By Kevin Shaw

Second Technical Seminar Held on International Implementation of the APEC Privacy Framework
The second technical seminar was held in Cairns, Australia on June 25-26. Approximately 11 economies were represented by some 100 delegates who attended.

The event was designed to continue the work of the January seminar and meetings in Canberra, and to build confidence in an accountable system for personal information moving among economies.

One of the seminar's main goals was to advance the Data Privacy Subgroup work agenda for 2007, namely to develop options for Pathfinder projects to be pursued in 2008 that would begin to put in place arrangements for safer movement of personal information among Asia Pacific Economic Cooperation (APEC) Economies. In particular, the aim was to begin scoping and developing cooperative cross-border arrangements for implementing a Cross-Border Privacy Rules (CBPR) system.

This effort will be continued, as Peru as APEC host economy in 2008 has lodged a bid for funding for seminars on the use of Trustmarks, regulator enforcement issues and capacity building to be held in February and September 2008.

More information is available at www.apec.org.

Kevin Shaw is Associate Director — Security Privacy Continuity at KPMG. He may be reached at


This e-mail address is being protected from spam bots, you need JavaScript enabled to view it



By Jan Dhont

Have You Already Registered Your Camera Surveillance Practices In Belgium?

Since June 11, 2007, the installation of surveillance cameras in Belgium is subject to the new Belgian Camera Act of March 21, 2007. It introduces the following measures/ requirements:

  • Covert camera surveillance is prohibited.
  • Images only may be viewed and stored to collect evidence of criminal or harmful events and to identify relevant offender(s), witness(es), or victims.
  • It is required to announce camera surveillance to individuals by means of an official pictogram.
  • Individuals should be provided with an opportunity to access their images.
  • Measures should be taken to effectively protect the images against access by others. Images must be kept confidential.
  • Images may not harm individuals' intimacy, nor may they contain sensitive data.
  • Camera surveillance measures must be registered with the Data Protection Authority (DPA). In some cases, additional advice is required by the city council and the chief of the relevant police zone.
  • Images must, as a general rule, not be stored for longer than one month.

The Camera Act does not apply to workfloor surveillance, which is regulated by specific legislation containing strict surveillance restrictions and procedural requirements, including works council consultation requirements.

Jan Dhont is a Partner at Lorenz, based in Brussels. He may be reached at


This e-mail address is being protected from spam bots, you need JavaScript enabled to view it



By Terry McQuay, CIPP, CIPP/C

Canadian Do-Not-Call List Update

On July 3, 2007, the Canadian Radio-television and Telecommunications Commission (CRTC) issued its long-awaited rules for the creation and operation of a National Do-Not-Call List (National DNCL) and rules governing telemarketing generally.

Telemarketers will be required to become registered subscribers to the National DNCL and pay fees to the National DNCL operator. These rules will take effect once the operator for the National DNCL has been chosen, and the list is fully operational. Currently, it is expected that the list will become operational in mid-2008.

Under the National DNCL rules, telemarketers are prohibited from calling consumers registered on the list. Exemptions include unsolicited calls made by or on behalf of:

  • Registered charities;
  • Political parties;
  • Nomination contestants, leadership contestants or candidates of a political party;
  • Opinion polling firms;
  • General-circulation newspapers;
  • Organizations that have an existing business relationship with a consumer; and
  • Organizations to business consumers (B2B).

The telemarketing rules require telemarketers to:

  • Maintain an internal do-not-call list;
  • Provide the party being called information regarding:

- The identity of the caller and calling organization;
- Upon request, the contact information of the organization where the customer may make a do-not-call request or other inquires.

  • Restrict calls to the following time periods:

- 9 a.m. to 9:30 p.m., Monday - Friday;
- 10 a.m. to 6 p.m., Saturday and Sunday;

  • Achieve an abandonment rate of 5 percent;
  • Prohibit the use of sequential dialing;

- Includes exemptions relating to
- Voicemail broadcasts;
- Account collections;
- Surveys; and
- Market research.

Terry McQuay, CIPP, CIPP/C, is the Founder of Nymity, which offers Web-based privacy support to help organizations control their privacy risks. Learn more at www.nymity.com.


Cross-National Enforcement Actions Are Reality in Europe
The European Article 29 Working Party published its findings on the coordinated audit of the health insurance sector by the European national DPAs.

For the first time in history, the European DPAs bundled their forces to conduct a data protection audit of one specific business sector cross-nationally. Although compliance insufficiencies will be further followed up by national DPAs, the audit served also as a test case to refine the audit methodology for future actions. The report contains the following interesting highlights:

  • Information security measures, data retention and data economy will gain attention in future audits;
  • The Working Party announced potential collaboration with other international authorities or organizations, such as the Federal Trade Commission, Organization for Economic Cooperation and Development, APEC, etc.;
  • While this audit was based on a questionnaire sent to health insurers, random checks will be conducted in the future.

The Working Party did not reveal what business sectors may be audited next, but sectors that process important amounts of sensitive personal information or that process personal information as a main service activity (or a part thereof) are high on the Working Party's audit list.

— Jan Dhont                                   


By Carolina Hammarqvist

The "Misuse Model" in Sweden: A Way to Limit the Effects of the Broad Definition of Personal Data
The Article 29 Working Party recently released an opinion on the definition of personal data.

