Federal Commissioner releases annual PIPEDA report

Hot on the heels of the Ontario report yesterday, the Federal Privacy Commissioner has released her annual report on PIPEDA. It really should be a must read for anyone interested in PIPEDA, as it discusses many of the notable cases of the last year and some of the issues in the Office of the Privacy Commissioner of Canada. For example, the average resolution time from initial complaint to final finding has moved to sixteen months, five more months than in 2005.

Here's the media release with links to the report.

News Release: Privacy Commissioner calls for stronger data protection: Tabling of Privacy Commissioner of Canada's 2006 Annual Report on the Personal Information Protection and Electronic Documents Act (May 31, 2007)

Privacy Commissioner calls for stronger data protection: Tabling of Privacy Commissioner of Canada's 2006 Annual Report on the Personal Information Protection and Electronic Documents Act

Ottawa, May 31, 2007 — There has never been a greater need to take data protection seriously as new data breaches reinforce concerns about both security issues and trans-border data flows, according to the Privacy Commissioner of Canada, Jennifer Stoddart. Her 2006 Annual Report on the Personal Information Protection and Electronic Documents Act (PIPEDA) was tabled today in Parliament.

High-profile data breaches among a few well-known banking and retail organizations during 2006 reinforce the very serious nature of privacy breaches and the need to better protect personal information held by private sector companies.

Despite these cases, complaints against some of the major sectors covered by PIPEDA since 2001 (financial institutions, insurance companies and the transportation sector) have declined slightly. This is in contrast, however, to those industries which have been subject to PIPEDA only since 2004, such as the retail and accommodation sectors. These sectors have been the subject of substantially more complaints than in previous years. Overall, there were 424 complaints in 2006, compared with 400 in 2005.

“We are pleased to see fewer complaints related to sectors more familiar with PIPEDA; I believe it stems from a stronger understanding of the Act. It would appear that compliance is improving with time and we look forward to seeing this trend continue,” says Commissioner Stoddart.

“Sectors with less experience with PIPEDA have more work to do. As they gain a better understanding of what the law requires, we expect to see a decrease in complaints involving them,” she says.

“Research we are releasing today shows a majority of businesses covered by the Act appreciate their role in protecting consumer information, although there are still too many firms that need to take their role more seriously.”

That research, a survey of Canadian businesses on a number of issues relating to privacy, was conducted by Ekos Research Associates earlier this year. The results raise important questions about whether some businesses are doing enough to fulfill their PIPEDA obligations.

The survey found:

• While the majority of businesses that collect personal customer information have fully implemented PIPEDA provisions (67 per cent), there are a small but not insignificant number that are only in the process of implementing (16 per cent) and others that are not in the process of doing so (15 per cent).
• Only a third of all businesses report having staff that has been trained about their responsibilities under Canada’s privacy laws.
• Less than one in five has sought clarification of their role, although this is also much higher among larger businesses.

“Almost half of the businesses studied tend to rate their company’s awareness of its responsibilities under the privacy laws favourably. However, a similar number report either low or moderate awareness. PIPEDA and its provincial counterparts regulate commercial activity in Canada. All businesses that handle personal information need a good understanding of what the law requires,” says Commissioner Stoddart. “Businesses must realize the importance of living up to the law’s privacy protection principles and the consequences of failing to do so.

“I am particularly concerned to see that only a third of businesses have provided privacy training for staff. Good training is absolutely essential to prevent privacy breaches.”

Going forward, these companies will need to take steps to ensure greater compliance with the Act. Canadians expect private sector organizations to safeguard their personal information, particularly given the proliferation of identity theft.

The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman, advocate and guardian of privacy and the protection of personal information rights of Canadians.

In the fall of 2007, the Office of the Privacy Commissioner will be hosting the who’s who of the privacy world at the 29th International Conference of Data Protection and Privacy Commissioners in Montreal. Details are available at http://www.privacyconference2007.gc.ca/.

To view the reports:

• Annual Report to Parliament 2006 – Report on the Personal Information Protection and Electronic Documents Act (Adobe format)
• Backgrounder: Findings of a 2007 poll commissioned by the Office of the Privacy Commissioner of Canada
• 2007 EKOS Research Associates survey: Canadian Businesses and Privacy-Related Issues

Workplace privacy issues - Facebook and blogs

I'm currently in Toronto, co-chairing the Canadian Institute's conference on Privacy Compliance. I gave a presentation today on workplace privacy issues, which is available here. My co-presenters did a good job of canvassing many of the issues, so I got to have a bit of fun talking about the privacy aspects of reading employees' blogs and facebook pages.

