Federal court orders disclosure of eBay PowerSeller records to Canada Revenue Agency

Michael Geist, on his great blog, is pointing to an article in yesterday's Globe & Mail, in which the Federal Court of Canada has ordered that eBay Canada turn over records related to Canadian PowerSellers. As the Court's decision says, the Income Tax Act authorizes such fishing expeditions.

What is probably of greatest relevance from a privacy point of view is that the location of the information is not entirely relevant:

[23] The issue as to the reach of section 231.2 when information, though stored electronically outside Canada, is available to and used by those in Canada, must be approached from the point of view of the realities of today’s world. Such information cannot truly be said to “reside” only in one place or be “owned” by only one person. The reality is that the information is readily and instantaneously available to those within the group of eBay entities in a variety of places. It is irrelevant where the electronically-stored information is located or who as among those entities, if any, by agreement or otherwise asserts “ownership” of the information. It is “both here and there” to use the words of Justice Binnie in Society of Composers, Authors and Music Publishers of Canada v. Canadian Ass’n of Internet Providers, 2004 SCC 45 (CanLII), [2004] 2 S.C.R. 427 at paragraph 59. ...

[24] In the present case, eBay Canada has access to and uses information respecting PowerSellers. It is not determinative of the issue that the electronic apparatus storing the information which eBay Canada accesses is outside Canada. The information can be summoned up in Canada and for the usual business purposes of eBay Canada. The situation may be different if the information never had been used in Canada.

[25] To analogize to R. v. Spencer, supra, the information that the bank manager had is summonable from his memory but it was placed in his memory through transactions he witnessed in the Bahamas. Nonetheless, he was required to summon up the information in Canada. Here eBay Canada has access to and uses information stored in a computer for the very purpose of dealing with Canadian PowerSellers. For perhaps corporate efficiency the information is stored elsewhere, but its purpose is in respect of Canadian business. The information is not foreign but within Canada for the purposes of section 231.2 of the Income Tax Act.

See: globeandmail.com: Taxman goes browsing on eBay and Michael Geist - Federal Court Orders eBay To Disclose Power Sellers to CRA.

Inadequate security safeguards led to TJX breach, Commissioners say

The federal Privacy Commissioner and the Information and Privacy Commissioner of Canada have released their reports on the TJX/Winners breach (Report of Findings (September 25, 2007) Privacy Commissioner of Canada and Investigation Report P2007-IR-006). The moral of the story: don't collect information you don't need, don't keep it any longer than you need and properly secure the information you have.

Here's the media release:

News Release: Inadequate security safeguards led to TJX breach, Commissioners say (September 25, 2007) - Privacy Commissioner of Canada

Inadequate security safeguards led to TJX breach, Commissioners say

September 25, 2007 –The risk of a breach of sensitive personal information held by TJX Companies Inc., the US parent company of Winners and HomeSense stores in Canada, was foreseeable, but the company failed to put in place adequate security safeguards, an investigation by the Privacy Commissioners of Canada and Alberta has found.

“The company collected too much personal information, kept it too long and relied on weak encryption technology to protect it – putting the privacy of millions of its customers at risk,” says Privacy Commissioner of Canada Jennifer Stoddart.

“Criminal groups actively target credit card numbers and other personal information,” says Commissioner Stoddart. “A database of millions of credit card numbers is a potential goldmine for fraudsters and it needs to be protected with solid security measures.

“The TJX breach is a dramatic example of how keeping large amounts of sensitive information – particularly information that is not required for business purposes – for a long time can be a serious liability.”

The joint investigation by the two Commissioners was launched after TJX disclosed in January that its computer system had been breached. This breach involved millions of credit and debit card numbers as well as other personal information, such as driver’s license numbers collected when customers returned merchandise without receipts.

“This case is a wake-up call for all retailers. They must collect only the personal information necessary for a transaction,” says Frank Work, the Information and Privacy Commissioner of Alberta.

“One positive outcome of this extremely unfortunate breach is that TJX worked cooperatively with us to develop a new process for dealing with unreceipted returns which strikes an appropriate balance between privacy rights and a retailer’s need to take steps to prevent fraud.”

