AUSTRALIA
By Mandy Tang
Privacy Chief Seeks Changes to Credit Provisions of the Privacy Act
The Australian Privacy Commissioner has recommended that the existing credit reporting provisions in the Privacy Act (notably Part IIIA) and the Code of Conduct should be repealed and replaced by the National Privacy Principles (NPPs) operating in tandem with an enforceable code. The recommendations were included in her submission to the Australian Law Reform Commission's (ALRC) Review of Privacy (Issues Paper 32).
Although the Privacy Commissioner considered that the credit reporting provisions had worked well to provide privacy protection for individuals in relation to their credit information files, she also considered that the current framework is complex and makes it difficult for credit providers, credit reporting agencies and individuals to understand what their obligations and rights are.
Furthermore, various defined terms were ambiguous because the obligations expected of credit reporting agencies and credit providers sometimes differed or overlapped. Therefore, the privacy office recommended that the obligations should be more clearly set out in a structured way, with any inconsistent or overlapping defined terms resolved, through the repeal of Part IIIA and associated provisions of the Privacy Act. The recommended approach to regulating credit reporting would be under the NPPs and a binding code. It is believed that this approach will provide a regulatory regime consistent with the principle-based approach of the Privacy Act while at the same time imposing specific and enforceable obligations on credit providers and credit reporting agencies, in relation to their credit reporting activities.
Mandy Tang is a Trainee Solicitor with Baker & McKenzie. She may be reached at
mandy.tang@bakernet.com.
CANADA
By Terry McQuay, CIPP, CIPP/C
Federal Privacy Commissioner Issues 2006 Annual PIPEDA Report to Parliament
Federal Privacy Commissioner Jennifer Stoddart has issued her annual report to Parliament on the Personal Information Protection and Electronic Documents Act (PIPEDA).
The report notes that:
• The Office of the Privacy Commissioner (OPC) has adopted a policy of taking to the federal court all cases where a company fails to detail, within the prescribed time frame, how it will implement the recommendations contained in a preliminary letter of finding; and
• Consumers are seeking protection through PIPEDA complaints as a means to hold organizations accountable, due to the increasing concerns about identity theft and fraud. A copy of the report may be found at www.privcom.gc.ca/information/ar/200607/2006_pipeda_e.asp.
OPC Issues Findings of 2007 Privacy Poll
The OPC commissioned a study on a number of issues relating to privacy and the implementation of PIPEDA by private-sector organizations. The commissioner believes that this study of Canadian businesses shows that organizations need to take privacy more seriously. The poll found that:
• Almost half of the businesses report low or moderate awareness of their responsibilities under privacy laws; and
• Only a third of businesses have provided privacy training for staff. More detail about the poll's findings is available at www.privcom.gc.ca/information/survey/2007/ekos_2007_01_e.asp.
Terry McQuay, CIPP, CIPP/C, is the Founder of Nymity, which offers Web-based privacy support to help
organizations control their privacy risks. Learn more at www.nymity.com.
EU
By John Kropf
EU Developments on Sharing of Law Enforcement Information
Since last year, the EU has been intensively developing a framework by developing an authority that governs the use of personal information in the law enforcement and home affairs area — what the EU calls its third pillar.
First pillar issues are generally economic European Community issues; second pillar are Foreign and Security Policies; and third pillar are Justice and Home Affairs.
On May 7 — 9, a joint delegation of the Departments of Homeland Security and Justice met with European Union counterparts to learn first hand about recent developments with the draft framework.
During the visit, the Chief Privacy Officer for DHS, Hugo Teufel, CIPP/G, was invited to hearings before the European Parliament's Committee on Civil Liberties, Justice and Home Affairs (LIBE) to listen to the debate on the draft framework. Teufel heard comments from Sophie int' Veld, a member of the European Parliament, on the need to create better procedures to safeguard personal information. The feedback included the suggestion that the EU follow the U.S. practice of privacy impact assessments, something mandated by U.S. law on U.S. agencies' processing of personal information.
While it is too soon to know what the framework will look like, the biggest question for the U.S. is whether the sharing of this information will be interrupted based on the procedural requirement of adequacy — that is whether the U.S., or any third country is deemed adequate in the level of its data protection commitments.
John Kropf is the Director of International Privacy Policy at the U.S. Department of Homeland Security's Privacy Office. The views expressed here are his and not those of the Department of Homeland Security or the U.S. Government. He may be reached at
john.kropf@dhs.gov.
