Privacy News Highlights

20–27 July 2007

 

Contents:

US – Oregon Implements Facial Recognition on Drivers Licenses. 2

AU – Aussies to Stockpile Kiwi Biometrics in Central Database. 2

CA – B.C. to Offer ‘Passport’ Driver’s Licence. 2

CA – Privacy Commissioner: LSAT Thumbprinting Violates Privacy Rights. 2

UK – Schools Receive Guidance on Implementing Biometrics. 2

EU – Netherlands Citizen Service Number Gets Green Light 3

CA – Canadians Willingly Duped By Spam: Report 3

WW – Seeing Yellow Over Color Printer Tracking Devices. 3

WW – One-Fifth of the World Online by 2011. 3

US – Public Interest Groups Respond to NBC on Mandatory ISP Filtering. 4

UK – Web Networkers ‘at risk of fraud’: Equifax. 4

CA – Ontario Government Must Reveal Legal Costs. 4

US – Judges Respond to Site Outing Informants. 4

EU – New Rules Protect Irish Individuals’ Privacy Rights. 4

US – Senators Introduce Stringent Health Records Privacy Bill 4

US – CDT Calls for Privacy Standards in Health IT Bill 5

UK – New Hospital Tagging System Should End Patient Mixups. 5

US – Data on 867,000 Military Personnel May Have Been Compromised. 5

UK – Web Security Breach Exposes 54,000 Card Details. 5

US – North American Banks Move Towards Full MFA Deployment 5

AU – Mobiles to Become Tracking Devices in Australia. 6

WW – MySpace Finds 29,000 Sex Offenders on Its Site. 6

WW – Ask.com to Allow Users to Control Data Retention. 6

WW – Microsoft, Ask.Com Team Up On Privacy Protection. 6

WW – OECD Recommendation and Guidance on Electronic Authentication. 6

US – House Panel to Look at Google-DoubleClick Merger 7

US – AOL Announces Plan to Acquire Online Ad Company. 7

US – Researchers Blast TRUSTe on User Privacy. 7

TH – Critics Say Thai Cyber Law Invades Privacy. 7

US – Senate Votes Against REAL ID Funding. 7

US – CDT: NSL Bill Would Restore Critical Privacy Protections. 7

WW – Privacy Control Flawed In Many Security Suites. 8

WW – Beta Test MySpace’s Kid-Tracking Software. 8

CA – Survey: Many Canadian Parents Lack Ability to Protect Kids Online. 8

EU – Ireland’s Data Commissioner Raids Offices of SMS Marketing Firms. 8

EU – Ireland Plans to Introduce Mandatory Cellphone Registration. 9

US – ACLU Slams FBI Plan to Pay Telecoms to Store Phone Records. 9

US – GAO: DHS Privacy Office Has Made Progress but Faces Continuing Challenges. 9

US – White House Privacy Adviser: We Don’t Need More Authority. 9

EU – European Commission Cuts Replacement Deal With US on Passenger Data. 9

US – Department of Justice Proposes Update to Identity Theft Laws. 10

US – Nearly Ten Percent of Companies Have Fired Bloggers, Survey Claims. 10

US – New York Taxi Drivers Threaten to Strike Over GPS Proposal 10

 

 


 

US – Oregon Implements Facial Recognition on Drivers Licenses

Oregon officials are creating a biometric database of every motorist in the state that will ease a future transition to automated tracking and identification of residents. By July 2008, the state DMV plans to meet a deadline set by the legislature in completing the process of using facial recognition software to scan all existing driver photographs. Oregon has been at the forefront of exploring surveillance technology. State law already allows both red light cameras and speed cameras to photograph the face of drivers. For now, however, the program is limited to use by the DMV. The agency now requires anyone applying for a new driver’s license to be scanned by a high-resolution digital cameras. DMV officials insist that the change is not related to the federal REAL ID Act designed to implement a national identity card, but statements from officials involved in the program suggest otherwise. [Source]

 

AU – Aussies to Stockpile Kiwi Biometrics in Central Database

The biometric data of New Zealanders and other foreign nationals entering Australia could be permanently stored in a central repository for identity verification and cross-checking between federal government departments, national and international anti-identity fraud bodies, and border control systems. The Department of Immigration and Citizenship (DIAC), the Department of Foreign Affairs and Trade (DFAT) and the Australian Customs Service are all using biometrics for varying levels of identity management. A DIAC spokesperson says the department will increase the use of biometrics for identification in the lead-up to 2010, when it expects to provide a single identity for DIAC clients “regardless of what business function is being undertaken”. DIAC will employ facial recognition, iris scanning, and fingerprinting to verify the identity of non-citizens entering Australia. [Source]:

 

CA – B.C. to Offer ‘Passport’ Driver’s Licence

The B.C. government hopes to soon offer an enhanced driver’s licence that would serve as a cheaper, more convenient alternative to a passport for land or sea travel to the U.S. Pending approval from Ottawa, the province will begin offering limited numbers of the licences to residents who are Canadian citizens in January 2008. The goal is to comply with a coming U.S. requirement that land and sea travellers show a document denoting identity and proof of citizenship. [Source] [Source] [B.C. Calls for Action on Enhanced Driver’s Licences]

 

CA – Privacy Commissioner: LSAT Thumbprinting Violates Privacy Rights

The Office of the Privacy Commissioner has determined that thumbprinting Law School Admissions Test (LSAT) test-takers for identification purposes is a violation of the PIPEDA, and has instructed the Law School Admission Council to stop collecting thumbprints. In her report, the Commissioner found that the use of thumbprints was not justified based on proportionality of loss of privacy to benefit gained and on the question of “minimal invasion of privacy.” [Source]

 

UK – Schools Receive Guidance on Implementing Biometrics

The British Educational Communications and Technology Agency (BECTA), in conjunction with the Department for Children, Schools and Families and the UK Information Commissioner’s Office, has offered advice to assist schools with implementing biometric technology while protecting personal information. Biometric systems present a number of benefits for schools, including automating attendance records and eliminating the need for children to carry lunch money. In order to comply with the Data Protection Act of 1998, schools that use biometrics must take measures to ensure student information is secure and kept no longer than necessary. In addition, schools must get student and parent consent, notify parents of how personal information is used, and provide alternatives for parents who opt children out. [Source] [Guidance]

 

EU – Netherlands Citizen Service Number Gets Green Light

The Citizen Service Number, intended to facilitate interactions between the government and Dutch citizens, has been given the go-ahead by the Dutch Senate. The Citizen Service Number (CSN) – a unique identification number assigned to each individual resident in the Netherlands – will improve the delivery of government services, facilitate data sharing and help fight fraudulent access to public services, Dutch authorities say. The CSN has been in the pipeline since the government first approved plans for it in 2004. Despite a certain amount of privacy concerns earlier on, the Dutch government believes that the new number will simplify the identification of individuals in their dealings with public bodies, including for accessing eGovernment services. It also expects that the number will contribute to facilitate data sharing and combat fraudulent access to public services. [Source]

 

CA – Canadians Willingly Duped By Spam: Report

Spam may be in the eye of the beholder. While spam is on the rise, Canadians are choosing to click on spam out of curiosity, according to a study released by Ipsos-Reid. After a steady decline since 2003 in the amount of spam received by Canadians, that number is up again, according to “E-mail Marketing 2007: Spam or Marketing - Do Canadians Know the Difference?” From 2003 to 2005 spam levels remained flat, due to the efficiency of ISPs, anti-spam software, anti-spam legislation and more consumer awareness. “All of a sudden this year it increased 51%,” said Ipsos-Reid. “We double-checked and triple-checked - we were astounded by that. But somehow the spammers managed to get through.” However, 26% of Canadians click through spam messages - on average eight to 12 pieces per week. And that number has been consistently increasing for the past five years. [Source] [Ipsos-Reid report]

 

WW – Seeing Yellow Over Color Printer Tracking Devices

A series of encodings on printouts from color laser printers to discourage counterfeiting? At first, the idea sounds like the urban legend from a couple of decades ago that claimed you could hear Satanic messages when you play vinyl records backwards. Yet the evidence from the Electronic Frontier Foundation is that the encodings are embedded in color printers from all major manufacturers. Moreover, the issues raised by the practice have caused Free Software Foundation director Benjamin Mako Hill and other members of the Computing Culture group at the MIT Media Lab to begin the Seeing Yellow campaign to stop the practice. The campaign takes its name from the nature of the encoding, which takes the form of yellow dots printed across the entire page of a printout. The dots are invisible to the unaided eye, but can be seen by placing an intense blue LED light behind a printout in a darkened room. However, for the most part, the public can only guess what information is carried by the yellow dots. Most printer manufacturers do nothing to make consumers aware that their printouts can be tracked. [Source] [www.seeingyellow.com ]

