Inside Privacy - Updates on Developments in Global Privacy & Data Security

The data protection authority in Hamburg, Germany, issued an administrative fine in the amount of € 145,000 against Google for its illegal WiFi data collection activities. This fine fell just short of the maximum amount for such fines under German data protection law, which is € 150,000 (in cases of negligence).  Between 2008 and 2010, Google Street View vehicles collected WiFi data while at the same time recording images for Google’s Street View program.  Google recorded the content of communications, including e-mails, passwords, photographs and chat-logs.

When these facts were first discovered in 2010, a German prosecutor initiated proceedings against Google.  Those proceedings were terminated in November 2012, but the Hamburg data protection authority subsequently investigated the same facts in the framework of administrative offence proceedings.  That data protection authority ultimately held that Google acted negligently in its unauthorized collection and storage of personal data and imposed the above-referenced administrative fine.  Google also was ordered to delete all illegally collected data and Google confirmed such deletion.

By Ezra Steinhardt and Oliver Grazebrook

On April 2, the Article 29 Working Party (the “Working Party”) approved a new Opinion on a principle of European data protection law known as the “purpose limitation”.  The principle (which stems from Article 6(1)(b) of the Data Protection Directive) requires that data controllers only collect data for “specific”, “explicit” and “legitimate” purposes, and not process the data for further purposes that are incompatible with the purposes for which data were originally collected.  As each of these terms have been interpreted differently in different Member States, causing potential confusion for data controllers operating in multiple jurisdictions, one of the main aims of the Working Party paper is to provide clearer, more harmonized interpretations of the principle.  The paper also aims to generally clarify the current legal framework and assist policy makers in drafting the new EU data protection legal framework, and offers guidance on specific scenarios (such as so-called “Big Data” processing). 

Continue Reading

The Civil Liberties, Justice and Home Affairs (LIBE) Committee of the European Parliament (EP)-- the EP’s lead committee for the European Commission’s legislative proposal for a General Data Protection Regulation to replace the current EU Data Protection Directive--was supposed to vote at the end of April on the proposed amendments to the draft Regulation. However, since the release of the rapporteur’s draft report on the proposed Regulation (see InsidePrivacy Draft report on the proposed EU Data Protection Regulation released, January 8, 2013) more than 3,000 amendments have been proposed by the different parliamentary committees involved in the process. The rapporteur, Green Member of the EP (MEP) Albrecht, has now been tasked to boil the proposed changes down to 100 compromise amendments. The date for the LIBE Committee vote has therefore been postponed to 29 May 2013.

Despite this delay, MEPs are still hopeful to find an agreement with the EU Member States in the Council on the proposal before the elections in May 2014. This will require a huge effort by both the EP and the Council, which both seem to be split into two camps:  on the one hand those who are pushing for a stricter set of rules, which reinforces both obligations of companies and rights of consumers and provides for increased enforcement powers, and on the other hand those who want to lower the burden for businesses. The latter camp seems headed in the same direction as the Council with its recent calls for introducing a more risk-based approach into the proposal (see InsidePrivacy The Battle Lines are Clearing Up: The Irish Presidency Note on the Proposed General Data Protection Regulation, March 11, 2013).

By Oliver Grazebrook and Ezra Steinhardt

On 27 February 2013, the Article 29 Working Party published its latest statement regarding the draft General Data Protection Regulation (the “Regulation”), which continues to undergo revision in the European Parliament and Council.  (The latest European body to comment on the draft was the European Parliament's Committee on Employment and Social Affairs (EMPL), which published its opinion on the draft Regulation late last week.)

The Working Party statement stakes out the Working Party’s position on six key areas of the reform, including rules on consent, regulation of the public sector, and data transfers.  The statement was also accompanied by in-depth discussions about an “exemption for personal or household activities” and about how the “one-stop shop” rules will work when a controller is processing data in multiple jurisdictions. 

Continue Reading

On 24 January 2013, the UK Information Commissioner’s Office (ICO) announced that Sony Computer Entertainment Europe Limited (Sony) would be fined £250,000 following a data breach of the Playstation Network.  The breach occurred in 2011 when hackers accessed the personal details of “millions” of Playstation Network customers, including names, dates of birth, passwords, and other categories of data. 

