Better develop a "culture of privacy"

David Canton, of eLegal Canton fame, is a regular contributor to the London Free Press. In today's business section, David recommends that all businesses need to adopt a "culture of privacy" to prevent the sorts of privacy fiascos that we have seen in the last few months:

London Free Press: Business Section - Privacy culture necessary:

"Just when you thought your bank and government have your privacy interests protected -- think again. Recent privacy gaffs show privacy breaches can happen despite the best intentions of business or government.

Protection of privacy rights is not an automatic concern for many. However, people are becoming more aware of the repercussions of not having privacy top of mind....

And perhaps most importantly, create a culture of privacy within your organization. All organizations will have a chief privacy officer, but that person alone cannot do the job. All employees should understand the importance of keeping certain information confidential."

I couldn't agree more. So many of the high-profile screwups and a huge portion of the negative findings of the Office of the Privacy Commissioner stem from employees not having privacy at the top of their minds. In my experience, the lack of privacy culture leads directly to non-compliance or to not dealing with the incident properly when it comes to the company's attention.

The best example of this is an incident that happened in Ontario in 2003. If memory serves (the media reports about it are no longer online), a woman was suspecting that her spouse was having an affair. So she calls his cellphone company [the phone was not in her name] and says, essentially, "Hi, this is Mrs. Smith. I'm doing the bills and I don't know what all these charges are. Can you fax me the calling details for the last few months so I can figure these out?" The customer service person, thinking that s/he was providing the best customer service possible, says "sure thing!" and faxes them right over. So the list of numbers leads to the mistress, causing all sorts of problems for both the mistress and the ex-husband. The ex-husband gets upset and goes to the media with the story of how his phone company violated his privacy.

So, what went wrong? The customer service representative didn't think about privacy. S/he may have known about the company's policy of not disclosing this sort of information to anyone who is not listed on the account, but s/he was not thinking about privacy in a meaningful way. She sould have told the inquiring spouse that "at XYZ cellular, we respect our customers' privacy. You're not listed on the account, so I can't send you that information. Please have Mr. Smith give is a call to add you to the account, so you can get this information now and in the future, of ask Mr. Smith to request the information directly." But she didn't. As a result, her company's name was dragged through the mud.

Customer privacy needs to be the first thing your employees think about.

Fallout from naming/not naming Canadian victims

In the last few days, the Toronto Star decided to release an unofficial list of missing and dead Canadians in South Asia after Canadian authorities suggested that their hands were tied by the Privacy Act. The Privacy Commissioner and others corrected them, pointing out the public interest exception in s. 8 of the Act. All of this has led to two interesting letters to the editor in the Toronto Star:

TheStar.com - Release official list to world: Circulate listing via e-mail to every hotel, resort and set of bungalows — especially in Thailand:

"Search for the dead

Jan. 6.

After days of citing the Privacy Act as a barrier to disclosing names of the missing and dead Canadians in southern Asia, the federal government has conceded it made a discretionary decision not to release the information. And yet, in practical terms, releasing the names may very well help in ascertaining the fate of Canadians missing in Asia.

Prime Minister Paul Martin and a series of Foreign Affairs officials invoked Canada's Privacy Act as a reason for not releasing the names of the Canadians missing and feared dead in the Boxing Day tsunami. However, Jennifer Stoddart, Canada's privacy watchdog, is concerned that federal officials are "misquoting" the Privacy Act to justify withholding the names of the estimated 150 Canadians missing and feared dead in the tsunami. "The Privacy Act does allow exceptional release of names where there's a public interest that outweighs an invasion of privacy," she says.

With all due respect to anyone upset, if publishing an unofficial list, in the Star, "derived from many sources," has now confirmed that 50 on that list are in fact safe — all the better! It's now the rest — and others — that we should all be focused upon. If publishing the official listing helps to find only one — even better. Rather than waving an index finger at the Star for its efforts, get the official listing out — it is not an infringement on privacy rights. Circulate that listing via e-mail to every hotel, resort and set of bungalows — particularly in Thailand. And get them to start double-checking their guest registries. These are developing countries and we must not assume that everything functions like it does in the developed world, particularly during a crisis.

Prime Minister Martin, please give us the official listing so that those of us who can, are able to search even from afar. No one will think badly of you.

Keith Dériger, Ottawa

Canadians in Thailand

Jan. 5.

I am certain that Star editors have the best of intentions in publishing a list of known dead and/or missing people from this recent tragedy. But it is an unfair sleight of hand to circumnavigate privacy laws. The privacy laws exist for just that reason, to preserve privacy — pure and simple — no questions to be asked.

The Star notes the list was complied by reference to information provided to the government "from reports by worried friends and relatives." Is it not just possible this information was provided to the government by some people who did not expect to see it on page A3 of Canada's largest newspaper? In short, some of these friends and relatives may have wished for privacy or had a reasonable expectation of privacy. Did the Star canvass the friends and relatives to see who wanted to see their enquiries end up on page A3 ? Would all missing wish to have their names published? How generous of the Star to speak for all these people.

