Twitter Updates for EUdiscovery
December 13th, 2010 by Monique Altheim
- RT@PosseList Dec 11th weekend “Top 20 … plus more” – a compendium of e-discovery articles/upcoming events http://bit.ly/i82KP4 #ediscovery #
- #Dataprotection compliance in the EU administration: EDPS adopts comprehensive policy on supervision and enforcement http://bit.ly/dM7IfB #
- IQPC Exchange in Munich: Information Retention and eDiscovery in Europe http://bit.ly/i4wQv0 #
- Will 2011 be the year of Cloud?: http://bit.ly/dZPHLQ #
The International Association of Privacy Professionals’ First Europe Data Protection Congress
December 8th, 2010 by Monique Altheim
I recently attended the International Association of Privacy Professionals’ (IAPP) very first Europe Data Protection Congress in Paris on November 29 and 30.
The attendee list was impressive:- Privacy professionals, employed by Fortune 500 companies from a wide variety of industries, like Hewlett-Packard, Lockheed Martin, Citigroup, Oracle, Western Union, Microsoft, IBM, Dell, Google, Yahoo, Estee Lauder, Pfizer, Johnson & Johnson, Eli Lilly, Merck, Mc Donald’s, Procter & Gamble and Disney. Even Facebook was represented.
- Vendors, like Lexis Nexis, Nymity, Iron Mountain and ADP.
- Partners of the international law firms Bird & Bird, Covington & Burling, Hogan Lovells, Morrisen & Foerster, Sidley Austin, Osborne Clarke, Field Fisher Waterhouse and Pearl Cohen Zedek Latzer.
- Partners of the national law firms Cabinet Gelly (France), Van Bael & Bellis (Belgium), Bristows (UK), Panetta & Associati (Italy), Houthoff Buruma (Netherlands), Coelho Ribeiro E Associados (Portugal and Spain), Baker & Daniels (USA), and Hunton & Williams (USA).
- Privacy Consultants like Brian Tretick of Athena (USA) and Anne Wilkes of ACW Privacy Consulting Ltd. (UK).
- Representatives of the European Data Protection Supervisor, of the French Data Protection Authority (DPA) (the CNIL), of the Spanish DPA, of the British DPA (the ICO) and of the European Commission.
- The IAPP staff, headed by executive director Trevor Hughes.
- One lone privacy advocate, Tara Taubman of Open Rights Group (UK).
In this communication, the European Commission announced that fifteen years after the original 1995 Data Protection Directive was enacted, the original twofold objective of protecting the fundamental right to data protection as well as of achieving the free flow of data in the internal European market is still valid.
However, two factors have caused the 1995 Directive to have become too outdated to guarantee these two objectives : The rapid technological advances and the globalisation in the ways information is collected, stored and transferred.
These dramatic changes were reflected in some of the topics debated during the breakout sessions:
- Cloud Computing: Peter Fleisher of Google pointed out that the current Directive is totally inadequate for cloud computing, since many of the Directive’s legal concepts rely on data being located in one particular place. However, Google has servers in the US, in Ireland, in Belgium and is building new ones in Finland and Austria. Google’s data are always duplicated in multiple locations and are constantly moving around from one location to another. Concepts for dealing with trans-border transfers of data, like Safe Harbor, BCR, and Model Contracts all rely on knowing the location of the data and were not created with the “cloud” in mind. Fleisher suggested that in the long run only the adoption of global standards would provide a solution for the “location” conondrum.
- Cross-Border Discovery and Investigations: Seth Berman of Stroz Friedberg pointed to the same problems concerning the difficulties of dealing with a location-based concept as a basis for determing the applicability of the Directive. If the data are located in the European Union, then the Directive is applicable and cross-border discovery of these data has to conform to its legal requirements.But where are the data located when they are in the “cloud”? Is the Directive applicable for discovery of updates on Facebook posted by a Europen Citizen? But are these data “located” in the EU? The Directive was not drafted with social media in mind, and new concepts need to replace the old, pre-cloud/pre-social media notions of data location.
- Data Breach Notification: In the context of strengthening the individual’s rights, the Commission has declared in its communication: “It is also important for individuals to be informed when their data are accidentally or unlawfully destroyed, lost, altered, accessed by or disclosed to unauthorised persons. The recent revision of the e-Privacy Directive introduced a mandatory personal data breach notification covering, however, only the telecommunications sector. Given that risks of data breaches also exist in other sectors (e.g. the financial sector), the Commission will examine the modalities for extending the obligation to notify personal data breaches to other sectors in line with the Commission declaration on data breach notification made before the European Parliament in 2009 in the context of the reform of the Regulatory Framework for Electronic Communications. This examination will not affect the provisions of the e-Privacy Directive, which must be transposed into national laws by 25 May 2011. A consistent and coherent approach on this matter will have to be ensured. The Commission will examine the modalities for the introduction in the general legal framework of a general personal data breach notification, including the addressees of such notifications and the criteria for triggering the obligation to notify.”
