Cedric Laurant

, , , , , , , , ,

New Blog: “Information Security Breaches & The Law”

In News on 7 August, 2010 at 22:15

Last June, I have started with a colleague, Marie-Andrée Weiss, a blog dedicated specifically to the topic of information security breaches (“Information Security Breaches & The Law”) from both a legal and technical perspectives.

The blog, which is written in English and French, and later will also be in Spanish, will include opinions, comments on recent news, laws or other developments, research notes and conference reports in the area of information security breaches, mainly in the United States, Europe and Latin America.  It also features a “Security Breaches Library” that includes links to major recent reports and surveys, upcoming conferences, calls for papers and news, all on the same subject of information security breaches.

It should be of interest to company executives concerned with information security issues in their business, as well as to professionals practicing in the field of information security, privacy and data protection, along with the interested general public.

Below is an outline of the first blog posts:

  • Will France adopt a law requiring the notification of security breaches? (August 6, 2010): A French bill “to better guarantee the right to privacy in the digital age” has implemented the European Directive 2009/136/EC by requiring the data controller to inform the “Data Protection Correspondent” or the French data protection authority, of a breach of integrity or confidentiality. Those involved in the breach must also be informed, at least if security breaches are “likely to adversely affect” their personal data. The bill follows the recommendation of the Directive to notify individuals of security breaches for all sectors, not just electronic communications. It was adopted by the French Senate on March 24, 2010 and is currently before the National Assembly. (A French version of this article is also available here.)
  • Article 29 Data Protection Working Party reports on implementation of Data Retention Directive (July 19, 2010): The Article 29 Data Protection Working Party has adopted on July 13, 2010 a report on the EU Data Retention Directive (2006/24/EC). This report is the Working Party’s contribution to the evaluation of the implementation of the Data Retention Directive by the European Commission, which is due by September 15, 2010. The report details the results of a joint inquiry made by the data protection authorities about the compliance, at the national level, with the obligations of telecom providers and Internet service providers with both the Data Retention Directive and articles 6 and 9 of the EU e-Privacy Directive (2002/58/EC).
  • Are ‘clouds’ located outside the European Union unlawful? (July 16, 2010): A central aspect of every cloud service contract is the security of data processing. It is therefore important, if only for liability reasons, that responsibility for specific security measures be clearly assigned. This can be done by using security service level agreements between the cloud service provider and its client that clearly assign who is responsible for which particular security measure. Storing data in a cloud located outside the EU raises specific legal compliance issues. According to some experts, such clouds are even unlawful. There are, however, some ways to make sure that, even if a data controller stores data into a cloud located in a third country, he is still in compliance with German data protection law. A data exporter must use, in order to satisfy the adequate level of data protection requirement, specific standard contractual clauses for all contracts with a cloud service company located outside the EU. Binding corporate rules are the alternative solution, though only for private clouds.
  • The Safe Harbor Framework: not a “safe harbor” anymore for US companies? German expert body insists on stronger compliance stance (July 9, 2010): On April 29, 2010, the Düsseldorfer Kreis, an informal group of German data protection authorities, published a decision that could have significant repercussions on U.S. companies importing personal data from organizations operating in the European Union. One of these repercussions is that German organizations exporting personal data to the United States should check if the U.S. data importer does indeed comply with the Safe Harbor Framework. Security plan recommendations will provide for a useful guideline to E.U. data exporters to help them comply with the Safe Harbor’s Security Principle.
  • Canada May Soon Have a Data Breach Law (June 5, 2010): a bill called the “Safeguarding Canadian’s Personal Information Act” (C-29) that would amend Canada’s national privacy legislation. C-29 would introduce a security breach disclosure (also called “notification” in the United States) requirement in PIPEDA. Canada does not yet have such a law, contrary to the United States where the majority of states have enacted data breach notification statutes.

Share

Comment »

, , , ,

European Parliament Debates “SWIFT” Transatlantic Bank Data Deal

In News digest on 10 February, 2010 at 16:02

The European Parliament discusses today, and votes tomorrow on, the transatlantic deal the US Government and the EU Council brokered last year.  It is an interim agreement (called the “FDMA” or “Agreement between the European Union and the United States of America on the processing and transfer of Financial Messaging Data from the European Union to the United States for purposes of the Terrorist Finance Tracking Program (“TFTP”)”) that was agreed between both parties last November. It will enter into force as soon as the EP votes on it, on 11 February, and last until 31 October 2010.  The EP’s consent is required under the provisions of the recent Lisbon Treaty to make the agreement enter into force.  The European Parliament can only give its consent or refuse it.

The European Parliament’s Committee on Civil Liberties, Justice and Home Affairs (“LIBE Committee”) issued last week a Recommendation with respect to how the EP should vote on the FDMA.

