Privacy Briefing - September 2004

Edited by Michael Power

Contents

• Australia: Privacy Concern at Data Sharing

• Canada: Privacy Chief to E-Commerce Firms—Don't Blame PIPEDA

• Canada: Privacy Commissioner Calls for Exam of Cross-Border Personal Information Transfer

• EPIC Files Brief Supporting Driver Privacy

• Germany: Princess' Privacy Right Upheld

• Lebanon: Medical Record Files Dumped in Sacks in an Open Warehouse

• Manitoba: Police Web Site Riles Privacy Watchdogs

• N.W.T Privacy Commissioner Appalled by Some Cases

• Study: Consumers Will Go for Wireless Directory if Privacy Protections in Place

• U.S.: EFF Files Brief in Email Privacy Case

CENTRELINK, an Australian government agency delivering a range of Commonwealth services to the Australian community, plans to create a central database for sharing information about clients with other government departments, despite concerns the system could be open to privacy abuse. Centrelink's aim to become the government's "trusted authentication hub" was outlined in the agency's Future Directions 2004-2009 five-year corporate plan.

But Australian Privacy Foundation spokesman Nigel Waters said a system that did not allow individuals to give specific consent before personal information was shared with an outside organisation, was against the spirit and letter of privacy legislation.

While it recognised Centrelink as "one of the better examples in government" of respect for private information, Mr. Waters said the foundation was concerned about any agency that shared data outside its specific functions. He said "identity management" issues could only be safely handled through the creation of an independent agency.

Full press report available at:

http://www.theaustralian.news.com.au/common/story_page/0,5744,10581463%255E2702,00.html

Canada: Privacy Chief To E-Commerce Firms: Don't Blame PIPEDA

The best way for e-businesses to rebuild the public's waning trust of online transactions is to comply with Canada's new privacy rules, says Jennifer Stoddart, privacy commissioner of Canada.

Speaking at a conference in Ottawa on August 25th, Ms. Stoddart made an aggressive pitch, referring to a 2002 Leger Marketing survey that found issues with security and privacy continue to be the biggest barrier to Canadians making online purchases. Stoddart cautioned that while a company may see a business opportunity in data mining, "their next door neighbour might see it as an unacceptable invasion of privacy."

Stoddart also emphasized that e-commerce companies need to realize they are responsible for the products they distribute. "Developers and sellers of data management software may be tend to feel that they are just providers of a product and it's up to the customer to use that software in a responsible manner," she said.

Full press report available at:

Canada: Privacy Commissioner Calls For Exam Of Cross-Border Personal Information Transfer

The Privacy Commissioner of Canada, Jennifer Stoddart, today calls for a greater dialogue between governments, the private sector and the public about cross-border exchanges of Canadians' personal information. The Commissioner articulated this need in the Office's submission to the Information and Privacy Commissioner of British Columbia about the privacy implications of the USA Patriot Act.

Canadians expect that governments and the privacy sector will collaborate to protect against mismanagement of personal information. We must collectively seek a balance between the requirements of national security, the need for public safety and the conditions of an open and efficient economy.

In the submission, the Privacy Commissioner recommends practical measures for citizens, companies and governments to better manage the cross-border flow of personal information.

Full text of press release:

http://www.privcom.gc.ca/media/nr-c/2004/nr-c_040818_e.asp

Full text of submission to the Information and Privacy Commissioner of British Columbia about the privacy implications of the USA Patriot Act.

http://www.privcom.gc.ca/media/nr-c/2004/sub_usapa_040818_e.asp

EPIC Files Brief Supporting Driver Privacy

EPIC, joined by the American Civil Liberties Union of Florida, has submitted an amicus brief in Kehoe v. Fidelity Bank, a case under the federal Drivers Privacy Protection Act where a bank purchased over 500,000 motor vehicle records from Florida for car loan solicitations. The brief argues that individuals are entitled to damages under the law when businesses or data brokers intentionally access motor vehicle information.

The Drivers Privacy Protection Act, 18 USC § 2721, protects the confidentiality of motor vehicle records. It was enacted in 1993 after stalkers, murderers, and robbers were shown to have used records at DMVs in order to locate victims. In 1999, Senator Shelby amended the law to require opt-in consent before a DMV could release personal information for marketing purposes. The amendment took effect June 1, 2000, but Florida law was never updated to reflect the federal law change.

For further information see:

For a copy of the brief, see:

Germany: Princess' Privacy Right Upheld

Germany has accepted a European court decision that Monaco's Princess Caroline can stop publication of photos of her and her family, despite complaints by news agencies. The European Court of Human Rights in Strasbourg, France, ruled in June that three German magazines—Bunte, Freizeit Revue and Neue Post—had violated Caroline's privacy rights by publishing photos of her and her children in their private lives. It rejected a 1999 ruling from Germany's top court that allowed the photos on the grounds that Caroline was a public figure.

