Privacy Commissioner begins a new phase as an ombudswoman

When the Assistant Privacy Commissioner was at the McInnes Cooper/NPSi seminar on privacy and business last week, on thing she said was that the Office of the Privacy Commissioner is going to emphasise its original mission: that of an ombudsman (or ombudswoman). Apparently Radwanski had no interest in settling matters or helping with the process. With that in mind, the OPC is now going to release "findings" of many that are settled in the course of investigation, beginning with a batch that were just put on the website this week:

Commissioner's Findings - Privacy Commissioner of Canada

The following are new noteworthy settled in the course of the investigation and early resolution case summaries

• PIPEDA Case summary #295: Access request ignored, but no personal information existed


• PIPEDA Case summary #294: Trucking Business Formulates and Implements Privacy Policy


• PIPEDA Case summary #293: Collection agency corrects inaccurate information


• PIPEDA Case summary #292: Windows reveal too much information


• PIPEDA Case summary #291: Company takes steps to become compliant with the Act


• PIPEDA Case summary #290: Company eliminates excessive information from database


• PIPEDA Case summary #289: Trucking company prepares privacy policies and procedures and designates a privacy officer subsequent to settling complaint from former employee


• PIPEDA Case summary #288: Credit check to open a personal deposit account


• PIPEDA Case summary #287: Company amends employee list it sends to union


• PIPEDA Case summary #286: Concerns result in improved language of consent


• PIPEDA Case summary #285: Pharmacy simplifies its consent policy and procedures


• PIPEDA Case summary #284: Store implements changes following laptop lapse

Army's proposed database of sexual assault victims comes under fire from privacy advocates

The United States Army, in an attempt to deal with the problem of sexual assaults within its ranks, is proposing to develop a database to track all sexual assaults and victims. Privacy advocates are concerned about the risks associated with this database and the chilling effect it may have on victims coming forward. See:

Some Oppose Army's Sexual Assault Database - Yahoo! News:

...The planned Army system would include the victim's name, Social Security number, date of birth, other demographic information, military service data, assault investigation and police reports, medical and other support records, and any actions taken against offenders...

Just imagine what would happen if this database on a laptop or a USB thumb drive gets "lost" ...

Incident: Missing laptop affects 500 Safeway employees

From the Santa Cruz Sentinel:

Safeway discloses possible security compromise - By Gwen Mickelson - Sentinel staff writer - November 22, 2005:

About 500 Safeway employees in Santa Cruz County could be affected by a company laptop theft.

In October, Pleasanton-based Safeway Inc. notified employees in California and Hawaii that certain personal information may have been compromised when a company laptop was stolen in August from a division director's home, along with other unrelated items.

In a letter to Safeway employees dated Oct. 17, Human Resources Director Bob Carlson said the computer contained several reports that include names, Social Security numbers, hire dates and work locations for a number of Safeway employees. The computer was protected by a power-on password, the company said, but nonetheless recommended that employees place a fraud alert on their credit files and request copies of their credit reports every three months for the next year.

No information breaches have been reported, spokeswoman Jennifer Webber said.

...

But union leaders criticized the company, asking why it took so long to notify employees and why the information was stored on a laptop.

...

Members of the union, which represents about 1,200 employees in Monterey, Santa Cruz and San Benito counties, "don't want to hear 'no one's been compromised yet,'" he said. "They want to hear 'we're sorry, we apologize for the 60-day delay, we assure you you're not going to pay out-of-pocket for one thing, we've put measures in place so that this won't happen again.'"

...

Briley said the password protection doesn't soothe his members, and said he wants assurance from Safeway that if anyone does fall victim to identity theft down the road, the company would take responsibility and help out.

He criticized the grocer for keeping members information on a laptop, saying he'd "bet a hundred-dollar bill" that Safeway Club Card data the company keeps on consumers is "kept on a safer computer than my members' information."

Webber called Safeway security processes "incredibly tight," and said procedures "have been and will be to keep information as secure as possible."

...

Your life secrets, left in a taxi

I didn't hear about this incident: Apparently last month, a USB "thumb drive" containing sensitive personal information of ONE HUNDRED TWENTY THOUSAND current and former patients of Wilcox Memorial Hospital in Hawai'i went missing. No word on where it went. (See: TheHawaiiChannel - KITV 4 News - Kauai Hospital Missing Drive With Patients' Social Security Numbers.)

Bob Sullivan, at MSNBC, uses it as an example of the latest challenges facing custodians of personal information: information is mobile and huge quantities of personal information can leave your control on thumb-drives, laptops, iPods, Blackberries and the like. See Your life secrets, left in a taxi - Security - MSNBC.com.

