Privacy News Highlights
09—15 March 2006
Contents:
EU – European Data
Protection Supervisor Issues Press Release on EURODAC
CA – Toronto Pearson Airport Developing Biometrics
Security Program for Travellers
UK – Biometric Immigration Control Now Live at Heathrow
JP – Japanese Cabinet Backs Foreigner Fingerprinting Plan
UK – Supermarket Trials Fingerprint Payment Technology
CA – Microsoft, UofT, Bell Team up on Business Privacy
Network
CA – Anti-Census Website Launched
CA – Edmonton Police Rapped for Improper CPIC Use
CA – Federal Privacy Commissioner to Review New CIBC Fax
Fiasco
CA – RCMP Investigates B.C. Government Computer Breach
SK – Privacy Watchdog Gets Budget Hike
CA – Online Gun Registry Called “Online Shopping List for
Criminals”
AB – Alberta Introduces Bill to Block PATRIOT ACT
Disclosures
CA – Analyst Urges Canadian Banks to Improve Online
Authentication, Security
US – E-mail Marketing Company Agrees to $1.1 Million
Settlement
US – Children Email Registry Legislation Moves Forward
UK – Watchdog Updates Data Protection Guidance
UK – Government Determined to Force through ID Cards Bill
EU – MEPs Challenge Secret Report on EU-US Air Data
Privacy
EU – Article 29 Working Party: Webmail Scanning Can Be
Interception
CA – MasterCard Survey: Canadians Need to Guard their PII
WW – Citibank Uncovers Debit Card Fraud
US – Sunshine Week Focuses on Public’s Right to Know
US – Study: States Steadily Restricting Information
EU – Malta Police Considering National DNA database
NF – Newfoundland Privacy Commissioner OK’s Release of
Doctor Billings
WW – Porn Billing Leak Exposes 17 Million Buyers
JP – Japanese Police Force Leaks Huge Amount of Data
Following Virus Attack
JP – Info on 2,800 Patients Uploaded to Internet by Winny
Virus
UK – ID Card Support Collapses
UK – MPs Back Compulsory ID Cards
AU – APF Says Identity Security Disaster Coming
CA – Canadian Identity-Theft Scam Catches 100 People in
Net
US – U.S. Suggests 21-Day Deadline for Google Subpoena
US – Colorado Bankers Back ID Theft Plan
WW – New GPS Service Allows Parents to Track Children
HK – Hong Kong: Keeping Tabs on the Wiretappers
NZ – New Zealand Government Departments Swaps Info on
‘Bad’ Families
HK: Net Search Stumbled on Private Data Cache
US – Pew Study on Online Dating
US – Border ID Plan Worries Tourism Industry
HK – Hong Kong Privacy Commissioner to Investigate Leak
of Identities
US – Report: Web Searches Can Identify CIA Employees
EU – EC Launches Public Consultation on RFID
WW – RFID on All Goods is 15 Years Away, Says Metro
UK – Marks & Spencer to Deploy RFID Tags Women’s
Underwear
WW – Economist Report: RFID Gains Global Momentum,
Privacy Concerns Linger
WW – Security is Part of RFID Spread; Foes Fear Hijacking
of Personal Data
WW – Study Says Chips in ID Tags Are Vulnerable to
Viruses
WW – Study: Internet Security Threat Report Tracks
Notable Rise in Cybercrime Activity
CA – Canadian Chip Card Rollouts to Begin Next Year
US – Gonzales: NSA Program Doesn’t Need a Law
US – ACLU Asks Judge to Immediately Halt Domestic Spying
Program
US – FBI Cites More Than 100 Possible Eavesdropping
Violations
UK – Spy in the Sky Will Help Police Keep an Eye on
Drivers
US – House Committee Approves Phone Data Privacy Bill
US – Panel on Eavesdropping Is Briefed by White House
US – Pentagon Admits Errors in Spying on Protesters
US – FTC Retains Children’s Online Privacy Protection
Rule
US – GAO: Agency Public Information Centers Should Stress
Accuracy
US – Patriot Act Renewed, Some Civil Liberties Safeguards
Added
US – Data Privacy Laws Place New Obligations on Businesses
US – Workers Object to City’s GPS Tracking System
The European Data Protection Supervisor (EDPS) Peter
Hustinx recently completed his first inspection of the EURODAC central biometrics
database. An inspection report has now been sent to Commission, Parliament and
Council, and to data protection authorities in the Member States. The report
covers the first stage of a comprehensive inspection, which will be followed by
an in-depth security audit by mid 2006. The EDPS expresses general satisfaction
with the security level, although a number of concrete recommendations are
given. The EDPS press release states that: “Because of the sensitivity of some
information in the report, it is not publicly available” Tony Bunyan,
Statewatch editor, comments: “This sets a very bad precedent. If this principle
is extended to the Visa Information System, SIS II and in time the EU PNR and
fingerprint databases all we will get is a one page press release. The very
minimum should be a “partially accessible” report with any “sensitive
information” deleted.” [Source]
The company that operates
Last week Heathrow Terminal 1 launched a new
biometrics-based immigration control program. The Iris Recognition Immigration
System (IRIS) will enable registered passengers to enter the
A
Public and private sector organizations have banded
together to create one of
A significant part of the upcoming May, 2006 Canada
Census has been outsourced by Statistics Canada to a
The
Edmonton Police Service has had its knuckles rapped for allowing an officer to
run a check seeking sensitive police information on a private citizen. [Source]
The
federal Privacy Commissioner is looking into a faxing incident involving
Canadian Imperial Bank of Commerce and one of its clients. [Source]
[Source]
The
RCMP has been brought in after a breach of the B.C. government’s computer
system last month. [Source]
[Source]
The provincial government’s information and privacy
watchdog is getting more money but will still have a large backlog of
complaints to deal with as an increasing number of cases come into his office.
