request access and amendments to health information; and (4) Implementing adequate security measures for protecting health information. [Source] [Highlights]

US – Pennsylvania Blue Cross Health Records to be Accessible Via Cell Phone

Blue Cross of Northeastern Pennsylvania plans next month to begin a project to allow its 600,000 members to access their health records on cell phones or handheld devices. In March, the insurer will begin providing members free access to mobile software that they can download to cell phones and handheld devices. Members can then use their mobile devices to show doctors their medication history, previous diagnoses, allergies and other data. In addition to the health data obtained from claims records, the mobile application will have a member's eligibility and insurance benefits. The insurer is using MobiSecure Wallet and MobiSecure Vault software from Toronto-based Diversinet Corp. to run the application. Users can download the Wallet software to their PC or cell phone, which is used to retrieve the health data from the Vault, a server-side repository that stores the health data. The MobiSecure software generates a new unique password for each transaction. [Source]

WW – Data Security and Privacy Breach Roundup

Vermont agency warns 70,000 of possible data compromise – The Vermont Agency of Human Services (AHS) this week started sending letters to about 70,000 individuals in the state warning them of a computer compromise that may have exposed their SSNs and other personal data. The breach was discovered on Dec. 8 and involved a computer running an application that is used for collecting delinquent child support payments from noncustodial parents in the state. The “bank match” application is used to run quarterly matches of names with nine financial institutions in the state to establish whether delinquent parents have assets that can be used to pay off their child support obligations. [Source]

Stolen Laptop Holds Kansas Hospital Patient Data – Among the items taken in a burglary at a Kansas Regional Health Center is a laptop computer that contains PII of as many as 1,100 patients. The data include SSNs and medical histories. The hospital has notified the affected patients by mail. The data were stored on the computer because its authorized user travels to different offices in the course of this person’s work. [Source]

Stolen Laptop Holds Illinois University Student Information – A desktop computer stolen from the Student Life office of Eastern Illinois University (EIU) holds PII, including SSNs, of about 1,400 students. The computer database holds fraternity and sorority membership rosters. The university has sent letters to the affected students. EIU police are investigating the theft. EIU is in the process of eliminating the use of SSNs as unique identifiers; that plan is expected to be complete in one year. [Source]

Stolen Computers Hold University Financial Aid Applicant Info. – Two computers stolen from Vanguard University’s financial aid office contain PII of more than 5,000 financial aid applicants. The computers were stolen in mid-January, but officials did not know until January 26 that they contained sensitive data, including SSNs, driver’s license numbers and lists of assets. The number of people affected is reportedly as high as 10,000, as many of the students are dependent children. The breach affects students who applied for financial aid for the 2005-06 and 2006-07 academic years. The California university is notifying those affected by the breach by letter. [Source] [Source]

Stolen Boeing Laptop Recovered – A laptop reported stolen from Boeing has been recovered. The laptop was reported stolen in December 2006; it holds personally identifiable information of approximately 382,000 current and former Boeing employees. A Boeing Senior VP reportedly told employees in an email that a consultant had determined that the files were not read after the theft. Boeing fired the employee responsible for the computer shortly after the theft was reported. [Source] [Source]

Prudential, Amex and Random House Employees Learn Their Data Are in Stolen Towers Perrin Computers – The roster of companies affected by the Towers Perrin computer theft continues to grow. Employees at Prudential, American Express and Random House have been notified their personal information could be at risk of exposure following the computers’ disappearance. Towers Perrin provides actuarial services for pension plans. A former Towers Perrin employee has been arrested in connection with the theft but the computers have not been recovered. [Source] [Source]

UK – Information Commissioner Issues ID Theft Warning

People are risking identity theft by not protecting their personal details, the UK information watchdog says. A survey for the Information Commissioner’s Office (ICO) shows that about 20% of people had been victims of identity theft crime. One-third threw away bank statements, receipts and other personal documents without shredding or destroying them. This figure rose to 60% among 16 to 25-year-olds - the age group least protective of personal details. A quarter of the respondents did not regularly check bank statements for transactions which were not theirs. And almost half of those surveyed said they used the same PIN and passwords across different accounts. The ICO also found that when it came to the internet, many consumers fail to adequately protect their personal details, with 35% of respondents making online debit or credit card transactions without checking the security of the site. It is launching a guide which advises on how to avoid identity theft. [Source] See also: [Experts warn of soaring ID theft]