Again, it is the exponential growth in personal data holdings and the increased outsourcing of data to third countries and to the “cloud” that have caused increased data breach scandals and have required changes in the Directive. Some EU member states, like Germany, already have enacted a national general data breach law (Section 42 a FDPA- September 2009), but most others will have to implement their national laws once the new legal framework is in place.
Other important suggestions for consideration in reframing the Directive by the Commission are : The right to be forgotten, Privacy by Design, greater transparancy in internet related data collections, data portability rights, achieving more harmonization among the vastly different implementaions into national laws by the member states, the requirement of mandatory privacy officers in companies and organizations, the requirement of privacy impact assessments upon introducing new systems and technologies in companies and organizations, and strengthening as well as harmonizing enforcement of the Directive.
Concluding the panel on the revision of the 1995 Directive, Henriette Tielemans of Covington & Burling asked the European Commission representative Thomas Zerdeck: “Will the new baby be a directive or a regulation?” to which Thomas, in his usual style, replied: “This is way too complex. You will find out in 2011.”
The European Commission has opened a public consultation period (from November 4, 2010, to January 15,2011) to obtain views on its ideas for addressing new challenges to personal data protection in order to ensure an effective and comprehensive protection to individuals’ personal data within the EU.
They welcome contributions from citizens, organisations (i.e., Non-Governmental Organisations, businesses) and public authorities.
Thus all stake holders have a chance to be part of this sweeping overhaul of the European Union Data Protection framework.
http://ec.europa.eu/justice/news/consulting_public/news_consulting_0006_en.htm
First Tweeted Int’l Data Protection and Privacy Commissioners Conference – Jerusalem 2010
October 30th, 2010 by Monique Altheim
The 32nd International Conference of Data Protection and Privacy Commissioners, held on october 27-29 2010 in Jerusalem, Israel, was the first event of its kind to be tweeted live.
Israel’s data protection authority, ILITA, enabled live streaming of the conference on its web site, so that even twitterers who could not attend the conference in person, were able to tweet about it in real time from all over the world.
The hashtag was #privacygenerations and all the tweets were archived at Twapperkeeper.com.
Here are some statistics :
Total tweets: 578
Total twitterers: 78
Total hashtags tweeted: 15
Total URLs tweeted: 38
Top 10 twitterers
80% (463) of the tweets in this TwapperKeeper archive were made by 25% (20) of the twitterers.
The top 10 (12%) twitterers account for 57% (334) of the tweets.
41% (33) of the twitterers only tweeted once.
@nacpec (73)
@PrivacyCamp (40)
@givoly (35)
@embedprivacy (32)
@cedric_laurant (30)
@EUdiscovery (28)
@JulesPolonetsky (25)
@HealthPrivacy (24)
@Bsegalis (24)
@InfoLawGroup (23)
Top 10 @reply recipients and/or mentions
31% (184) of the tweets in this TwapperKeeper archive were @replies or mentions.
24% (19) of the twitterers who tweeted as part of this TwapperKeeper archive received an @reply and/or mention.
Note: recipients marked ‘*’ did not tweet as part of this TwapperKeeper archive.
@zephoria (32) *
@cedric_laurant (20)
@ILITAgovil_en (17)
@JulesPolonetsky (14)
@abrandtva (13)
@givoly (11)
@EUdiscovery (9)
@oceanpark (8)
@InfoLawGroup (8)
@PrivacyCamp (8)
Top 10 “conversations”
(1) @cedric_laurant <–> @givoly (3)
(3) @IsCool <–> @oceanpark (1)
(2) @givoly <–> @JulesPolonetsky (1)
(1) @givoly <–> @oceanpark (2)
(1) @EUdiscovery <–> @privacyguru (1)
(1) @InfoLawGroup <–> @JulesPolonetsky (1)
(1) @Bsegalis <–> @JulesPolonetsky (1)
(1) @givoly <–> @ProfJonathan (1)
(1) @abrandtva <–> @EUdiscovery (1)
Note: a ‘conversation’ is an exchange of at least one @reply or mention in each direction between any two twitterers who tweeted as part of this TwapperKeeper archive.
For more details and statistics, see here.
Privacy and Data Protection: A Super Sad True Love Story
October 25th, 2010 by Monique Altheim
Meet Lenny Abramov:
“ZIP code 10002, New York, New York. Income averaged over five-year-span, $289,420, yuan-pegged, within top 19 percent of U.S. income distribution. Current blood pressure 120 over 70. O-type blood. Thirty-nine years of age, lifespan estimated at eighty three (47 percent lifespan elapsed; 53 percent remaining). Ailments: high cholesterol, depression. Born: 11367 ZIP code, Flushing, New York. Father: Boris Abramov, born Moscow, HolyPetroRussia; Mother: Galya Abramov, born Minsk, Vassal State Belarus. Parental ailments: high cholesterol, depression. Aggregate wealth: $9,353,000 non-yuan-pegged, real estate, 575 Grand Street, Unit E-607, $1,150,000 yuan-pegged. Liablities: mortgage $560,330. Spending power: $1,200,000 per year, non-yuan-pegged. Consumer profile: heterosexual, nonathletic, nonautomotive, nonreligious, non-Bipartisan. Sexual preferences: low-functioning Asian/Korean and White/Irish American with Low Net Worth family background; child abuse indicator: on; low self-esteem indicator: on. Last purchases: bound, printed, nonstreaming Media artifact, 35 norther Euros; bound, printed, nonstreaming Media artifact, $126 yuan-pegged; bound, printed, non-streaming Media artifact, 37 northern euros.”