[Source]
A former webmaster for the Canadian Firearms Centre
says he could hack a road right through the feds’ online firearms registration
service into the private files of Canadian gun owners. “During my tenure as the
CFC web master I duly informed management that the web site that interfaced to
the firearms registry was flawed. It took some $15-million to develop and I
broke it inside of about 30 minutes”. The webmaster added: “I want to make it
perfectly clear, I never broke into the system. I never crossed that line,” he
said. “I just wanted the federal administrators to know how vulnerable the
system was, and still is. I’m talking about getting access to a gun owner’s
personal information -- number and type of guns, home address, everything.” [Source]
[Source]
[Source]
[Source]
The
A
Forrester analyst says that Cdn banks need to convince their customers that
paying bills online is safe by deploying 2-factor authentication if they want
them to embrace other Web-based services. [Source]
NY AG Eliot Spitzer has agreed to a $1.1 million
settlement from an interactive marketing firm that he said reused e-mail
addresses and other consumer information without authorization. Spitzer
described the case as being possibly "the largest breach of privacy in
Internet history" with e-mail addresses and other data about some 6
million people involved. [Source]
BNA’S Electronic Commerce & Law Report reports
that legislation that would create a registry of children’s electronic contact
information, and require marketers to pay a fee to scrub their lists against
it, advanced in five states during recent weeks. In addition to an
The
Information Commissioner has updated his Data Protection guidance in the wake
of a House of Lords decision not to consider a landmark Court of Appeal ruling
that effectively narrows the right of individuals to access “personal data”. [Source]
MPs
and peers face a constitutional crisis when the Government prepares a fresh
attempt to drive its identity card proposals into law. Although the House of
Lords is digging in against the scheme, ministers have taken the surprise
decision to try to force through the ID Cards Bill at the earliest possible
opportunity. They warn that further parliamentary wrangling could delay plans
to issue the first ID cards in 2008-09. [Source]
[Clarke
Digs in for ID Card Battle with Peers] [Clarke
Faces New ID Cards Battle]
A closed hearing and a confidential European
commission report on handovers of air passenger data to US security agencies
may be contested by MEPs. Four Liberal members of the European parliament's
civil liberties committee are angry that an assessment of implementation of a controversial
EU-US agreement is secret. [Source]
The Article 29 Data Protection Working Party has
issued an opinion stating that some email screening services may not comply
with European data protection legislation. In some cases, the group said, filtering
based on content may constitute an “unjustifiable interception of
communications.” While EU laws allow email screening for viruses, spam or other
content filtering could abridge individuals’ free speech if it blocks
legitimate emails from reaching their recipients. Scanning the content of
emails can also be a violation of data protection laws, unless Internet service
providers or email service providers must adequately inform email software
users of the blocking. [WP
Opinion]
According to new research from MasterCard
Citibank
has frozen the use of an undisclosed number of debit cards in three countries
after detecting “several hundred” fraudulent cash withdrawals in PIN-based transactions.
An undisclosed but possibly large number of Citibank customers in
This is Sunshine Week, an effort by the nation’s news
media to draw attention the public’s right to know and to limit government
secrecy. It is a time to discuss the balance between the need to protect our
security and the need to ensure open government. What information does the
public have a right to know? Where is the line between government operating in
secret and protecting national security? Closer to home, how many details of a
crime do the public and the victim’s family need revealed in a press conference?