 

WW – One-Fifth of the World Online by 2011

One-fifth (22%) of the world's population will be online by 2011 - with around 1.5 billion users expected to be surfing the web. The expected growth represents an increase of around 36% on the 1.1 billion internet users in 2006. The most significant areas of growth are expected to be the BRIC countries (Brazil, Russia, India and China), according to the JupiterResearch report, titled Worldwide Online Population Forecast, 2006 to 2011: Emerging Economies Catalyse Future Growth. [Source]

 

US – Public Interest Groups Respond to NBC on Mandatory ISP Filtering

A few weeks ago, NBC submitted comments to the FCC asking it to adopt new rules declaring that “broadband service providers have an obligation to use readily available means” to stop copyright infringement. Basically, NBC wants the FCC to force ISPs to police their users and play copyright cop. Now, a coalition of public interest groups — including EFF — has made a response (PDF), pointing out that a policy of this sort would be bad for free speech, bad for innovation, and would be wildly outside the FCC’s mandate.  [Source]

 

UK – Equifax: Web Networkers ‘at risk of fraud’

People who use internet networking sites are being warned that they could be at risk of identity theft. Credit information group Equifax said members of sites such as MySpace, Bebo and Facebook may be putting too many details about themselves online. It said fraudsters could use these details to steal someone’s identity and apply for credit and benefits. About 80,000 people in the UK were victims of identity theft last year, at a cost to the economy of £1.5bn. [Source]

 

CA – Ontario Government Must Reveal Legal Costs

Information and Privacy Commissioner Ann Cavoukian determined in February that the government must release public information on the cost of litigation involving the parents of autistic children. This week, a three-judge panel of the divisional court of the Ontario Superior Court of Justice ruled that the government must reveal the cost of the litigation. [Source]

 

US – Judges Respond to Site Outing Informants

In response to a Web site that outs criminal informants and undercover agents, some U.S. judges are withholding certain court documents from the Internet. Federal judges in eastern Pennsylvania and southern Florida are keeping plea and sentencing memos out of online case files because of concerns that the information is being posted on a Web site called WhosARat.com. [Source]

 

EU – New Rules Protect Irish Individuals’ Privacy Rights

The Irish Data Protection Commissioner, has created new rules prohibiting insurers from using private investigators to uncover confidential information about customers. The rules were developed as part of a new code of practice for insurers after an audit revealed that social welfare records had been leaked to insurance companies. The penalty for repeated violation of the rules could include prosecution. [Source]

 

US – Senators Introduce Stringent Health Records Privacy Bill

Sens. Patrick Leahy (D-Vt.) and Edward Kennedy (D-Mass.) introduced a bill last week designed to “place stringent restrictions on disclosures of personal health information” and clear up “confusion surrounding federal privacy rules.” The bill would not replace HIPAA, but would require the U.S. Department of Health and Human Services to “revise HIPAA rules.” According to Government Health IT, as part of the proposed Health Information Privacy and Security Act of 2007 disclosure of personal information without patient authorization would be prohibited in most cases and patients would be able to opt-out of electronic recordkeeping systems. The measure also would require that patients be notified if their information is released without authorization. [Source]

 

US – CDT Calls for Privacy Standards in Health IT Bill

CDT and the Health Privacy Project called for the inclusion of privacy protection standards in a Senate bill intended to spur development of electronic health records and other applications of information technology in the health care field. CDT and HPP support the goals of the Wired for Health Care Quality Act, but said in a letter to Sen. Edward Kennedy, chairman of the Senate Health Committee, that privacy should be an integral part of any health information technology project. The bill, S. 1693, was approved by the committee on June 27 and awaits action by the full Senate. July 25, 2007 [CDT-HPP letter, July 25, 2007] [S. 1693] [Bush Administration Opposes Healthcare IT Bill]

 