US – Identity Theft Tops Complaints to Illinois Attorney General in 2006

Consumers complained to Illinois Attorney General Lisa Madigan’s office about identity theft more than they did about any other topic in 2006. Of the 32,724 consumer complaints received last year, 5,327 – or 16% – dealt with ID theft, capturing for the first time the No. 1 spot on the yearly consumer complaint list that the attorney general compiles. Other complaints in the top 10 dealt with such subjects as credit, telecommunications and construction/home improvement fraud. In a news release, Madigan also pointed to a disturbing new trend, saying her office received more than 700 mortgage-related complaints last year. While mortgage-related problems did not make the top 10 list of 2006 consumer complaints, last year’s figure represents more than double the number of mortgage-related complaints from 2005. [Source]

US – Survey: ID Fraud in U.S. Falls by $6.4B

Americans lost about $US49.3 billion to criminals who stole their identities in 2006, an 11.5% decline that may reflect increased vigilance among consumers and businesses. Losses declined from a revised $US55.7 billion in 2005, according to the third annual study by Javelin Strategy & Research. They had increased in each of the prior two years. The average identity theft fraud fell 9% from $US6278 to $US5720, while the median - where half were larger and half were smaller - held steady at $US750. "Businesses are doing a better job screening, and consumers are doing better at locking up information and monitoring their accounts," Javelin president said. The percentage of people affected by fraud has steadily fallen from the first survey in 2003, when it was 4.7%, to 3.7% last year. [Source] [Source]

WW – Symantec Unveils ‘Universal ID System’

Symantec Corp. claims a new component of its Security 2.0 initiative will create a universally accepted identity system across all Web sites, helping users manage their online identities in a secure way. The Identity Initiative is a combination of services and software the company calls the centerpiece of the Security 2.0 initiative it launched in October. “Our goal is to create a universally accepted identity system across all Web sites – from online financial institutions to retailers – for millions of consumers,” said Symatnec spokesman. “We have a strong base to build from, with almost half of our active Norton user base already enrolled in a basic Norton account. We’ll enable our millions of customers to extend the functionality of their Norton account to manage all their information, all in one place.” [Source]

US – Sony BMG Settles FTC Charges Over Rootkit

The FTC has announced that Sony BMG Music Entertainment agreed to reimburse consumers up to $150 for damage to their computers from CDs with hidden DRM software. According to the FTC, which announced the settlement, Sony BMG’s software limited the devices on which music could be played to those made by Sony, Microsoft, or other Windows-compatible devices. The software also exposed consumers to significant security risks and was unreasonably difficult to uninstall. [Source]

US – Carnegie Mellon CyLab Publishes 2006 Privacy Policy Trends Report

The Carnegie Mellon CyLab Privacy Interest Group (CPIG) has released Privacy Policy Trends Report. The report examines the state of online privacy at the end of 2006 through the lens of website privacy policies, looking at three main areas: (1) privacy practices of the most popular websites as compared with a random sample of websites that post privacy policies, (2) privacy policies of websites in the U.S. financial industry, and (3) trends in the adoption of the Platform for Privacy Preferences (P3P). [Report]

WW – Net Pioneer Predicts Overwhelming Botnet Surge

Internet pioneer Vint Cerf warned high-powered attendees at the World Economic Forum in Switzerland that the Internet is at serious risk from botnets. Cerf predicted that a quarter of all PCs currently connected to the Internet, around 150 million, could be infected by Trojans that covertly seize control of a computer and its broadband connection, handing control of both to criminals in remote locations. [Source]

CA – Canadian Tax Authorities Use Searchbot to Search for Cheats

Canada’s revenue agency is testing out a software program known as a “spider” that methodically crawls the Internet looking for online tax cheats. The software, called Xenon and created in the Netherlands three years ago by Amsterdam-based Sentient Machine Research, is designed to go after online auction, gambling and shopping sites that operate out of Canada but neglect to pay their taxes. [Source]

