The Secure Times

Continue reading "New CAN-SPAM Rule Gives Long-Awaited Answers" »

Continue reading "Emerging Standards For Mobile Marketing" »

UK government ministers are to consider plans for a database of electronic information holding details of every phone call and e-mail sent in the UK, it has emerged.   The plans, reported in the Times, are at an early stage and may be included in the draft Communications Bill later this year, the Home Office confirmed.

A Home Office spokesman said the data was a "crucial tool" for protecting national security and preventing crime.   The Home Office spokesman added: "The Communications Data Bill will help ensure that crucial capabilities in the use of communications data for counter-terrorism and investigation of crime continue to be available." 

However, the UK privacy watchdog is concerned about this development and Jonathan Bamford, Assistant Information Commissioner said: "We have warned before that we are sleepwalking into a surveillance society. Holding large collections of data is always risky; the more data that is collected and stored, the bigger the problem when the data is lost, traded or stolen. Defeating crime and terrorism is of the utmost importance, but we are not aware of any pressing need to justify the government itself holding this sort of data. If there is a problem with the current arrangements, we stand ready to advise on how they can be improved, rather than creating an additional system to house all records".

The UK Information Commissioner has been notified of almost 100 data breaches by public and private sector organisations since the loss of 25 million people's details by HM Revenue and Customs last November, according to figures released this week.  Half of the 28 private sector security breaches were by financial services companies.

1. Contain the breach and do a preliminary assessment.
2. Evaluate the risks associated with the breach, for example, what information is involved, who and what caused the breach, who is affected, and what is the risk of harm to those affected.
3. Consider and issue notification.
   • When to notify? Most importantly, the OPC has recommended a harm-based analysis for notification: "In general, if an information security breach creates a real risk of serious harm to the individual, those affected should be notified."
   • How to notify? Notification may be sent directly to the affected individuals, for example by phone, mail, in person or (notably) email. Indirect notification, for example, in the media or posted on a website, should occur only when direct notification could cause further harm, when costs are prohibitive, or when contact details for affected individuals cannot be determined.
   • What to notify? The draft recommends type of information involved, how the company has responded, what assistance is being provided to affected individuals or other sources of information available, company contact details, whether the regulator has been notified, and how a complaint may be lodged with the Privacy Commissioner.
4. Prevent future breaches.

• Delete or anonymize personal data (including IP addresses and search histories) after 6 months, or if retained for longer, retained for no longer than strictly necessary for declared purposes. Make data retention information should be clearly accessible from the home page.
• Other than such information that must be collected to provide the service, do not require additional personal data from users to perform a search.
• Minimize cookie periods to no longer than demonstrably necessary. Use Flash cookies only with transparent information about their use and control.
• Do not add data from third parties to existing profiles without consent.  
• Give users rights to access, correction and deletion of data held about them, including profiles and search histories.
• Do not correlate data across services without informed consent.

At the recent International Association of Privacy Professionals' Summit in Washington DC, BCR was one of the frequently used buzzwords alongside data beach notification, behavioural targeting and global compliance, which shows that the BCR concept is probably the most popular EU data protection law feature outside the EU.

BCR are finally coming of age and establishing themselves as a real runner.  There are a number of factors that evidence this and much of the concern of the previous years has turned into excitement.  For starters, BCR is one of the top priorities for the Article 29 Working Party according to its Work Programme for this year.  In fact, the Working Party subgroup dealing with BCR has already met several times since the beginning of 2008, which is quite an important indicator given that last year it only met once.

At a national level, EU member states and their data protection authorities are making all the right noises to ensure that the use of BCR to legitimise personal data transfers is a workable proposition.  Some countries, like Spain, have even amended primary legislation to facilitate the external binding effect of unilateral declarations made by corporate entities.  Other jurisdictions like Italy or Greece are looking to take similar steps, but what is truly encouraging about this is that such moves have been promoted by the regulators themselves.

The ICO has also found Skipton Financial Services (SFS) in breach of the Data Protection Act. This follows the theft of an unencrypted laptop which contained the personal information of 14,000 SFS customers.The laptop, which contained names, dates of birth, national insurance numbers and investment amounts, was stolen from an SFS contractor. It is the ICO’s view that SFS should have had appropriate encryption measures in place to keep the data secure.