Over the years, there have been a series of stories like this one ..

Suit charges Prozac privacy violations - (United Press International):

"Fort Lauderdale, FL, Jul. 15 (UPI) -- Court papers filed this week in Fort Lauderdale, Fla., show pharmaceutical companies mailed unsolicited doses of Prozac to potential customers.

A deposition filed in a privacy suit brought by some of the recipients of the anti-depressant said the companies got the names and addresses from physicians, the South Florida Sun-Sentinel reported Thursday.

In one case, Dr. Ken Burke admitted supplying his signature on a blank piece of office stationery that a company representative, a frequent fishing companion, attached to the free drugs. Two other doctors from the same office also said they provided their signatures.

The trial packages of a new weekly form of Prozac were sent mostly to users of the standard medication but at least one recipient -- a 16-year-old boy -- had never used anti-depressants.

The suit has also prompted a criminal investigation by the state and criticism from consumer advocates who say it is an example of the improper relationship between doctors and drug companies.

Labels: information breaches

Privacy Expert To Publishers: Don't Bury It In The Privacy Policy

Publishers that think their privacy policies are sufficient should think again. Claria Corp.'s chief privacy officer told attendees at the Jupiter Advertising Forum to expect more enforcement where privacy issues surrounding behavioral marketing are concerned. Freeman argued that anything a consumer is likely to be surprised by must be extracted from a privacy policy and made plain. "Ask yourself," Freeman told the crowd, "Is there something going on here that would surprise your mother or a sick uncle?"

Full text of the article here ...

Labels: information breaches

You can always count on Michael Geist to provide good commentary on privacy issues. His latest LawBytes article in the Toronto Star adds to the debate about the collision between the USA Patriot Act (among others) and Canadian privacy laws:

TheStar.com - U.S. laws put Canadian privacy at risk:

"Although it has garnered only limited attention in the rest of the country, for the past few months the British Columbia privacy and information technology communities have been embroiled in a high-stakes issue that raises difficult questions about the effectiveness of Canadian privacy law and the potential threat posed by data outsourcing to the United States. "

One thing that we shouldn't forget is that PIPEDA gives Canadian law enforcement access to Canadian personal information without consent and without notice to the individual concerned.

7(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is

(c) required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records;

(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that

(i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs,

(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or

(iii) the disclosure is requested for the purpose of administering any law of Canada or a province;

(c.2) made to the government institution mentioned in section 7 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act as required by that section;

*(c.2) made to the government institution mentioned in section 7 of the Proceeds of Crime (Money Laundering) Act as required by that section; *[Note: Paragraph 7(3)(c.2), as enacted by paragraph 97(1)(a) of chapter 17 of the Statutes of Canada, 2000, will be repealed at a later date.]

(d) made on the initiative of the organization to an investigative body, a government institution or a part of a government institution and the organization

(i) has reasonable grounds to believe that the information relates to a breach of an agreement or a contravention of the laws of Canada, a province or a foreign jurisdiction that has been, is being or is about to be committed, or

(ii) suspects that the information relates to national security, the defence of Canada or the conduct of international affairs;

Labels: bc, information breaches, outsourcing, patriot act

File this under "c" for creepy:

Under-the-skin ID chips move toward U.S. hospitals - News - ZDNet:

"VeriChip, the company that makes radio frequency identification--RFID--tags for humans, has moved one step closer to getting its technology into hospitals.

The Federal Drug Administration issued a ruling Tuesday that essentially begins a final review process that will determine whether hospitals can use RFID systems from the Palm Beach, Fla.-based company to identify patients and/or permit relevant hospital staff to access medical records, said Angela Fulcher, vice president of marketing and sales at VeriChip.

VeriChip sells 11-millimeter RFID tags that get implanted in the fatty tissue below the right tricep. When near one of Verichip's scanners, the chip wakes up and radios an ID number to the scanner. If the number matches an ID number in a database, a person with the chip under his or her skin can enter a secured room or complete a financial transaction."

Full text is available here ...

Labels: information breaches, rfid

A followup to my previous post. Privacy International announced the awarding of their annual Big Brother Awards last night:

Privacy International:

"Privacy International Announces Winners of 6th Annual Big Brother Awards

28/07/2004

PRIVACY INTERNATIONAL ANNOUNCES WINNERS OF
THE 6th ANNUAL BIG BROTHER AWARDS

WINNERS INCLUDE MARGARET HODGE MP AND BRITISH GAS.

28th July 2004

On July 28th, the human rights watchdog Privacy International will present the 6th annual 'Big Brother awards' to name and shame the government and private sector organisations that have done the most to invade personal privacy in Britain.