This is Lenny’s profile that the people who inhabit Gary Shteyngart‘s latest novel “Super Sad True Love Story” can freely view on their äppärät.
The novel is set in a near future New York, where everyone walks around with an äppärät around his/her neck, constantly streaming. The streets are lined with Credit Poles, that instantly register and exhibit each passerby’s credit rating from his/her äppärät and giant banners that proclaim: “America celebrates its spenders”. Huge conglomerates named ColgatePalmoliveYum!BrandViacomCredit and AlliedWasteCVSCitigroupCredit call the shots.
At work, there are huge billboards, where each employee’s health data and mood status are displayed and adjusted daily.
People (with the notable exception of the protagonist, Lenny Abramov) don’t read books anymore, but just scan texts for info.
This world is divided into two categories: The HNWIs (high net worth individuals) and the LNWIs (low net worth individuals). Many LNWIs have lost their homes, their jobs, their health insurance and are camping out in tent cities in Central Park. They don’t even own äppäräts. Riots are about to break out.
Meanwhile, the HNWIs are busy shopping on their äppäräts on sites like AssLuxury. They communicate through a social network site called GlobalTeens. They obsessively GlobalTrace each other’s locations. Men and women gage each other in bars by streaming their Personality, F**kability, Male Hotness and Sustainability ratings on their äppäräts. Detailed sexual preferences are instantly revealed.
And of course, the Governement, via the “American Restauration Authority”, keeps a close eye on all its citizens via those very same äppäräts. It sends regular global messages via the äppäräts, always ending with:”By reading this message, you are denying its existence and implying consent.”
At the center of this darkly satirical novel, a genuine and moving love story unfolds between Lenny and the much younger, e-culturally hip Eunice Park.
While reading Super Sad True Love Story, I was struck by how accurately Shteyngart has depicted most of the current issues concerning loss of privacy: Government Surveillance, Profiling, Geotracking, Global tracking, Legalese Nonsensical Disclaimers, Hyper-Sexualization, Sub-Literacy are exposed with great wit. Financial and private health information are not protected and are publicly showcased to favor the young, the healthy, the wealthy and the polyanna-happy.
This novel is a frightening and powerful description of what will happen to us as a society if we don’t take drastic action NOW to halt the increasing erosion of our privacy by the public and private sector alike.
I love my privacy and would not want it to end the way a super sad true love story always does.
Federal Court in NY Says EU Documents Containing Personal Information are Off Limits in Class Action Litigation
September 15th, 2010 by Monique Altheim
This post was written by Kevin Xu and John L. Hines, Jr.U.S. courts often disregard foreign data privacy laws in the context of discovery. Litigants sometimes find themselves compelled to produce under U.S. law what they are forbidden to produce under the privacy laws of another country. However, a recent U.S. court decision indicates increasing sensitivity to the privacy expectations of persons abroad.
On August 27, 2010, in connection with In re Payment Card Interchange Fee and Merchant Discount Antitrust Litigation, the court ruled that some data collected and processed in the EU would have been unlawful to transfer to the United States under the EU Privacy Directive, and thus, should not be subject to production in U.S. litigation.
Judge John Gleeson of the U.S. District Court for the Eastern District of New York deferred to the European Commission’s request to shield documents related to its antitrust investigation of the interchange fee practices of Visa and MasterCard from the discovery request of plaintiffs. The plaintiffs had asked the court to compel production of the documents, claiming they were relevant to the litigation at hand, while the European Commission sought to keep the documents confidential under its Privacy Directive. The court held that even though the materials requested by the plaintiffs are plainly relevant to the litigation, federal courts should avoid any unnecessary circumventions of the practice of international comity.
Read More
Behavioral Advertising is for Compumers
July 22nd, 2010 by Monique Altheim
I saw the movie “Inception”
by Christopher Nolan last night. It is not a movie I would usually
pick, since I am not particularly fond of science fiction. But my
daughter insisted: “You MUST see this movie. You won’t regret it.” I
caved in and indeed enjoyed watching that movie. In the movie,
technology has advanced to the point where certain highly skilled people
are able to enter the human mind through dream invasion and plant seeds
for new ideas. The story is sophisticated and emotionally engaging, the
actors give excellent performances, and the ending is, well,
unexpected.Marketers using the behavioral advertising technique would have never recommended that movie to me.
Behavioral Advertising is a technique used by internet marketers to target consumers, based exclusively on their past online behavior: Past choices, past preferences, past browsing and search history. Companies will tell you what to purchase, based on your past online behavior.