UK – New Hospital Tagging System Should End Patient Mixups

Five years after launching the world's biggest civil IT programme, the NHS in England has only just started telling hospitals that they should consider labelling patients with a technology that supermarkets have used for decades. The risk of medical mixup is real. Last year, the National Patient Safety Agency received nearly 25,000 reports of patients being "mismatched" with their care. In nearly 3,000 of these cases, mistakes happened because someone misread a patient's identity wristband. Earlier this month, the agency set a formal deadline for hospitals to issue patients with legible and consistent wristbands carrying printed identity information rather than the confusing mess of handwriting and different colour codes. But while legibility and consistency will be big steps forward, they are hardly the cutting edge of IT. The next stage proposed by the NHS is to attach a unique code to patients so they can be automatically matched to their case notes and prescriptions, with no possibility of human error. The necessary technology, called auto-identification and data capture (AIDC), is well-established in the business world - most familiar as the supermarket barcode, now supplemented with RFID tags that keep track of high-value items. [Source]

 

US – Data on 867,000 Military Personnel May Have Been Compromised

A government contractor handling sensitive health information for 867,000 U.S. service members and their families acknowledged yesterday that some of its employees sent unencrypted data -- such as medical appointments, treatments and diagnoses – across the Internet. Air Force investigators are probing the security breach at Science Applications International Corp. (SAIC) of San Diego, an $8 billion defense contractor that holds sensitive government contracts, including for information security. [Source][Source]

 

UK – Web Security Breach Exposes 54,000 Card Details

A security blunder at Newcastle City Council has exposed the credit and debit card details of up to 54,000 people online. The breach was discovered on 19 July after the council hired an independent security expert to try and crack its systems. The security exercise found an encrypted file containing names, addresses, and credit and debit card numbers had been mistakenly placed on an insecure server. An internal investigation also revealed the file with all the card details had been accessed and uploaded to a computer IP address registered in Israel. The file contained details of payments for council tax, business rates, parking fines and rents for more than a year between February 2006 and April 2007.  [Source]

 

US – North American Banks Move Towards Full MFA Deployment

The challenge of balancing security and positive client experience continues to plague efforts by North American banks to implement multifactor authentication solutions, according to a recent study. Only 50% of U.S. retail online banking, 40% of small business online banking and 60% of corporate online banking operations had MFA solutions deployed last year despite a 2005 deadline set by the U.S. Federal Financial Institutions Examination Council (FFIFEC). However, these figures are expected to approach 90–95% across the board by the end of 2007, according to a report by a research and advisory firm based in Boston. While not required to comply with the FFIFEC directive, the Canadian banking industry showed 44% MFA implementation in 2006. It is expected to boost that number to 67% by end of this year then to 100% by the end of 2008.  [Source]

 

AU – Mobiles to Become Tracking Devices in Australia

Australian Legal and civil liberty groups are warning that ASIO and law enforcement agencies in Australia will be able to track the movement of people through their mobile phones secretly, without obtaining a court warrant, under new laws. Warnings that such powers could be abused or misused are contained in submissions to a Senate committee inquiring into the proposed provisions of the Telecommunications (Interception and Access) Amendment Bill. [Source]

 

WW – MySpace Finds 29,000 Sex Offenders on Its Site

North Carolina officials said this week that MySpace.com has found more than 29,000 registered sex offenders with profiles on the popular social networking Web site, which is more than four times the number cited by the company two months ago. MySpace said it deleted the 29,000 convicted sex offenders from its service. North Carolina Attorney General Roy Cooper is pushing for legislation that would require children to receive parental permission before creating social networking profiles, and require the Web sites to enact procedures for verifying the parents’ identity and age. [Source]

 

WW – Ask.com to Allow Users to Control Data Retention

Ask.com announced last week that it will allow search users to control how and whether their searches are recorded, marking the first time a major search company has modified their data retention policy to make it user controllable. Ask plans to roll out Ask Eraser by the end of the year in the U.S. and U.K.. Search results pages will include language reminding users of their preferences. Ask will also uncouple search history from identifying user information after 18 months, which matches a change Google announced earlier this year about anonymizing IP addresses for older records. Ask made the decision after conferring with the Center for Democracy and Technology. [Source] [Source]

 

WW – Microsoft, Ask.Com Team Up on Privacy Protection

Microsoft and Ask.com said yesterday they are joining together to encourage the creation of a set of privacy principles for collecting data about people through online advertising and search programs. Microsoft said it has enhanced the privacy protection for users of its Windows Live service by making search query data anonymous after 18 months. It would do so by permanently removing “cookie” identifications, the IP address, and other identifiers from search terms. Yahoo also announced similar plans yesterday. The policies match the one that Google announced earlier this year. [Source] [Microsoft And Ask.com Propose Industry Summit To Create Privacy Standards] See also [Search Engines Race to Update Privacy Policies] and [Openads lets websites keep visits private]

