Privacy Briefing - August 2004

Edited by Michael Power

• Big Companies Employing Snoopers for Staff Email

• Canada: Police May Not Fish for Evidence

• Italy: Civil Choice to Publish Mobile Numbers

• South Africa: Sentech Confidentiality Breach

• Under-The-Skin ID Chips Move Toward U.S. Hospitals

• U.K.: Privacy Traded for Personalization

• U.S.: Allegheny County Courts Reveal Personal Information

• U.S.: No Constitutional Right to Sexual Privacy

• U.S.: The Confidentiality of Alcohol and Drug Abuse Patient Records Regulation and the HIPAA Privacy Rule

British Columbia has announced plans to stop any far-reaching effects the U.S. Patriot Act may have on the privacy of people in B.C. The province will introduce rules this fall to forbid Canadian subsidiaries of American companies from handing over private information to American law enforcement agencies.

Under the Patriot Act, passed in response to the September 11, 2001 attacks, U.S. agencies are allowed access to the information in the name of U.S. homeland security. Civil liberty and privacy activists say there's an easier way around the Patriot Act—stop contracting out government data services to American-owned companies.

The province is currently negotiating seven different contracts where private information could be exposed under the Act, including financial and medical records. Geoff Plant, B.C.'s attorney general, says the Patriot Act presents "a small and largely theoretical risk to personal information" collected in B.C.

Full press report available at:

http://www.cbc.ca/story/canada/national/2004/07/24/bc_privacy040724.html

Full press release available at:

http://www2.news.gov.bc.ca/nrm_news_releases/2004MSER0012-000602.pdf

BC Submission to BC Privacy Commissioner outlining proposal available at:

http://www.gov.bc.ca/mser/down/submission.pdf

Large companies are now so concerned about the contents of the electronic communications leaving their offices that they're employing staff to read employees' outgoing emails. According to research from Forrester Consulting, 44 per cent of large corporations in the U.S. now pay someone to monitor and snoop on what's in the company's outgoing mail, with 48 per cent actually regularly auditing email content.

The Proofpoint-sponsored study found the motivation for the mail paranoia was mostly due to fears that employees were leaking confidential memos and other sensitive information, such as intellectual property or trade secrets, with 76 per cent of IT decision makers concerned about the former and 71 per cent concerned about the latter.

Full press report available at:

http://www.silicon.com/silicon/management/government/

Police with reasonable suspicions have the power to detain people temporarily but can't go on "fishing expeditions" for evidence, the Supreme Court of Canada ruled in a decision released July 23rd.

It was the first time the high court had examined an everyday police practice that many law officers and prosecutors take for granted. The decision upholds a ruling by a trial judge in Winnipeg, who acquitted Phillip Henry Mann of trafficking after police stopped him on the street in relation to a nearby break-and-enter and found almost an ounce of pot in his sweatshirt pouch.

"Individuals have a reasonable expectation of privacy in their pockets," Justice Frank Iacobucci wrote in a majority decision that divided the high court 5-2. "The search here went beyond what was required to mitigate concerns about officer safety and reflects a serious breach of (Mann's) protection against unreasonable search and seizure."

The court agreed, however, that police can briefly detain a person for investigative purposes, provided they have reasonable grounds to suspect the person is connected to a particular crime.

Full press report available at:

http://cnews.canoe.ca/CNEWS/Law/2004/07/23/pf-554418.html

The Privacy Authority's decision to authorize the publication of mobile phone numbers in telephone directories is "a very civil choice that could be useful and timely for all users." This is the opinion of the Communications Minister, Maurizio Gasparri. "…I believe that for all us users it will be useful and timely to also have available alongside the yellow pages and the white pages a directory of these numbers. Naturally, if there is the authorization of the user." Gasparri said a decision on this matter was wanted for some time: "If you like we are even behind compared to other countries given the mobile phone boom in Italy."

Press Report available at:

http://www.agi.it/english/news.pl?doc=200407212034-1262-RT1-CRO-0-NF82

South Africa: Sentech Confidentiality Breach

Sentech, a South African wireless carrier, has e-mailed a database of MyWireless users to some of its clients, in what one user described as a "serious breach of confidentiality."

Astonished MyWireless clients forwarded copies of the database to ITWeb, saying it had been attached to an e-mail they received from Sentech the previous weekend. The e-mail purported to contain an attachment outlining Acceptable Use Policy. The Excel database includes names, addresses and contact numbers of around 1 500 users.