Amazon’s and Netflix’s recommendations are based on the customer’s past purchases. I recently bought a Garmin nüvi 255W 4.3 inch Portable GPS Navigator on Amazon. Within the hour, I received an email from Amazon, suggesting I might also be interested in the Garmin nüvi 37907 4.3 inch Portable GPS Navigator . Sure, Amazon, thanks! I was just thinking of starting a Garmin nüvi GPS Navigator collection…
Facebook also recommends friends based on people who already are your friends. LinkedIn recommends “People You May Know”, based on your previous connections.
Proponents of behavioral advertising claim that the loss of privacy experienced by consumers as a result of the creation of individual profiles for the purpose of behavioral targeting is offset by the benefit consumers gain from getting advertisements that are custom tailored to their peferences and interests.
I beg to differ.
No machine on earth would have recommended I see “Inception”, because none of my past choices pointed in that direction.
But, I am not a “compumer“. I am not a “computer-consumer”. I am a human being, capable of imagination and dreams, programmed for evolution and change.
I am afraid that if we let machines make all our consumption suggestions, we will become frozen in our status quo, defined and limited by our past inputs, in other words, we might welll turn into computers, or “compumers” ourselves.
We will keep watching the same type of movies we have watched in the past, we will keep reading the same type of books we have read in the past, we will keep eating the same type of food we have eaten in the past, we will keep friending the same type of friends we have friended in the past, and we will keep connecting with the same type of professionals we have connected with in the past.
We will be locked into a class, as determined by data mining companies and online data aggregators.
What will become of that quintessential American idea of being able to “re-invent” ourselves, when our past becomes less than satisfactory? What will become of the desire to expand horizons, of the allure of unchartered territories, of the drive for social mobility, of the basic human need for change and progress?
But then, maybe one day technology will have progressed to the point where marketers themselves will be able to plant the seeds for all of the above mentioned ideas into our brains through “Inception”!
Update: 11/03/2010
Well, “Inception” in real life has apparently started already! see: http://www.technewsdaily.com/product-placements-on-social-media-sites-will-hack-into-your-memory-1549/
EU Article 29 Working Party Decrees Strict Opt-In Standards for Behavioral Advertising Data Collection
June 30th, 2010 by Monique Altheim
by Bret CohenOn June 24, the Article 29 Working Party established by the 1995 European Directive on Data Protection published an opinion declaring that online advertisers who want to target ads by tracking consumers’ surfing habits must obtain the consumers’ affirmative opt-in consent to such data collection.At the same time, the Working Party lauded certain privacy-enhancing practices incorporated into behavioral advertising today and it encouraged industry to develop technologies to comply with the framework and “to exchange views” with the Working Party on the use of such technologies.
Behavioral Advertising is Regulated in the EU by Two Primary Sources
The Working Party explained that behavioral advertising ecosystem is regulated in the EU by two primary sources. The first is Article 5(3) of EU Directive 2002/58 (the ePrivacy Directive) that requires that organizations wishing to store or access information on an individual’s computer to obtain the consent of the individual before doing so. The e-Privacy Directive is to be implemented in the national laws of EU member states law by June 2011.
The Opinion explained that since behavioral advertising relies on the placement of cookies (small data files) on individuals’ computers to aid in the tracking of their web browsing habits, the ePrivacy Directive applies. In addition, the Opinion went on to specify that if the behavioral advertising involves the collection of any personally identifiable information (PII), including an individual’s IP address (which is recognized as PII in the EU), then the EU Directive 95/46/EC (the Data Protection Directive) also applies.
Opt-In Consent Requirement and Opt-Out Deficiencies Explained
The major theme of the opinion is that under the ePrivacy Directive, meaningful, informed consent must be obtained by an individual before any information is collected and used for behavioral advertising purposes. The opinion went a long way in discussing what the Working Party considers to be meaningful consent in the behavioral advertising context.
Currently, consumers can “opt out” of behavior tracking through control panels offered by certain online advertising services or by relying on default web browser settings through which Internet users automatically accept all cookies that websites request to place on their computers. Users are therefore automatically “enrolled” in behavioral advertising, and can only stop the practice (if they know it is occurring) by blocking or deleting cookies.
The Working Party rejected this “opt-out” approach, concluding that it does not sufficiently allow individuals the ability to exercise choice on whether to share their information with behavioral advertisers. Instead, it stated that notice to individuals should explicitly reference the ad network that will place the cookie and describe how the information will be used once it is collected. Then, the individual should be given the opportunity to “opt in” to the sharing of their information for behavioral advertising purposes.
Once a user opts in, separate consent would not need to be obtained every time the user visited a website participating in the ad network, but separate consent would need to be periodically obtained (the opinion did not specify a time period) and the user would need to be afforded the opportunity to easily revoke consent.
Read more
The Fifth Sail
June 22nd, 2010 by Monique Altheim
“It is quite clear,” replied Don Quixote, “that you are not experienced in this matter of adventures. They are giants, and if you are afraid, go away and say your prayers, whilst I advance and engage them in fierce and unequal battle.”
