Is it live or is it Memorex?
Michael Geist has a source sitting in on the PIPEDA hearings. Read her notes: Michael Geist - PIPEDA Hearings - Day 01 (Industry Canada).
Update (20070118): For links to the full hearing transcripts, go to: Canadian Privacy Law Blog: PIPEDA Review Transcripts.
Regular readers won't be shocked to discover that Michael Geist has a few thoughts on the PIPEDA review, which started today. Check it out: Michael Geist - PIPEDA Review Underway Today. And read his Toronto Star column on the same topic: Michael Geist - Hearings Offer Chance to Fix Holes in Privacy Law.
Update (20070118): For links to the full hearing transcripts, go to: Canadian Privacy Law Blog: PIPEDA Review Transcripts.
Information Week is always a good source of privacy reporting and today they've posted a really good article on the changing face of privacy and how companies need to adjust. The article is about eight printed pages long, but here are the topics covered:
Privacy: The Problem That Won't Go Away - Your privacy mistakes can easily become everyone's business. Here's how to keep your company--and your career--out of the spotlight
- It's A Strategy, Not Just A Policy
- Privacy Laws Will Change—Often
- You Can Excel--Don't Just Avoid Screwups
- All Data Is Sensitive
- Retain The Right Data, For The Right Time
- Helping Can Hurt You--Even With The Feds
- Partners Can Be Your Biggest Problem
- Technology Can Create New Problems
- One Privacy Approach Can't Cover All
They've also posted two great sidebars: Technology To The Rescue: From anonymizers to network monitors to identity management sysems, there's a host of privacy-enhancing products and strategies available and Privacy File: 10 Events That Impacted The IT Landscape - Here's a quick scan of recent events, which have roiled the privacy waters at AOL, at the FBI, and in Europe.
Read it, learn it, live it.
According to TorrentFreak, the highest appeal court in Germany has ruled that an ISP is required to delete IP logs in order to protect privacy. This is qualified by the fact that the deletion should be at the request of the individual (and TorrentFreak provides a link to a sample letter). See: Privacy Prevails: German ISP Forced To Delete IP Logs at Torrentfreak. Thanks to Links: Ben Laurie Blathering for the link.
Today's New York Times comments on new technologies that make cell phones "buddy beacons" (or stalker tools):
Cellphone as Tracker: X Marks Your Doubts - New York TimesTHE diminutive cellphone is turning out to be the most clever of devices. As it connects to more networks, stores more kinds of data, delivers more kinds of entertainment — wherever we happen to be — it effectively becomes the most personal computer we own.
Now, as more of the handsets are equipped to use the Global Positioning System, the satellite-based navigation network, we are on the verge of enjoying services made possible only when information is matched automatically to location. Maps on our phones will always know where we are. Our children can’t go missing. Movie listings will always be for the closest theaters; restaurant suggestions, organized by proximity. We will even have the option of choosing free cellphone service if we agree to accept ads focused on nearby businesses.
None of this entails anything exotic. The technology has been ready for a while, but not the customers. Prospective benefits have seemed paltry when placed against privacy concerns. Who will have access to our location information — present and past? Can carriers assure us that their systems are impervious to threats from stalkers and other malicious intruders or neglectful employees — or from government snoops without search warrants? Contemplating worst-case scenarios, our hands holding these very mobile devices have been frozen, hesitant to turn the location beacon on. Are we finally ready to flip the switch? ....
Last Saturday's New York Times ran a lengthy article on the rehabilitation of ChoicePoint. The one-time poster child for privacy fiascos has since apparently cleaned up its act. Now members of the "privacy possee" are quoted as singing the company's praises after it gots its house in order. Right after the high-profile privacy breach, representatives of the company contacted members of the privacy community (I even got a call) to ask what they did right and what they did wrong in responding to the incident. Since then, many of their harshest critics hail the company as a model for the data brokerage industry. Check it out: Keeping Your Enemies Close - New York Times.
The article also has a great timeline illustrating the number and magnitude of privacy incidents in the US over the past few years:
Cracked it! Special reports Guardian Unlimited:...By last month, Booth, Laurie and I each had access to a new biometric chipped passport and were ready to begin testing them. Laurie's first port of call was the ICAO's website, where the organisation had published specifications for the new travel documents. This is where he learned that the key to opening up the secure chip was contained in the passports themselves - passport number, date of birth and expiry date.