FRANCE
By Pascale Gelly
A New President for France Shares His Views on the Protection of Personal Data
On May 6, 2007, voters in France elected Nicolas Sarkozy as the new President of the French Republic. In the area of privacy, his actions as former Ministry of Interior raised eyebrows for the creation of a database of illegal immigrants and their contacts.
Nevertheless, in a letter to Alex Türk, the President of the Commission nationale de l'informatique et des libertés (CNIL), he recognized the importance of the CNIL for the preservation of public liberties. He added that he wished "to strengthen the means of the CNIL so that it can carry out its missions efficiently, which is not the case today," including a higher budget. He also wants to change the way CNIL commissioners are appointed to include a hearing before the Parliament. Interviewed on commentcamarche.com, he also announced a public debate on a bill relating to the protection of identity which will deal with the e-ID card.
www.Signal-Spam.fr: A New Weapon Against Spam
Both private and public sector organizations are partnering to create a non-profit organization aimed at fighting the spam plague.
Partners include the CNIL, direct marketing organizations, ISP organizations, Microsoft, the chamber of commerce and the Ministries of Justice and Finance. The system is simple: Registered Internet users download a plug-in "Signal Spam," which will be integrated into their boxes.
By a mere click they can forward spam to the association which will analyze them with specific tools. ISPs will be informed if the email of one of their subscribers is used. Signal Spam expects to handle one million spam a day. The site also is available in English.
A New Decree on Encryption
A new Decree (May 2, 2007) closes the reform of laws on encryption tools that began in 1996. This Decree specifies the formalities to carry out before the supply, transfer, import or export of means and services of encryption in France. It distinguishes between two procedures: notification and authorization. Non-compliance triggers criminal sanctions.
Draft Decree on Data Retention
A decree for the implementation of the law on trust in the digital economy is in the drafting stages. The current version provides that telecomm operators, ISPs, hosts and suppliers of online services must keep for one year data enabling them to identify the origin of the creation of content.
Relevant data elements are listed in the decree such as: connection identifier and other identifiers allocated by the system, type, time and date of the operation, IP protocol or network used, pseudonyms used and also, if available, user name and contact details, passwords and some information relating to payment. The decree is expected to be published during the second semester of this year.
Whistleblowing, a Live Example
Euro Disney recently presented its 20-page code of conduct to its works council.
The works council rejected the text, criticizing the organization of a "denunciation system." The code "invites" employees to report violations to the legal department and specifies that "it is preferable and even desirable, including on accounting matters, that the reporting person identifies herself/himself." Under French labour law, a negative opinion of the Works council doesn't prevent a company to go ahead with a project.
Therefore, the management announced that the code of conduct will now be submitted to the CNIL and the Labor Inspectorate, as required by French law, and if no reserves are made, it will be launched next summer.
Pascale Gelly is Avocat à la Cour within SCM Lambot Gelly Soyer. She may be reached at
pg@pascalegelly.com
SPAIN
By Norman Heckh and Susana RodrÃguez
"Big Brother" fined by the Spanish Supreme Court for Data Protection infringement
The Spanish Supreme Court adopted a decision that confirms the fine of ?1,081,822 imposed in January 2001 by the Spanish Data Protection Agency (SDPA) on Zeppelin Televisión S.A. (Zeppelin), the Spanish producer of the television programme "Gran Hermano," the Spanish version of the popular reality television show "Big Brother."
In 2001, the SDPA placed a complaint against Zeppelin after finding that Internet hackers managed to access personal data about 7,000 potential contestants on the Big Brother show. In some cases the information accessed included data on the contestants' religious beliefs, data on the contestants' health, data on the contestants' racial origin and data on the contestants' sex lives, which are considered sensitive data under the Spanish Data Protection Act (SDP ACT) and consequently require extra safeguards.
While Zeppelin tried to claim that it was the innocent victim of illegal hacking activity, the incident brought to light various data protection infringements that led to a ?1,081,822 fine against Zeppelin, which is the highest fine imposed by the SDP ACT in a single administrative proceeding.
In its decision of May 2007, the Spanish Supreme Court ratified a ruling of the Spanish National High Court of January 2003, which ruled the appropriateness of the fine imposed to Zeppelin in 2001 by the SDPA.
The Supreme Court ruled that the collection of personal information on Big Brother's potential contestants was undertaken without complying with the data protection principles set out in the SDP ACT. Zepplin also failed to provide notice information to the data subjects and failed to collect unambiguous consent for the processing of sensitive data.
The television production company claimed that it was not responsible for compliance with the SDPA as the data was collected by a third party service provider. However the contract between Zeppelin and the service provider did not include any data protection provisions that needed to be observed by the parties. Therefore, Zeppelin, as a data controller, was responsible solely for obtaining consent and providing notice information at the time the personal information was collected. These duties were never imposed on the service provider through the contract.