The awards will be bestowed at a special event at the London School of Economics. Awards will also be given to individuals and organisations that have made an outstanding contribution to the protection of privacy. "

Full text of the announcement and info on the winners is available here: http://pi.gn.apc.org/article.shtml?cmd[347]=x-347-63280

Labels: information breaches

This entry represents a first ... I've never linked to a video before, but the ACLU has released an interesting and eye-opening flash animation, illustrating a bit of a worst-case scenario for linked databases. Check it out:

ACLU - Pizza:

"The government and corporations are aggressively collecting information about your personal life and your habits. They want to track your purchases, your medical records, and even your relationships. The Bush Administration's policies, coupled with invasive new technologies, could eliminate your right to privacy completely. Please help us protect our privacy rights and prevent the Total Surveillance Society.

Government programs such as MATRIX and Carnivore are destroying our privacy. We live in a democratic society and government-controlled data systems are a dangerous step toward establishing a 24-hour surveillance society.

Recently Northwest Airlines provided the names, addresses, travel plans and credit card numbers of its customers to a NASA project in complete violation of its own privacy policy. In another example, JetBlue provided information from over a million of its customers to the Transportation Security Administration, also in violation of its own privacy policy."

Labels: air travel, cardsystems, information breaches, surveillance

Watch those attachments!

allAfrica.com: South Africa: Sentech Confidentiality Breach:

"Sentech has e-mailed a database of MyWireless users to some of its clients, in what one user described as a 'serious breach of confidentiality'.

Astonished MyWireless clients forwarded copies of the database to ITWeb this morning, saying it had been attached to an e-mail they received from Sentech at the weekend. The e-mail purported to contain an attachment outlining Acceptable Use Policy. The Excel database includes names, addresses and contact numbers of around 1 500 users.

User groups who have campaigned to get Sentech to improve its MyWireless service said this morning that they were hoping to arrange a meeting with Sentech soon. 'We don't want to fight with Sentech over things like this,' one said. 'We just want the service to work properly.'"

Labels: information breaches

More coverage on the BC outsourcing privacy debate. This time, American CNET News.Com has a report that hightlights a submission co-written by Michael Geist, one of the leading Canadian academics on privacy and technology law:

Labor groups raise outsourcing privacy concerns | CNET News.com A 34-page legal analysis released Monday suggests that the Canadian unions are exaggerating the impact of the Patriot Act. A section of the law enacted after the Sept. 11, 2001 terrorist attacks lets police obtain records from any company with a U.S. branch if the information is said to be "relevant" to a terrorism investigation. The request is made to a secret court that meets behind closed doors in Washington, D.C.

The report, written by Michael Geist and Milana Homsi and filed with the BC Privacy Commissioner, says that current rules granting police the power to review data are "not significantly different than that which was available in a pre-Patriot Act era through grand jury subpoenas and national security letters." (National security letters are a type of administrative subpoena that doesn't require a judge's prior approval.)

The report also says that a Canadian law called the Personal Information Protection and Electronic Documents Act authorizes companies to secretly disclose data to government officials--a definition that could include U.S. police.

Labels: information breaches, outsourcing, patriot act

An earlier blog entry mentioned that BC is planning to strenthen their public sector privacy legislation to prevent access to British Columbians' data by foreign governments. (See the entry here.) The B.C. government's press release is available here: "B.C. LEADS CANADA IN PRIVACY PROTECTION". Also of interest is the BC Government's submission to the BC Privacy Commissioner's study on the impact of the USA Patriot Act on the privacy of Lotuslanders: http://www.gov.bc.ca/mser/down/submission.pdf

Labels: bc, information breaches, patriot act

Prescription drug abuse has consistently presented one of the greatest challenges to the privacy of patient prescriptions. Health Canada has recently required many pharmacists to report prescriptions of certain drugs. Now it looks like the government of Prince Edward Island is proposing to introduce a province-wide computer system to drack prescriptions. Privacy is obviously an issue. Pharmacists and private practice physicians are subject to PIPEDA and are unable to disclose personal information without consent.

CBC News: P.E.I. to track prescription drug abuse:

"Last Updated Fri, 23 Jul 2004 15:22:45 EDT

The government's software could let doctors, hospitals and pharmacists share information on what prescriptions their patients are pocketing, but it's unlikely they will have access when the system launches in the fall.

Under the privacy act, doctors and pharmacists are not allowed to trade information about a patient without that person's consent."

One thing to remember is that PIPEDA has a catch-all exception to the consent principle buried in the end of section 7:

(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is ...

(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that ...

(iii) the disclosure is requested for the purpose of administering any law of Canada or a province;

...

(i) required by law.

If the pharmacist is "required by law" to disclose the information, the pharmacist arguably may dispense with consent.

