Website update: David T.S. Fraser's Privacy Law Resources

Over the weekend, I updated and added more content to my page of privacy resources, David T.S. Fraser's Privacy Law Resources. On the table of Canadian privacy legislation, I have added an annotation indicating the laws that have been declared by the federal Governor in Council to be substantially similar to PIPEDA.

I have also added a number of links to the national privacy regimes of the US, the UK, France and Germany:

Non-Canada: Individual Countries

United States of America

• Public Sector
  
  
  • Privacy Act of 1974,
    5 U.S.C. § 552a
  
  
  • US Department of
    Justice Overview of the Privacy Act of 1974
  
  
  
  


• Health Information
  
  
  • Health Insurance
    Portability and Accountability Act (HIPAA) (PL 104-191)
  
  
  • HIPAA Privacy Rule
  
  
  • 
    
    HIPAA Security Rule
  
  
  
  


• Financial Information
  
  
  • Gramm Leach Bliley Act (GLB) (PL 106-102) [Text]
    [PDF]
  
  
  • Subtitle A:
    Disclosure of Nonpublic Personal Information - 15 U.S.C. § 6801-6809
    (Financial Privacy)
  
  
  • Subtitle B:
    Fraudulent Access to Financial Information - 15 U.S.C. § 6821-6827 (Pretexting)
    
  
  
  
  

United Kingdom

• Data
  Protection Act 1998


• Information
  Commissioners Office

France

• CNIL- Commission Nationale de l'informatique
  et des Libertés

Germany

• Bundesbeauftragten für den Datenschutz
  
  

EPIC petitions FCC on sale of phone records

Last month, I blogged about the fact that a number of companies online are selling telephone records without the consent or knowledge of the individuals concerned. The records appear to be obtained by "pretexting" or from employees of the telcos (See: The Canadian Privacy Law Blog: Online Data Gets Personal: Cell Phone Records for Sale). Now, the Electronic Privacy Information Center is petitioning the FCC to put a stop to the practice. Read about it at Red Herring: FCC's Privacy Petition.

Security of phone records

Rob Hyndman weighs in on the recent concerns over the ease with which some companies are able to get calling records from various phone companies:

robhyndman.com:
... What I find particularly troubling about pretexting is that it pulls back the
covers on what must be profoundly lax security precautions taken by the phone
companies, and suggests that they are still - even after all of 2005's
controversy over poor data security - remarkably unconcerned with building data
security in as a core value of their corporate cultures (quite apart from the
obvious failure to build sensible data protection measures into business
processes). At some point, data security just has to be recognized as a
mission-critical obligation of these organizations, and there ought to be
serious and punitive consequences if they are not up to this challenge. "

Technorati tags: Privacy :: Security :: Phone Records

Illinois fights cell records theft

According to the Chicago Tribune, the state of Illinois is planning to be the first state to implement strong measures to protect phone customers from the unauthorized release of their calling information. The proposed law will require phone companies to protect the privacy and security of customer information. Notably, it will also outlaw "pretexting", which is said to be the technique used by most of the companies who trade in this sort of data. See: Chicago Tribune | Gov. fights cell records theft.