US – Lawmakers Target Sex Offenders on The Net

U.S. lawmakers this week proposed requiring sex offenders to register their e-mail and instant messaging addresses with law enforcement authorities in a bid to protect children using popular social Internet sites like MySpace. The legislation introduced in the U.S. Senate and House of Representatives also would require the Justice Department to develop a system that would allow commercial social networking Web sites to check members’ addresses against individuals listed in the National Sex Offender Registry. [Source] MySpace to Donate Database of Sex Offenders: Popular Internet social network MySpace said it will donate a national computer database on U.S. sex offenders to the National Center for Missing & Exploited Children. MySpace and background verification company Sentinel Tech Holdings Corp. developed a technology that combines close to 50 U.S. state registries, aiming to help police keep track of an estimated 600,000 convicted sex offenders. [Source] See also [UK Police Say They’re Overwhelmed by E-Crime] [More] [Same thing]

WW – IBM Donates New Privacy Tool To Open-Source

IBM is giving its work on its “Identity Mixer” software to Higgins project, an open-source effort devoted to empowering users by granting them more online control of their personal information. When making an online purchase, users would provide an encrypted credential provided by their credit card company in lieu of credit card account information. The encrypted credentials could be used only once, requiring users to obtain a new set when they make another purchase or transaction. The technology is intended to build consumers’ trust about the security of online transactions. [Source]

WW – Phishing Overtakes Viruses and Trojans

Phishing attacks have outnumbered e-mails infected with viruses and Trojan horse programs for the first time. Security mail services vendor MessageLabs reports that in January 2007, one in 93.3 e-mails (1.1%) comprised some form of phishing attack. There were fewer e-mails infected with viruses. [Source]

WW – Study Finds IE7 + EV SSL Won’t Stop Phishing.

Stanford University and Microsoft Research have published a study that claims that the new Extended Validation SSL Certificates in IE7 are ineffective. The study, based on user testing, found that EV certificates don’t improve users’ ability to detect attacks, that the interface can be spoofed, and that training users actually decreases their ability to detect attacks. The study will be presented at Usable Security 2007 next month, which is a little late now that the new certificates are already being issued. [Source] See also: [Internet Explorer Unsafe for 284 Days in 2006] and related [Visual Chart]

EU – Norwegian Privacy Authorities Investigating Google

The Norwegian press is reporting that the Norwegian Data Inspectorate is investigating Google and the large amount of data stored by search engines. Google has responded that does not know the persons behind IP numbers, and that the company is not willing to give such information to others. [Source]

EU – French Big Brother Awards 2006

The French Big Brother Awards event took place on 20 January 2007. The winner of the State award was Jacques Lebrot, a “security” sub-prefect for having deprived of jobs several thousand people with police records created just on the basis of suspicion and discrimination, violating their right to the presumption of innocence. Sony-BMG company took the enterprise award for its “rootkit”, spy software installed in the sold CDs to control the usage of the CD, ironically, by those who had became the rightful owners by buying the respective CD. The Locality Orwell prize was given to the Mayor of Ploërmel for having installed more than 50 video-surveillance cameras in a locality with 9000 inhabitants and zero degree of delinquency and for the creation of a green number encouraging denunciations. The Orwell Novlang prize was awarded to the director of the Judiciary Police who supports the genetic filing of the entire population arguing that the innocent persons could thus be rid of any suspicion. Winning the lifetime achievement award was the Minister of Justice who had previously been nominated and awarded in 2004 for being a strong supporter of the electronic bracelet for delinquents and for having imposed it retroactively to the sexual delinquents after their liberation. He won the 2006 award for his disrespect of institutions and human rights and for his determination to imprison and control. The Voltaire prize for vigilance was taken, ex-aequo, by the school directors who have refused to fill in the children database and by the webmaster of Ordinateurs-de-vote.org for his permanent work in showing why the electronic vote is a false good idea and a threat to democracy. [Source]

AU – Australian Big Brother Awards 2006

Outgoing Human Services Minister Joe Hockey has won the People's Choice Orwell for the "access card - a national ID card in disguise", in the 2006 Australian Big Brother Awards, hosted by the Australian Privacy Foundation. Mr. Hockey was chosen for "his refusal to release the privacy impact assessment" and for "his rejection of key recommendations of his own Consumer and Privacy Taskforce.". "This was a well-deserved win for the relentless campaign of disinformation and doublespeak surrounding the access card project." The Worst Public Official award went to federal Justice Minister Chris Ellison, "for the 'Abolition of Financial Privacy' legislation masquerading as the Anti-Money-Laundering and Counter-Terrorism Financing Bill". "People might think, who could possibly object to that?" the judges said. "But this legislation turns thousands of bank tellers and other employees into amateur spies, with a legal obligation to report anyone who may be 'acting suspiciously'." The Orwell for Greatest Corporate Invader was shared by all Australian banks, for continuing to send personal information to the global transaction hub, Swift, even after it was confirmed that the information was being provided to US security agencies. Most Invasive Technology went to the NSW Health Department, for overturning the opt-in requirement in the state's health privacy law to allow the start of its electronic patient record system, Healthelink. The Best Privacy Guardian award, or Smith, went to barrister Lex Lasry and other defence lawyers who refused to submit to stringent ASIO security clearances when representing suspects accused of terrorism. The Australian Communications and Media Authority won an honourable mention for having successfully prosecuted the company, Clarity 1, under the Spam Act, resulting in fines of $5.5 million.