Following an investigation, the ICO declared that the breach had been “preventable” had software been kept up to date, and stated that “[Sony] is a business that should have known better”. 

The monetary penalty notice redacts key details of the breach -- such as the precise number of Sony Playstation accounts affected -- but nevertheless reveals interesting details about how the ICO reached the decision to fine Sony £250,000, that other companies should take note of.

In particular, the notice cites aggravating factors, including, for example, the “vast amount” of personal data affected, and the ICO’s belief that Sony “should have been aware of the software vulnerability” that led to the breach.  The notice also cites mitigating factors, that presumably reduced the scale of the fine, including, for example, the complexity of the Sony Playstation Network, a lack of previous security breaches, the fact that no complaints were received by Sony after the breach, and Sony's behaviour following the breach (Sony voluntarily reported the breach to the ICO, informed data subjects, and fully cooperated in the investigation).

A short Youtube video of David Smith, Deputy Commissioner and Director of Data Protection at the ICO, commenting about the breach, was also released, and is available here.

by Monika Kuschewsky and Kristof Van Quathem

On January 8, 2013, MEP Jan Philipp Albrecht released his draft report on the proposed EU Data Protection Regulation.  Albrecht, of the European Green Party, is rapporteur for the Civil Liberties, Justice and Home Affairs (LIBE) Committee of the European Parliament, the lead Committee for the proposal.  His draft report will now be considered by the Committee members, who have until the end of February to table amendments before it will be discussed in plenary. They will need this time as Albrecht has tabled a total of 350 amendments to the proposed Regulation.  Those who expected a conciliatory report searching for compromise and practical solutions will be disappointed, as many of the proposed amendments will strengthen the rights of individuals and supervisory authorities and reinforce existing, or impose additional, obligations on companies.  As a result, the draft report is expected to be heavily criticized and amended in the months to come.

In terms of content, it is noteworthy that Albrecht puts greater emphasis on the Internet.  A number of the proposed amendments are closely related online practices.  This is rather worrisome as the proposed Regulation is not limited to online data processing, and care should be taken not to turn the General Data Protection Regulation into an Internet Data Protection Regulation. 

We review the key points of the draft report after the jump. 

Continue Reading

By Jacqueline Clover and Ezra Steinhardt

In December 2012, the European Network and Information Security Agency (ENISA) published a set of (non-binding) Guidelines titled, “Appropriate security measures for smart grids; Guidelines to assess the sophistication of security measures implementation”.  The Guidelines are intended to help EU Member States and smart grid stakeholders improve the resilience of smart grid cyber security systems against cyber threats and attacks, and follow on from a pair of European Commission initiatives that have called for improved security of European electricity networks:  the Commission’s Standardization Mandate to support European Smart Grid Deployment, released in March 2011, and the Commission’s Recommendation on the roll-out of smart metering systems, released in March 2012.  The latter document encourages EU Member State electricity network providers to consult the ENISA Guidelines when implementing smart grid security measures.

The Guidelines stress the importance of data privacy for smart grid stakeholders, and note that many such stakeholders “still have little experience in these areas”.  The Guidelines do not set out to address data privacy concerns per se, but the information security measures proposed by the Guidelines will also be of use to controllers, who must take adequate organizational and technical measures to protect personal data under European data protection law. 

The Guidelines aim to harmonise and establish minimum cyber security standards and best practices for European smart grids.  The Guidelines identify ten smart grid security issue areas and make security recommendations for each area.  To take into account different smart grid characteristics, such as the size of the grid or the types of services provided, and correspondingly different risk profiles, the Guidelines accommodate varying degrees of security measure implementation (“sophistication levels”).  Some security measures (or security issues) discussed by the Guidelines include:

• Protection of sensitive information processing facilities;
• Encryption methods for sensitive data during storage and transmission;
• Controlling access to critical asset information, and the use of secure remote access methods;
• Precautions against malware and viruses;
• Timely technical upgrades to smart grid information systems;
• Segregation of information services and information systems into groups and networks;
• Protection of security audit information;
• Security policies and monitoring of grid information systems;
• Staff cyber security training programs, personnel risk assessments, and staff security responsibilities and oversight;
• Third party agreements (e.g., with external suppliers and contractors) and monitoring of third parties to preserve confidentiality;
• Communication with relevant authorities and cyber security interest groups (i.e., to stay ahead of the latest vulnerabilities and threats);
• Maintaining updated inventories of all smart grid components and systems;
• Management of authentication credentials, user names, etc.; and 
• Policies for secure disposal of smart grid components and systems.

