Blocked! By the Great Firewall of China

I don't know if I should be offended or flattered that this blog is blocked by the Great Firewall of China.

Check out the status of your URL here: http://www.greatfirewallofchina.org/test/.

Alberta Commissioner Order about journalistic collection and disclosure of personal information

The Information and Privacy Commissioner of Alberta just released a new Order in which the he determined he did not have jurisidction because the personal information in question was collected and disclosed for journalistic purposes, which is excluded from the purview of the Personal Information Protection Act.

Order P2005-004

Summary: The Complainant alleged that the Organization had disclosed the Complainant's personal information when it published a newspaper article. The Organization argued that the disclosure of personal information in the form of a newspaper article was for journalistic purposes only as provided for by section 4(3)(c) of the Personal Information Protection Act. As such the Act did not apply to the personal information in question. The Commissioner decided the personal information disclosed were materials written for publication in the media and therefore collected and disclosed for journalistic purposes only in accordance with section 4(3)(c). The Commissioner, having determined that he had no jurisdiction in the matter, further stated that he had no authority to determine the remaining issue of the inquiry, regarding the allocation of a complainant's burden of proof.

Prison time under UK Data Protection Act?

DP Thinker is reporting on his blog that the UK Government intends to add prison time to the penalties available for misuse of personal information in the UK Data Protection Act: DP thinker: Data Protection Act 1998.

New findings from the Office of the Privacy Commissioner of Canada

A bunch of new findings have been released on the Privacy Commissioner's website recently:

Commissioner's Findings - Privacy Commissioner of Canada

• PIPEDA Case summary #364: Employer agrees to revise language of consent form regarding exchange of health information
• PIPEDA Case summary #363: Registrar collects personal information to combat domain name hijacking
• PIPEDA Case summary #362: Insurance adjuster readjusts its collection practices
• PIPEDA Case summary #361: Retailer requires photo identification to exchange an item
• PIPEDA Case summary #360: Bank erroneously e-mails employees’ personal information to client
• PIPEDA Case summary #359: Bank reported accurate information regarding bounced cheque
• PIPEDA Case summary #358: Individual objects to insurance company’s consent requirements
• PIPEDA Case summary #357: Inconclusive evidence of disclosure prompts fitness club to clarify privacy policy for clients and staff
• PIPEDA Case summary #356: Customer’s banking personal information found in a recycling bin
• PIPEDA Case summary #355: Funeral home’s disclosure in pursuit of a debt allowed under the Act
• PIPEDA Case summary #354: Fees for access questioned
• PIPEDA Case summary #353: Bank’s Ombudsman revises agreement to clearly explain exchanges of personal information between it and the bank

Commissioner pressured bank to go public on data loss

It has been suggested that the only reason why CIBC went public in announcing that Talvest Mutual Funds' files went missing is because of pressure from the Privacy Commissioner of Canada (Watchdog pushed CIBC on lost file). Advocates for mandatory notification will likely use this as evidence that companies will not go pubic unless pressured to do so.

RCMP seeks easier access to personal information

The Parliamentary Committee on Access to Information, Privacy and Ethics continues its five year review of PIPEDA, most recently hearing from the Royal Canadian Mounted Police on Tuesday and the Privacy Commissioner on Wednesday.

The RCMP is calling for lowering the bar in PIPEDA to allow greater access to personal information in the course of investigations. The Act, as it is currently in force, allows organizations to provide personal information without consent to law enforcement in certain circumstances. Section 7(3)(c.1)(iii) of PIPEDA allows this, but only where the law enforcement agency has "lawful authority to obtain the information":

Disclosure without knowledge or consent

(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is ...

(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that

(i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs,

(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or

(iii) the disclosure is requested for the purpose of administering any law of Canada or a province;

Representatives of the RCMP told the committee this requirement is the force's largest single impediment in child exploitation investigations. The force would like the ability to get pesonal information even in circumstances where they don't have enough to justify a warrant.

The Privacy Commissioner is not at all impressed.

For media coveage, see: Federal watchdog and RCMP battle privacy protection.

And for some earlier discussions on this and related topics, see label:warrants.

T.J. Maxx probe finds broader hacking

This isn't good:

T.J. Maxx probe finds broader hacking | Tech News on ZDNet

The TJX Companies, the discount retailer best known for its T.J. Maxx and Marshalls clothing stores, said Wednesday that its hacking investigation has uncovered more extensive exposure of credit and debit card data than it previously believed.

Information on millions of TJX customers may have been exposed in the long-running attack, which was made public last month. It affects customers of any of TJX store in the U.S., Canada or Puerto Rico, with the exception of its Bob's Stores chain.

The breach of credit and debit card data was initially thought to have lasted from May 2006 to January. However, TJX said Wednesday that it now believes those computer systems were first compromised in July 2005.

TJX said credit and debit card data from January 2003 through June 2004 was compromised. The company previously said that only 2003 data may have been accessed. According to TJX, however, some of the card information from September 2003 through June 2004 was masked at the time of the transactions.

The company added that names and addresses apparently were not included with the card information, that debit card PIN numbers are not believed to have been vulnerable, and that data from transactions made with debit cards issued by Canadian banks likely were not vulnerable.

TJX also found that there was evidence of intrusion into the system that handles customer transactions for its T.K. Maxx stores in the United Kingdom and Ireland, but that there has been no confirmation that anyone actually accessed that data.

