Wednesday, November 26, 2008

Pre-employment polygraph screening

While my blog was down, I wrote on slaw.ca about an interesting story from Nova Scotia that made national news. For those who missed it on slaw, here it is:

Slaw: Pre-employment screening

A recent story from Nova Scotia has focused a lot of attention on pre-employment screening and the use of polygraphs. Hopefully, it will encourage a larger discussion on both sides of the issue.

According to media reports, anybody applying for a job that falls within the purview of the Halifax Police Service and Fire Service is required to pay for a polygraph examination that includes a range of questions, some of which have been considered to be objectionable. (See the full questionnaire here (pdf).)

Others have objected to the use of a polygraph, as many assert it is not a reliable indicator of truthiness truthfulness. (If you want a refresher on how Canadian courts are to treat polygraphs, check out R. v. Béland, 1987 CanLII 27 (S.C.C.)).

The media coverage has been plentiful, from the local papers to CBC's The National (Quicktime). The former FOIPOP Review Officer has made his thoughts known (Ex-watchdog: Ditch polygraphs) as has his successor Dulcie McCallum (Nova Scotians deserve same privacy protection as others).

Any debate and discussion is a good thing. It should, hopefully, focus the mind on one of the principes of privacy best practices that appears in almost every public and private sector privacy law: only collect information that's reasonably necessary for the (reasonable) purposes. If it's not necessary or not reasonable, don't collect it. Other important principles to consider: who has access to the information, how is it used and how long is it kept around?

And now for something completely different somewhat relevant, yet inadmissible:

Here's CBC The National's report:

Tuesday, November 25, 2008

Connecticut librarian requires a warrant in library child pornography investigation

The Republican-American of Connecticut has an interesting story about a vigilant and diligent librarian who required a court order before handing over computer records after a complaint that a patron had been using a library computer to view child pornography. Her two reasons were (i) to protect the privacy of all library patrons and (ii) to make sure that if the patron had been using the computer unlawfully, the evidence would be admissible. See: The Republican-American Porn complaint hits Waterbury library.

Verizon sacks employees for peeking at Obama's phone records

According to the Internet News, Verizon employees who took a peek at Barak Obama's e-mails have been sent packing: InternetNews Realtime IT News - Verizon Staff Fired After Peek at Obama's Calls. Interestingly, Patrick Leahy (chair of the Senate Judiciary Committee) is using this to call upon the Justice Department to account for the efficacy of the Telephone Records and Privacy Protection Act of 2006.

The Future Privacy Forum launched in Washington

There's a new privacy organization setting up shop in Washtington, DC. Initially funded by AT&T, the Future of Privacy Forum seems to be pushing for transparent consumer choice:

About the Future Privacy Forum : FUTURE OF PRIVACY FORUM

The Future of Privacy Forum (FPF) is a think tank led by privacy experts Jules Polonetsky and Christopher Wolf and includes an Advisory Board comprised of leading figures from industry, academia, law and advocacy groups. The Future of Privacy Forum’s initial underwriter is AT&T. We invite and welcome the support of other companies committed to advancing privacy practices.

FPF advocates for privacy advances that promote transparency and user control in a manner that is practical for business to implement to ensure personal autonomy for all who seek to embrace the benefits of our digital society.

Some additional coverage: A skeptical welcome for online privacy forum.

Facebook wins $873M judgment against spammer

Facebook has just won a multi-multi-million dollar judgment against a Montreal residet under the American CAN-SPAM Act after the individual was accused of sending millions of unsolicited commercial e-mails to Facebook users. The company will never see most of the cash, but Facebook has said they'll go after all they can.

Hopefully, this will be a strong, visible deterrent.

See: The Associated Press: Facebook wins $873M judgment against spammer.

Monday, November 24, 2008

Making privacy practices meaninful

A client pointed me to this great post, with which I couldn't agree more.

After discovering that, by default, friends of friends who comment on Facebook-posted pictures get access to the full album of photos, the author writes:

apophenia: Putting Privacy Settings in the Context of Use (in Facebook and elsewhere)

... Tech developers... I implore you... put privacy information into the context of the content itself. When I post a photo in my album, let me see a list of EVERYONE who can view that photo. When I look at a photo on someone's profile, let me see everyone else who can view that photo before I go to write a comment. You don't get people to understand the scale of visibility by tweetling a few privacy settings every few months and having no idea what "Friends of Friends" actually means. If you have that setting on and you go to post a photo and realize that it will be visible to 5,000 people included 10 ex-lovers, you're going to think twice. Or you're going to change your privacy settings....

Making people think? Good idea.

When privacy has been characterized as minimizing surprises, if you fully let people know what they're doing (particularly when it is somewhat behind the veil of not-well-understood technology) you're doing your job.

Federal Court of Appeal upholds disclosure of eBay PowerSeller records to CRA

In September of last year, I blogged about a decision of the Federal Court of Canada that ordered eBay to hand over to the Canada Revenue Agency information about Canadian "power sellers". (See: Canadian Privacy Law Blog: Federal court orders disclosure of eBay PowerSeller records to Canada Revenue Agency.)

