Data protection/privacy bloggers

For those interested in data protection/privacy, there are a few blogs that are worth following:

PIPEDA Blog - Written by a Canadian Lawyer, this contains information related to the Personal Information Protection and Electronic Documents Act (aka PIPEDA) and other Canadian and international laws.
Privacy Podcast - By Aaron Titus, with a US bias on keeping identity secure.
Marketing by Permission - By Tim Trent with a UK focus on data protection developments
SpyBlog - Need no further explanation.

Let me know if there are any new blogs that have a data protection/privacy focus.

Sensitive data

I have been doing a lot of writing lately, hence the lack of any blog posts recently. Anyway, the latest article that I recently wrote is on sensitive data which examines the current data protection framework and in particular, the Data Protection Directive 95/46/EC and its categorisation of sensitive data under Art. 8 as applied to the internet. The article can be found here. Any views on this subject are welcome.

League table of media's trade in personal information

The Information Commissioner is due to present a report today to Parliament naming some of the UK's newspapers and magazines that have bought people's personal information in search of a story. According to the latest press release,

The list was assembled following the Operation Motorman raid at premises in Hampshire which led to prosecutions of private investigators. In that operation, the Information Commissioner’s staff uncovered numerous invoices addressed to newspapers and magazines detailing prices for providing their journalists with pieces of personal information. Altogether, 305 journalists were identified as recipients of a wide range of information.

It reinforces the importance of protecting personal information and stronger penalties for those that trade in personal information. As for freedom of expression, the DPA 1998 does provide an exemption to the processing of personal information under s 32:

32. - (1) Personal data which are processed only for the special purposes are exempt from any provision to which this subsection relates if-

(a) the processing is undertaken with a view to the publication by any person of any journalistic, literary or artistic material,

(b) the data controller reasonably believes that, having regard in particular to the special importance of the public interest in freedom of expression, publication would be in the public interest, and

(c) the data controller reasonably believes that, in all the circumstances, compliance with that provision is incompatible with the special purposes.

There will be the public interest defence available, so claims about curtailing freedom of speech seems to be slightly far-fetched. The Information Commissioner also gave a recent interview on this. See

• BBC Radio 4 Today Programme: Interview with the Information Commissioner 14 December 2007

Why spam is still a problem

The European Commission has published a report into the growth of spam showing that it accounts for between 50 and 80 per cent of all e-mails, at a worldwide cost of €39 billion (£26 billion). According to its latest press release:

The new Communication on Spam acknowledges that legislative tools to fight these threats already exist, in particular the EU-wide “ban on spam” adopted in 2002 as part of the ePrivacy Directive (see IP/03/1015). However, implementation is still a problem in most EU Member States. To improve, they should now lay down clear lines of responsibility to use the tools available under EU law effectively. Because of the criminal trend in spam and its cross border aspects, good cooperation between enforcement authorities is paramount. In the Commission's view, spam fighters should have sufficient resources. The Dutch fall in spam was achieved through prosecutions by spam fighter OPTA, with just 5 full-time employees and €570,000 invested in equipment. Although we have the Directive on Privacy and Electronic Communications 2002/58/EC, more still needs to be done to tackle this problem.

See also:

• European Commission Communication on Fighting spam, spyware and malicious software. COM(2006) 688 final (pdf)

Surveillance Society

Whilst there has been much debate about living in a surveillance society (particularly as highlighted in the 28th International Conference on Data Potection Commissioners), and the strategies that could be adopted in regulating such surveillance, one of the interesting aspects that arose from the report (pdf) commissioned by the Information Commissioner is the idea of a privacy impact assessment test (PIA) and even a surveillance impact assessment test. There is quite a lot to digest from this report, but here is an excerpt on the PIA:

‘an assessment of any actual or potential effects that an activity or proposal may have on individual privacy and the ways in which any adverse effects may be mitigated’;
• ‘a process. The fact of going through this process and examining the options will bring forth a host of alternatives which may not otherwise have been considered’;
• an approach and a philosophy that holds promise by instilling a more effective culture of understanding and practice within organisations that process personal data;
• a form of risk-assessment, which therefore cannot escape the uncertainties of identifying and estimating the severity and likelihood of the various risks that may appear, to privacy, life-chances, discrimination equality and so on;
• a tool for opening up the proposed technologies or applications to in-depth scrutiny, debate and precautionary action within the organisation(s) involved;
• like PETs, premised on the view that it is better to build safeguards in than to bolt them on;
• an early-warning technique for decision-makers and operators of systems that process personal information, enabling them to understand and resolve conflicts between their aims and practices, and the required protection of privacy above or the control of surveillance;
• ideally, a public document, leading to gains in transparency and in the elevation of public awareness of surveillance issues and dangers may be realised; in turn, it may assist regulatory bodies in carrying out their work effectively.