 

WW – OECD Recommendation and Guidance on Electronic Authentication

On 12 June 2007, the OECD Council adopted a Recommendation encouraging efforts by Member countries to establish compatible, technology-neutral approaches for effective domestic and cross-border electronic authentication of persons and entities. This Recommendation reaffirms the important role of electronic authentication in fostering trust online and the continued development of the digital economy. [Source]

 

US – House Panel to Look at Google-DoubleClick Merger

In a letter to FTC Chairman Deborah Platt Majoras, U.S. Rep. Bobby Rush, D-Ill., said the proposed Google-DoubleClick merger is causing “widespread concern.” A U.S. House subcommittee plans to look at the deal, which already is under review at the FTC. Rush indicated in the letter that in addition to anti-trust concerns, the deal is causing concern about the “potentially enormous impact on consumer privacy.” Google said that the company is “confident that upon further review the FTC will conclude that this acquisition is good for both competition and privacy and should be approved.” [Source]

 

US – AOL Announces Plan to Acquire Online Ad Company

In an effort to boost advertising revenue, AOL plans to purchase Tacoda, a company that delivers targeted ads according to users’ browsing patterns. According to Tacoda, it does not keep personally identifiable information, such as email addresses, and users have the ability to turn off the targeting feature. [Source]

 

US – Researchers Blast TRUSTe on User Privacy

Consumer privacy firm TRUSTe is under fire from spyware researchers over its handling of a recent rogue download incident, and the fallout is leading those connected with the case to publicly question the firm’s credibility. The controversy stems from the way TRUSTe handled reports that web traffic analysis firm comScore was installing its tracking software. The software, known as RelevantKnowledge, is used to gather information on a user’s internet behaviour such as website traffic and purchasing patterns. It normally requires direct consent from the user before installation. Earlier this year, two researchers discovered that a comScore affiliate was using security exploits to install RelevantKnowledge without user consent. [Source] [TRUSTe suspends RelevantKnowledge from TDP]

 

TH – Critics Say Thai Cyber Law Invades Privacy

A new cyber-crime law has come into force in Thailand this week, which allows police to seize computers from homes and businesses. Authorities say the Computer-related Crimes Act will help crack down on Internet pornography. Media rights activists say the law will allow the government to invade people’s privacy. [Source] [Source]

 

US – Senate Votes Against REAL ID Funding

This week the U.S. Senate voted to kill an amendment to the Homeland Security Appropriations Bill that would have provided $300 million in funding for REAL ID. CDT applauded the Senate for this significant vote. In a letter sent to key Senators this week, CDT called on Congress to rectify the serious privacy and security holes in REAL ID before it even considers funding the measure. This week’s vote represents the first time the Senate has voted up or down on REAL ID specifically. When the Act was initially passed in 2005, it was attached to a must-pass war and hurricane relief bill; and last month the REAL ID requirement for employment verification was buried in the massive immigration bill.  [CDT REAL ID Letter, July 25, 2007]

 

US – CDT Analysis: NSL Bill Would Restore Critical Privacy Protections

The National Security Letters Reform Act – introduced in the House of Representatives by Reps. Jerrold Nadler and Jeff Flake – takes some vital first steps in restoring basic privacy protections to law-abiding Americans, while still providing the government with the tools it needs to pursue real threats, CDT said today. In 2001, the PATRIOT Act drastically expanded the FBI's authority to obtain the business and personal records of Americans by issuing National Security Letters (NSLs). The National Security Letters Reform Act would limit the reach of this powerful tool by, among other things, requiring that NSLs only be used to obtain records that pertain to suspected spies or terrorists.  [Press Release: Nadler-Flake Bill, July 26, 2007]

 

WW – Privacy Control Flawed In Many Security Suites

The privacy control components used in many market-leading security suites are ineffective and misleading, lulling users into a false sense of security, according to a new report issued by Kaspersky Lab. Nearly all modern security programs include privacy control, a component designed to protect confidential data stored on a PC from unsanctioned access and transmission to third parties. Kaspersky Lab advocates an alternative approach to privacy control, as a subsystem of the anti-spyware component and which is based on analysing application activity – an approach that can block both the harvesting of confidential data and the stealth transmission of data via a Trojan to the remote malicious user. [Source]