"I was amazed that they made it so easy," Laurie says. "The information contained in the chip is not encrypted, but to access it you have to start up an encrypted conversation between the reader and the RFID chip in the passport.
"The reader - I bought one for £250 - has to say hello to the chip and tell it that it is authorised to make contact. The key to that is in the date of birth, etc. Once they communicate, the conversation is encrypted, but I wrote some software in about 48 hours that made sense of it.
"The Home Office has adopted a very high encryption technology called 3DES - that is, to a military-level data-encryption standard times three. So they are using strong cryptography to prevent conversations between the passport and the reader being eavesdropped, but they are then breaking one of the fundamental principles of encryption by using non-secret information actually published in the passport to create a 'secret key'. That is the equivalent of installing a solid steel front door to your house and then putting the key under the mat."
Within minutes of applying the three passports to the reader, the information from all of them has been copied and the holders' images appear on the screen of Laurie's laptop. The passports belong to Booth, and to Laurie's son, Max, and my partner, who have all given their permission....
Michael Geist has a snapshot of what's been scheduled so far for the PIPEDA review before the House Standing Committee on Information, Ethics and Privacy:
Michael Geist - PIPEDA Review Schedule Unfolds:The Standing Committee on Access to Information, Ethics, and Privacy launches the PIPEDA review next week with three hearings now on tap. Representatives from Industry Canada will appear on Monday, Richard Rosenberg and Colin Bennett, two B.C. experts appear on Wednesday, and Privacy Commissioner of Canada Jennifer Stoddart is scheduled to appear on Monday, November 27th. The Committee is still open to written submissions and proposals for oral presentations.
Update (20070118): For links to the full hearing transcripts, go to: Canadian Privacy Law Blog: PIPEDA Review Transcripts.
I am confident that I would not suggest that a client put this on its website, but I found it to be the funniest website privacy policy I've ever read. (I am also confident that the words "funny" and "privacy policy" don't hang out together all that often. Like ever.)
SoutheastTexasLive.com - Southeast Texas' ONLY online entertainment pageSoutheast Texas Live Privacy Policy
I. Privacy Policy:
Subsection z: Caution. This Privacy Policy contains humor and is actually pretty funny. If you have been told you have a lousy sense of humor or you do not appreciate simple (my mom calls it potty) humor please CLICK HERE for our serious (and legal) privacy policy. By continuing to read past this point and not reading the serious privacy policy, you agree not complain if you are offended in any way and agree to the legality of our legal privacy policy (which is the exact same, just not funny. At all.) And just so you know, by accessing and using this website, you agree to abide by our privacy policy and furthermore hold SoutheastTexasLive.com, its parent companies, shareholders, investors, and business partners blameless for any disagreement you may have over content, opinions, photos, headlines, or anything else contained within this website or on the websites of our partners and advertisers. Cool?
A. Personal Information We will only collect the personally identifiable information you willingly provide to us, such as your name, address and email address. If you choose not to provide us with information we ask for when filling out forms, forums, contests, and anything else you may encounter we ask you not give us intentionally fake information. For instance, do not give us your friends or neighbor's phone numbers as a substitute for your own. This way, if we call you at 4 o'clock in the morning, we know we are bothering the right person. Your personal information is used by us to respond to your requests, to process your transactions, for administrative purposes, to process prizes, and to send you information about SoutheastTexasLive.com's programs and, occasionally, advertising/promotional material from some of its advertising and strategic partners. You are more than welcome to give us nicknames, pseudonym, alias, tag, street name, handle, stage name, Christian name, affectionate name, or title. Just make sure that if we call you at 4 o'clock in the morning that you will know it is you with whom we are asking to speak. We may also use your personal information for internal business purposes, such as analyzing and managing our businesses.
B. Financial Information We will only collect your financial information such as account or credit card numbers, from you when you make purchases on this site. We will use your financial information to process your transactions. We will never store this information online or use it to buy our girlfriend something pretty. By making a purchase on this site, you consent to our providing your financial information to our service providers and to such third parties as we determine is necessary to process your transactions. These third parties may include the credit card companies and banking institutions used to process the transaction. They may also include the U.S. Government if subpeoned because they need to study terrorist purchasing t-shirts, music, and newspapers. For this, we apologize on behalf of our government.