The smart grid provider should conduct a risk assessment when determining how to implement and maintain the above measures. 

By Bonnie Drury and Ezra Steinhardt

The Information Commissioner’s Office (ICO) has produced new guidance on “IT asset disposal for organisations” to help data controllers understand their responsibilities relating to the destruction and disposal of electronic equipment.  The guidance, which addresses one of the areas where organizations are most frequently fined under the UK Data Protection Act 1998 (DPA), explains how controllers should create an asset disposal strategy, take measures when engaging IT disposal companies, and assign responsibility for IT asset disposal within their organization.  These measures are intended to help controllers comply with the seventh principle of the DPA, known as “information security”, which requires data controllers to take measures to ensure the security of the personal data they process. 

There are three main elements to the ICO’s guidance:

• Create an asset disposal strategy. The organisation should formulate an information security policy that includes a section on procedures for IT asset disposal and data deletion.  This section should include information about the devices used by the organization to process personal data; the nature of such personal data; how the devices will be disposed of when they are no longer needed; and how the risks associated with the disposal process will be assessed.

• Engage an IT disposal company. If the organization employs a specialist asset disposal company to deal with the devices, this company will likely be defined as a “data processor” under the DPA. As a result, a written contract should be put in place between the parties, detailing the organization’s instructions for disposal of the assets. The organization should monitor and audit the disposal process to ensure that the asset disposal service provider is complying with its instructions.

• Designate an asset disposal champion. A member of the organization with a suitable level of authority should have responsibility for IT asset disposal. This person should be aware of which devices leave the organization, what personal data is stored on them, and who has responsibility for erasing the personal data.

By Fredericka Argent and Ezra Steinhardt

On 26 October, 2012, Commissioner Viviane Reding, the Vice President of the European Commission, gave a speech in Luxembourg following the conclusion of a meeting of the Justice Council (a body of ministers representing Member State justice and home affairs departments, and part of the European Council).  The speech covered a variety of topics, including an update on Commissioner Reding’s positions on the proposed new data protection regime. In particular, businesses may be interested to learn that Commissioner Reding offered to review the number of “delegated act” provisions in the legislation, potentially reducing the scope for future uncertainties.  The Commissioner acknowledged a variety of concerns raised by the Member States, and observed that the legislative  negotiations in the European Parliament and Council were now at a “crucial stage”. 

The Commissioner used the speech as an opportunity to describe three “proposed solutions” to the criticisms of the bill levied to date.  Each solution represents a change from the Commission’s previous negotiating position, and also possibly a step towards compromise among the three law-making European institutions.

Continue Reading

By Dan Cooper & Ezra Steinhardt

On 16 October, 2012, the French data protection authority, the CNIL, released a report on behalf of the Article 29 Working Party that examines Google’s compliance with European data protection law.  The report marks a new stage in an investigation which began nine months ago, when Google announced that it intended to change its online privacy policy.  The report finds that Google’s new privacy policy (which came into effect on March 1) does not yet comply with European law in a number of important respects, and challenges Google to commit publicly to certain European data protection principles, including principles of “purpose limitation” and “data minimization”. 

The report, released together with an annex, makes a number of recommendations to Google, including, for example, recommendations:

• That Google enhance its notices to users by becoming more specific about what types of data Google processes and combines, and for which services; by introducing new interactive privacy notices; by adding more in-product and product-specific privacy information; and so on.
• That Google simplify the various opt-out mechanisms that it provides to users, and to make them available in “one place”;
• That Google obtain explicit user consent for the combination of user data for certain purposes.

A variety of other recommendations are also made in the Annex (for example, Google is asked to clarify that users are not required to sign up to Google Accounts using their real names).

In a morning press conference, CNIL President Isabelle Falque-Pierrotin said that she would allow Google a period of “a few months” to respond to the recommendations.  If Google takes no action by that time, she said the CNIL will consider litigating against Google in national French courts.

In a separate letter, other data protection authorities, from Australia, Canada, Mexico, Hong Kong and Macao (representing the Asia Pacific Privacy Authorities Forum) also endorsed the findings.