-DON QUIXOTE de LA MANCHA
Of the Valorous Don Quixote’s Success in the Dreadful and Never Before Imagined Adventure of the Windmills
May 28th, 2010 by Monique Altheim
“It is quite clear,” replied Don
Quixote, “that you are not experienced in this matter of adventures.
They are giants, and if you are afraid, go away and say your prayers,
whilst I advance and engage them in fierce and unequal battle.”
-DON QUIXOTE de LA MANCHA
Ediscovery, Cloud Computing and EU Data Protection: Cloud Nationalities Do Matter
May 25th, 2010 by Monique Altheim
Cloud Computing With Borders May Be On Horizon in Europe
by Jennifer L. SchenkerA proposal to build a national federation of interconnected computing clouds in France, funded in part by government in order to protect the country’s sovereignty, data privacy and local jobs, is gaining favor. Some fear that the idea, which is in part a backlash against American companies like Google, will spread to other parts of the Continent, potentially undermining the promised benefits to Europeans of cloud computing, which is being billed as the biggest shift in computing since personal computers were introduced in the 1970s.
French tech companies and businesses are calling on local governments in France to partner with private companies to build a network of data centers and shared cloud platforms and services that would respond to the computing needs of French businesses, organizations, governments and citizens, giving them an alternative to handing their data to American companies. The group called for local cloud infrastructure to be built with the help of funds set aside for France’s “grand emprunt national,” a €4.5 billion economic stimulus package that will start to kick-in at the end of next year.
Cloud computing is the term for a new form of distributed computing which allows consumers, enterprises and governments to store their data and their applications on networked servers rather than on local computers and data centers and to tap into computer applications and other software via the cloud, freeing themselves from building and managing their own technology infrastructure In addition to reducing operational costs, analysts say the shift to cloud technologies allows radical business innovation and new business models.
Some industry experts in Europe believe only giants like Google and Amazon can achieve the necessary economies of scale in building the massive data centers that underpin the cloud. They fear that national projects will be white elephants and question whether big enterprise customers like Danone and Carrefour will be willing to pay the price of French sovereignty. “Interconnection of hybrid clouds is not a simple problem and the risk is that the benefits come slowly and that local champions cannot grow and reach critical mass fast enough,” say Pierre Liautaud, a Frenchman who has worked in the tech industry for 25 years, holding executive positions at both IBM and Microsoft and heading up start-ups. He is currently organizing a November conference for the European Tech Tour Association to highlight European start-up companies in cloud computing. Most start-ups in Europe are concentrating on creating applications that run on top of infrastructure built and run by American companies like Google, Amazon and Microsoft.
Read More
Privacy Week in Jerusalem, hosted by ILITA: A Preview
May 6th, 2010 by Monique Altheim
ILITA, The Israeli Law, Information and Technology Authority, will host a Privacy Week on October 25-29, 2010 in Jerusalem, Israel.Article 29 Working Party recently published an an opinion finding that Israeli data protection law largely provides an “adequate level of data protection” under the European Union Data Protection Directive 95/46.
Thus Israel will be joining the small and select club of countries to which personal data from the 27 EU member states and three EEA member countries ( Norway, Liechtenstein and Iceland ) can flow without any safeguard being necessary.
( The other countries deemed “adequate” are : Switzerland, Canada, Argentina, Guernsey, Jersey, Isle of Man and the Faroe Islands.)
This International Conference will consist of two parts:
1.October 25-26: OECD Conference on “Privacy, Technology and Global Data Flows”
and
2.October 27-29: The 32nd Annual International Conference of Data Protection and Privacy Commissioners on: ” Privacy: Generations.”
At the recent IAPP Global Privacy Summit in Washington, D.C., one of the more interesting sessions offered a preview to the 32nd Annual International Conference of Data and Privacy Commissioners‘ main themes.
The panel consisted of Jules Polonetsky, Director of the Future of Privacy Forum, Yoram Hacohen, the Head of ILITA and Dr. Omer Tene, a Law Professor and an Israeli Legal Consultant on Law and Technology.
A New Generation of Privacy :
1. A New Generation of Technologies2. A New Generation of Users
3. A New Generation of Governance
1.The top issues for A New Generation of Technologies will be:
.Privacy by Design,.E-Health and Genetics
.Profiling and Behavioral Targeting, RFID and the Smart Grid
.Privacy v. Intellectual Property
2.The top issues for a New Generation of Users will be:
.The past: Where did we come from?.The present: Where are we now? What are the inter-generational shifts in privacy perceptions?
.The Future; Where are we headed?
3.The top issues for a New Generation of Governance will be:
.The relationship of Privacy and Antitrust Law.Consumer Protection
.Erosion of Consent and the Right to Oblivion
.Government access to private sector data and Conflict of Law
Jules Polonetsky noted that this is the first time that the agenda of the conference has been revealed so openly, and also that for the first time, the conference will be featured on Twitter and Facebook.