What is at stake?

A bit of history is required to understand the stakes of the current vote.  In her report on behalf of the LIBE Committee, the Rapporteur, Jeanine Hennis-Plasschaert, states that each agreement that the EU and the US have negotiated on justice and home affairs issues since 11 September 2001 features many of the same problems in relation to personal data and legal protection.  To overcome these difficulties, the EP has required since 2003 the definition of a coherent EU data protection legal framework as well as negotiations for a transatlantic binding agreement on this issue.

In 2006, it was revealed that the US government had obtained access since 2001 to all of SWIFT‘s data – including European bank customers’ financial information that was originally stored on servers based in the United States.  This news story led to a storm of protest in the EU – in particular as regards the TFTP’s perceived lack of compatibility with the obligations under the EU Data Protection Directive (95/46/EC) as well as Member States’ laws implementing that Directive.

“Slippery slope”

The LIBE Committee’s report argues that:

“As far as the TFTP is concerned, it must be considered as a departure from European law and practice in how law enforcement agencies would acquire individuals’ financial records for law enforcement activities, namely individual court-approved warrants or subpoenas to examine specific transactions instead of relying on broad administrative subpoenas for millions of records.” [...]

“[W]hat might have kicked off as an urgent temporary measure (in reply to 9/11) became de facto permanent without specific approval or authorisation by EU authorities or a real transatlantic evaluation of its impact and forward looking transatlantic negotiations covering at the same time security, judicial cooperation and data protection impact.”

The LIBE Committee’s report is critical of the FDMA and calls for the EP to withhold its consent on 11 February for the following reasons:

“[T]he current debate is not about SWIFT as such but about how Europe could cooperate with the US for counter-terrorism purposes and how financial messaging data providers are requested to contribute to this fight, or indeed more generally the law enforcement use of data collected for commercial purposes.” [...]

“[I]t is not difficult to imagine that accepting the proposed FMDA (as it stands) could lead down the slippery slope of accepting other requests for commercial data with (f.e.) Skype, PayPal and other companies in the information-telecommunication field being potentially interesting for law enforcement purposes.”

EP Committee argues the deal violates EU data protection rules

Among the most crucial legal considerations that the LIBE Committee report highlights are:

  • Violation of the principle of proportionality: when it receives a US government’s request to produce data related to e.g. an individual, SWIFT is not able to produce that specific data because of technical reasons.  The only data it could provide is ‘data in bulk’, which may contain personal data such as the name or address of an individual, and not be limited to the specific purpose for which US authorities may need information for counter terrorism purposes.

This shows that if SWIFT has to transfer most of its data to the US Government it will not be able to comply with the EU Data Protection Directive’s principles of necessity and proportionality.  “This cannot be subsequently rectified by mechanisms of oversight and control,” writes Rapporteur Jeanine Hennis-Plasschaert.

  • Violation of the principle requiring prior judicial authorisation – Uncertainty regarding onwards data transfers to third countries: The FMDA does not provide that transfer requests be limited in time and be subject to prior judicial authorisation.  Neither does it does define enough the conditions under which the US Government plans on sharing TFTP data with third countries.  The public control and oversight of the access to SWIFT data by US authorities is not defined either.
  • Undefined retention time: The FMDA provides that all non-extracted SWIFT data will be erased after a specified period but does not provide any length of time.

By “non-extracted data”, the FDMA refers to the data US law enforcement authorities have not needed for terrorism-related investigations.  Only if such data is “no longer necessary to combat terrorism or its financing” (Article 5 (i)) will the US authorities not keep the data for longer than 5 years after their receipt (Article 5 (l)).  For all data that might be necessary “to combat terrorism or its financing”, or for data that is extracted but found not to contain usable information, the duration of retention is not indicated in the Agreement.  This implies that the US Government could legally keep that data for up to 100 years.  (See “Representations of the United States Government”.)  The same retention issue occurred during the negotiation of the EU-US PNR (“Passenger Name Record”) Agreement that the EU Council, the Commission and the US Department of Homeland Security negotiated between 2003 and 2004.  In that case, the US Government had used a 100-year retention period as the regular duration period to keep such PNR data.

  • Undetermined provisions on access, rectification, compensation and redress outside the EU: these rights are not defined adequately in the FDMA.

The EP report states:

“The FMDA does not guarantee European citizens and companies the same rights and guarantees under US law as they would enjoy in the territory of the EU.  Furthermore, the FMDA does not indicate under what circumstances an individual or company outside the territory of the US is to be informed of the fact that an unfavourable administrative decision has been taken against him/it.”

What happens next?

