By Kevin Shaw

Second Technical Seminar Held on International Implementation of the APEC Privacy Framework
The second technical seminar was held in Cairns, Australia on June 25-26. Approximately 11 economies were represented by some 100 delegates who attended.

The event was designed to continue the work of the January seminar and meetings in Canberra, and to build confidence in an accountable system for personal information moving among economies.

One of the seminar's main goals was to advance the Data Privacy Subgroup work agenda for 2007, namely to develop options for Pathfinder projects to be pursued in 2008 that would begin to put in place arrangements for safer movement of personal information among Asia Pacific Economic Cooperation (APEC) Economies. In particular, the aim was to begin scoping and developing cooperative cross-border arrangements for implementing a Cross-Border Privacy Rules (CBPR) system.

This effort will be continued, as Peru as APEC host economy in 2008 has lodged a bid for funding for seminars on the use of Trustmarks, regulator enforcement issues and capacity building to be held in February and September 2008.

More information is available at www.apec.org.

Kevin Shaw is Associate Director — Security Privacy Continuity at KPMG. He may be reached at


This e-mail address is being protected from spam bots, you need JavaScript enabled to view it



By Jan Dhont

Have You Already Registered Your Camera Surveillance Practices In Belgium?

Since June 11, 2007, the installation of surveillance cameras in Belgium is subject to the new Belgian Camera Act of March 21, 2007. It introduces the following measures/ requirements:

  • Covert camera surveillance is prohibited.
  • Images only may be viewed and stored to collect evidence of criminal or harmful events and to identify relevant offender(s), witness(es), or victims.
  • It is required to announce camera surveillance to individuals by means of an official pictogram.
  • Individuals should be provided with an opportunity to access their images.
  • Measures should be taken to effectively protect the images against access by others. Images must be kept confidential.
  • Images may not harm individuals' intimacy, nor may they contain sensitive data.
  • Camera surveillance measures must be registered with the Data Protection Authority (DPA). In some cases, additional advice is required by the city council and the chief of the relevant police zone.
  • Images must, as a general rule, not be stored for longer than one month.

The Camera Act does not apply to workfloor surveillance, which is regulated by specific legislation containing strict surveillance restrictions and procedural requirements, including works council consultation requirements.

Jan Dhont is a Partner at Lorenz, based in Brussels. He may be reached at


This e-mail address is being protected from spam bots, you need JavaScript enabled to view it



By Terry McQuay, CIPP, CIPP/C

Canadian Do-Not-Call List Update

On July 3, 2007, the Canadian Radio-television and Telecommunications Commission (CRTC) issued its long-awaited rules for the creation and operation of a National Do-Not-Call List (National DNCL) and rules governing telemarketing generally.

Telemarketers will be required to become registered subscribers to the National DNCL and pay fees to the National DNCL operator. These rules will take effect once the operator for the National DNCL has been chosen, and the list is fully operational. Currently, it is expected that the list will become operational in mid-2008.

Under the National DNCL rules, telemarketers are prohibited from calling consumers registered on the list. Exemptions include unsolicited calls made by or on behalf of:

  • Registered charities;
  • Political parties;
  • Nomination contestants, leadership contestants or candidates of a political party;
  • Opinion polling firms;
  • General-circulation newspapers;
  • Organizations that have an existing business relationship with a consumer; and
  • Organizations to business consumers (B2B).

The telemarketing rules require telemarketers to:

  • Maintain an internal do-not-call list;
  • Provide the party being called information regarding:

- The identity of the caller and calling organization;
- Upon request, the contact information of the organization where the customer may make a do-not-call request or other inquires.

  • Restrict calls to the following time periods:

- 9 a.m. to 9:30 p.m., Monday - Friday;
- 10 a.m. to 6 p.m., Saturday and Sunday;

  • Achieve an abandonment rate of 5 percent;
  • Prohibit the use of sequential dialing;

- Includes exemptions relating to
- Voicemail broadcasts;
- Account collections;
- Surveys; and
- Market research.