C. Demographic Information We may also collect demographic data, such as your date of birth, gender, and zip code. Demographic data may be used to tailor your experience at this site, such as showing you content including special events and advertising that you might be interested in, and displaying the content according to your zip code. We're not really this advanced yet, but it helps to have all our ducks in a row. We promise not to tell your friends if you happen to like visiting our children's area or wearing women's clothing. We mean you John.
On occasion, aggregate information that does not identify any particular user may be compiled and shared with strategic partners, merchants and advertisers. We had to look up aggregate on dictionary.com too. Don't feel bad.
D. Passive Collection of Non-Personal Information. This site often requires the use of encrypted or non-encrypted cookies, pieces of information that a web site places in a file on your computer associated with your browser that may be used to deliver content specific to your interests and for other purposes, such as security and other account administrative functions, and which may track personal identifying information. This information is processed passively by your browser as you surf through this site. You CANNOT dunk these cookies in milk. Nor can you reheat them in the oven. Attempting to do so may result in complete equipment failure and possibly void your manufacturer's warranty. IF you were lucky enough to get one without paying an arm and leg for it.
II. Disclosure of Information to Third Parties
A. Strategic Partners From time to time we may enter into a special relationship with another company that is not owned by or affiliated with SoutheastTexasLive.com to provide additional features on this site. We assure you this is merely a plutonic relationship and you will never see us kissing in public. These special relationships may include business partners, sponsors, and co-branded sites (referred to here as “co-branded sites”). Any information, including personal information, that you provide on one of these co-branded sites will be shared with these third party partners. Don't worry, they have been tested for virus' and have had their shots. By participating in activities or providing your information on these co-branded sites, you also consent to our providing your personal information to those third parties. Since these third parties will use your information in accordance with their own privacy practices, you should check their Web sites for information regarding their individual privacy policies. We doubt their policies will be as entertaining as ours, but you already knew that.
B. Service Providers We may use third party service providers to help us operate our business and this site or administer activities on our behalf, such as authorization of credit card transactions, order fulfillment, and sweepstakes administration. We may share your information with these third parties for those limited purposes. For instance, if you participate in a sweepstakes, game, or loyalty program resulting in a prize or award, we will share personally identifiable information about you to our games and merchandise fulfillment and management agencies. This may include your name, physical description, baby photos of you, embarassing morning "candids", pet names (like 'Snookie' or 'Cuddly-Bear'), or the ever popular "look how far I'm sticking my finger up my nose" shot.
C. Other Disclosures Unless specified in this Privacy Statement or another activity-specific privacy statement, personally identifiable information of any individual user is never shared with other companies outside SoutheastTexasLive.com, except as follows: (i) as permitted by law, (ii) in the event of a transfer of ownership, assets or a bankruptcy of SoutheastTexasLive.com, (iii) where we determine that disclosure of specific information is necessary to comply with the request of a law enforcement or regulatory agency, (iv) to protect the interests or safety of SoutheastTexasLive.com or other visitors to this site (v) . We will never use your information to ask you on a date, blackmail you, or locate your home to toilet paper it.
III. LINKS AND THIRD PARTIES' PRIVACY PRACTICES
This site may contain links to other sites which are not operated by SoutheastTexasLive.com. SOUTHEASTTEXASLIVE.COM IS NOT RESPONSIBLE FOR THE PRIVACY PRACTICES OR THE CONTENT OF SUCH OTHER WEB SITES. SoutheastTexasLive.com recommends that you review the privacy policy of third party Web sites arrived at from links on this site. You agree to hold us blameless for any naughty words, naughty content, offensive imagery, or other questionable things you may come across in your web travels. This includes seeing your mother or teacher naked. Yes, we said naked. Naked. We mean nude, though.