Labels: health information, information breaches

The Vancouver Province is reporting that the BC government will be responding to concerns about the impact of the PATRIOT Act on BC by introducing legislation:

The Province: B.C. responds to U.S. Patriot Act with privacy plan:

"VICTORIA -- The B.C. government is moving to introduce tough new privacy protection laws in response to the USA Patriot Act.

Attorney General Geoff Plant and Management Services Minister Joyce Murray outlined the plan Friday to B.C.'s Information and Privacy Commissioner.

Murray says the government is taking every step to have the strongest privacy legislation in Canada.

He says the laws would make sure no sensitive personal information will be sent to the U.S. on either a temporary or permanent basis.

It limits the application of the Act by ensuring that American affiliates and B.C. service providers do not have access to information supplied by a public body.

Plant calls the move a 'made-in-B.C.' solution and hopes other provinces will follow.

The U.S. government introduced the Patriot Act after the 9/11 terrorist attacks to give more power to law agencies like the FBI. "

I'll post more info as I find it. In the meantime, you can check out information about the BC Privacy Commissioner's consultations on this matter at his website:http://www.oipcbc.org/sector_public/usa_patriot_act/patriot_act.htm.

Labels: information breaches, law enforcement, outsourcing, patriot act

Computerworld.com has a very good article on protecting customer information. The focus on the article is confidentiality and preventing employees from stealing critical customer info when they leave their employment. A very good read:

Protecting the Data Jewels: Valuable Customer Lists :

"There are techniques to keep the list of your best customers from walking out the door.

News Story by Bob Violino

JULY 19, 2004 (COMPUTERWORLD) - In the casino industry, one of the most valuable assets is the dossier that casinos keep on their affluent customers, the high rollers. But last year, casino operator Harrah's Entertainment Inc. filed a lawsuit in Placer County, Calif., Superior Court charging that a former employee had copied the records of up to 450 wealthy customers before leaving the company to work at competitor Thunder Valley Casino in Lincoln, Calif.

The complaint said the employee was seen printing the list -- which included names, contact information and credit and account histories -- from a Harrah's database. It also alleged that he tried to lure those players to Thunder Valley. The employee denies the charge of stealing Harrah's trade secrets, and the case is still pending, but many similar cases have been filed in the past 20 years, legal experts say. "

Full text here ...

Labels: information breaches

Today's Montreal Gazette has a good and long article discussing privacy issues, from black boxes in vehicles to RFID technology:

They've got your number: Cutting-edge technologies work as tattle-tales for a surveillance-minded state, Canadian privacy advocates warn:

"RFIDs, like other technology, can be misused, Stoddart says. If it is used to track people or if it transmits personal information, those practices would come under applicable provincial and federal legislation, she says.

People have to be notified that RFIDs are attached to products they may buy, allowing them to refuse them or disable them so they don't collect or transmit personal information.

'What concerns me most is the fact that if we don't act fairly soon to have a public debate, a public awareness and discussion of (RFIDs and other potential invasive technologies), they may soon become ubiquitous and then lower our general societal expectation of privacy at a time when, due to the international situation, we already have great pressures on privacy,' Stoddart says.

Her office is in the process of designing a public education program on privacy issues that may be launched this winter."

Full text here ... (beware, Canada.com expires their content pretty quickly).

Labels: information breaches, rfid, surveillance

Thanks to Privacy.org for the reference to the following article that is pretty common sense, but bears repeating and repeating and repeating:

vnunet.com - Multinationals warned on global privacy policy:

"Companies should use the most stringent privacy laws of all the countries in which they operate in order to establish an effective privacy policy.

Leaks of customer information can cause major damage to reputation and brand, according to a report by The Information Security Forum.

The report recommends that organisations use the strictest legislation as the lowest common denominator for establishing an effective policy, and to make sure it is presented consistently at all levels."

Full text here ...

Labels: information breaches

I recently gave a presentation for Advocis, the Canadian national association for financial planners. The presentation is available here: PIPEDA for Financial Planners.

Labels: information breaches, privacy

From CNET News.com:

Intuit warns of credit card risk CNET News.com:

"Intuit, a provider of financial software and services, is warning 47,000 customers that their credit card data may be at risk after computers were stolen from a company office.

According to a letter sent to customers last week and a notice recently posted on Intuit's Web site, the theft happened in early June at the Omaha, Neb., office of ItsDeductible, a software maker acquired by Intuit last year to be part of its TurboTax tax preparation business.

Thieves broke into the office the weekend of June 11, according to the notice, and took several items, including a PC with password-protected customer data. "

Full text here ...