Terry McQuay, CIPP, CIPP/C, is the Founder of Nymity, which offers Web-based privacy support to help organizations control their privacy risks. Learn more at www.nymity.com.


Cross-National Enforcement Actions Are Reality in Europe
The European Article 29 Working Party published its findings on the coordinated audit of the health insurance sector by the European national DPAs.

For the first time in history, the European DPAs bundled their forces to conduct a data protection audit of one specific business sector cross-nationally. Although compliance insufficiencies will be further followed up by national DPAs, the audit served also as a test case to refine the audit methodology for future actions. The report contains the following interesting highlights:

  • Information security measures, data retention and data economy will gain attention in future audits;
  • The Working Party announced potential collaboration with other international authorities or organizations, such as the Federal Trade Commission, Organization for Economic Cooperation and Development, APEC, etc.;
  • While this audit was based on a questionnaire sent to health insurers, random checks will be conducted in the future.

The Working Party did not reveal what business sectors may be audited next, but sectors that process important amounts of sensitive personal information or that process personal information as a main service activity (or a part thereof) are high on the Working Party's audit list.

— Jan Dhont                                   


By Carolina Hammarqvist

The "Misuse Model" in Sweden: A Way to Limit the Effects of the Broad Definition of Personal Data
The Article 29 Working Party recently released an opinion on the definition of personal data.

In Sweden, the initial implementation of the 95/46/EC Directive led to many difficulties for companies trying to apply the Swedish Data Protection Act.

This was mainly due to the fact that the definitions of "personal data" and "processing" data, as well as the way it was interpreted by the Data Inspection Board, is broad. For example, personal data was interpreted to include anonymous data.

Since Jan. 1, 2007, most of the provisions of the act do not apply when processing personal data in unstructured material, which is personal data that does not form part, and is not intended to form part, of a set of personal data that has been structured to significantly facilitate searches for, or compilations of, personal data.

In short, the basic rule of the act with regard to processing of personal data in unstructured material (such as emails, word processing documents, sounds and images) is that such processing is permitted, provided that the processing does not lead to infringement of the data subject's privacy.

To date, there have been few decisions by the Data Inspection Board based on this new model, so it is uncertain how it will be interpreted. However, it is obvious that it will be easier for data controllers storing data, for example in an inbox in an email system, to comply with the act on a day-to-day basis.

Carolina Hammarqvist is an Associate in Technology, Media & Telecommunications at Linklaters Advokatbyrå Aktiebolag, Stockholm. She may be reached at


This e-mail address is being protected from spam bots, you need JavaScript enabled to view it



By Steve Kenny

Regulator Seeks Additional Privacy Safeguards

The UK Information Commissioner has called on chief executives to improve outmoded data protection compliance systems, stating that "privacy must be given more priority in every UK boardroom. Organisations that fail to process personal information in line with the Principles of the Data Protection Act not only risk enforcement action by the ICO, they also risk losing the trust of their customers."

Businesses increasingly recognise data protection as a reputational risk, and reputational risk as ‘the risk of risks.' The UK Data Protection Act sets out eight principles UK organisations are required to comply with. All eight principles require operational controls, yet only the 7th principle, relating to information security, is approaching operational maturity in theory, if not always in practice.

Steve Kenny is Principal Advisor, Privacy Services Leader for KPMG, based in London. He may be reached at


This e-mail address is being protected from spam bots, you need JavaScript enabled to view it



If you want to comment on this post, you need to login.


Board of Directors

See the esteemed group of leaders shaping the future of the IAPP.

Contact Us

Need someone to talk to? We’re here for you.

IAPP Staff

Looking for someone specific? Visit the staff directory.

Learn more about the IAPP»

Daily Dashboard

The day’s top stories from around the world

Privacy Perspectives

Where the real conversations in privacy happen

The Privacy Advisor

Original reporting and feature articles on the latest privacy developments

Privacy Tracker

Alerts and legal analysis of legislative trends

Privacy Tech

Exploring the technology of privacy

Canada Dashboard Digest

A roundup of the top Canadian privacy news

Europe Data Protection Digest

A roundup of the top European data protection news

Asia-Pacific Dashboard Digest

A roundup of the top privacy news from the Asia-Pacific region

Latin America Dashboard Digest

A roundup of the top privacy news from Latin America

IAPP Westin Research Center

Original works. Groundbreaking research. Emerging scholars.