Ontario Commissioner releases annual report for '06

Yesterday, Anne Cavoukian released the 2006 annual report for the Office of the Information and Privacy Commissioner of Ontario. It's a pretty slick report and chock full of interesting info.

Incident: Patient information cards sold at auction in Saskatchewan

Another case of personal information being sold at auction, this time in hardcopy form:

Patient information cards sold at auction

REGINA -- The Saskatoon Health Region apologized Tuesday after more than 2,000 patient information cards that were supposed to be treated as "very confidential" were accidentally sold at an auction of health region surplus material rather than shredded.

The plastic cards are used to make imprints on documents for patient records. The cards contain names, dates of birth, addresses, religious affiliations, health card numbers and the names of the patient's doctor.

They were used between January and May of this year for day surgery patients and outpatients at City Hospital.....

FTC probes Google / Doubleclick merger

According to the New York Times, the US Federal Trade Commission has begun an inquiry into the planned acquisition of Doubleclick by Google: Google Deal Said to Bring U.S. Scrutiny - New York Times:

Privacy groups said it was significant that the F.T.C., the agency that monitors online privacy issues, would be conducting the review.

“We think it’s very important that the F.T.C. is taking a look at the Google-DoubleClick deal,” said Marc Rotenberg, executive director of the Electronic Privacy Information Center, a privacy rights group.

In the days after the planned merger was announced, Mr. Rotenberg’s center and two other advocacy groups, the Center for Digital Democracy and the United States Public Interest Research Group, filed a request for the F.T.C. to investigate the privacy implications.

In the complaint, the groups noted that Google collects the search histories of its users, while DoubleClick tracks what Web sites people visit. The merger, according to their complaint, would “give one company access to more information about the Internet activities of consumers than any other company in the world.”

Google has built a lucrative business in selling small text ads that appear alongside its search results and on other Web sites. DoubleClick is the leader among companies that specialize in placing graphical and video ads online.

Jeff Chester, executive director of the Center for Digital Democracy, said that decisions made now about the structure of the online advertising industry could have lasting effects on data collection and personal privacy on the Internet, especially if control rests with a “few powerful gatekeepers” led by Google.

Still, privacy issues are not typically the concern of antitrust officials. In reviewing a proposed merger, legal experts say, regulators weigh the likely impact on competition and struggle with tricky technical matters like defining the relevant market to measure.

Privacy, dumpsters, drives and discs

If you're not reading David Canton's blog, you should. Particularly the latest of his Canoe/London Free Press columns: eLegal Canton: Privacy, dumpsters, drives and discs.

Reasonable expectation of privacy videos

The folks at the IDTrail have produced two interesting videos on the reasonable expectation of privacy that are worth checking out:

blog*on*nymity - blogging On the Identity Trail The first film, "Tessling-Just the Facts", is a brief dramatization of the facts that gave rise to R. v. Tessling [2004], a criminal case which addressed the concept of the "reasonable expectation of privacy" with respect to forward-looking infrared (FLIR) technology.

Download Tessling-Just the Facts (Save As...))Format: .mov[Quicktime],Duration: 4min22sec, Size: 9.53MB.

The second film, "CFP-Interviews", is a documentary that provides the viewer with a taste of various public interest perspectives on how to conceive of "reasonable expectations of privacy". It features short interviews with the following experts in the field of privacy, civil rights and law, in order of appearance:

Starring (in order of appearance):

• Clayton Ruby, Ruby & Edwardh
• Andrew Clement, University of Toronto
• Peter Jordan, Engineer (ret.)
• Chris Hoofnagle, Samuelson Clinic, UC Berkeley
• Eugene Oscapella, Lawyer, Foundation for Drug Policy
• David Sobel, Electronic Frontier Foundation (EFF)
• Pippa Lawson, Canadian Internet Policy and Public Interest Clinic (CIPPIC)
• Jim Karygiannis, MP Scarborough-Agincourt
• Marc Rotenberg, Electronic Privacy Information Center (EPIC)
• Cindy Cohn, Electronic Frontier Foundation (EFF)
• Marlene Jennings, MP Notre-Dame-de-Grâce -- Lachine
• Deirdre Mulligan, Samuelson Clinic, UC Berkeley

Download Public Interest Perspectives (Save As...)Format: .mov[Quicktime], Duration:25min52sec, Size: 54.8MB.

Google is watching you. No surpise, but privacy regulators are concerned.

From the Independent (UK):

Google is watching you - Independent Online Edition > Science & Technology

'Big Brother' row over plans for personal database

By Robert Verkaik, Law Editor

Published: 24 May 2007

Google, the world's biggest search engine, is setting out to create the most comprehensive database of personal information ever assembled, one with the ability to tell people how to run their lives.