As I mentioned in a previous post about the Boeing missing laptop incident, the solution is to not let this information go on a walkabout. If you have an employee who needs access to sensitive data offsite, provide access using a secure VPN. And two-factor authentication. And a dumb terminal. That doesn't address all the data that goes on an unauthorized sojourn, but it does deal with those companies that let relatively unsecured data wander about in easily stolen devices.

Incident: PC containing personal information on +160K Boeing employees and retirees stolen

A personal computer containing sensitive personal information on current and former Boeing employees has been stolen. The information included names, addresses, social insurance number and, in some cases, banking information. Boeing says that the information was password protected. The PC was being used by an employee off-site, but the company wouldn't elaborate on the details of the theft. See: The Seattle Times: Business & Technology: PC stolen from Boeing packed with employees' personal data.

Saying it is "password protected" isn't a lot of assurance, given that Windows login passwords are not very secure. (See The Canadian Privacy Law Blog: Don't worry, your data is password protected. Yeah? How?)

Rob Hyndman comments:

"All interesting, etc. etc., but really just another day in the wacky world of data security. For my part, it's difficult to understand why one would ever need the personal and banking information of 161,000 people on a laptop - so one can read it on the sofa? Or take it to that HR Symposium in Duluth, 'just in case'?"

In this day and age, with the widespread adoption of relatively secure remote access by VPN, it is difficult to see why this sort of sensitive information really needs to be on an easily stolen laptop.

Summaries of incidents cataloged on PIPEDA and Canadian Privacy Law

Since I started this blog in January 2004, I have noted a few incidents related to inappropriate release of personal information. After an e-mail exchange with Rob Hyndman, I thought it would be interesting to figure out how many incidents I've blogged about. So here is a brief catalog of what I've picked up over the last year and a bit.

Hacking and inappropriate disposal rank highly as the reasons for ending up on this list. But, if there is one thing to learn from all of this: inadequate security of personal information is the one practice that is the most likely to put your company on the front pages of the paper and to destroy any customer trust you've managed to develop.

• 200401- Incident: Hackers may have accessed personal info for 20,000 Georgia students
  
• 200401 - Incident: Computer containing airline ticketing info stolen
  
• 200402 - Incident: Computers (likely containing personal information) stolen from Whitehorse probation office
  
• 200402 - Incident: Softbank Says Data on 4.52 Million Subscribers Leaked
  
• 200402 - Incident: Shred first, then discard!: "Files containing property tax information and receipts for parking tickets and business licences were mistakenly left overnight Thursday in a recycling bin outside Port Coquitlam city hall"
  
• 200402 - Incident: Computers (likely containing personal information) stolen from Whitehorse probation office
  
• 200403 - Incident: Net firm admits leak of data about 1.4 M clients
  
• 200403 - Incident: Equifax admits that more than a thousand credit reports have been compromised
  
• 200405 - Incident: Computer System at U.C. San Diego Hacked: " Hackers broke into the computer system of the University of California, San Diego, compromising confidential information on about 380,000 students, teachers, employees, alumni and applicants. "
  
• 200407 - Article: Suit charges Prozac privacy violations -: "A deposition filed in a privacy suit brought by some of the recipients of the anti-depressant said the companies got the names and addresses from physicians."
  
• 200407 - Incident: Intuit warns of credit card risk: "'Intuit is warning 47,000 customers that their credit card data may be at risk after computers were stolen from a company office."
  
• 200408 - Incident: Highly Personal Information Found In Trash - Collection agency throws out personal information
  
• 200408 - Incident: Highly Personal Information Found In Trash: "personal information found behind a Columbus collection agency."
  
• 200408 - Incident: Identity theft alert for CSU students and staff: "The auditor of California State University lost a hard-drive, containing 23,000 names and social security numbers."
  