TJX believes the intruder may have initially gained to customer information via the wireless local area networks at two of its US stores. Customer information was stolen from mid-2005 through December 2006, a TJX investigation found. Some stolen information involved transactions dating back to 2002.

Stolen information included credit card account data as well as data collected when customers returned merchandise without a receipt (drivers’ license numbers, names and addresses).

The investigation concluded TJX did not comply with the federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA), and Alberta’s Personal Information Protection Act (PIPA). The investigation found:

• TJX did not properly manage the risk of an intrusion against the amount of customer data that it collected.
• The company failed to act quickly in converting from a weak encryption standard to a stronger standard. The conversion process took two years to complete, during which time the breach occurred.
• TJX did not meet its duty to monitor its computer systems vigorously. An adequate monitoring system should have alerted the company of an intrusion prior to December 2006.
• The company did not adhere to the requirements of the Payment Card Industry Data Security Standard, which was developed to address the growing problem of credit card data theft.

The investigation also found the company did not have a reasonable purpose to collect driver’s license and other identification numbers when unreceipted merchandise was returned. TJX stated it asked for this information as part of a fraud prevention process to identify people frequently returning merchandise. It retained the driver’s license numbers – an extremely valuable piece of information for identity thieves – indefinitely.

In response to these concerns, TJX proposed a new process to address fraudulent returns. Store staff will continue to ask for identification, however, information such as a driver’s license number will instantly be converted into a unique identifying number when it is keyed into the point-of-sale system. This will allow the company to track unreceipted merchandise returns without keeping original driver’s license numbers in its system.

The Commissioners called on TJX to take a number of steps to improve its security measures and privacy practices and are pleased the company has agreed to follow these recommendations.

Commissioner Stoddart says the Winners/HomeSense breach illustrates the need to get security right in the first place to avoid the potentially huge costs of mopping up after a security breach. “Organizations need to ensure they have multiple layers of security and that they keep up with advances in security technologies. The cost of failing to do this can be enormous – not only to a company, but to its customers,” she says, adding that a data breach can also have a major impact on credit card companies, banks, law enforcement agencies and regulatory bodies.

A summary of the findings in the case is available on the Commissioners’ websites.

The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman, advocate and guardian of privacy and the protection of personal information rights of Canadians.

The Information and Privacy Commissioner of Alberta has a mandate to promote a society where personal privacy is respected and public bodies are open and accountable.

Mom upset after son's photos scalped from website

CBC is reporting that a Portugese social networking website has been taking pictures of kids from Flickr.com and has been giving them fictitious biographical profiles. Parents of those kids who have discovered this are pretty upset. See: Mom upset after son's photos scalped from website.

Federal and Alberta Commissioners to release report on TJX breach

According to a media advisory released by the Privacy Commissioner of Canada, both the federal and Alberta commissioners are going to release their findings on the TJX/Winners/Home Sense privacy breach tomorrow morning in Montreal. See: Media Advisory: September 24, 2007 - Privacy Commissioners to release report on Winners/HomeSense breach - Privacy Commissioner of Canada.

Report calls for revamped privacy laws in New Brunswick

A consultant's report is calling for a significant overhaul of public sector privacy laws in New Brunswick. Via the CBC: N.B. privacy laws 'hopelessly outdated': report.

Ad-supported phone service listens to calls to customize advertising

Does this creep you out?

Is there any difference between this and Gmail's ads?

Company Will Monitor Phone Calls to Tailor Ads StarNewsOnline.com Star-News Wilmington, NC

Pudding Media is introducing an Internet phone service that will be supported by advertising related to what people are talking about during their calls.

Companies like Google scan their e-mail users’ in-boxes to deliver ads related to those messages. Will people be as willing to let a company listen in on their phone conversations to do the same?

Pudding Media, a start-up based in San Jose, Calif., is introducing an Internet phone service today that will be supported by advertising related to what people are talking about in their calls. The Web-based phone service is similar to Skype’s online service — consumers plug a headset and a microphone into their computers, dial any phone number and chat away. But unlike Internet phone services that charge by the length of the calls, Pudding Media offers calling without any toll charges.