In a mission statement that raises the spectre of an internet Big Brother to rival Orwellian visions of the state, Google has revealed details of how it intends to organise and control the world's information.

The company's chief executive, Eric Schmidt, said during a visit to Britain this week: "The goal is to enable Google users to be able to ask the question such as 'What shall I do tomorrow?' and 'What job shall I take?'."

Speaking at a conference organised by Google, he said : "We are very early in the total information we have within Google. The algorithms [software] will get better and we will get better at personalisation."

Google's declaration of intent was publicised at the same time it emerged that the company had also invested £2m in a human genetics firm called 23andMe. The combination of genetic and internet profiling could prove a powerful tool in the battle for the greater understanding of the behaviour of an online service user.

...

Privacy protection campaigners are concerned that the trend towards sophisticated internet tracking and the collating of a giant database represents a real threat, by stealth, to civil liberties.

That concern has been reinforced by Google's $3.1bn bid for DoubleClick, a company that helps build a detailed picture of someone's behaviour by combining its records of web searches with the information from DoubleClick's "cookies", the software it places on users' machines to track which sites they visit.

The Independent has now learnt that the body representing Europe's data protection watchdogs has written to Google requesting more information about its information retention policy.

The multibillion-pound search engine has already said it plans to impose a limit on the period it keeps personal information.

A spokesman for the Information Commissioner's Office, the UK agency responsible for monitoring data legislation confirmed it had been part of the group of organisations, known as the Article 29 Working Group, which had written to Google.

It is understood the letter asked for more detail about Google's policy on the retention of data. Google says it will respond to the Article 29 request next month when it publishes a full response on its website.

The Information Commissioner's spokeswoman added: "I can't say what was in it only that it was written in response to Google's announcement that will hold information for no more than two years."

...

A spokeswoman for the Information Commissioner said that because of the voluntary nature of the information being targeted, the Information Commission had no plans to take any action against the databases.

Peter Fleischer, Google's global privacy Ccunsel, said the company intended only doing w hat its customers wanted it to do. He said Mr Schmidt was talking about products such as iGoogle, where users volunteer to let Google use their web histories. "This is about personalised searches, where our goal is to use information to provide the best possible search for the user. If the user doesn't want information held by us, then that's fine. We are not trying to build a giant library of personalised information. All we are doing is trying to make the best computer guess of what it is you are searching for."

Privacy protection experts have argued that law enforcement agents - in certain circumstances - can compel search engines and internet service providers to surrender information. One said: "The danger here is that it doesn't matter what search engines say their policy is because it can be overridden by national laws."

Why Your Company Needs a Chief Privacy Officer

From CSO Online:

Why Your Company Needs a Chief Privacy Officer - Security Feed - News - CSO Magazine

May 23, 2007

In this era of data breaches and identity theft, chief privacy officers working hand-in-hand with security groups play a crucial if little-known role in protecting identifiable personal information.

The position of privacy executive is a relatively new one, dating back less than ten years, says Chris Zoladz, vice president of information protection and privacy with Marriott International. He pegs this role at about the stage where the security profession was 10 to 15 years ago. Although many organizations might believe the privacy function is covered by security groups, Zoladz told security professionals at The International Information Systems Security Certification Consortium’s (ISC2) 2007 SecureAmericas conference, held near Washington, D.C. last week, why the privacy function is separate but complementary.

"There are a lot of similarities between the professions, [such as] the focus on business value," he told the audience. The CPO is more focused on what data in an organization needs to be protected, however, while the security department develops and manages the way to protect it. "The CPO defines the ’what,’ the CISO deals with the ’how,’" he said.

...

"Good privacy is good business. The stakes in this area are constantly getting higher and higher . . . now we’re reading about [data breaches] in major media outlets," he said. "That’s done a lot for consumer awareness . . . and has raised the consciousness and awareness of our managers. That’s a positive move forward."

...

Zoladz defined privacy professionals as custodians -- not owners -- of personal information and said they must ensure that data is used in a responsible manner. Offering an example of his company’s Web site, he said because Marriott collects personal information from guests as part of the hotel chain’s reservation process, marketing executives have proposed personalizing the information that appears on the site so it’s customized to each visitor’s preferences. He said he gets involved in these proposals to make sure guests’ information is used properly.

...

There’s something else CPOs and CISOs have in common: Their career paths usually aren’t well defined, he said -- "Which means there’s a lot of opportunity."

