What to do when faced with a privacy breach

Dr. Ann Cavoukian, Ontario's Information and Privacy Commissioner, has just released a new paper, What to do When Faced With a Privacy Breach: Guidelines for the Health Sector, to provide guidance to health information custodians under the Personal Health Information Protection Act when they are faced with a privacy breach, including what happens when the IPC investigates a privacy breach. Good reading ...

NJ Librarian ensnared in privacy conflict

Michael Zimmer is writing about a recent story out of New Jersey. A librarian who stood up for privacy rights, her library's privacy policy and the ALA's code of ethics has come under fire for "showing blatant disregard" for the police by asking for a subpoena before handing over a borrower's records. Interesting reading: michaelzimmer.org » Archives » NJ Librarian ensnared in privacy conflict.

South Carolina health agency now destroying computers on site after personal info found on surplus computer

Health and Human Services in South Carolina has changed its policy of dealing with surplus computers after personal information, including social security and medicaid numbers were found on a computer sold as surplus last week. Now the agency will be destroying the equipment "on site" to prevent a recurrence. See: WIStv.com Columbia, SC: SC state agency halting surplus computer sales after information leak.

Fans targeted in personal information scam

Fans of the Red Hot Chili Peppers are apparently being targeted to provide personal information, including social security numbers, by scammers promising free concert tickets in exchange for filling in a specious survey: Net Music Countdown: Red Hot Chili Peppers Security Alert.

Data protection in Latin America

I just happend upon a very useful site for information and developments in privacy law in Latin America, Habeas Data, which includes "News about Data Protection, Computer Law & Habeas Data in Latin America". Unfortunately, it doesn't have an RSS feed but should be added to your bookmarks on foreign privacy law.

Victim impact statement on debit card fraud

A colleague in Alberta recently sent me a link to a recent case from Alberta, R. v. Singh, 2006 ABPC 156. It is a decision of the Alberta Provincial Court determining the appropriate sentencing for an individual who pleaded guilty to debit card fraud under section 342.1 of the Criminal Code of Canada. The decision is interesting in that it describes the crime in some detail, but the most interesting part is the victim impact statement submitted by the Interac Association:

“I, Fred Harris have been employed by INTERAC ASSOCIATION as Senior Vice President of Strategy and Business Development for over 15 years. In my capacity as Senior Vice President, I have knowledge of the fraud prevention mechanisms implemented by Interac Association’s member institutions to ensure the security of transactions on the Shared Cash Dispensing and Interac Direct Payment services (the “Interac Services” or the “Services”), and also of the specific matters addressed below.

INTERAC SERVICES IN CANADA

The Interac Services account for millions of automated banking machine and payment transactions (known as “debit at the point of sale” or “POS” transactions) on a daily basis. These services enjoy a high degree of consumer confidence given the ease of use and the widespread acceptance of debit cards at locations ranging from retail outlets to federal and provincial government offices.

In 2004, there were 19.8 million users of Interac Direct Payment each month resulting in a total of 2.8 billion point of sale transactions. Those 2.8 billion transactions represent $124.4 billion dollars at 546, 000 point of sale terminals. In 2004, cardholders withdrew cash from an automated banking machine that did not belong to their own financial institution over 294 million time utilizing one of the 46,178 ABMs available in the Canadian marketplace. In addition to the transactions processed through the Interac Services there are close to one billion proprietary transactions, such as bill payments and cash withdrawals, processed on Members; own proprietary banking machines every year. These services are among the most secure in the world. Interac Association and its Members take extreme care in identifying threats and vulnerabilities to ABM or Point of Sales locations. Establishing stringent device level security standards, and by employing security features that can include surveillance cameras, and automated fraud detection systems.

Banking machine and point of sale transactions require a two factor authentication system consisting of the electronic reading of valid magnetic strips information from the back of a debit card plus the inputting of an associated Personal Identification Number (PIN). In recent years, criminals have developed diverse and increasingly ingenious means of obtaining the information on the magnetic stripe and PIN information from cardholders. This activity, often called “skimming” uses methods that range form low-tech ploys consisting of double swiping a cardholder’s card and then looking over the individual’s shoulder as the PIN is entered, to higher-tech methods that include hidden pinhole cameras and additional card readers installed on top of banking machine card readers or point of sale devices.

Once a skimming incident is identified, Interac Association and its Members take action to eliminate the source of skimming and manage the resulting exposure to cardholders and financial institutions. In order to protect cardholders, most exposed cards are proactively cancelled by the financial institution and the cardholder is notified that a replacement card is being required. Until the cardholder receives the replacement card they are unable to access their money using a banking machine or point of sale terminal. In other instances, thousands of cards are proactively blocked to stem losses, thereby increasing substantially the number of cardholders affected by a single skimming incident. Canadian financial institutions have been at the forefront of fraud prevention and detection and continue to develop improved procedures and use new technology as it becomes available.