That decision was appealed to the Federal Court of Appeal, which upheld the decision on November 7, 2008:

eBay Canada Ltd. v. Canada (National Revenue), 2008 FCA 348 (CanLII)

...

[46] In order to induce compliance with a requirement, subsection 231.6(8) provides that a judge may prohibit a person who has failed to comply substantially with the requirement from relying on foreign-based information covered by it in a civil proceeding relating to the enforcement or administration of the Act.

[47] The scheme of section 231.6 suggests that Parliament was concerned that it could be unduly onerous for a person to be required to produce material located outside Canada and in the possession of another person, and that the section may operate in an unduly extraterritorial manner. While these concerns may be taken into account on a review by a judge for unreasonableness, they are largely irrelevant to the information (bulky as it may be) that is the subject of the requirement in the present case.

[48] This is because, with the click of a mouse, the appellants make the information appear on the screens on their desks in Toronto and Vancouver, or anywhere else in Canada. It is as easily accessible as documents in their filing cabinets in their Canadian offices. Hence, it makes no sense in my view to insist that information stored on servers outside Canada is as a matter of law located outside Canada for the purpose of section 231.6 because it has not been downloaded. Who, after all, goes to the site of servers in order to read the information stored on them?

[49] Nor is the extraterritorial application of the Act a significant issue on the present facts. For example, the agreements with eBay Canada expressly provide that they may disclose confidential “eBay System Information” (which the appellants say includes information about PowerSellers) which “is required to be disclosed by order of any court”: Appeal Book, vol. II, pp. 295-96. Nor does the requirement oblige a person outside Canada to do anything.

[50] Counsel concedes that the information identifying PowerSellers registered as having an address in Canada would be located in Canada if the appellants had downloaded it to their computers. In my view, it is formalistic in the extreme for the appellants to say that, until this simple operation is performed, the information which they lawfully retrieve in Canada from the servers, and read on their computer screens in Canada, is not located in Canada.

[51] I would only add that, although Justice Hughes does not frame his reasons by reference to the statutory definition of “foreign-based information” in subsection 231.6(1), he clearly meant that the information in question could be “located” at places other than the site of the servers where it is stored. For example, he stated 2007 FC 930 (CanLII), (2007 FC 930 at para. 23) that information stored electronically outside Canada “cannot truly be said to ‘reside’ only in one place”, and (supra at para. 25) the information required by the Minister “is not foreign but within Canada” for present purposes.

[52] Having concluded that information in electronic form stored on servers outside Canada is in law capable of being located in Canada for the purpose of section 231.6, I now consider whether Justice Hughes’s application of the law to the particular facts of this case was vitiated by palpable and overriding error. In my view, it was not. In finding that the information in question was located in Canada within the meaning of section 231.6, Justice Hughes properly took into consideration the fact that eBay US and eBay International had granted the appellants access to information about Canadian PowerSellers for the purpose of their business, and that they indeed used it for this purpose. The facts support the following conclusion by Justice Hughes (supra at para. 25):

For perhaps corporate efficiency the information is stored elsewhere, but its purpose is in respect of Canadian business. The information is not foreign but within Canada for the purposes of section 231.2 of the Income Tax Act.

[53] Since the facts of this case do not engage section 231.6, it is not necessary to consider whether the presence of that section in the statutory scheme reduces the Minister’s powers under section 231.2 when the requirement relates to “foreign-based information”.

See also: Michael Geist - Federal Court of Appeal Upholds Ebay Power Seller Decision, EXCESS COPYRIGHT: eBay "PowerSeller" data is "both here and there".

Back in business

Due to a screw-up beyond my control [finger pointed directly at my hosting company], I haven't been able to update this blog for almost three weeks. But it's fixed and we're back in business.

Thursday, November 13, 2008

Testing

My apologies. Technical issues have meant that I haven't been able to post for a while now. I'm looking into it...

Thursday, November 06, 2008

What are these?

Last weekend, after a day of meetings, I wandered around downtown Ottawa. When I lived there in 1999-2000, I noticed that a number of light poles in the downtown area have directional antennas on top of them. I had only seen them in the vicitinty of Parliament Hill. Being paranoid, I wondered what they were. I even called the city and asked what they were and whose they are. The city was not able to answer my question, though they acknowledged that the poles are theirs and putting anything on them would require the city's ok.

You can read the text on the label on the back, which says it's made by TIL-TEK, model TA-2408. The TIL-TEK brochure describes it as:

The TA-2408 is a vertically or horizontally polarized panel antenna. The antenna consists of a printed broadband dipole array enclosed in an aluminum cavity with a UV stabilized ASA radome for superior weatherability. It is designed for wireless data in the ISM band and is at DC ground to aid in lightning protection.

Here are two other pictures:

Directional antennaDSC_3987

If anyone knows anything about these, please help satisfy my curiosity ... Email me or put something in the comments.