• 200409 - Not again: Medical records found on street: "The medical records of about three to five patients at San Diego's Kaiser Hospital were found in the street outside of the hospital. According to a hospital representative, the papers fell out of a recycling bin that was being picked up by the Edco Recycling company. Kaiser is reviewing its contract with Edco and working to prevent any future incidents. "
  
• 200409 - Incident: Hacker taps into CSUH Server: "HAYWARD -- A computer hacker somehow gained access to the records of about 2,000 Cal State Hayward students earlier this month, prompting campus officials to send out letters warning students that their personal information may have been compromised. "
  
• 200410 - Incident: Purdue computers hacked - General systems hacked into and users are urged to change their passwords
  
• 200410 - Data protection watchdog distributes email mailing list (The Register): "In a recent incident, slightly tinged with irony, the Dutch Data Protection Authority did the same thing: "
  
• 200410 - UC Berkeley reports massive security/privacy breach: "'The FBI is investigating the penetration of a university research system that housed sensitive personal data on a staggering 1.4 million Californians who participated in a state social program, officials said Tuesday. "
  
• 200410 - Incident: Confidential Medical Records Found In Dumpster Behind Building: "'Suspected burglary at the Community Counseling Center leaves boxes of confidential files exposed. News 3 Investigator Darcy Spears tells us about the unlikely place the files were found. Counseling center staff were shocked when we showed them dozens upon dozens of private files in a wide open dumpster behind their building. They recovered everything, then called police to find out who would want to hurt those in the business of helping. "
  
• 200410 - Dutch prosecutor leaves crime files on dumped PC: "'Dutch public prosecutor Joost Tonino was condemned yesterday for putting his old PC out with the trash. It contained sensitive information about criminal investigations in Amsterdam, and also his email address, credit card number, social security number and personal tax files."
  
• 200411 - Incident: Massive leak of personal information in Edmonton, Alberta: "Police in Edmonton, Alberta are investigating a curious (and scary) leak of personal information when forms containing sensitive information related to the provinces top bureaucrats was discovered at the scene of a meth bust. "
  
• 200411 - Incident: Candian bank's internal faxes went to West Virginia for three years
  
• 200411 - Incident: New York schools dump sensitive records on sidewalk (NY Daily News)
  
• 200411 - Woman's medical file used as a prop; woman sues
  
• 200411 - Documents sent for shredding left blowing around in Toronto
  
• 200411 - Incident: UK online bank security glitch exposes customer accounts: "'A security loophole at internet bank Cahoot briefly allowed customers to access other people's accounts, a BBC investigation has revealed. '"
  
• 200412 - Canadian Privacy Firsts: Misdirected faxes leads to joint investigation and report by Alberta and Federal Commissioners: "In July 2004, it was reported in the Edmonton Journal that a couple who managed an apartment building had received facsimile transmissions in error from various sources. These transmissions contained personal medical information. "
  
• 200412 - Red cross employee implicated in ID theft of blood donors: "'A Red Cross employee and two other people were accused Friday of stealing the identities of about 40 blood donors and using the information to obtain about $268,000 in cash and merchandise.... '"
  
• 200412 - Glitch lets you mess with the phone book
  
• 200412 - Another privacy breach to round out the week: "twenty seven thousand welfare cheques were distributed this week with the social insurance numbers of others written on them"
  
• 200501 - Incident(s): Hacker breaches T-Mobile systems, reads US Secret Service email
  
• 200501 - Incident: Identity Theft Concerns Over UNC Lost Hard Drive
  
• 200501 - Incident: More hacking of university computers containing personal information - UCSD computers hacked into, compromising PI of 3500 university students and alumni
  
• 200501 - Incident: Harvard Hacked - Harvard University that allowed access to student numbers and student drug prescriptions
  
• 200501 - Another university hacked; personal information breached: "'Campus administrators detected a low-level breach of computers within the UCSD Extension network, which has stored more than 4,800 files of students' personal information. "
  
• 200501 - Incident: Identity Theft Concerns Over UNC Lost Hard Drive
  
• 200502 - Incident: Impostors obtain personal information on thousands of Americans - ChoicePoint Hacking Incident
  
• 200502 - Incident: Personal data on nearly 25,000 subscribers leaked by Japanese Telco
  
• 200502 - Incident: Bank of America loses data on 1.2 MILLION customers
  
• 200503 - Incident: Personal information of 32,000 stolen from LexisNexis
  
• 200503 - Incident: Shoe chain says customer data stolen
  
• 200503 - "Disgruntled" employee said to have posted confidential personal health information of insureds online - Kaiser Permanente employee said to have posted member personal information online


• 200503 - Incident: Personal information taken in Nevada DMV office break-in
  
• 200503 - Incident: Boston College alumni database breached
  
• 200503 - Incident: NWU's Kellog School of Management systems hacked
  
• 200503 - Incident: Purdue warns hackers hit some computers
  
• 200503 - Incident: Stolen Berkeley Laptop Exposes Data of 100,000
  
• 200503 - Incident: Data from 270,000 Japanese bank accounts lost
  
• 200503 - Incident: Encrypted tapes containing health information on hundreds of thousands of Albertans missing or tampered with
  
• 200504 - Incident: Chico, Berkeley and now Davis: UC-Davis computer hacked, personal information compromised

Last updated - 20050405

Surplus military laptops contained info on Canadian soldiers

The London Free Press is reporting that an Alberta military surplus store has received surplus computers that still contain information on Canadian soldiers:

London Free Press: News Section - Probe sought over military laptops:

"EDMONTON -- Alberta's privacy commissioner is calling for a federal investigation into why personal information about soldiers was on laptops turned in to an army surplus store. 'It would appear the military may have breached the federal Privacy Act and so the federal commissioner would be interested in that,' Frank Work said yesterday...."