THE IMPACT OF BANKING CARD FRAUD

The initial group affected by debit card fraud is [sic] cardholders. Money is taken directly from their chequing or savings accounts. In some cases cardholders are burdened in the short term by being unable to meet basis living requirements, for example they may be unable to make rent or mortgage payments. They may suffer immediate “on the spot” inconvenience and embarrassment, particularly given the widespread use and acceptance of debit cards, when their card cannot be used to pay for goods or other services. Cardholders must then take steps to lodge an inquiry with their financial institution, which leads to an investigation regarding the missing funds. Their financial institution will reimburse them if they are the victims of a proven fraud, but in the meantime they are inconvenienced.

In 2003 our Members collectively reimbursed $44 Million to approximately 28,000 cardholders who were victims of debit card fraud resulting from skimming. In 2004 this figure increased to $60 Million reimbursed to over 48,000 cardholders. The related costs are also significant. The time and effort to investigate each instance of fraud is a significant burden on the time and resources of law enforcement agencies, Interac Association, and the involved financial institutions, terminal deployers and merchants. Each incident typically requires a team of individuals from several different financial institutions and terminal deployers to retrieve and scrutinize various records and to liaise with the appropriate law enforcement agencies. This investigation often takes several weeks. In addition, financial institution often proactively block and re-issue other debit cards used at this location during the skimming period in order to prevent further losses. This represents a further cost to the financial institution as well as an inconvenience to cardholders.

Interac Association and its Members, and the entire industry, also suffer. At a minimum, debit card fraud shakes customer confidence in the use of modern banking technology. This risk and potential harm increase exponentially when one considers that criminals often share the success of their schemes on readily accessible internet bulletin boards.”

US Government sets new standards on security for personal information

According to the Washtington Post (OMB Sets Guidelines for Federal Employee Laptop Security), the White House Office of Management and Budget has sent a memorandum to all heads of civilian agencies setting additional requirements for the safeguarding of personally identifiable information. The memo requires, among other things, that government departments:

1. Encrypt all data on mobile computers/devices which carry agency data unless the data is determined to be non-sensitive, in writing, by your Deputy Secretary or an individual he/she may designate in writing;

2. Allow remote access only with two-factor authentication where one of the factors is provided by a device separate from the computer gaining access;

3. Use a “time-out” function for remote access and mobile devices requiring user re-authentication after 30 minutes inactivity; and

4. Log all computer-readable data extracts from databases holding sensitive information and verify each extract including sensitive data has been erased within 90 days or its use is still required.

Geist on Sympatico privacy policy flap

Michael Geist's weekly Toronto Star column focuses on internet privacy and the sympatico privacy policy fuss: TheStar.com - Bell clause creates problems for privacy.

Nova Scotia considers electronic reporting of second-hand goods sales

The province of Nova Scotia has posted a discussion paper on the Department of Justice website soliciting comments on the electronic monitoring of pawnshops and second hand goods dealers. They seem to be considering following the Saskatchewan model, which requires photo ID from sellers and depositors. The info on the items and the particulars from the ID are sent to a company that operates a police-accessible database.

The discussion paper only mentions privacy in one throw-away line.

Possible Concerns or Drawbacks:

The Committee recognizes that the transition from the present no reporting of pawn transactions to mandatory reporting using an automated system is a big step. Customer concerns will include privacy issues and the fee on the service. Pawn shops will have concerns about the expense and time involved; also that it may discourage business or cause customer complaints. Some businesses may not voluntarily comply which will mean new enforcement responsibilities for the police. Licensing will also be an additional administrative responsibility and cost.

Similar rules are in place elsewhere, and I've commented a bit here:

• The Canadian Privacy Law Blog: New Toronto bylaw being called a privacy threat
• The Canadian Privacy Law Blog: Pawnbroker vows to fight Edmonton bylaw requiring handing over customer information
• The Canadian Privacy Law Blog: Database on sellers of used goods upsets Ontario Privacy Commissioner
• The Canadian Privacy Law Blog: Municipal bylaws mandating police database for used goods vendors OK'd by the Courts

Incident: Laptops stolen from American Red Cross office in Texas

According to the Dallas Morning News, three laptops were stolen from a locked closet in a Texas office of the American Red Cross. The laptops contained years of data on all donors from that particular region, but all the data was encrypted. Because it was encrypted, it should probably classified as a "non-incident" or "incident averted".

See: Dallas Morning News | Donor data stolen at local Red Cross .