ILITA on Twitter: ILITAgovil_en
ILITA on Facebook:Facebook Fan Page
The Privacy Conference’s Website:privacyconference2010.org
The participants at this session were invited to suggest further hot topics for inclusion in the conference. Some of the suggestions were:
.The role of the CPO in the US v the EU
.The differences in approach in the public v the private sector
.Data Security
.The human flesh search phenomenon in China
.The inclusion of Generation Y and their point of view on Privacy issues.
If you have any suggestions, you are welcome to email them to: steeringcom@privacyconference2010.com
Updates:
Program and Registration for Data Commissioner’s Conference now onlinehttp://www.privacyconference2010.org/outline.asp
Irish block EU plan to allow data transfer to Israel http://www.irishtimes.com/newspaper/world/2010/0708/1224274266971.html
“The draft Commission Decision on the adequate protection of personal data in the State of Israel has been adopted on 25 October in the comitology procedure (so called Article 31 Committee),” said the spokeswoman. “The European Parliament has one month of scrutiny. Its opinion is however not binding for the Commission.” http://www.theregister.co.uk/2010/10/29/israel_gets_data_protection_laws_approved/
Cloud Security and Privacy: A Legal Compliance and Risk-Management Guide, Part 1 and 2
May 4th, 2010 by Monique Altheim
In this two-part series, legal expert Robert McHale, author of Data Security and Identity Theft: New Privacy Regulations That Affect Your Business, provides a comprehensive overview of the legal security and privacy risks associated with cloud computing.Part 1 discusses the principal federal and state laws regulating cloud activities.
Part 2 provides a practical due diligence checklist companies should consult before entering into a cloud service agreement.
While storage of user data on remote servers is hardly a recent phenomenon, the current explosion of cloud computing warrants a closer look at the associated privacy and security implications.
Cloud computing carries with it its own unique risks regarding the privacy, confidentiality, and security of business information, which companies must fully assess before migrating to the cloud. Armed with an appropriate legal compliance and risk-management strategy—and strong, fully-negotiated contractual protections—companies should be able to safely transfer their data and applications to the cloud.
Part I of this article discusses the principal federal and state laws regulating cloud activities, and the legal security and privacy risks associated with cloud computing.
U.S. Laws and Regulations Governing Data Security and Privacy
The United States has numerous federal and state data security and privacy laws with implications for cloud computing. Unfortunately, there is not a single, comprehensive legal framework in which the rights, liabilities, and obligations of cloud providers and cloud users are regulated or defined. Instead, U.S.-based cloud users and providers must rely upon a veritable hodgepodge of (oftentimes) sector-specific laws to evaluate their legal risks and obligations, and the contractual terms between them.The most notable data security and privacy laws are examined here.
Read More
The European Union Data Protection Directive
The location of information stored in the cloud can have a profound impact upon the level of privacy and confidentiality protections afforded the information in question, and upon the privacy obligations of the cloud provider.For instance, the European Union’s Data Protection Directive, which regulates the processing of personal data within the EU as a means to safeguard individual citizens’ privacy, is of particular significance.
Under the EU Data Protection Directive, personal data may be transferred to third countries (non-EU member states) only if that country provides an “adequate” level of protection. Most notably, the United States is not on the list of countries that meet the EU’s “adequacy” standard for privacy protection. Accordingly, an organization that does its processing in the cloud may be violating EU law if the data goes to a server outside of the EU to prohibited countries, such as the United States.
In order to provide a means for U.S. companies to comply with the Directive (and thereby ensure continued trans-Atlantic transactions), the U.S. Department of Commerce, in consultation with the European Commission, developed a “Safe Harbor Program” designed to protect accidental information disclosure or loss.
Read More
Cloud Security and Privacy: A Legal Compliance and Risk-
Management Guide, Part 2
Due Diligence and Cloud Service Agreements
An organization’s contractual agreement with a cloud service provider is perhaps the most critical component in evaluating cloud computing risks, and therefore should be carefully examined before being entering into a cloud relationship.Cloud Service Agreements (CSAs) should clearly describe the services provided, guarantees, warranties, limitations, liabilities, and the responsibilities and rights of each party.
Proper due diligence requires inquiry into the following categories of concern: data security, performance, limitations of service, data migration, government and third-party litigation access, handling of trade secrets/confidential information, and exit plan, all of which are discussed in detail below.
Data Security
To properly manage the operation risk associated with cloud services, the cloud provider’s level of data security should be carefully examined. At a minimum, the following should be ascertained:- Is the cloud provider contractually obligated to protect the customer’s data at the same level as the customer’s own internal policies?
- Who has access to customer data, and what are their backgrounds?
- Where is the provider’s data center physically located, and what safeguards exist to prevent data centers from unauthorized access (for example, 24/7 security personnel)?
- Does the provider promise to maintain user data in a specific jurisdiction and/or to avoid certain jurisdictions?
- What are the provider’s migration policies regarding moving data back internally or to alternate providers? (Companies need to make sure that no data is lost or falls into the wrong hands.)
- Does the provider conduct regular backup and recovery tests?