Get more News »

IAPP Communities

Meet locally with privacy pros, dive deep into specialized topics or connect over common interests. Find your Community in KnowledgeNet Chapters, Sections and Affinity Groups.

IAPP Job Board

Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.

Join the Privacy List

Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.

Find a KnowledgeNet Chapter Near You

Talk privacy and network with local members at IAPP KnowledgeNet Chapter meetings, taking place worldwide.

Find more ways to Connect »

Find a Privacy Training Class

Two-day privacy training classes are held around the world. See the complete schedule now.

The Privacy Core™ Library Has Evolved

Privacy Core™ e-learning essentials just expanded to include seven new units for marketers. Keep your data safe and your staff in the know!

Online Privacy Training

Build your knowledge. The privacy know-how you need is just a click away.

Upcoming Web Conferences

See our list of upcoming web conferences. Just log on, listen in and learn!

Train Your Team

Get your team up to speed on privacy by bringing IAPP training to your organization.

Let’s Get You DPO Ready

There’s no better time to train than right now! We have all the resources you need to meet the challenges of the GDPR.

Learn more »

CIPP Certification

The global standard for the go-to person for privacy laws, regulations and frameworks

CIPM Certification

The first and only privacy certification for professionals who manage day-to-day operations

CIPT Certification

The industry benchmark for IT professionals worldwide to validate their knowledge of privacy requirements

FIP Designation

Recognizing the advanced knowledge and issue-spotting skills a privacy pro must attain in today’s complex world of data privacy.

Certify Your Staff

Find out how you can bring the world’s only globally recognized privacy certification to a group in your organization.


The IAPP’S CIPP/E and CIPM are the ANSI/ISO-accredited, industry-recognized combination for DPO readiness. Learn more today.

Learn more about IAPP certification »

Are You Ready for the GDPR?

Check out the IAPP's EU Data Protection Reform page for all the tools and resources you need.

IAPP-OneTrust PIA Platform

New U.S. Government Agency privacy impact assessments - free to IAPP members!

IAPP Communities

Meet locally with privacy pros, dive deep into specialized topics or connect over common interests. Find your Community in KnowledgeNet Chapters, Sections and Affinity Groups.

Privacy Vendor List

Find a privacy vendor to meet your needs with our filterable list of global service providers.

More Resources »

Europe Data Protection Intensive 2017

The Intensive is sold out! But cancellations do happen—so hurry and get on the wait list in case more seats become available.

Global Privacy Summit 2017

The world’s premier privacy conference returns with the sharpest minds, unparalleled programs and preeminent networking opportunities.

Canada Privacy Symposium 2017

The Symposium returns to Toronto this spring and registration has opened! Take advantage of Early Bird rates and join your fellow privacy pros for another stellar program.

The Privacy Bar Section Forum 2017

The Privacy Bar Section Forum is sold out! But you can still add your name to the wait list, and we'll keep in touch about your status. Good luck!

Asia Privacy Forum 2017

Call for Speakers open! Join the Forum in Singapore for exclusive networking and intensive education on data protection trends and challenges in the Asia Pacific region.

Privacy. Security. Risk. 2017

Call for Speakers open! This year, we're bringing P.S.R. to San Diego. Submit today and be a part of something big! Submission deadline: February 26.

Europe Data Protection Congress 2017

Call for Speakers open! The Congress is your source for European policy debate, multi-level strategic thinking and thought-provoking discussion. Submit a proposal by March 19.

Sponsor an Event

Increase visibility for your organization—check out sponsorship opportunities today.

More Conferences »

Become a Member

Start taking advantage of the many IAPP member benefits today

Corporate Members

See our list of high-profile corporate members—and find out why you should become one, too

Renew Your Membership

Don’t miss out for a minute—continue accessing your benefits

Join the IAPP»