One thing that I find simply amazing is that the computers contained the personal information, including credit card data, for approximately 47,000 customers who purchased Intuit's "ItsDeductible" products between December 2002 and November 2003. Is there any reason why credit card data should be kept for transactions that took place over a year ago?

This highlights the risk inherent in keeping data longer than you need. Once you have sensitive data, you are responsible for protecting it. If the data has no business value, it is now a liability because of the costs of securing it and, more importantly, the cost of having to deal with it being stolen. It just doesn't make business sense to retain any personal information for any longer than you need it.

Labels: information breaches

Today's Toronto Star has an article on workplace surveillance. It quotes Anne Cavoukian, the Information and Privacy Commissioner and is also notable because it mentions that PIPEDA only applies to federally regulated workers. (It's pretty rare for articles like this to make this critical point.)

Labels: air travel, information breaches, surveillance

The London Free Press has an article on the recent Federal Court of Canada decision about video surveillance at the CPR Yards in Toronto (see my blog entry on the case):

Labels: information breaches, surveillance, video surveillance

National Privacy Services Inc. and ClinCoach Inc. have officially announced a series of training courses designed to assist physicians and other regulated healthcare professionals in addressing the Personal Health Information Protection Act, also known as Bill 31 and PHIPA.

Thanks to the alliance between NPSi and ClinCoach, the program will include a very comprehensive and practical course for those engaged in clinical research.

The updated brochure is available at http://www.privacylaw.ca/privacy/Bill_31_training.htm, which also includes an outline of the program.

More information is available on NPSi's training page, and you can register online here.

Labels: health information, information breaches, phipa

I suppose the important thing is that they are getting more business...

Full text of the story here ...

Labels: information breaches

An Unprecedented Training Opportunity

ClinCoach and National Privacy Services have developed a range of training courses to assist health and health research professionals in adapting to and complying with Ontario's new Bill 31, the Personal Health Information Protection Act (aka PHIPA). This law comes into force on November 1, 2004 and has significant requirements for "health information custodians", including all regulated health professionals (physicians, physiotherapists, etc.), hospitals, nursing homes, and more.

The administrative requirements are similar to those of PIPEDA (hopefully the federal cabinet will deem the entire statute to be "substantially similar" to PIPEDA), and there are limited resources available to get healthcare professionals in compliance by the November 1 deadline. No matter what, it is not business as usual. The consent requirements are more specific for healthcare, but they are not exactly user friendly.

The new law also contains specific requirements for clinical researcher and Paula's years of experience in clinical research and clinical research education will prove to be a tremendous asset to attendees of our course designed for clinical research professionals.

From August to October, we will be offering our PHIPA training courses in Ottawa and Toronto. We will likely be hitting other centres in the rest of Ontario through late October and into the fall.

For more information, check out our brochure (advance copy available here) and the websites of National Privacy Services and ClinCoach.

Labels: health information, information breaches, ontario, phipa

National Privacy Services Inc. and ClinCoach Inc. are going to announce tomorrow the establishment of a unique alliance to provide privacy training services for those involved with clinical research. ClinCoach is a leading, international provider of training for clinical research best practices, including the provision of Clinical Research Standard Operating Procedures. With NPSi, ClinCoach is developing a Standard Operating Procedures for interjurisdictional privacy best practices, designed to assist clinical researchers in complying with PIPEDA, PHIPA and other privacy laws.

Labels: health information, information breaches, phipa

Michael Fitzgibbon's labour law blog has a reference to another workplace surveillance case, this time from the B.C. Court of Appeal: See Thoughts from a Management Lawyer: Yet Another Surveillance Case.

Labels: information breaches, surveillance

In an earlier blog entry, I suggested that the bulk of Ontario's Personal Health Information Protection Act will come into force on January 1, 2005. That was incorrect. The version of the bill passed by the legislature had November 1, 2004 as the effective date:

Addition: For information about Bill 31 (PHIPA) training, see http://www.privlaw.com/pages/training_courses.htm

Labels: health information, information breaches, phipa

The Ontario Ministry of Health and Long-Term Care has published a notice of proposed regulations under Bill 31. The public and interested parties are invited to comment on the proposed regulations (deadline: September 3, 2004):

Labels: health information, information breaches, ontario, phipa

Privacy International will be hosting the annual UK Big Brother Awards in London on July 28, 2004. The international lobby group always produces a very interesting list of initiatives and incidents, all of which should not be missed. Prizes are being awarded for the "Most Invasive Company" and "Most Appalling Project", among others. (Thanks to Slasdot and the Register for the link):

Labels: information breaches

This is a slightly older article, but I just happened across it today. It highlights something that I try to drill into my clients. Protecting customer personal information is not just about compliance, it is about keeping customers.

Full text here ...

Labels: information breaches