- Do the provider’s security policies comply with all applicable regulatory rules?
- Is the provider willing to undergo on-demand or periodic audits and security certifications?
- Is the provider required to investigate illegal or inappropriate activity?
- Is the provider required to disclose any new vulnerabilities that may affect the confidentiality of customer data, or the integrity and availability of their services?
- In the event of lost or compromised data, can the data be backed up, and can it be easily reconstituted from the backups?
- What are the provider’s policies on data handling/management and access control? Do adequate controls exist to prevent impermissible copying or removal of customer data by the provider, or by unauthorized employees of the company?
- What happens to data when it is deleted?
- What happens to cloud hardware (for example, trailers of servers) when the hardware is replaced?
Facebook’s Instant Personalization: It Takes FIFTEEN Steps to ” OPT-OUT “
April 29th, 2010 by Monique Altheim
After Facebook‘s recent changes in their privacy policies, you need to take a few steps if you don’t want your Facebook
bio, education & work, hometown, likes and interests data to be
publicly shared online, as well as probably sold to behavioral
marketers.1. Go to your Facebook page
2. Go to “account”
3. Go to “privacy settings”
4. Go to “applications & websites”
5. Go to “instant personalization pilot program” all the way at the bottom
6. UN-check the PRE-checked box: allow selected partners to …(steal all your data?)
7. A window pops up; are you SURE? click: CONFIRM!!
8. Go back to “applications & websites”
9. Go to “what your friends can share”
10. Uncheck each category that you don’t want your friends to share online
11. Click : Save Changes
After this, you need to block each “selected partner” on their respective Facebook page. So far, they are
12. Microsoft Docs : click “block”
13. Pandora : click “block”
14. Yelp : click “block”
15. Keep checking every day , for the rest of your life, which new “selected partner” Facebook has added to the list and block those too.
Voilà! You have just opted out! Wasn’t that quick & easy?
Unfortunately, I believe most people won’t bother to go through all these steps, even in order to protect their privacy.
Worse, most people won’t even know how to opt-out, because the opt-out option is set up in such a complicated way. Facebook knows this and counts on this.
Do you think it’s fair to have to go through fifteen steps in order to prevent your personal data to be sold to advertisers?
In Canada’s Privacy by Design system , the opt-in option is the default setting.
Jules Polonetsky, Director of The Future of Privacy Forum proposes more balance between consumer and business interests by improving opt-out techniques.
Both above mentioned alternatives have one thing in common: the ingredient that is missing in Facebook‘s machiavellian opt-out design, which is “respect for the consumer”.
UPDATE: EPIC and others have filed a complaint on 5/5/ 2010 with the FTC about the New Facebook Features discussed in this article.
UPDATE: After worldwide outrage about Facebook’s new Privacy Policy, Facebook caved in and made some changes:
Facebook’s New Privacy Controls as of 5/28/2010
UPDATE: One more reason to opt-out of Facebook’s instant personalisation program. Now all your “likes” might show up on your Facebook friends’ Bing search: see Facebook and Bing Do the Search Two-Step. Since I wrote the article, Facebook has added Rotten Tomatoes and Scribd to their list of instant personalization partners. 9/15/2010
IAPP Global Privacy Summit 2010 – Hot Topics : Robert Rothman on the New EU Controller-to-Processor Model Clauses
April 24th, 2010 by Monique Altheim
At the recent IAPP Global Privacy Summit in Washington, D.C., many hot topics were addressed:Privacy by Design, Behavioral Advertising, the new EU Cookie Consent Law, the Smart Power Grid, the Cloud, Web 2.0, the new EU Model Clause Agreements, Controllers, Processors and Sub-Processors, the recent Google convictions, to name just a few.
I interviewed a few prominent privacy professionals, attending and/or presenting at the summit on some of the important issues of the day.
Robert Rothman, President of Privacy Associates International, (PAI ), is an expert in Cross Border Data Transfers.
The EU Commission Decision of February 5, 2010, contains new rules on standard contractual clauses for the transfer of personal data from EU countries to processors established in third ( non-EU , and non- “adequate” ) countries. This decision comes into effect on May 15, 2010.
I asked Robert Rothman to explain the changes in the model clauses.
See also my previous post for a comprehensive coverage of the subject matter.
IAPP Global Privacy Summit 2010 – Hot Topics : Jay Libove on Italy v. Google
April 24th, 2010 by Monique Altheim
At the recent IAPP Global Privacy Summit in Washington, D.C., many hot topics were addressed:Privacy by Design, Behavioral Advertising, the new EU Cookie Consent Law, the Smart Power Grid, the Cloud, Web 2.0, the new EU Model Clause Agreements, Controllers, Processors and Sub-Processors, the recent Google convictions, to name just a few.
I interviewed a few prominent privacy professionals, attending and/or presenting at the summit on some of the important issues of the day.
In this video, Jay Libove, CISSP, CIPP, an experienced privacy professional, expresses some concerns about the recent Italian verdict against three Google executives.