Article 11 of the SDP ACT also provides that data subjects' consent also is required for the disclosure of their personal data. The supreme court found Zeppelin also violated this provision as it disclosed data on the contestants to a psychologists' cabinet without obtaining any prior consent.
The Spanish Supreme Court also brought to light the lack of observance of both Article 9 of the Spanish Data Protection Act and Decree 994/1999, which deal with data security, as Zeppelin did not correctly implement measures set out by these instruments to prevent the loss or unlawful access to the potential contestants' personal data.
Norman Heckh is an Associate at Baker & McKenzie. He may be reached at
Norman.heckh@bakernet.com.
Susana RodrÃguez is a Trainee Solicitor at Baker & McKenzie. She may be reached at
Susana.rodriguez@bakernet.com.
UK
By Eduardo Ustaran
Regulator Seeks Additional Privacy Safeguards
The UK Information Com-missioner, Richard Thomas, is seeking additional privacy safeguards, including new inspection powers for the Information Commissioner's Office (ICO) and privacy impact assessments, after expressing concern about the dangers of excessive surveillance of the public.
According to Thomas' evidence to a House of Commons Home Affairs Select Committee inquiry, "improvements to the Commissioner's powers to undertake proactive audits and the introduction of a penalty for flagrant breaches of the Data Protection Act would send a strong signal."
The support of privacy impact assessments as a tool for compliance is a logical step in the ICO's strategy to raise the stakes for data privacy, while the call for inspection powers shows that the UK regulator is determined to strike the right balance between the need for data and the right to privacy. Both public sector and private sector organisations should expect greater scrutiny.
Eduardo Ustaran is a Partner at Field Fisher Waterhouse LLP, based in London. He may be reached at
Eduardo.ustaran@ffw.com.
By Paul McGrath
Transitional Relief Period Set to Expire
Midnight on 23 October 2007 will mark the expiry of the final transitional relief period in respect of the UK Data Protection Act 1998.
Though the act came into force in March 2000, it included a number of ‘transitional relief' arrangements designed to allow data controllers sufficient time to bring their records and personal information handling practices fully into line with the law and ensure a smooth transition from the previous regime under the Data Protection Act 1984.
All the other transitional relief periods have already expired and the remaining arrangement relates to certain manual (i.e. non-digitised) records created before 24 October 1998, including those held in structured manual filing systems. A data controller who processes such data is not bound currently by the majority of the requirements of the first five principles of the law or the general right of a data subject to go to court to correct inaccurate personal information. However from 24 October this year the 1998 Act will apply in full to all the personal information that it covers and individuals will have full rights to go to court to rectify any inaccurate information held about them.
As such, data controllers will now need to ensure that the way personal information is processed is compliant with all the provisions of the law.
Paul McGrath is a Trainee Solicitor with Baker & McKenzie. He may be reached at
paul.mcgrath@bakernet.com.
By Stewart Room
Mobile Phone Operator Admits Security Breach
On 21 June, the UK's Information Com-missioner, Richard Thomas, who is responsible for ensuring compliance with the Data Protection Act of 1998, issued a news release about unlawful data processing by the mobile phone operator Orange Personal Communications Services Ltd.
The complaint against Orange was that new employees shared user names and passwords in order to access and use Orange's computer systems. In the information commissioner's opinion this amounted to a breach of the seventh data protection principle in the Data Protection Act, which requires data controllers to implement and maintain appropriate technical and organisational security measures.
In order to avoid the commencement of formal enforcement action under section 40 of the act, Orange has admitted the breach and has signed formal undertakings in which it promises to properly comply with the seventh data protection principle. If Orange repeats the breach, the signed undertakings will be evidence that can be used against the company.
Retailer Also Admits Processing Failures
In the same news release, the information commissioner reports that the well-known UK retailer, Littlewoods, also has admitted to being in breach of the Data Protection Act, this time for failing to comply with the rules about data processing for direct marketing purposes.
The case against Littlewoods was that it failed to comply with a customer's request for the cessation of processing for direct marketing purposes. Such a failure breaches section 11 of the Data Protection Act and rules about electronic direct marketing contained in the Privacy and Electronic Communications (EC Directive) Regulations 2003. As with the Orange case, Littlewoods has signed formal undertakings promising to comply with the direct marketing rules.
Stewart Room is a Partner in the Privacy and Information Law Group at Field Fisher Waterhouse. He may be reached at
stewart.room@ffw.com.
Comments
If you want to comment on this post, you need to login.