The trade-off is that Pudding Media is eavesdropping on phone calls in order to display ads on the screen that are related to the conversation. Voice recognition software monitors the calls, selects ads based on what it hears and pushes the ads to the subscriber’s computer screen while he or she is still talking.

A conversation about movies, for example, will elicit movie reviews and ads for new films that the caller will see during the conversation. Pudding Media is working on a way to e-mail the ads and other content to the person on the other end of the call, or to show it on that person’s cellphone screen...

Google modifying street view to meet Canadian privacy expectations

According to the Globe & Mail, Google is looking into blurring faces and license plates in its Canadian version of Street View to satisfy the requirements of local privacy laws. This is in the wake of earlier reports that the Canadian Privacy Commissioner, Jennifer Stoddart, had written to Google and Immersive Media with her view that rolling out the service would likely infringe Canada's Personal Information Protection and Electronic Documents Act. (See: Canadian Privacy Law Blog: Privacy Commissioner questions legality of Google Street View in Canada.)

globeandmail.com: Google: we hear (and see a fuzzy rendition of you), Canada

The man in charge of Google's privacy policy says the Internet giant is working on a version of its controversial Street View service that won't breach Canadian privacy rules, after federal privacy commissioner Jennifer Stoddart raised concerns about the service earlier this month.

Peter Fleischer, Google's global privacy counsel, said in an interview from Montreal on Monday the company understands Canada has "struck a different balance" than the U.S. has in terms of what is public and what is private, and that Google is sensitive to those differences.

Street View, which has data available from seven U.S. cities but does not yet include any Canadian sites, is a tool that shows users street-level photographs of the addresses they are searching for. Some of the photos, which are being taken by a fleet of cars belonging to Immersive Media of Calgary, show individuals entering adult-video stores and urinating in public.

In comments earlier this month, Ms. Stoddart said that she had contacted Google and Immersive Media to express her concerns that taking photos of people -- even in public -- for such a service might violate Canadian privacy laws.

The United States has "a long tradition of saying that it is legal and appropriate to take pictures from public spaces and publish them," Mr. Fleischer said. "But clearly, we're aware that different countries around the world strike a different balance between this idea of a public place on the one hand and people's expectation of privacy."

...

Mr. Fleischer said the Internet company doesn't have "an exact timeline" of when Street View might be available in Canada, but said Google is working on it now. Altering the quality of the photos "makes it a little harder for us [to launch Street View in Canada], because it takes a little more work," he said.

Commissioner says we're all "little brothers" in surveillance society

The Privacy Commissioner of Canada, who is promoting an international privacy conference taking place in Montreal this week, is interviewed in the National Post. The focus of the interview is the "little brothers" that have an impact on privacy, including the proliferation of digital cameras. See:

Print Story - canada.com network

Ordinary citizens part of 'surveillance society': Privacy czar

Carly Weeks

CanWest News Service

Sunday, September 23, 2007

OTTAWA -- If you think the oppressive hand of Big Brother is the only threat to personal privacy in today's digital society, think again.

Our camera phone-toting friends and strangers in the online universe can be just as responsible for the erosion of the truly private life as the corporations and government agencies that keep tabs on citizens in the name of product sales and national security, warns federal Privacy Commissioner Jennifer Stoddart.

"It's not just Big Brother who's akin to a government watching you in the Orwellian dystopia," Ms. Stoddart said in an interview. "We're all little brothers. We're all fascinated with the gadgets that allow you to do this."

The pervasive presence of technology, and its unprecedented capacity to surreptitiously track the lives of others, is one of the issues to be addressed at a major international privacy conference that will be hosted by Ms. Stoddart in Montreal this week.

...

But Ms. Stoddart says people who complain about the watchful eye of governments and corporations should first take a long look in the mirror.

That's because technology and the Internet are turning ordinary citizens into spies who can post pictures of the neighbours' yards online. Even social networking sites like Facebook, intended to let people tell friends and co-workers what they're up to, can be corrupted by the unwanted circulation of false or malicious postings.

"We're all participating in the surveillance society," Ms. Stoddart said, adding that "knowledge gives us power."