A further point that should be added and noted in the report is that a PIA is not a compliance audit.

PIA should not be confused with compliance audits and the like, which are usually ex post facto and legally-oriented; as with environmental impact assessment, PIA assesses the likely impact of technology applications or new systems in the future, and considers a wider range of criteria.

For further reading, see pages 89 onwards in the report. Some countries such as Canada and Australia already have PIAs, but it remains to be seen whether PIAs will be adopted in the UK. See also:

• Australian Privacy Commissioner: Privacy Assessment Guide
• Canada: Office of the Privacy Commissioner: Privacy Impact Assessments

Podcasts

Some of the podcasts that I find useful when keeping myself updated on freedom of information/data protection developments include:

1. FOI Podcast service - a monthly series by Ibrahim Hasan, solicitor and information law expert on the latest developments on freedom of information law.
2. Out-law radio - updated every Thursday, free 10 minute podcast produced by Out-Law.
3. Privacy podcast - produced by Aaron Titus and more directed towards the protection of an individual's identity.

Data protection law for India?

I was reading through an article this morning about India's Information Technology Act 2000 which is likely to be amended to take account of data protection concerns. What is unclear at this stage is what these amendments will consist of and when they are likely to take effect. However, addressing data protection concerns in India have long been overdue, particularly with the recent Channel 4 documentary highlighting the security failures in a number of commercial call centres which allow detailed financial data on individuals to be gathered and sold on with ease.

Art. 25 of the Data Protection Directive 95/46/EC clearly provides that personal data is not transferred to countries outside the EEA without satisfying an adequate level of protection.

Art. 25

1. The Member States shall provide that the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of this Directive, the third country in question ensures an adequate level of protection.

2. The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the third country in question and the professional rules and security measures which are complied with in that country.

These provisions have been implemented in the UK Data Protection Act, Schedule 1, 8th data protection principle:

8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

It remains to be seen whether India's laws will be sufficiently vigorous to deal with data protection breaches, but at least, it is a move towards the right direction.

How much is your personal information?

I was reading through an article where the leader of leader of Bracknell Forest BC has suggested that people who allow their data to be sold to marketing firms could receive council tax cuts. There is more to this:

Paul Bettison told a Conservative party conference fringe meeting that the information from the council's smartcard system could be sold if controls on government databases were loosened."If I could use the information on the 45,000 residents who carry cards, I believe I could be the first council in the country to have a zero council tax," Bettison, e-champion of the Local Government Association (LGA), told the Conservative Technology Forum on 2 October 2006.Such use of the data gathered through the E+ cards, previously known as Edge smartcards, would be voluntary for residents – but for those who did not wish to take part, "it will be £1,400 for a band D," Bettison said.He added that the data held by the council, such as library books borrowed, indications of income and family, could allow companies to target direct mail with enough accuracy to stop it being annoying, as it would present people with offers that were of genuine interest. "Targeted junk mail isn't junk mail," he said. "It's welcome if it's relevant to me.

According to the same article, the Council has indicated that it has no plans to follow up on the idea, but it raises broader questions not only on the privacy of individuals to control their personal information, but also their right to use their information for a commercial incentive. Certainly, supermarkets have already started this line where you sign up for their store cards and build up points on the card in exchange for discounts such as money off coupons etc... I should add one does not have any objection with anyone signing up for a store card. However, if we ponder about the profiles that are being formed about consumers' shopping habits, then this information is certainly valuable to any marketer.

Information Commissioner's website

The UK Information Commissioner's website has recently been revamped. There is information about dealing with nuisance calls and spam and environmental information. What is unclear is why put emphasis on environmental information? Anyway, the website also contains details about the upcoming Data Protection Commissioners' conference, which will be held on 2-3rd November 2006 and there will be an open session on the theme "a surveillance society." Finally, on the topic of surveillance, the European Commission has issued a consultation paper (pdf) on the use of surveillance technology in civil society.

Russian Data Protection Law

Not being an expert in Russian law, but this brief article (pdf) did catch my attention. Two new laws, About Personal Data 2006 and (160-03) and About Information, Information Technologies and Protection of Information 2006 (No. 149-03) were signed by the President Vladimir Putin on July 27, 2006. This would mean that the law on personal data will take effect in February 2007, bringing Russia into line with the other European countries that have enacted data protection laws.

The laws are meant to give effect to the European Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, ratified by Russia last year....