If Parliament refuses consent on Thursday 11 February, the FMDA will not enter into force and its provisional application would terminate upon notification by the EU to the US authorities.  In such case, the US-EU Agreement on Mutual Legal Assistance of 2003 (“MLAT”, or Mutual Legal Assistance Treaty) and bilateral agreements on mutual legal assistance between the US and certain EU Member States would provide the framework pursuant to which future financial data exchanges would have to be pursued.  This MLAT includes, but is not limited to, terrorist offences.  Not only does it greatly limit the scope of data requests to investigations of specific individuals or companies “suspected of or charged with a criminal offence”, but the transfer of data to the US is also governed by the domestic law of the Member State(s) concerned.  The request for information must identify the person (legal or natural), indicate the grounds for suspecting he/she has committed a crime, and show how the information relates to the criminal investigation or proceeding.

Links:

Share

Comment »

, , , , ,

“Educating” about Facebook’s recent privacy policy changes

In Opinions on 20 December, 2009 at 05:25

In response to the Washington-based Electronic Privacy Information Center (EPIC)’s recently filed complaint against Facebook for its new privacy policy changes, Jules Polonetsky, Co-chair and Director of the Future of Privacy Forum, wrote the following comment:

“How Facebook handles user reaction is more important than even an FTC complaint. Certainly the new privacy setting changes will lead to some Facebook users sharing information more widely, and that warrants privacy scrutiny and debate. Other users may use the new controls to make case by case decisions about what they share. The key question is whether users are aware of the settings and whether they are using them. So far, many users seem to be aware of the changes and are adjusting the privacy controls as they see fit. As people react to the new options, Facebook should continue to respond as they have done by continuing to add educational information and to adjust to ensure they meet user expectations.”

(“Statement in Response to FTC Complaint Filed Regarding Facebook Privacy Settings“)

One cannot object that a company intend to make profits when, like in Facebook’s case, the company aims at monetizing its users’ profile information by making some of it fully public, and selling it to advertisers, search engines and other businesses. However, it’s a big no no for a company to mislead its users. Firstly by leading them to think that the latest change to its privacy policy is an “upgrade” when it should instead be called a “downgrade” — much more information is now considered “publicly available” like contacts and friends’ list, geographic region and profile picture). Secondly, by disregarding its users’ previous privacy settings by, e.g., making their profiles available for indexing by search engines.

If, as Jules Polonetsky writes, “how Facebook handles user reaction is more important than even an FTC complaint”, then the company should, first of all, have been straighforward by telling its users the truth: that its business model is based on extensive data mining and targeting of users; that users should carefully review all of their privacy settings; that its formerly acclaimed granular privacy settings are now a thing of the past; and that the main aim of the changes are to make even more personal information available publicly or to the company’s API (application programming interface) developers and advertisers. This would then have been properly called “educational information”. Instead it cannot be called otherwise than misinformation and deception (a “representation, omission or practice that is likely to mislead the consumer acting reasonably in the circumstances, to the consumer’s detriment”, as the U.S. Federal Trade Commission’s definition goes), especially when considering that many of Facebook’s users are still in high school, or even younger than that.

Consumer privacy and the protection of personal information are an essential value of the online social networking experience. It cannot be a hostage to a constantly changing privacy policy that does not have any other (business, not educational) purpose than monetizing its user base. Like in the offline world, in the online one, you are ready to share certain types of information depending on whom you address the information to, be they friends, colleagues or strangers. Facebook by changing, from one day to the other, the basic assumption on which many people relied upon when they signed up for the service — that your list of contacts and friends is not public information — is deceiving its users.

For all these reasons, the complaint to the Federal Trade Commission is well-founded and will be very educational for the general public and Facebook’s 350 million users.

Here are a few links truly educative for Facebook’s users, detractors and apologists alike about the nature and implications of its recent privacy policy changes:

- Kevin Bankston (Electronic Frontier Foundation), Facebook’s New Privacy Changes: The Good, The Bad, and The Ugly (9 Dec. 2009)

- Jason Kincaid (TechCrunch), The Looming Facebook Privacy Fiasco (1 July 2009)

- EPIC’s complaint with the U.S. Federal Trade Commission (17 Dec. 2009)

Here is a detailed legal analysis of the Facebook website under Canadian data protection rules:

- Elizabeth Denham (Office of the Privacy Commissioner of Canada), Report of Findings into the Complaint Filed by the Canadian Internet Policy and Public Interest Clinic (CIPPIC) against Facebook Inc. Under the Personal Information Protection and Electronic Documents Act (16 July 2009)

and a legal analysis of social networking websites under European Union data protection rules:

- Article 29 Data Protection Working Party, Opinion 5/2009 on online social networking (12 June 2009)

Share

Comment »