[Source] [APF Big Brother Award Winners]

US – ACLU v. NSA Hearing on Warrantless Wiretaps

This week, the ACLU urged the Sixth Circuit Court of Appeals to uphold a lower court ruling that the NSA’s warrantless wiretapping is illegal and unconstitutional. Audio from the hearing is available at the Sixth Circuit’s website as a 670 MB WAV file. This case deals with the so-called “Terrorist Surveillance Program” that the President has publicly confirmed. EFF has sued AT&T for its role in the NSA’s illegal spying, which we allege goes beyond what the President has directly admitted and intercepts the phone and Internet communications of millions of ordinary Americans. Last summer, Judge Walker rejected the government’s motion to dismiss EFF’s case, along with AT&T’s motion to dismiss, and allowed the case to go forward. That ruling is also on appeal. [Source] [Source]

US – Digital Billboards Use RFID to Deliver Personalized Messages to Car Owners

Mini Cooper owners will be the recipients of personalized marketing messages on billboards in four U.S. cities in a unique effort to deliver personalized advertising content to consumers. The boards identify Mini drivers through a coded signal from a radio chip embedded in their keys. The Motorby campaign is raising anew questions about the use of RFID, but a company spokeswoman points out that the program is voluntary, and that no confidential information is stored on the key fob. [Source] [Announcement] SEE ALSO: [Tracking Audis with RFID]

EU – European Commission Announces RFID Forum in March 2007

DG Information Society and Media will be hosting a conference on RFIDs in Brussels on March 13-14, 2007. After the opening by a keynote session, two fora will be run in parallel, the first one focusing on academic research and development, the second one on industry and technology issues. The conference will be concluded by a panel session, providing concise summaries and recommendations. The European Commission is calling for contributions in all areas related to research, development and experience. Submission deadline is February 7, 2007. [Source] See also [US Congressional Internet Caucus Roundtable on RFID]

US – Human RFID Tag Provider VeriChip Announces IPO

Applied Digital Solutions announced this week that it will take VeriChip public on Feb 8. Applied Digital manufactures security and identification products based on a number of technologies, including RFID. A subsidiary of Applied Digital, VeriChip manufactures the controversial human-implantable RFID tag of the same name. VeriChip targets non-traditional areas in which most RFID companies do not compete, like patient identification, infant protection, and wander prevention. [Announcement]

WW – RFID Deployed in Large US, UK Hospitals

RFID solutions provider Parco Wireless has announced its UWB RFID implementation at Washington Hospital Center in Washington, D.C., one of the 25 largest hospitals in the nation. According to the company, the installation will include 2,500 tags distributed over 2.5 million square feet in its 926-bed facility. Vnunet.com reports that Royal Alexandra Hospital in the U.K. is extending its RFID pilot. Mantic Point provides the software and Wavetrend the RFID tags and readers for the asset management system that is expanding from three initial wards to include the accident and emergency department and the patient recovery wards. [Source]

US – TJX Hit with Class Action Lawsuit

A class action lawsuit, filed in US District Court in Boston, alleges TJX was negligent in maintaining computer security resulting in the misuse of customer information. The lawsuit also claims that TJX failed to disclose the intrusion in a timely manner. TJX runs 2,500 TJ Maxx and Marshall’s stores. Credit card and drivers license data was stolen and the company did not disclose the loss for a month. The suit seeks credit monitoring services for those whose information was exposed as well as damages incurred as a result of the breach. TJX chairman Ben Cammarata said the company would not provide credit monitoring because it would not “be meaningful to customers” and that the delay in notification about the breach allowed the company “to contain the problem and further strengthen [its] computer network to prevent further intrusions.” [Source] [Source] [TJX Chairman Launches Public Campaign To Explain Breach Notification Delay] [Bank of America Reissuing Cards]