She notes that more people are living alone and turn to technological gadgets to satisfy a craving for human contact....

DHS collected more info on travelers than previously disclosed

Yesterday's Washington Post ran a front page story on the amount of information collected by the Department of Homeland Security as part of its Automated Targeting System.

Collecting of Details on Travelers Documented - washingtonpost.com

The U.S. government is collecting electronic records on the travel habits of millions of Americans who fly, drive or take cruises abroad, retaining data on the persons with whom they travel or plan to stay, the personal items they carry during their journeys, and even the books that travelers have carried, according to documents obtained by a group of civil liberties advocates and statements by government officials.

The personal travel records are meant to be stored for as long as 15 years, as part of the Department of Homeland Security's effort to assess the security threat posed by all travelers entering the country. Officials say the records, which are analyzed by the department's Automated Targeting System, help border officials distinguish potential terrorists from innocent people entering the country.

But new details about the information being retained suggest that the government is monitoring the personal habits of travelers more closely than it has previously acknowledged. The details were learned when a group of activists requested copies of official records on their own travel. Those records included a description of a book on marijuana that one of them carried and small flashlights bearing the symbol of a marijuana leaf....

Ontario court quashes adoption disclosure law

Earlier this week, the Ontario Court of Justice struck down the opening of adption records in that provice under the Adoption Information Disclosure Act. The decision is here.

The Information and Privacy Commissioner of Ontario has issued a press release about the decision:

IPC - Office of the Information and Privacy Commissioner/Ontario

News Release September 19, 2007

Court ruling strikes down privacy-invasive provisions of adoption disclosure law: Commissioner Cavoukian

TORONTO – Today’s court decision quashing the opening of past adoption records through Ontario’s Adoption Information Disclosure Act confirms the importance of an individual’s right to privacy, said Ontario Information and Privacy Commissioner, Ann Cavoukian.

The ruling declares that the law is unconstitutional – it breaches section 7 of the Canadian Charter of Rights and Freedoms and thus, the sections of the Act relating to access to birth registration information “are declared invalid and of no force and effect.” As the Court noted, the Charter, “… is intended primarily to protect individuals and minorities against the excesses of the majority.”

The Commissioner constantly urged the government to amend the legislation to protect the privacy of past adoptions, giving birth parents and adoptees the right to file a “disclosure veto,” which would allow them the option of blocking access to their birth registration information. While this would provide much-needed protection for the minority, it would, as the Court noted, “… in fact allow the vast majority to get the information they were seeking.”

“While I supported the overall thrust of this Act, I fought long and hard to convince the Ontario government to introduce a crucial amendment that would provide much-needed protection for a number of deeply worried birth mothers and adoptees. Some literally feared that the Act – without the amendment I proposed – would shatter their lives. Now their prayers have been answered.”

Commissioner Cavoukian did not object to the opening of future records, but repeatedly cautioned that changing the rules retroactively, and exposing the identities of birth parents who entered into the adoption process in an era when secrecy was the norm, could have major repercussions. Despite the passing of the Act last year, the Commissioner continues to receive heart-wrenching letters, e-mails and calls from birth parents and adoptees expressing their concern – and in some cases great fear and despondency.

This court ruling will mean that Ontario residents no longer have less privacy protection than persons in the three other Canadian provinces that have adoption disclosure laws where the legislation is applied retroactively. Each of those provinces – unlike Ontario – passed laws with a provision for a disclosure veto for those who were involved in adoptions prior to the new legislation. “This is what should have happened here” says Commissioner Cavoukian.

In the words of the Court, “People expect, and are entitled to expect, that the government will not share [confidential personal] information without their consent. The protection of privacy is undeniably a fundamental value in Canadian society, especially when aspects of one’s individual identity are at stake.”

The Information and Privacy Commissioner is appointed by and reports to the Ontario Legislative Assembly, and is independent of the government of the day. The Commissioner's mandate includes overseeing the access and privacy provisions of the Freedom of Information and Protection of Privacy Act, the Municipal Freedom of Information and Protection of Privacy Act, and the Personal Health Information Protection Act, and helping to educate the public about access and privacy issues.