In addition to these exposures, TJX said there were more breaches of driver's license information than it previously thought. These included the license numbers, names and addresses of customers making merchandise returns in the U.S. and Puerto Rico locations of T.J. Maxx, Marshalls and HomeGoods stores. That compromised data, according to TJX, is restricted to returns without receipts that took place in the last four months of 2003, as well as in May 2004 and June 2004.

TJX plans to notify customers whose driver's license data may have been accessed.

The company, which is continuing its investigation, encourages customers to check their credit-card and bank-account records and look for further updates on its website.

Kids, the Internet, and the End of Privacy: The Greatest Generation Gap Since Rock and Roll

Last night, I went to a party for a colleague celebrating her 36th birthday. The theme was pretty clever: to celebrate the tewentieth anniversary of her sweet sixteen. Guests were encouraged to wear their best '80s outfits. A number did and the outfits were classic. With MC Hammer blaring in the bar, there was some reminiscing about the teen years, twenty years ago.

My generation is very different from those currently going through their teen years. I have to go down to the basement and open a trunk to find all the pictures that I took during those years. Many current teens just need to log into Myspace, Friendster, Flickr or pull up their blogs to find the full, detailed chronicle of their adolescence.

I'm a different person from who I was twenty years ago. I don't think I'd want to have that time of huge changes and wholesale weirdness on the 'net for all to see. (At the time I might have thought it was cool, but in retrospect .... not so much.)

Last week's New York magazine has a very interesting, feature length article on current teens and how their experiences are chronicled in great detail on the internet. Much of it deals with ADHD type attention spans and attention whoring, but the perception of privacy is very interesting.

Kids, the Internet, and the End of Privacy: The Greatest Generation Gap Since Rock and Roll -- New York Magazine

Kids today. They have no sense of shame. They have no sense of privacy. They are show-offs, fame whores, pornographic little loons who post their diaries, their phone numbers, their stupid poetry—for God’s sake, their dirty photos!—online. They have virtual friends instead of real ones. They talk in illiterate instant messages. They are interested only in attention—and yet they have zero attention span, flitting like hummingbirds from one virtual stage to another.

But maybe it’s a cheap shot to talk about reality television and Paris Hilton. Because what we’re discussing is something more radical if only because it is more ordinary: the fact that we are in the sticky center of a vast psychological experiment, one that’s only just begun to show results. More young people are putting more personal information out in public than any older person ever would—and yet they seem mysteriously healthy and normal, save for an entirely different definition of privacy. From their perspective, it’s the extreme caution of the earlier generation that’s the narcissistic thing. Or, as Kitty put it to me, “Why not? What’s the worst that’s going to happen? Twenty years down the road, someone’s gonna find your picture? Just make sure it’s a great picture.”

And after all, there is another way to look at this shift. Younger people, one could point out, are the only ones for whom it seems to have sunk in that the idea of a truly private life is already an illusion. Every street in New York has a surveillance camera. Each time you swipe your debit card at Duane Reade or use your MetroCard, that transaction is tracked. Your employer owns your e-mails. The NSA owns your phone calls. Your life is being lived in public whether you choose to acknowledge it or not.

So it may be time to consider the possibility that young people who behave as if privacy doesn’t exist are actually the sane people, not the insane ones. For someone like me, who grew up sealing my diary with a literal lock, this may be tough to accept. But under current circumstances, a defiant belief in holding things close to your chest might not be high-minded. It might be an artifact—quaint and naïve, like a determined faith that virginity keeps ladies pure. Or at least that might be true for someone who has grown up “putting themselves out there” and found that the benefits of being transparent make the risks worth it.

Mining drivers' licence databases raises privacy concerns

Yesterday's New York Times ran an interesting article on the increasing application of biometrics to drivers' licenses in the United States, and the collateral use of this technology. For example, photos from state databases are run against the rest of the database to identify those who have multiple licenses (to try to thwart a license suspension) or against photos of wanted felons. This practice has privacy advocates upset:

Driver’s License Emerges as Crime-Fighting Tool, but Privacy Advocates Worry - New York Times

“What is the D.M.V.?” asked Lee Tien, a lawyer with the Electronic Frontier Foundation and a privacy advocate. “Does it license motor vehicles and drivers? Or is it really an identification arm of law enforcement?”

Anne L. Collins, the Massachusetts registrar of motor vehicles, said that people seeking a driver’s license at least implicitly consent to allowing their images to be used for other purposes.

“One of the things a driver’s license has become,” Ms. Collins said, “is evidence that you are who you say you are.”

US Federal Court limits police surveillance of protests

A federal court judge in New York has delivered a strong rejection the practice of routine law enforcement video taping of protests unless there is actual reason to believe that illegal acts will be comitted.

Judge Limits New York Police Taping - New York Times

In a rebuke of a surveillance practice greatly expanded by the New York Police Department after the Sept. 11 attacks, a federal judge ruled yesterday that the police must stop the routine videotaping of people at public gatherings unless there is an indication that unlawful activity may occur.

Four years ago, at the request of the city, the same judge, Charles S. Haight Jr., gave the police greater authority to investigate political, social and religious groups.

In yesterday’s ruling, Judge Haight, of United States District Court in Manhattan, found that by videotaping people who were exercising their right to free speech and breaking no laws, the Police Department had ignored the milder limits he had imposed on it in 2003....

Related

• Text of the Decision (pdf)
• The Empire Zone Blog: Court Case Primeval
• Police Infiltrate Protests, Videotapes Show (Dec. 22, 2005)
• Video: N.Y.C. Police Surveillance

From Boing Boing.