IV. OPT-IN/CHOICE
This site provides you with the opportunity to opt-in to receive weekend updates and partner notices from SoutheastTexasLive.com. If you do not opt-in, SoutheastTexasLive.com will not send you its promotional offers or someone to your house to break your legs. We're just not that way. However, regardless of your opt-in preferences, sexual bias, religious choices, and whether you really do like long walks on the beach at sunset, SoutheastTexasLive.com may still at times need to send program emails for administrative reasons. Note: Your opt-out preference may not be retroactive in certain instances where you agreed to receive brand-specific communications. SoutheastTexasLive.com also gives you convenient methods for removing your information from our database so as not to receive future communications or to close your account:
• Email us @ TakeMyNameOffYourList@southeasttexaslive.com Please put "I still love you" as the headline to make our webmaster feel better. • You may send mail to the following postal address:
SoutheastTexasLive.com Website Customer Care 380 Main Street Beaumont, TX 77701
• Or just cry and whine about it to your friends and family and hope something gets done.
V. UPDATES TO THIS PRIVACY STATEMENT
SoutheastTexasLive.com reserves the right to make changes in this Privacy Statement. In the event that SoutheastTexasLive.com makes a material change to this Privacy Statement, it will be posted here. We encourage you to check this page regularly since your continued use of this site following any changes to this Privacy Statement will be deemed to constitute your acceptance of such change. This includes your agreeance to fork over your first born upon demand and the transferance of any inheritance to us should we decide to put that in. And you may have to take us out for dinner one night. Or a movie. We haven't decided.
VI. REVIEWING/CORRECTING/UPDATING YOUR INFORMATION
This site gives you several options for reviewing, correcting, updating or otherwise modifying information you have previously provided:
• Email us @ ChangeMyInfo@southeasttexaslive.com Please put "please" as the headline to make our webmaster feel wanted. • You may send mail to the following postal address:
SoutheastTexasLive.com Website Customer Care 380 Main Street Beaumont, TX 77701 Please note, changes may not be effective immediately if at all. And it's not our fault. It's your mother's.
VII. CONTACTING SOUTHEASTTEXASLIVE.COM
If you have any questions about this Privacy Statement, the practices of the this site, you may contact:
SoutheastTexasLive.com Website Customer Care 380 Main Street Beaumont, TX 77701 Telephone # 409-880-0718 http://www.southeasttexaslive.com/contactUs.html
When writing, please include your name, the problem, pie (or cake), and a return address (so if it's a nasty letter we can toilet paper your house).
The Information and Privacy Commissioner of Saksatchewan, Gary Dickson, has released his annual report for 2005-2006, calling for a significant overhaul of the province's public sector legislation. See: Saskatchewan told to update privacy laws that expose residents to risk - Yahoo! Canada News.
From the Commissioner's media release:
SaskatchewanInformation and Privacy Commissioner
NEWS RELEASE – November 16, 2006
Saskatchewan Information and Privacy Commissioner tables 2005-2006 Annual Report.
Saskatchewan’s Information and Privacy Commissioner, Mr. Gary Dickson, has submitted his Annual Report for 2005-2006 to the Legislative Assembly. The document is available at the website: www.oipc.sk.ca.
Dickson recommends action by the Saskatchewan Government to make Deputy Ministers and CEOs of Crown corporations and local authorities explicitly accountable for access and privacy compliance in their organizations.
The Commissioner also highlights unfinished business from his last Annual Report. Of six major recommendations in his 2005 Privacy and Access: A Saskatchewan ‘Roadmap’ for Action, there has been no action taken on four recommendations, namely:
- Extend privacy protection to private sector employees in Saskatchewan;
- Conduct a public review of our 14 year old law, The Freedom of Information and Protection of Privacy Act, and then make the necessary changes to modernize that first- generation law;
- Integrate two separate access and privacy laws into a single law to make it more understandable and easier to comply;
- Ensure that public registries address the new challenges to the privacy of citizens.
The Commissioner also highlighted two emerging issues that warrant attention:
- Development of an electronic health record for every man, woman and child in Saskatchewan poses major challenges to the protection of privacy. “It will be important to get the ‘privacy piece’ of the EHR right so that citizens will continue to be frank and candid when they deal with their family physician and other primary providers.”
- There is a popular trend to promote ‘shared services’, whether SchoolPlus for children at risk, or multi-department delivery of services for adults. This trend requires a careful rethinking of the way access to information and privacy will be managed.