About Personal Data (The Personal Data Act) regulates the processing of personal data by Russia’s federal and regional governments, municipal authorities, legal entities and natural persons. It applies to both automatically and manually processed data. The aim is to protect an individual’s rights and freedoms, in particular the right to privacy, and private and family secrets...

The data protection laws are certainly beginning to make its headway. May it long continue...

28th International Data Protection and Privacy Commissioner's Conference

The 28th International Data Protection and Privacy Commissioners' Conference will be held in London on the 2 and 3 November 2006 and hosted by the Information Commissioner. One of the main themes of discussion will be surveillance. The ICO has commissioned a report into the the theme "Are we sleep walking into a surveillance society? The threats to individuals and the challenges for data protection authorities."

One of the challenges facing us today is the amount of personal information that can be collected, be it on the internet, supermarket or at our place of work. The Data Protection Act 1998, which implements the Data Protection Directive 95/46EC goes some way to regulate the collection of personal data. With the subject of ID cards raising its head again and the possibility of a national ID card database, the question is not so much about whether we are sleep walking into a surveillance society, but the implications (socially or politically) about the personal information that are collected of an individual/group of individuals? There is much scope for debate, but for an interesting read, see David Brin's work The Transparent Society.

UK Spam laws

I came across an article about strengthening the UK anti-spam laws introduced back in 2003. The Privacy and Electronic Communications Regulations was introduced to implement the Directive on Privacy and Electronic Communications 2002/58/EC. Yet, three years on, the law has been criticised for its weakness in not stopping spam being sent to businesses. From a legal standpoint, this is interesting given that the regulations were originally intended to prevent spam being sent to individuals. In its latest annual report (pdf), the UK Information Commissioner's Office took the view that the powers confered under the Privacy and Electronic Communications Regulations were insufficient to deal with the problem of spam. This is particularly the case when spam originates from countries outside the EU. Certainly, more can be done, but one will wait and see whether the government consider revising its laws.

ICO E-Newsletter

The UK Information Commissioner has published its first e-newsletter (April 2006). Certainly, a good idea and raises more awareness of data protection issues. Also includes a link to the report arising from the one-day conference "Data protection: the next 21 years".

Interesting Reading

I came across a recent article that described the current state of developments on data protection in Singapore. The article is entitled European Union Data Protection Directive: Adequacy of Data Protection in Singapore. My initial thoughts when reading this was that Singapore did not have any data protection laws as yet and even though there has been some discussion about whether to introduce such laws, to date, this has not yet materialised. In any case, the article is well worth reading and in some respects, I do agree that with the suggestions for introducing a framework to meet the requirements of the European Data Protection Directive. As a taster, here is the abstract:

The European Union Data Protection Directive requires member states to place restrictions on transfers of personal data to countries that cannot guarantee an adequate level of data protection. Countries that do guarantee adequate protection enjoy a smooth business environment and an enhanced ability to participate in trade. In this paper I examine the adequacy of Singapore’s data protection regime, and in particular the Model Data Protection Code. I suggest various amendments to the regime to enable Singapore to meet the Directive requirements. To carry out the assessment,I use a framework developed by the Article 29Working Party, the body that in practice carries outthe official adequacy assessments for the EU.

US privacy laws

Well, I have been taking a break from this, having been putting my head down with writing. Anyway, returning to my usual blog, I came across a recent press release that caught my attention. According to the this press release, some of the major tech companies including Google and Microsoft are calling for stronger privacy laws in the US.

The time has come for a serious process to consider comprehensive harmonized federal privacy legislation to create a simplified, uniform but flexible legal framework," said the CPL Forum's statement. "The legislation should provide protection for consumers from inappropriate collection and misuse of their personal information and also enable legitimate businesses to use information to promote economic and social value.

Whilst such efforts for stronger privacy laws in the US should be commendable, it is unclear whether the laws will in anyway be modelled on the European model on data protection. One can only await to see whether their calls are brought to fruition!

Data Protection Award

This is the first time I have heard, but there is a European award for best practice in data protection. According to the press release, the UK Information Commissioner is encouraging the public sector organisations to put in an application which must be received by 5 October 2006. The criteria is as follows:

procedures in place for ensuring quality of the personal data processed

design of an efficient system for furnishing mandatory information to citizens

respectful and efficient procedures to manage consent

existence of specific rules or procedures for processing sensitive data

security measures in place

procedures for the communication or disclosure of data to third parties

arrangements in place for access to the data by third parties

the planning and design of procedures which enable people to access and challenge content, and seek any correction or deletion

More information can be obtained from the Information Commissioner. Well, it is another way of raising awareness of data protection laws and promoting good practice! Why not!