In many cases newspapers publish information that may indicate secret corporate, government or individual malfeasance — possibly stopping an unjust practice. This is not the case here. This is not a public service. Why do readers have to know this information?

David S. Faul, Ajax"

Letterman: Top Ten Signs Your Boss is Spying On You

From last night's Late Show with David Letterman:

CBS | Late Show Top Ten Archive: January 06, 2005:

"Top Ten Signs Your Boss Is Spying On You

10. Wherever you go you're followed by a potted plant in loafers.
9. The bracelet he gave you for Christmas beeps if you leave your cubicle.
8. Office coffee has hint of hazelnut and sodium pentothal.
7. Your name:'Sam.' Next to your parking spot: 'Reserved for the guy following Sam'
6. Find yourself getting tasered more than with previous bosses.
5. Your new secretary looks a lot like that chick from 'Alias'
4. Instead of photos of wife and kids on his desk, he has a photo of you sleeping.
3. When you're alone in the men's room, a voice tells you to quit blocking the lens.
2. Boss critical of typos in your personal e-mails.
1. The fax machine just coughed."

E-mail in litigation: Delete, delete, damn e-mail!

The front page of today's Globe and Mail Report on Business is full of coverage of a high-profile lawsuit between CIBC and Genuity. The most compelling evidence in the case is a bunch of e-mails that the senders and recipients thought were private:

Globetechnology: E-mail used as weapon in court case

The Canadian Imperial Bank of Commerce has turned employee e-mails into a potent legal weapon in an acrimonious court battle with a team of top executives who left the bank last year to form a competing investment firm.

In a lawsuit filed in the Ontario Superior Court, CIBC alleged that six former senior executives, including its one-time vice-chairman David Kassie, improperly recruited bank employees and took confidential bank data to their new company, Genuity Capital Markets....

The revealing e-mails are a stark reminder to employees in the digital age that messages they zap into the Internet ether can come back to haunt them....

CIBC was able to tap into messages sent by BlackBerrys that the former executives apparently believed were protected by a private system of e-mail communications known as PINning, which involves personal identification numbers or PINs.

The bank's ability to read and publish the BlackBerry e-mails is expected to send chills through the legions of investment bankers and lawyers who conduct all kinds of communications through the ubiquitous portable e-mail devices.

“You mean they broke into the PIN messages, how did they do that?” gasped one Bay Street lawyer and frequent BlackBerry PIN user who declined to be identified.

The CIBC isn't saying how it accessed the BlackBerry messages, but states in its lawsuit that the executives “seemed to have believed [they] did not create any record of their e-mails on the [Bank's] central computer systems.” ...

If you don't want to see it again, don't put it in writing, don't e-mail it, and don't text it.

Voyeur CCTV attendants suspended for using awesome powers for evil

This sort of stuff is what makes many people nervous about widespread surveillance cameras in public places. The Register is reporting that two employees entrusted with keeping the streets safe though CCTV have been suspended for using the technology to peep into a woman's apartment:

Council suspends CCTV Peeping Toms | The Register:

"Police are investigating a a trio of municipal 'Peeping Toms' from Sefton, Merseyside who reportedly trained a street safety CCTV camera on a woman's flat in Liverpool's Bootle district, UK tabloid the Sun reports.

The three have been suspended 'pending a full internal investigation into alleged breaches of the council's policies and procedures,' as a Sefton council spokesman put it. Police confirmed that they are 'currently investigating allegations under the Sexual Offences Act 2003 and we are talking to a number of people', although no-one has been arrested.

The triumvirate of alleged snoops work in the Sefton council street safety camera centre, which controls 70 CCTV cameras across Merseyside."

Commissioner speaks up on interpretation of the Privacy Act and naming tsunami victims

Jennifer Stoddart has spoken up, correcting politicians and public servants about the Privacy Act and its effect on the ability of the government to name tsunami victims. While the Act does generally prevent the disclosure of personal information, it does contain a public interest exception that the PM or the Minister of Foreign Affairs can invoke at any time. (See my very reference to the pubilc interest exception in PIPEDA and Canadian Privacy Law: Editorial urges that naming Canadian tsunami victims is in the public interest.)

Victoria Times Colonist - Naming the missing not a privacy issue:

"Watchdog: Commissioner says law does not prevent government from listing Canadians feared dead

OTTAWA -- Canada's privacy watchdog says she is concerned that federal government officials are 'misquoting' the Privacy Act to justify withholding the names of the estimated 150 Canadians missing and feared dead in the South Asian tsunami.

And Jennifer Stoddart said that she plans to discreetly warn government officials to stop misrepresenting the act to Canadians.

'When we read that the Privacy Act is being misquoted we usually follow up informally,' Stoddart said in an exclusive interview Wednesday.

'I continue to be concerned when I hear in the media public officials declaiming what the Privacy Act does not allow them to do,' Stoddart added.

'The Privacy Act does allow exceptional release of names where there's a public interest that outweighs an invasion of privacy.'