Zoladz is also treasurer of the International Association of Privacy Professionals (IAPP), which has launched the IAPP certification, a three-hour test that is to the privacy profession what the CISSP is to the security profession, he said.

-- By Cara Garretson Network World (US)

Incident: Private medical records of Colorado residents exposed on Internet

From Minnesota public radio:

MPR: wavLength: Private medical records of Colorado residents exposed on Internet Private medical records of Colorado residents exposed on Internet

Posted at 10:03 PM on May 22, 2007 by Jon Gordon

On Friday's Future Tense, you'll hear this story:

As medical records are created and transmitted electronically more and more, the chance of private information falling into the wrong hands is growing. Sometimes records are stolen by hackers, other times just improperly secured. Compromised records can lead to a range of problems, from loss of employment to identity theft to plain old embarrassment.

Future Tense has discovered that detailed, personally identifiable medical records of thousands of Colorado residents were viewable on a publicly accessible Internet site for an uncertain period of time through at least last Friday, May 18. The data included patient records from at least 10 Colorado clinics and hospitals, and one hospital in Peoria, Illinois. It's unclear how many people may have seen the records.

Experts say the case likely runs afoul of federal health information privacy laws, even though there is no evidence that the records were misused.

The unsecured computer, which was accessible through a Web browser, was operated by Beacon Medical Services of Aurora, Colorado, which provides billing, coding and other services to emergency physicians at 17 facilities.

Beacon CEO Dennis Beck says he was shocked to learn about the breach and that the company took immediate steps to correct it.

"We've implemented a culture of compliance and data security and it just did not seem consistent with our culture, our practice and our experience," he said.

The medical records resided on an FTP server. FTP stands for File Transfer Protocol. It's a means by which users send and receive computer files over the Internet or private networks. In Beacon's case - and this is typical of the industry - health care providers sent encrypted data to the server for Beacon to access so it could bill patients and insurance companies. The data was unencrypted on Beacon's end, and the FTP server was not supposed to be accessible to the public. But in this case it was. No username or password was required to view the records.

The data included details of patients' visits to emergency rooms -- what ailments they complained of, diagnoses and treatments, and medical histories, along with the patients' names, occupations, addresses, phone numbers, insurance providers, and in some cases, Social Security numbers. Some of the records detailed sensitive cases, from sexually transmitted diseases to severe depression. The site also contained financial information, such as a list of low-income patients who received state aid to help pay their medical bills.

Beacon has employed two firms to help investigate what led to the security hole.

"It appears to us now at this point as if there was some back door that was opened to this server," said Beck. "We don't know when, but we believe it may have been done when a consultant did some work for us several years ago."

The company is trying to determine the exact number of patients affected, but Beck says the number looks to be fewer than 5,000.

Future Tense discovered the Beacon site after a tip from a source who stumbled upon it. We followed up on the tip, staying just long enough to confirm the existence of the records and get an idea what kind of data they contained. We notified several health care providers whose patient data was exposed. Those providers informed Beacon, which promptly shut the server down when it learned of the problem.

Bill Byron is spokesman for Banner Health Corporation, the parent company of McKee Medical Center of Loveland, Colorado, one of the providers whose data was included on the FTP site. Byron said McKee physicians won't transmit any more records to Beacon
until they're satisfied the security problem is fixed.

"We're trying to understand what our obligations are going to be, in terms of disclosing to patients that this has occurred, so that's still in process, to determine what we have to do," he said.

The Colorado medical records incident appears to be a serious violation of federal law governing medical record privacy, according to Janlori Goldman, director of the Health Privacy Project at Georgetown University.

"Large-scale breaches like this are not uncommon," she said. "They may not happen every day but they happen enough that you have to wonder, why aren't people taking greater care with this information?"

About a year ago, for example, a data security breach exposed medical information and Social Security numbers of some 26 million veterans after data was stolen from the home of an employee of the Department of Veterans Affairs.

Tomorrow on Future Tense, we'll explore the potential harm of compromised medical records, and at the federal law designed to protect patients. One critic of current law says patients have very little recourse when their most sensitive medical records become public.

Here is a list of physician groups, clinics and hospitals which had data of various kinds on the exposed site:

-McKee Medical Center of of Loveland, CO
-Big Thompson Emergency Physicians of Longmont, CO
-Presbyterian St. Luke's Hospital of Denver
-North Suburban Medical Center of Thornton, CO
-Carepoint Emergency Physicians of the greater Denver area
-Long's Peak Emergency Physicians
-Longmont United Hospital
-Boulder Community Hospital
-Emergency Medical Specialists PLC
-Memorial Hospital of Colorado Springs
-Proctor Hospital of Peoria, IL