For the latest update on this case, click here
IAPP Global Privacy Summit 2010 – Hot Topics: Cédric Laurant and the EPHR project
April 23rd, 2010 by Monique Altheim
At the recent IAPP Global Privacy Summit in Washington, D.C., many hot topics were addressed:Privacy by Design, Behavioral Advertising, the new EU Cookie Consent Law, the Smart Power Grid, the Cloud, Web 2.0, the new EU Model Clause Agreements, Controllers, Processors and Sub-Processors, the recent Google convictions, to name just a few.
I interviewed a few prominent privacy professionals, attending and/or presenting at the summit on some of the important issues of the day.
In this video, I interviewed Cédric Laurant, who is an attorney and an independent privacy consultant based in Belgium. Cédric was probably the only European to have braved the Icelandic ash clouds in order to make it to the IAPP Summit in Washington, D.C. Indeed, about 25 European speakers and a couple of hundred European attendees never got to the summit because of cancelled flights all over Europe.
Cédric is closely involved in the brand new European Privacy and Human Rights ( EPHR) project. This project is a collaboration between EPIC ( Electronic Privacy Information Center) in Washington, D.C., PI (Privacy International) in London and the CEU ( Central European University ) in Budapest.
IAPP Global Privacy Summit 2010 – Hot Topics -Privacy by Design in Canada
April 23rd, 2010 by Monique Altheim
At the recent IAPP Global Privacy Summit in Washington, D.C., many hot topics were addressed:Privacy by Design, Behavioral Advertising, the new EU Cookie Consent Law, the Smart Power Grid, the Cloud, Web 2.0, the new EU Model Clause Agreements, Controllers, Processors and Sub-Processors, the recent Google convictions, to name just a few.
I interviewed a few prominent privacy professionals, attending and/or presenting at the summit on some of the important issues of the day.
In this video, I interviewed Ken Anderson, Assistant Commissioner, and Estella Cohen, Issues Manager at the Information and Privacy Commissioner’s Office in Ontario, Canada.
They explain the concept of Privacy by Design and how it is implemented in Canada.
The IAPP is holding a Canada Privacy Symposium 2010 on May 26 – 28, in Toronto.
Update November 1, 2010: Privacy by Design Resolution adopted by international privacy commissioners in Jerusalem
IAPP Global Privacy Summit 2010 – Hot Topics: Jules Polonetsky Predicts the Future of Behavioral Advertising
April 23rd, 2010 by Monique Altheim
At the recent IAPP Global Privacy Summit in Washington, D.C., many hot topics were addressed:Privacy by Design, Behavioral Advertising, the new EU Cookie Consent Law, the Smart Power Grid, the Cloud, Web 2.0, the new EU Model Clause Agreements, Controllers, Processors and Sub-Processors, the recent Google convictions, to name just a few.
I interviewed a few prominent privacy professionals, attending and/or presenting at the summit on some of the important issues of the day.
In this video, I interviewed Jules Polonetsky, Director of The Future of Privacy Forum, on the future of behavioral advertising.
IAPP Global Privacy Summit 2010 – Hot Topics: Convergence, by Jay Libove, CISSP, CIPP
April 22nd, 2010 by Monique Altheim
At the recent IAPP Global Privacy Summit in Washington, D.C., many hot topics were addressed:Privacy by Design, Behavioral Advertising, the new EU Cookie Consent Law, the Smart Power Grid, the Cloud, Web 2.0, the new EU Model Clause Agreements, Controllers, Processors and Sub-Processors, the recent Google convictions, to name just a few.
I interviewed a few prominent privacy professionals, attending and/or presenting at the summit on some of the important issues of the day.
In this video-interview, Jay Libove, CISSP, CIPP, talks about the importance of convergence of all corporate departments in order to increase efficiency.
E-Discovery Challenges in China
April 14th, 2010 by Monique Altheim
by Kevin LoA complicated international anti-dumping case brought several U.S. lawyers and a team of e-discovery experts to a large industrial town in northeast China. They had come to interview senior executives and conduct a search of paper and electronic records at a major pharmaceutical company.
During negotiations for the trip, the company said the team was more than welcome to speak with anyone they wished to meet and that access to records would be granted willingly. What transpired once the team arrived in China, however, was considerably different.
To begin with, their hosts seemed disinclined to get down to business. On the first day, they insisted on giving a tour of the large plant. It was long and far too detailed for the team’s interests. Having everything translated only added to the ordeal.
After the tour ended, the hosts suggested everyone go to lunch. The lead lawyer politely declined, despite the urging of her translator to accept. The lawyer asked, instead, to begin the discovery process. “I would like to begin by taking a copy of your hard drive,” she said to the company’s CEO.
Although the CEO didn’t say no outright, it was obvious this request made him quite upset. Rather than discuss the matter further, he changed the subject back to the luncheon invitation. “We can eat and have something to drink and get to know each other,” he said.
“He’s got something to hide,” one of the lawyers said to his colleagues. Although he had made this observation in an aside, it was loud enough for the CEO’s translator to hear.
Read More
No comments:
Post a Comment