[Source]
[Source]
Since Sept 11, 2001, local, state and federal
government agencies are keeping more information secret from the public, making
it harder for citizens to keep tabs on what elected officials and bureaucrats
are doing, an investigation by the Associated Press shows. An analysis of laws
in all 50 states has found that legislatures have passed more than 1,000 laws
changing access to information, approving more than twice as many measures that
restrict information as laws that open government books. [Source]
[Source]
The
The
billings of individual physicians through
Seventeen million customers of the online payment
service iBill have had their personal information released onto the internet,
where it’s been bought and sold in a black market made up of fraud artists and
spammers, security experts say. The stolen data includes names, phone numbers,
addresses, e-mail addresses and internet IP addresses. Other fields in the
compromised databases appear to be logins and passwords, credit-card types and
purchase amounts, but credit-card numbers are not included. The breach has
broad privacy implications for the victims. Until it was brought low by legal
and financial difficulties, iBill was a top credit-card processor for adult
entertainment websites. The transactions documented in the database are dated
between 1998 and 2003, spanning a period at the height of iBill’s success. [Source]
A
massive amount of investigation data kept by Ehime Prefectural Police has been
leaked onto the Internet, apparently after the computer that kept the data was
infected with a virus through the file exchange software Winny. [Source]
Information
on about 2,800 patients who had surgery at a privately-run hospital in
Support for the
MPs have again voted in favour
of compulsory ID cards by forcing passport applicants to register their
personal and biometric details on the vast national ID database. The government
this week successfully overturned an amendment to the ID card bill made by
peers in the House of Lords last week that would make it optional for people
applying for a passport or other "designated document" to register
for an ID card. The peers' objection is that the government's election
manifesto promised ID cards would be voluntary initially and that by linking
them to passports - held by 85% of the population - this would effectively make
it "compulsion by stealth". [Source]
More than 100 people were caught in a “wide-ranging
identity-theft scam” that has seen at least $500,000 in charges made on phoney
credit cards in the last four years, say Ontario police. [Source]
The
The Colorado Bankers Association is the driving force
behind HB 1347, which would create an identity theft task force to help
An
Ancaster company is using high technology to put a serious crimp in your social
lives. Global Positioning Systems is going to let parents know when their child
is late, plays hooky or sneaks out of the house. The 24-hour-a day service will
cost $200 a year. [Source]
Lawmakers
and the government are set to clash in a row over balancing freedom with the
need to carry out surveillance. It took nine years and a slew of landmark court
rulings, but the long-awaited legislative debate over wiretapping and covert
surveillance is finally on the dock. Over the next few weeks, lawmakers and the
administration will weigh the limits of privacy rights and executive powers in
post-handover
Agencies
from at least four government departments are swapping information on “bad
families” and storing their details on a database. The database also gives and
receives details from volunteer groups including Women’s Refuge and Parentline.
A more powerful prototype, proposed last year, was shelved because it
contravened privacy legislation. [Source]
Last week, David Webb typed the address of a
According to a new report from the Pew Internet &
American Life Project entitled, “Online Dating,” there is now broad public
awareness of the online dating world. While online dating is becoming more commonplace,
there are strong concerns in the wider public about the dangers of posting
personal information on dating sites and about the honesty of those who pursue
online dating. Some 66% of internet users agree with the statement that online
dating is dangerous because it puts personal information online. And 57% of
internet users agree with the statement that a lot of people who use online
dating sites lie about their marital status. [Source] [Report]
The U.S. plan to require people traveling between the
United States and Canada to have passports or similar identification is already
hurting cross-border tourism, and it’s not even in effect yet, tourism
officials said this week. Convention planners are hesitant to book events
across the border a year or two in advance without knowing how the plan will be
implemented or what new identification cards will cost, Randy Williams of the
Tourism Industry Association of Canada told a panel of
Roderick
Woo,
The identities of 2,600 CIA employees and the
locations of two dozen of the agency's covert workplaces in the
The European Commission has launched a debate and
consultation on RFID technologies. It is seeking views on the opportunities,
interoperability and compatibility issues as well as the privacy and security
concerns raised by the new technology. [Source]
[Source]
The day when RFID replaces bar codes for identifying
products is at least 15 years away, according to an executive of German retail
giant Metro, which is leading the smart-tag charge in
Marks & Spencer, a major
A
new report from the Economist Intelligence Unit, entitled RFID Comes of Age, concludes that consumers will be willing to
trade some of their privacy rights for the convenience and brand-loyalty discounts
potentially on offer from RFID-tagged products. The report found that the
adoption rate of RFID is accelerating despite concerns that the technology
could compromise consumers’ privacy rights. [Source] [Source]
[Source]
RFID
tags will soon be attached to everything from cell phones to credit cards to
cartons of sour cream. But if technology companies and consumer goods makers
are determined to see that futuristic vision come true, then security and
privacy concerns have to be addressed, according to panelists and speakers said
at the recent RFID World show in Grapevine, Texas. [Source]
A group of European computer researchers have
demonstrated that it is possible to insert a software virus into radio
frequency identification tags, part of a microchip-based tracking technology in
growing use in commercial and security applications. In a paper to be presented
today at an academic computing conference in
Symantec Corp. released its latest Internet Security
Threat Report, covering the last six months of 2005. The report notes an
increase in threats designed to facilitate cybercrime. While past attacks were
designed to destroy data, today’s attacks are increasingly designed to silently
steal data for profit without doing noticeable damage that would alert a user
to its presence. In the previous Internet Security Threat Report, Symantec
cautioned that malicious code for profit was on the rise, and this trend
continued during the second half of 2005. Malicious code threats that could
reveal confidential information rose from 74% of the top 50 malicious code
samples last period to 80% this period. [Source]
The
payment industry is readying itself for the rollout of chip card technology,
with the first transactions to likely take place in less than two years' time.
