AUSTRALIA
By Kevin Shaw
Second Technical Seminar Held on International Implementation of the APEC Privacy Framework
The second technical seminar was held in Cairns, Australia on June 25-26. Approximately 11 economies were represented by some 100 delegates who attended.
The event was designed to continue the work of the January seminar and meetings in Canberra, and to build confidence in an accountable system for personal information moving among economies.
One of the seminar's main goals was to advance the Data Privacy Subgroup work agenda for 2007, namely to develop options for Pathfinder projects to be pursued in 2008 that would begin to put in place arrangements for safer movement of personal information among Asia Pacific Economic Cooperation (APEC) Economies. In particular, the aim was to begin scoping and developing cooperative cross-border arrangements for implementing a Cross-Border Privacy Rules (CBPR) system.
This effort will be continued, as Peru as APEC host economy in 2008 has lodged a bid for funding for seminars on the use of Trustmarks, regulator enforcement issues and capacity building to be held in February and September 2008.
More information is available at www.apec.org.
Kevin Shaw is Associate Director — Security Privacy Continuity at KPMG. He may be reached at
kshaw@kpmg.com.au
.
BELGIUM
By Jan Dhont
Have You Already Registered Your Camera Surveillance Practices In Belgium?
Since June 11, 2007, the installation of surveillance cameras in Belgium is subject to the new Belgian Camera Act of March 21, 2007. It introduces the following measures/ requirements:
- Covert camera surveillance is prohibited.
- Images only may be viewed and stored to collect evidence of criminal or harmful events and to identify relevant offender(s), witness(es), or victims.
- It is required to announce camera surveillance to individuals by means of an official pictogram.
- Individuals should be provided with an opportunity to access their images.
- Measures should be taken to effectively protect the images against access by others. Images must be kept confidential.
- Images may not harm individuals' intimacy, nor may they contain sensitive data.
- Camera surveillance measures must be registered with the Data Protection Authority (DPA). In some cases, additional advice is required by the city council and the chief of the relevant police zone.
- Images must, as a general rule, not be stored for longer than one month.
The Camera Act does not apply to workfloor surveillance, which is regulated by specific legislation containing strict surveillance restrictions and procedural requirements, including works council consultation requirements.
Jan Dhont is a Partner at Lorenz, based in Brussels. He may be reached at
j.dhont@lorenz-law.com
.
CANADA
By Terry McQuay, CIPP, CIPP/C
Canadian Do-Not-Call List Update
On July 3, 2007, the Canadian Radio-television and Telecommunications Commission (CRTC) issued its long-awaited rules for the creation and operation of a National Do-Not-Call List (National DNCL) and rules governing telemarketing generally.
Telemarketers will be required to become registered subscribers to the National DNCL and pay fees to the National DNCL operator. These rules will take effect once the operator for the National DNCL has been chosen, and the list is fully operational. Currently, it is expected that the list will become operational in mid-2008.
Under the National DNCL rules, telemarketers are prohibited from calling consumers registered on the list. Exemptions include unsolicited calls made by or on behalf of:
- Registered charities;
- Political parties;
- Nomination contestants, leadership contestants or candidates of a political party;
- Opinion polling firms;
- General-circulation newspapers;
- Organizations that have an existing business relationship with a consumer; and
- Organizations to business consumers (B2B).
The telemarketing rules require telemarketers to:
- Maintain an internal do-not-call list;
- Provide the party being called information regarding:
- The identity of the caller and calling organization;
- Upon request, the contact information of the organization where the customer may make a do-not-call request or other inquires.
- Restrict calls to the following time periods:
- 9 a.m. to 9:30 p.m., Monday - Friday;
- 10 a.m. to 6 p.m., Saturday and Sunday;
- Achieve an abandonment rate of 5 percent;
- Prohibit the use of sequential dialing;
- Includes exemptions relating to
- Voicemail broadcasts;
- Account collections;
- Surveys; and
- Market research.
Terry McQuay, CIPP, CIPP/C, is the Founder of Nymity, which offers Web-based privacy support to help organizations control their privacy risks. Learn more at www.nymity.com.
EU
Cross-National Enforcement Actions Are Reality in Europe
The European Article 29 Working Party published its findings on the coordinated audit of the health insurance sector by the European national DPAs.
For the first time in history, the European DPAs bundled their forces to conduct a data protection audit of one specific business sector cross-nationally. Although compliance insufficiencies will be further followed up by national DPAs, the audit served also as a test case to refine the audit methodology for future actions. The report contains the following interesting highlights:
- Information security measures, data retention and data economy will gain attention in future audits;
- The Working Party announced potential collaboration with other international authorities or organizations, such as the Federal Trade Commission, Organization for Economic Cooperation and Development, APEC, etc.;
- While this audit was based on a questionnaire sent to health insurers, random checks will be conducted in the future.
The Working Party did not reveal what business sectors may be audited next, but sectors that process important amounts of sensitive personal information or that process personal information as a main service activity (or a part thereof) are high on the Working Party's audit list.
— Jan Dhont
SWEDEN
By Carolina Hammarqvist
The "Misuse Model" in Sweden: A Way to Limit the Effects of the Broad Definition of Personal Data
The Article 29 Working Party recently released an opinion on the definition of personal data.
In Sweden, the initial implementation of the 95/46/EC Directive led to many difficulties for companies trying to apply the Swedish Data Protection Act.
This was mainly due to the fact that the definitions of "personal data" and "processing" data, as well as the way it was interpreted by the Data Inspection Board, is broad. For example, personal data was interpreted to include anonymous data.
Since Jan. 1, 2007, most of the provisions of the act do not apply when processing personal data in unstructured material, which is personal data that does not form part, and is not intended to form part, of a set of personal data that has been structured to significantly facilitate searches for, or compilations of, personal data.
In short, the basic rule of the act with regard to processing of personal data in unstructured material (such as emails, word processing documents, sounds and images) is that such processing is permitted, provided that the processing does not lead to infringement of the data subject's privacy.
To date, there have been few decisions by the Data Inspection Board based on this new model, so it is uncertain how it will be interpreted. However, it is obvious that it will be easier for data controllers storing data, for example in an inbox in an email system, to comply with the act on a day-to-day basis.
Carolina Hammarqvist is an Associate in Technology, Media & Telecommunications at Linklaters Advokatbyrå Aktiebolag, Stockholm. She may be reached at
carolina.hammarqvist@linklaters.com
.
UK
By Steve Kenny
Regulator Seeks Additional Privacy Safeguards
The UK Information Commissioner has called on chief executives to improve outmoded data protection compliance systems, stating that "privacy must be given more priority in every UK boardroom. Organisations that fail to process personal information in line with the Principles of the Data Protection Act not only risk enforcement action by the ICO, they also risk losing the trust of their customers."
Businesses increasingly recognise data protection as a reputational risk, and reputational risk as ‘the risk of risks.' The UK Data Protection Act sets out eight principles UK organisations are required to comply with. All eight principles require operational controls, yet only the 7th principle, relating to information security, is approaching operational maturity in theory, if not always in practice.
Steve Kenny is Principal Advisor, Privacy Services Leader for KPMG, based in London. He may be reached at
steve.kenny@KPMG.co.uk
.
Comments
If you want to comment on this post, you need to login.