Full press report available at:

http://allafrica.com/stories/200407261247.html

VeriChip, the company that makes radio frequency identification—RFID—tags for humans, has moved one step closer to getting its technology into hospitals. The Federal Drug Administration issued a ruling on July 27 that essentially begins a final review process that will determine whether hospitals can use RFID systems from the Palm Beach, Florida-based company to identify patients and/or permit relevant hospital staff to access medical records, said Angela Fulcher, vice president of marketing and sales at VeriChip.

VeriChip sells 11-millimeter RFID tags that get implanted in the fatty tissue below the right tricep. When near one of Verichip's scanners, the chip wakes up and radios an ID number to the scanner. If the number matches an ID number in a database, a person with the chip under his or her skin can enter a secured room or complete a financial transaction.

The approval process does not center on health risks or implications. The company's basic technology has also been used in animals for years. Instead, the FDA may mostly examine privacy issues.

Full press report available at:

http://zdnet.com.com/2100-1103_2-5285815.html

British consumers are happy to give away private information if they get better, more personalised online content in exchange. A survey found 64 per cent would exchange preference information for personalised content and product information. Just over half, 56 per cent would give away information about their age and gender.

The survey also found differences in attitude according to age—younger surfers are more trusting (gullible?) than their older and more suspicious counterparts. Among 18-to-34 year olds, 63 per cent would happily give away demographic information; this falls to 49 per cent of over-35s. Overall, 40 per cent of respondents would agree to let a Web site monitor their clicks and purchases.

Full press report available at:

http://www.theregister.co.uk/2004/07/27/privacy_personalised/print.html

For nearly a year, the Allegheny County prothonotary's(chief clerk's) office has been electronically scanning court documents in civil cases, including divorces and child custody cases, and posting them online for public access. The problem is that many of the files contain potentially sensitive personal data, including birth dates, Social Security numbers, even bank account numbers—the information ID thieves crave in order to steal people's identities.

The prothonotary's office believes it's the only court in the state, and one of the few nationwide, that allows unfettered electronic access to court filings, throwing it into the forefront of a debate pitting greater public access against concerns about privacy.

Advocates of electronic access, including the local prothonotary's office and the news media, defend the practice by pointing out that the court filings being displayed are already public record and can be viewed in hard copy at courthouses.

Critics, chiefly consumer privacy groups, argue that since paper filings are relatively difficult and time-consuming to obtain (it requires visiting the courthouse and asking a clerk to retrieve them by case number or name), sensitive personal data is protected by "practical obscurity." Simply put, electronic access makes viewing court records a whole lot easier, for both the public and ID thieves.

Full press report available at:

www.post-gazette.com/pg/04211/353372.stm

On July 28th a federal appeals court upheld a 1998 Alabama law banning the sale of sex toys in the state, ruling the Constitution doesn't include a right to sexual privacy.

In a 2-1 decision overturning a lower court, a three-judge panel of the 11th U.S. Circuit Court of Appeals said the state has a right to police the sale of devices that can be sexually stimulating.

The American Civil Liberties Union, which represented merchants and users who sued to overturn the law, asked the appeals court to rule that the Constitution included a right to sexual privacy that the ban on sex toy sales would violate. The court declined, indicating such a decision could lead down other paths.

The state law bans only the sale of sex toys, not their possession, the court said, and it doesn't regulate other items including condoms or virility drugs. "The Alabama statute proscribes a relatively narrow bandwidth of activity," U.S. Circuit Judge Stanley F. Birch Jr. wrote.

Circuit Judge Rosemary Barkett disagreed, saying the decision was based on the "erroneous foundation" that adults don't have a right to consensual sexual intimacy and that private acts can be made a crime in the name of promoting "public morality."

Full press reports available at:

http://seattlepi.nwsource.com/national/apus_story.asp?category=1110

http://courttv.com/news/2004/0729/sextoys_ap.html

http://abcnews.go.com/wire/US/ap20040729_210.html

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule establishes a foundation of Federal privacy protections and individual rights with respect to individually identifiable health information held by covered entities and their business associates. Other laws, such as state and other federal laws, may provide additional privacy rights and protections.

The document "The Confidentiality of Alcohol and Drug Abuse Patient Records Regulation and the HIPAA Privacy Rule: Implications For Alcohol and Substance Abuse Programs," addresses the interaction of the Confidentiality of Alcohol and Drug Abuse Patient Records regulation (42 CFR Part 2) and the HIPAA Privacy Rule. It offers guidance on how these entities may integrate the Privacy Rule into business and clinical processes. Among other things, the document contains a summary that highlights significant areas in which the two federal regulations interact.

The document, produced by the Substance Abuse and Mental Health Services Administration, may be found at:

http://www.hipaa.samhsa.gov/Part2ComparisonCleared.htm

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.