In Sweden, the initial implementation of the 95/46/EC Directive led to many difficulties for companies trying to apply the Swedish Data Protection Act.

This was mainly due to the fact that the definitions of "personal data" and "processing" data, as well as the way it was interpreted by the Data Inspection Board, is broad. For example, personal data was interpreted to include anonymous data.

Since Jan. 1, 2007, most of the provisions of the act do not apply when processing personal data in unstructured material, which is personal data that does not form part, and is not intended to form part, of a set of personal data that has been structured to significantly facilitate searches for, or compilations of, personal data.

In short, the basic rule of the act with regard to processing of personal data in unstructured material (such as emails, word processing documents, sounds and images) is that such processing is permitted, provided that the processing does not lead to infringement of the data subject's privacy.

To date, there have been few decisions by the Data Inspection Board based on this new model, so it is uncertain how it will be interpreted. However, it is obvious that it will be easier for data controllers storing data, for example in an inbox in an email system, to comply with the act on a day-to-day basis.

Carolina Hammarqvist is an Associate in Technology, Media & Telecommunications at Linklaters Advokatbyrå Aktiebolag, Stockholm. She may be reached at


This e-mail address is being protected from spam bots, you need JavaScript enabled to view it



By Steve Kenny

Regulator Seeks Additional Privacy Safeguards

The UK Information Commissioner has called on chief executives to improve outmoded data protection compliance systems, stating that "privacy must be given more priority in every UK boardroom. Organisations that fail to process personal information in line with the Principles of the Data Protection Act not only risk enforcement action by the ICO, they also risk losing the trust of their customers."

Businesses increasingly recognise data protection as a reputational risk, and reputational risk as ‘the risk of risks.' The UK Data Protection Act sets out eight principles UK organisations are required to comply with. All eight principles require operational controls, yet only the 7th principle, relating to information security, is approaching operational maturity in theory, if not always in practice.

Steve Kenny is Principal Advisor, Privacy Services Leader for KPMG, based in London. He may be reached at


This e-mail address is being protected from spam bots, you need JavaScript enabled to view it



If you want to comment on this post, you need to login.


Board of Directors

See the esteemed group of leaders shaping the future of the IAPP.

Contact Us

Need someone to talk to? We’re here for you.

IAPP Staff

Looking for someone specific? Visit the staff directory.

Learn more about the IAPP»

Daily Dashboard

The day’s top stories from around the world

Privacy Perspectives

Where the real conversations in privacy happen

The Privacy Advisor

Original reporting and feature articles on the latest privacy developments

Privacy Tracker

Alerts and legal analysis of legislative trends

Privacy Tech

Exploring the technology of privacy

Canada Dashboard Digest

A roundup of the top Canadian privacy news

Europe Data Protection Digest

A roundup of the top European data protection news

Asia-Pacific Dashboard Digest

A roundup of the top privacy news from the Asia-Pacific region

IAPP Westin Research Center

Original works. Groundbreaking research. Emerging scholars.

Advertise in IAPP Publications

Find out how to get your message in front the people you want to reach. Download a media kit now.

Get more News »

Find a KnowledgeNet Chapter Near You

Network and talk privacy at IAPP KnowledgeNet meetings, taking place worldwide.

Women Leading Privacy

Events, volunteer opportunities and more designed to help you give and get career support and expand your network.

IAPP Job Board

Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.

Join the Privacy List

Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.

Find more ways to Connect »

Find a Privacy Training Class

Two-day privacy training classes are held around the world. See the complete schedule now.

Online Privacy Training

Build your knowledge. The privacy know-how you need is just a click away.

The Training Post—Can’t-Miss Training Updates

Subscribe now to get the latest alerts on training opportunities around the world.

New Web Conferences Added!

See our list of upcoming web conferences. Just log on, listen in and learn!

Train Your Staff

Get your team up to speed on privacy by bringing IAPP training to your organization.

Learn more »

CIPP Certification

The global standard for the go-to person for privacy laws, regulations and frameworks

CIPM Certification

The first and only privacy certification for professionals who manage day-to-day operations

CIPT Certification

The industry benchmark for IT professionals worldwide to validate their knowledge of privacy requirements

Certify Your Staff

Find out how you can bring the world’s only globally recognized privacy certification to a group in your organization.

Learn more about IAPP certification »

Get Close-up

Looking for tools and info on a hot topic? Our close-up pages organize it for you in one easy-to-find place.

Where's Your DPA?

Our interactive DPA locator helps you find data protection authorities and summary of law by country.

IAPP Westin Research Center

See the latest original research from the IAPP Westin fellows.

Looking for Certification Study Resources?

Find out what you need to prepare for your exams

More Resources »

GDPR Comprehensive: Registration Open

New! Intensive two-day GDPR training led by the sharpest minds in the field. It's a can't-miss event.

The Congress Is Cancelled

The IAPP Europe Data Protection Congress 2015 is cancelled. Click through to learn more.

Sponsor an Event

Increase visibility for your organization—check out sponsorship opportunities today.

Exhibit at an Event

Put your brand in front of the largest gatherings of privacy pros in the world. Learn more.

More Conferences »

Become a Member

Start taking advantage of the many IAPP member benefits today

Corporate Members

See our list of high-profile corporate members—and find out why you should become one, too

Renew Your Membership

Don’t miss out for a minute—continue accessing your benefits

Join the IAPP»