ECJ judgment available

Following the ruling by the European Court of Justice (ECJ) on the joined Cases C-317/04 and C-318/04 European Parliament v Council and Commission on 30 May 2006 concerning the EU-US agreement that required airlines to transfer the personal data of their passengers to the US authorities, the judgment is now available.

The ECJ held that the Council Decision 2004/496/EC of 17 May 2004 on the conclusion of an Agreement between the European Community and the USA on the processing and transfer of Passenger Name Record ("PNR") data by Air Carriers to the US Department of Homeland Security, Bureau of Customs and Border Protection (see the Department's fact sheet on the agreement), and Commission Decision 2004/535/EC of 14 May 2004 on the adequate protection of personal data contained in the PNR of air passengers transferred to the United States Bureau of Customs and Border Protection, should be annulled.

Well, time to read up on the judgment!

Interesting article

I came across an interesting article that was published in the latest issue of the Computer Law and Security Report. The title of the article was on the Directive 95/46/EC: Ten years after. Yes, it is correct. It has been 10 years since the Data Protection Directive 95/46/EC was passed. A quick glance at the abstract will show this:

A birthday offers a unique opportunity to remember what has already been achieved along the way and to envisage what comes net, taking into account the lessons of the past. This paper offers some reflections on 10 years of experience with the Data Protection Directive. The following comments are offered in the knowledge that they will cover the whole picture and may well be considered partial.

For anyone who has studied data protection, undoubtedly, 10 years is a remarkable achievement for the Data Protection Directive 95/46/EC (hereafter "DPD") with all the member states of the European Union having implemented the DPD within their national laws. However, and there comes the "But", there are still areas that the DPD does not adequately address. Indeed, the article picks up on some of the points.

1) Is the Directive effectively applied? According to the Privacy Eurobarometers survey in 2003, the results indicate that if 'privacy is a concern, the legal guarantees and requirements are broadly being ignored and are not, therefore, very effective.

2) The role of the data protection authorities - Again, the Eurobarometers survey show that the lack of impact that data protection authorities have had. One should note that the survey was back in 2003, so it is not clear whether this situation has improved. In my view, however, I do not entirely agree with this. If one considers the work of the UK Information Commissioner (IC), the office has been quite proactive in raising the attention of businesses to comply with the Data Protection Act 1998. Furthermore, the IC has recently called for stricter penalties for those who obtain personal data without permission of the data subject.

3) Increasing role of the Art. 29 Working Party - The Art. 29 Working Party was established under the Data Protection Directive and is responsible for giving advice and recommendations to European institutions on privacy issues. It has produced a number of opinions including the application of data protection to RFID; internet issues and so on.

I could go on, but 10 years is an achievement, but also a cause for reflection. This is particularly the case, when looks at the recent judgment by the European Court of Justice in Lindqvist. Certainly, there have been tensions between the protection of privacy and the freedom of expression and one would even say that it is felt more in Sweden. There is still more work that needs to be done to raise the awareness of data protection issues.

Finally, one should not underestimate the impact of the DPD. Already some countries (outside the EEA) have introduced laws that are similar to the DPD. Examples include Hungary and Switzerland. On the Asian side, Hong Kong already has data protection laws; Japan has introduced privacy laws and one awaits to see whether Singapore will do the same.

Transfer of Passenger Data

The European Court of Justice has blocked the EU-US agreement to transfer airline passenger data to the US authorities. The main reason (I have yet to read the legal judgment) is that the decision was not founded on an "appropriate legal basis." You can read more at the BBC press release. The legal action was brought by the Council and the European Commission and was based on the Data Protection Directive 95/46/EC. I have still yet to explore the implications of this decision. I don't think we will have heard the last of this. Here is a quote from the same press release.

As the executive officer of the British Air Transport Association Bob Preston told the BBC European airlines could potentially be left in a "difficult position, between a rock and a hard place". "If we don't supply the information to the United States authorities then we're liable to fines of up to $6,000 per passenger and the loss of landing rights," he said. "And if we do supply the data, potentially we're breaking the law [on data protection].

Semantic Web and Privacy

There was an article about the semantic web and why this may be a problem with privacy. According to one academic:

Privacy problems could occur, he said, because the semantic web deliberately combines multiple sources of information about people and places.

However, even if semantic web should create a problem for privacy, I think it would be naive to think that privacy even exists on the internet. For example, if someone had created a web page and included their personal information, then he/she had waived some of their rights to their privacy by making some of their personal details available to the public. Probably, a more pertinent example is companies/individuals collecting information about other users online. A recommended book to read is Solove's book on The Digital Person!