Warning: These premises are under video surveillance

This one is pretty amusing ...

In the PIPEDA age, store owners and others who use CCTV on their premises for security and other purposes are required to post notices that the area is under video surveillance. This is because you have to make a reasonable effort to bring this form of collection of personal information to the person's attention so they can decide whether to enter the premises. How much is "reasonable" and does anyone pay attention to the signs?

You can likely assume that a company specialising in video surveillance would have the place covered by CCTV. But just for good measure, the owner of a Manchester CCTV supplier put up signs. You would think that was enough, but some dolt actually went onto the property and stole a laptop worth £700. Reports say he was picked up by eight separate cameras and was also seen casing the place half an hour before. See the story on Sky News : CCTV Shop Raid: Britain's Thickest Thief?.

What are the lessons to be learned?

1. People don't read signs?
2. CCTV signs don't deter theft?
3. Surveillance doesn't deter theft?
4. Some people are too thick to read signs that might actually affect them?
5. All of the above?

Incident: Bank of America notifying customers after laptop theft

A laptop containing sensitive customer informaiton has been stolen from a "service provider" to the Bank of America:

Bank of America notifying customers after laptop theft | InfoWorld | News | 2005-10-07 | By Robert McMillan, IDG News Service:

"... In a letters sent to Buxx users and dated Sept. 23, the Charlotte, North Carolina, bank warned that customers may have had their bank account numbers, routing transit numbers, names and credit card numbers compromised by the theft. Visa Buxx is a prepaid credit card for teenagers that the Bank of America (BofA) stopped selling in January.

The laptop, which belonged to an unnamed Bank of America 'service provider' was stolen on Aug. 29, said Diane Wagner, a BofA spokeswoman. The bank was notified of the theft on Sept. 9, and began sending out the letters after a two-week investigation, she said...."

Incident: AMEX subsidiary loses laptop with personal information on 230K customers and advisers

From today's New York Times:

Ameriprise Loses Data on 230,000 Customers and Advisers - New York Times

Ameriprise Financial, the investment advisory unit spun off from American Express last year, said today that lists with the personal information of about 230,000 customers and financial advisers were potentially exposed to fraud.

The breach occurred in late December after a company laptop was stolen from an employee's car. It contained lists of reassigned customer accounts that were being stored unencrypted on a computer in violation of Ameriprise's rules.

The information on the laptop included the names and Social Security numbers of more than 70,000 current and former financial advisers and the names and internal account numbers of about 158,000 customers. The data was being stored in separate lists, but it is possible that there could be some overlap between the two.

Andy MacMillan, an Ameriprise spokesman, said that it was unlikely the thief knew that the customer and employee data were being stored on the laptop and the risk of "any data being used or discovered is very low." He said no other personal information was exposed.

Technorati tags: Privacy :: Personal Information ::
Theft ::
Identity Theft.

Privacy-enhanced computer display

In my experience, airline flights are often unproductive because I'm very wary of showing confidential client information to everyone who has a chance to oogle my laptop screen. I've seen privacy shields, but the guy who can glance between the seats is probably within its field of view. Now, the clever folks at Mitsubishi Electric Research Labs have come up with a combination of hardware and software that limits what can be read to the wearer of special ferroelectric glasses. I don't pretend to know what that means from a scientific point of view, but it looks promising and the photo from the MERL website makes sense. For more info, check out: MERL � Privacy Enhanced Computer Display.

Arrest made in Berkeley laptop theft case

Avid readers may recall the theft of a laptop from Berkeley University that contained personal information on 100,000 students, staff, alumni and applicants. (To refresh your memory, check out The Canadian Privacy Law Blog: Incident: Stolen Berkeley Laptop Exposes Data of 100,000). Well, an arrest has been made after the laptop was sold online. Investigators can't tell whether any of the information was nefariously used: Arrest made in Berkeley laptop theft case | The Register.