Stoddart's comments come after Prime Minister Paul Martin and a series of Foreign Affairs officials invoked Canada's Privacy Act as a blanket reason for not releasing the names of the 146 Canadians missing and feared dead in the Boxing Day tsunami that ravaged the Indian Ocean...."

Scanning license plates to find stolen cars

I've seen SUVs with roof mounted cameras and stickers from the Insurance Bureau of Canada strolling down the lanes of Halifax and Vancouver, apparently checking license plates of parked cars against a database of stolen vehicles. Now police in Ohio are using a similar system that checks every car that enters the Ohio Turnpike. Techdirt has a pointer and a comment or two on this type of surveillance:

Techdirt:Don't Try Driving On The Ohio Turnpike In A Stolen Car:

"from the or,-um,-change-the-plates-first dept.

Beck writes 'The Ohio State Highway Patrol reports that they tested a license plate scanning system on the Ohio Turnpike last summer. The system scanned the plates of cars entering the Turnpike, and alerted the Patrol when it detected a car that was reported stolen, or was owned by a wanted fugitive. Troopers were then able to locate the car and pull it over. They say that the system identified 24 stolen cars during the test. The Highway Patrol says that the scanners only looked at lists of stolen cars and fugitives and did not access BMV records, nor did they retain a record of scanned plates.' "

PM decides it is not in the "public interest" to name Canadian tsunami victims

Further to my earlier posting "PIPEDA and Canadian Privacy Law: Editorial urges that naming Canadian tsunami victims is in the public interest", the Toronto Star is reporting that the Prime Minister made the call not to publicy name those Canadians affected by the Asian tsunami. The article also refers to the ability of government to release names "in the public interest":

TheStar.com - PM made decision not to release information:

"Privacy Act allows for disclosure `in public interest' Martin's office cites `respect for families'

TONDA MACCHARLES
OTTAWA BUREAU

OTTAWA—After days of citing the Privacy Act as a barrier to disclosing names of the missing and dead Canadians in southern Asia, the federal government conceded yesterday it made a discretionary decision not to release the information.

Pressure grew yesterday on the government to release names, especially after the Toronto Star reported it had found several individuals previously presumed missing.

The federal Privacy Act in fact allows a minister to override the privacy law to reveal such information — and it frequently does — in cases that it deems "in the public interest."

There is no definition of what that is or is not.

Here's what section 8.2 (m) of the law actually says:

"Personal information under the control of a government institution may be disclosed ... for any purpose where, in the opinion of the head of the institution, the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure."

In the end, it is now clear, the decision to keep the names secret was Prime Minister Paul Martin's, and not Foreign Affairs Minister Pierre Pettigrew's.

Martin's communications director, Scott Reid, said yesterday the Prime Minister's decision to withhold the names was "triggered by common sense and basic respect for the families involved."

"There is no compelling public interest that would result in the publication of the names of the 146 officially missing Canadians. Quite the contrary, the Prime Minister's strongly held view is that the public interest dictates that we should work closely with the families involved, offering support and assistance in any way possible while respecting their right to privacy."

"In truth, this was not a difficult decision. If families wish to speak publicly about their lost or missing loved ones, that is their decision. But the government will not presume or take that decision for them."

...

Renée Couturier, a spokesperson for federal Privacy Commissioner Jennifer Stoddart, says the federal government occasionally invokes the "public interest" exemption to privacy.

...

In fact last year, Ottawa invoked the "public interest" 67 times, according to Stoddart's annual report.

But this week, the prevailing view within the foreign affairs department was the information should not be released so as not to cause "further anguish and suffering" to the families, said spokesperson Reynald Doiron.

But Doiron indicated families were not asked if they would consent to a release of their relative's name.

Consultations were held with the Prime Minister's Office, the Privy Council Office, the federal privacy commissioner's office, and the justice department.

It was the Prime Minister who made the final call, said Reid.

In this case, one observer of privacy laws, John Lawford of the Public Interest Advocacy Centre, said yesterday the government should not be knocked for a decision made while the "chaos" of the disaster is still fresh.

He said it would be a greater concern if the government uses that as a long-term justification for withholding names...."

Red light cameras may cause accidents

Red light cameras, which are appearing on an increasing number of street corners, may actually cause accidents, according to a report from the New York Times: The New York Times > Technology > Circuits > With Cameras on the Corner, Your Ticket Is in the Mail.

Nervous drivers, it appears, may slam on the brakes when they should have cruised through the yellow light. (Privacy nerds, on the other hand, are so easily distracted by cameras that they may not pay close enough attention to traffic.)

David Fraser on Holder Tonight on CJAD

On Monday night, I was a guest on the Peter Anthony Holder show on CJAD in Montreal. The topic of discussion was (surprise!) privacy and we received some interesting calls from listeners, most of them concerned about their social insurance numbers and whether they have to disclose them to banks and others. You can listen to an MP3 of the show here [16,623 KB].

Yesterday, I was on the Bill Good show on CKNW in Vancouver. When I have an MP3 to share, I'll put it online as well.