German Justice Minister Brigitte Zypries said on Steptember 8th that the cabinet decided against an appeal after concluding the European ruling, which is not binding for national courts, does not explicitly curtail the media's right to report on politicians. Yet the Association of German Newspaper Publishers urged the government to change its mind, decrying the decision as an "excuse for censorship."

Full press report available at:

http://www.canoe.ca/NewsStand/LondonFreePress/News/2004/09/02/612542.html

Lebanon: Medical Record Files Dumped In Sacks In An Open Warehouse

One walk past the Health Ministry facility housing the National Aids Control Program in Carantine, would seem to suggest that the Hippocratic Oath has been trashed—literally—not because of doctors' negligence, but because of government negligence.

The sacks, piled twenty deep in some areas of the crumbling ministry warehouse, are easy to spot from the road. In all, there are at least several hundred, with many made of fraying burlap. Most importantly however, all are packed with the medical records, test results and identity papers of Lebanese citizens. Some of the individuals are perhaps dead. Many, however, appear young in their photos. Although only a handful of sacks could be examined by The Daily Star, records were found dating to as recently as 1998.

Unfortunately, as The Daily Star went to press, Health Ministry representatives were unable to comment or respond to specific requests for additional information on the source of the discarded records.

Full press report available at:

http://www.dailystar.com.lb/article.asp?edition_id=1&categ_id=1&article_id=7935

Manitoba: Police Web Site Riles Privacy Watchdogs

Privacy advocates are raising questions about the legality of a new police Web site that posts videos of possible sex-trade workers and their customers. The grainy, 15-second videos on the site generally show women approaching vehicles in several areas of the West End, talking to the occupants, and getting inside.

The site includes a disclaimer acknowledging the people in the videos may not be involved in the sex trade. Faces and licence plates are blurred out on the video, but the initiative has raised concerns about privacy.

The Web site has proven popular since its launch; Constable Shelly Glover says the Web site received nearly 4,400 hits in the last 24 hours, and the average visit to the site lasted four minutes. Glover says she has been fielding inquiries from municipalities and media outlets from across the country, and most of the feedback she's getting is positive.

Full press report available at:

http://winnipeg.cbc.ca/regional/servlet/View?filename=mb_privacy20040825

N.W.T Privacy Commissioner Appalled By Some Cases

The Northwest Territories privacy commissioner says she's disturbed by the lack of understanding of privacy law shown by some government employees. Elaine Keenan-Bengts reviewed the highlights of her 2003 annual report with MLAs on August 23rd.

One of the most egregious complaints her office dealt with came from the health department. A woman complained to the deputy minister of health about the way a nursing station had treated her.

The department's response to her suggested she was whining, and had nothing to complain about. The letter also included details of the woman's medical history. The department even sent a copy of the letter to the woman's employer, although her complaint had nothing to do with her work.

Full press release:

http://north.cbc.ca/regional/servlet/View?filename=aug24privacy24082004

Study: Consumers Will Go For Wireless Directory If Privacy Protections In Place

This year, five times as many wireless customers as last year said they were willing to list their mobile-phone numbers in a public directory without any set privacy standards. More than half of wireless customers said they were currently willing to list their phone numbers with some specific privacy protection in place, according to a consumer study conducted by The Pierz Group.

The survey, which consisted of an online survey this summer of more than 1,500 respondents, found that 11 per cent of wireless customers said they were willing to list their numbers in a wireless directory assistance/enquiry database without any specific privacy protection, compared with 2 per cent last year, with 52 per cent saying they were willing to list their number with some protection in place.

The wireless industry is split on the topic of a wireless database with the Cellular Telecommunications & Internet Association pushing for the publication of a database, while some carriers have expressed concern about consumer privacy in providing wireless numbers to the database.

The Pierz study noted that consumers seemed more willing to partake in such a database if it followed a similar privacy approach based on do-not-call lists currently being implemented by wireline services.

Full press report available at:

http://rcrnews.com/cgi-bin/news.pl?newsId=19430

U.S.: Eff Files Brief In Email Privacy Case

The Electronic Frontier Foundation (EFF) has submitted a friend-of-the-court brief in a case that will have a profound effect on the privacy of Internet communications.

The brief argues that U.S. v. Councilman, previously decided by a panel of First Circuit judges, should be reheard by the entire First Circuit Court of Appeals. In the earlier panel decision, the court ruled that it does not violate criminal wiretap laws when an email service provider monitors the content of users' incoming messages without their consent.

Co-authored by Orin Kerr and Peter Swire, law professors specializing in Internet privacy issues, the amicus brief is co-signed by EFF, the Center for Democracy and Technology (CDT), the Electronic Privacy Information Center (EPIC), and the American Library Association (ALA). Amici argue that a rehearing is necessary because the Councilman decision disrupts the traditional understanding of Internet surveillance laws, raising significant constitutional questions under the Fourth Amendment.

Full press report available at:

http://www.linuxelectrons.com/article.php/20040904075434511

Amicus brief available at:

http://www.eff.org/legal/cases/US_v_Councilman/

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.