 

WW – Beta Test MySpace’s Kid-Tracking Software

MySpace is in a public beta test of software it calls ‘ParentCare’ designed to let parents keep an eye on their kids’ profiles. According to the FAQ, ParentCare squats on the family PC to ‘automatically track any access to myspace.com from all the user accounts on your computer. The parent may run a check on their teen’s activities by double clicking the ParentCareBeta system tray icon to view the events.’ [Source] [FAQ]

 

CA – Survey: Many Canadian Parents Lack Ability to Protect Kids Online

A new survey shows Canadian parents are lacking the know-how to keep a virtual eye on their kids when online. 92% of parents told Ipsos-Reid they’ve talked to their children about online dangers, but many don’t know where to look for resources to help keep them safe. 58% know where to download parental control software, but only 1/3 actually use such programs. 22% say they don’t know where to find materials to educate their children about Internet safety. 49% of parents know the online aliases their children use. Despite the enormous popularity of YouTube, particularly with young audiences, 26% of parents say they’re unfamiliar with the video-sharing site. 41% don’t know the social networking site Facebook, and 1/3 are unfamiliar with MySpace. Many parents remain oblivious to these online destinations because children hide their usage, says Parry Aftab, executive director of WiredSafety. According to the survey, parents’ top online concern is sexual predators, with 77% worrying about that threat. Seventy-four per cent fret about their offspring happening upon pornographic sites and 70% are concerned their children will be victimized by online scams. [Source]

 

EU – Ireland’s Data Commissioner Raids Offices of SMS Marketing Firms

The Data Protection Commissioner has carried out raids on the offices of a number of mobile-phone text marketing companies. The snap inspections were made in response to a large number of complaints made to the commissioner’s office by members of the public. It is illegal for a marketing company to contact anyone by SMS without their permission. Commissioner Billy Hawkes is now examining data seized in the recent raids with a view to bringing prosecutions against any firm that sent unsolicited text messages. He says he will come down hard on any company found to be breaking the law. [Source]

 

EU – Ireland Plans to Introduce Mandatory Cellphone Registration

The Irish Department of Communications had previously classed plans to introduce mandatory registration of all mobile phones as “not practical” in the fight against crime. However, a spokesperson for the Department said that it would be reviewing the situation and seeking advice from the Attorney General to work to resolve issues as far as practical. “The Government is looking at all options that can assist in the fight against illicit drugs,” she said. “If you’ve nothing to hide, you’ve nothing to fear. There may well be confidentiality or civil liberties issues but there are lives of people at stake as well, which I believe overrides any of those,” said the Irish Minister of State. The new plan aims to stop the current practice of buying pay-as-you-go mobile phones anonymously. Minister of State Carey said it would aid in stopping “rampant use” of mobile phones in prisons. [Source]

 

US – ACLU Slams FBI Plan to Pay Telecoms to Store Phone Records

The ACLU this week criticized a new FBI plan to access phone records of U.S. citizens. The ACLU said the plan was contained in “a budget request made by the FBI in the current version of the Department of Defense Authorization bill.” “The request would allow the FBI to pay private companies (largely thought to be telecommunications companies) to retain and grant the bureau access to their clients’ telephone and Internet transaction records for two years,” the human rights organization said. “The ACLU has serious Fourth Amendment concerns with the proposal,” it said. “Americans’ privacy rights cannot be sold to the highest bidder,” said Caroline Fredrickson, director of the ACLU Washington Legislative Office. “The bureau cannot order a private company to create this unprecedented database simply because it cannot legally do so itself.” [Source] SEE ALSO: [ACLU Calls for Independent Oversight of FBI]

 