Consumers can expect to see chip-based debit and credit cards in the market by
2007, according to spokespeople from Interac Association, MasterCard Canada
Inc. and Visa Canada Association. Visa currently offers a couple of chip cards
in
Attorney General Alberto Gonzales made clear last week
that the White House is not seeking congressional action to inscribe the
National Security Agency's monitoring into U.S. law, even as members of
Congress negotiate with the Bush administration about legislation. Gonzales
maintained the program is legal the way it is. [Source]
[Source]
[Source] [Source]
[Source]
[Source]
[Source]
The
ACLU presented a federal judge with declarations from four individuals – two criminal
defense lawyers, an advocate for democratic reform in the
The
FBI reported more than 100 possible violations to an intelligence oversight
board over the past two years, including cases in which agents tapped the wrong
telephone, intercepted the wrong e-mails or continued to listen to
conversations after a warrant had expired, according to a report issued last
week. [Source]
[Source]
[DoJ Inspector General,
Report to Congress on Implementation of Section 1001 of the USA PATRIOT Act]
High-powered cameras capable of reading number plates
from several thousand feet up have been bought by five
The US House Energy and Commerce Committee has
approved a bill that would make it a crime to fraudulently obtain and sell a
person’s telephone records. The bill also would require telecommunications
companies to get consumers’ permission before sharing information about their
calling records with business partners. [Source]
[Source]
[Source]
[Source]
The new 7-senator intelligence subcommittee created to
review the Bush administration’s domestic surveillance program had its first
White House briefing yesterday and is scheduled to visit the National Security
Agency’s headquarters Monday to gather additional information, according to
congressional and administration officials. [Source]
The
Department of Defense admitted last week that it had wrongly added peaceful
demonstrators to a database of possible domestic terrorist threats. The letter
followed an NBC report focusing on the Defense Department’s Threat and Local
Observation Notice, or TALON, report. A DoD official says peaceful
demonstrators’ names have been erased from database. [Source]
The
Federal Trade Commission has decided to retain a rule implementing the Children’s
Online Privacy Protection Act (COPPA), which demands that website operators obtain
parental consent to their collection of children’s personal information. [Source] [Source]
The information provided to the public by
government-operated contact centers could be enhanced if agencies focused more
on accuracy and had better guidance on performance measurements and oversight
practices, the GAO concluded in a new report (GAO-06-270). Practices to
ensure the accuracy of information provided to the public by government
agencies vary widely. The report looked at contractor-run contact centers at the
U.S. Postal Service, Centers for Disease Control and Prevention, General Services
Administration and departments of Defense, Labor and Education. GAO considered
the use of four techniques for improving accuracy: regular review of the
centers' information databases, monitoring of public contacts and center
responses, post-inquiry satisfaction surveys and validation of
contractor-prepared reports. [Source]
[Report Highlights]
After
a long battle with Congress that went down to the wire President Bush signed a
renewal of the USA Patriot Act, a day before 16 major provisions of the old law
expire. [Source]
[Source]
[Source] [The USA PATRIOT
Improvement and Reauthorization Act of 2005] [S. 2369, Senate
Bill Further Amending the Patriot Act]
Ohio House Bill 104 took effect in February,
obligating virtually every private and public entity in
When the