US – Banks Step Up Efforts to Pressure Retailers On Data Security

The Massachusetts Bankers Association is increasing its efforts to force retailers to improve data security safeguards or face financial consequences. The group is backing legislation that would require the party responsible for a security breach to reimburse banks for the costs of reissuing cards when fraud results. Major credit card issuers may issue fines of up to $10,000 per month for stores that fail to make efforts to comply with the Payment Card Industry Data Security Standard (PCI). In December, Visa USA said it had fined violators $4.6 million, compared to $3.4 million in 2005. [Source]

US – US Government Does Not Score Well On Cybersecurity

The Cyber Security Industry Alliance (CSIA) has renewed its call for the U.S. Congress to pass a comprehensive data protection law in 2007. The CSIA, a trade group representing cybersecurity vendors, gave the U.S. government ‘D’ grades in three areas: security of sensitive information, security and reliability of critical infrastructure, and federal government information assurance. The CSIA called on agencies to notify citizens of data breaches. [Source]

US – Smart Card Alliance Issues Privacy, Security Guidelines

A group that represents companies and government agencies with a stake in the successful deployment of RFID and technology has issued a set of best practices guidelines. The Alliance Identity Council has released the best practices to address privacy concerns related to the use of RFID in identification documents. [Source]

US – FBI Turns To Broad New Wiretap Method

CNET reports that the FBI appears to have adopted an invasive Internet surveillance technique that collects far more data on innocent Americans than previously has been disclosed. Instead of recording only what a particular suspect is doing, agents conducting investigations appear to be assembling the activities of thousands of Internet users at a time into massive databases, according to current and former officials. That database can subsequently be queried for names, e-mail addresses, or keywords. [Source]

CA – Toronto Police Push Surveillance Cams: No Privacy Threat

Toronto police are big on the use of surveillance cameras, but are going to great lengths to soothe any public concerns about privacy being invaded. By May 1 the police service expects to roll out 15 cameras in three different areas of the city, but first they're conducting a series of public consultations across the city to sell their plan. The cameras will be deployed in crime-prone areas for six months as part of a $2 million program funded by the province. A big part of the police consultations, Supt. Jeff McGuire told reporters at city hall this week, will be providing assurances about privacy. [Source]

US – Justice Department Releases Documents on Spying Program

U.S. Attorney General Alberto Gonzales said this week he would turn over secret documents detailing the government’s domestic spying program, ending a two-week standoff with the Senate Judiciary Committee over surveillance targeting terror suspects. The records will be given to Senate Judiciary Chairman Patrick Leahy and the panel’s top Republican, Sen. Arlen Specter, who two weeks ago lambasted Gonzales for refusing to turn over documents that even the FISA Court’s presiding judge had no objection to releasing. [Source]

US – Bill Would Establish Cttee to Study Privacy Amendment to N.H. State Constitution

New Hampshire State Rep. Jim Ryan is sponsoring legislation that would create a committee to study whether the state should advance a constitutional amendment that would guarantee the right to personal privacy. Ryan’s bill is among a number of privacy-related measures the Legislature is advancing this year. A Republican lawmaker is eager to push for the second year to prevail in efforts to shun participation in the federal government’s Real ID Act, which would require states to meet federal standards for issuing driver’s licenses by May 2008. [Source]

US – Maine Lawmakers Reject Compliance With Real ID Act Of 2005

Maine lawmakers have rejected compliance with the federal law that requires states to replace their driver’s licenses by May 2008 with cards embedded with private information. The Senate and the House passed a resolution that also urges Congress to repeal the Real ID Act, which would set up a nationwide database of personal information and biometric identifiers that federal, state and local officials could access. Montana, New Hampshire, New Mexico, Georgia and Washington are considering legislation that takes a stand against the federal mandate. Privacy advocates say the Real ID Act is an effort to create a national identity card. [Source] [Repeal Real ID Act: Maine House & Senate nearly unanimous] SEE ALSO: [House passes 2 bills opposing national ID cards] [Montana moves to reject Real ID Act] [Maryland has REAL questions about ID law] [Massachusetts - Opposition brewing to Real ID] [New Mexico House panel: Feds should repeal Real ID Act] [As opposition grows, Davis pushes for Real ID Fast-track] [Several States Seek To Kill Federal 'Real ID' Requirements]

--------