US – GAO: DHS Privacy Office Has Made Progress but Faces Continuing Challenges

GAO was asked to testify on its recent report examining progress made by the DHS Privacy Office in carrying out its statutory responsibilities. GAO compared statutory requirements with Privacy Office processes, documents, and activities. The DHS Privacy Office has made progress in carrying out its statutory responsibilities under the Homeland Security Act and its related role in ensuring compliance with the Privacy Act of 1974 and E-Government Act of 2002, but more work remains to be accomplished. Limited progress has been made in ensuring compliance with the Privacy Act –updating public notices for systems of records that were in existence prior to the creation of DHS. These notices should identify, among other things, the type of data collected, the types of individuals about whom information is collected, and the intended uses of the data. Until the notices are brought up-to-date, the department cannot assure the public that the notices reflect current uses and protections of personal information. Further, the Privacy Office has generally not been timely in issuing public reports. For example, a report on the Multi-state Anti-Terrorism Information Exchange program--a pilot project for law enforcement sharing of public records data--was not issued until long after the program had been terminated. Late issuance of reports has a number of negative consequences, including a potential reduction in the reports’ value and erosion of the office’s credibility. [Source]

 

US – White House Privacy Adviser: We Don’t Need More Authority

Congress is already well on its way to bestowing new powers on an internal White House panel that’s supposed to judge whether Bush administration programs like the National Security Agency’s electronic surveillance regime pose privacy and civil liberties concerns. But the board’s chairman this week had one message for the politicians backing the new authority: thanks, but no thanks. [Source]

 

EU – European Commission Cuts Replacement Deal With US on Passenger Data

The European Commission and US security authorities have agreed a new deal on the handover of airline passenger information. Data will now be kept for 15 years, far longer than the three-and-a-half year limit in an earlier agreement. Data protection officials have expressed concern about the deal because the US does not have as strict data protection measures as the EU. The deal will last for seven years and actually reduces the amount of data transferred. It requires 19 pieces of data per passenger to be handed over as opposed to the 34 contained in the previous agreements. Other parts of the deal could worry privacy activists, though. The data can be kept for seven years in an active database. It can then be kept for a further eight years in what the agreement calls “dormant, non-operational status”. The data can also be used for non-terrorism related offences as long as they take place on an international scale. The PNR data includes some information classified as sensitive, such as information that reveals the racial or ethnic origin, political or religious views or health details of travellers. Though the deal says that the US authorities must filter and delete this material, it also says that it can be used in exceptional cases. The EU parliament, which has opposed the transfer of PNR data, said that it had “concern” over the fact that “these data may be used by the DHS in exceptional cases”. [Source] [US to Keep UK Personal Data for 17 Years] [The deal (18-pages)]

 

US – Department of Justice Proposes Update to Identity Theft Laws

The Department of Justice has submitted to Congress new proposed legislation that seeks to update and improve current laws aimed at protecting Americans from the increasingly sophisticated crime of identity theft. The proposed bill, titled the Identity Theft Enforcement and Restitution Act of 2007, was a recommendation included in the final strategic plan from the President’s Task Force on Identity Theft released in April 2007. The strategic plan was the result of an unprecedented federal effort to formulate a comprehensive and fully coordinated plan to attack identity theft at all levels in the public and private sectors. Among other provisions, the proposed legislation seeks to ensure that victims of identity theft can recover the value of the time lost attempting to repair damage inflicted by identity theft. Under current law, restitution to victims from convicted thieves is available only for the direct financial costs of identity theft offences. [Source]

 

US – Nearly Ten Percent of Companies Have Fired Bloggers, Survey Claims

Nearly ten percent of companies have fired an employee for violating corporate blogging or message board policies, and 19% have disciplined an employee for the same infractions, according to a new survey from Proofpoint, a messaging security company. Almost a third of companies ‘employ staff to read or otherwise analyze outbound email,’ while more than 15% have hired people whose primary function is to spy on outgoing corporate email.’ A quarter have fired an employee for violating corporate email policies. 20% of the companies and almost thirty percent of companies with more than 20,000 employees had been ordered by a court or a regulator to turn over employee emails. [Source] [Report]

 

US – New York Taxi Drivers Threaten to Strike Over GPS Proposal

Some taxi drivers are angry about a plan to install global positioning system devices in their yellow cabs and they are threatening to hang up their keys. The New York Taxi Workers Alliance has long opposed the plan - claiming it is an invasion of drivers’ privacy. ‘Why the TLC wants to know when and where and what time a taxi driver has taken their kids to the park, or gone out to a restaurant, or to the movies, is beyond our understanding,’ sad NY Taxi Workers Alliance Executive Director Bhairavi Desai. The Taxi and Limousine Commission wants to install the devices in all yellow and livery cabs. But the alliance is encouraging its 8,400 members to walk off the job on September 1st, rather than accept the GPS units - a decision, it believes, commuters will support. [Source]

 

--------