Certification_Ad_300x250final-01
iapp-privacycore
PrivacyTraining_ad300x250.Promo1-01

AUSTRALIA

By Kevin Shaw

Second Technical Seminar Held on International Implementation of the APEC Privacy Framework
The second technical seminar was held in Cairns, Australia on June 25-26. Approximately 11 economies were represented by some 100 delegates who attended.

The event was designed to continue the work of the January seminar and meetings in Canberra, and to build confidence in an accountable system for personal information moving among economies.

One of the seminar's main goals was to advance the Data Privacy Subgroup work agenda for 2007, namely to develop options for Pathfinder projects to be pursued in 2008 that would begin to put in place arrangements for safer movement of personal information among Asia Pacific Economic Cooperation (APEC) Economies. In particular, the aim was to begin scoping and developing cooperative cross-border arrangements for implementing a Cross-Border Privacy Rules (CBPR) system.

This effort will be continued, as Peru as APEC host economy in 2008 has lodged a bid for funding for seminars on the use of Trustmarks, regulator enforcement issues and capacity building to be held in February and September 2008.

More information is available at www.apec.org.

Kevin Shaw is Associate Director — Security Privacy Continuity at KPMG. He may be reached at

kshaw@kpmg.com.au

This e-mail address is being protected from spam bots, you need JavaScript enabled to view it

.

BELGIUM

By Jan Dhont

Have You Already Registered Your Camera Surveillance Practices In Belgium?

Since June 11, 2007, the installation of surveillance cameras in Belgium is subject to the new Belgian Camera Act of March 21, 2007. It introduces the following measures/ requirements:

  • Covert camera surveillance is prohibited.
  • Images only may be viewed and stored to collect evidence of criminal or harmful events and to identify relevant offender(s), witness(es), or victims.
  • It is required to announce camera surveillance to individuals by means of an official pictogram.
  • Individuals should be provided with an opportunity to access their images.
  • Measures should be taken to effectively protect the images against access by others. Images must be kept confidential.
  • Images may not harm individuals' intimacy, nor may they contain sensitive data.
  • Camera surveillance measures must be registered with the Data Protection Authority (DPA). In some cases, additional advice is required by the city council and the chief of the relevant police zone.
  • Images must, as a general rule, not be stored for longer than one month.

The Camera Act does not apply to workfloor surveillance, which is regulated by specific legislation containing strict surveillance restrictions and procedural requirements, including works council consultation requirements.

Jan Dhont is a Partner at Lorenz, based in Brussels. He may be reached at

j.dhont@lorenz-law.com

This e-mail address is being protected from spam bots, you need JavaScript enabled to view it

.

CANADA

By Terry McQuay, CIPP, CIPP/C

Canadian Do-Not-Call List Update

On July 3, 2007, the Canadian Radio-television and Telecommunications Commission (CRTC) issued its long-awaited rules for the creation and operation of a National Do-Not-Call List (National DNCL) and rules governing telemarketing generally.

Telemarketers will be required to become registered subscribers to the National DNCL and pay fees to the National DNCL operator. These rules will take effect once the operator for the National DNCL has been chosen, and the list is fully operational. Currently, it is expected that the list will become operational in mid-2008.

Under the National DNCL rules, telemarketers are prohibited from calling consumers registered on the list. Exemptions include unsolicited calls made by or on behalf of:

  • Registered charities;
  • Political parties;
  • Nomination contestants, leadership contestants or candidates of a political party;
  • Opinion polling firms;
  • General-circulation newspapers;
  • Organizations that have an existing business relationship with a consumer; and
  • Organizations to business consumers (B2B).

The telemarketing rules require telemarketers to:

  • Maintain an internal do-not-call list;
  • Provide the party being called information regarding:

- The identity of the caller and calling organization;
- Upon request, the contact information of the organization where the customer may make a do-not-call request or other inquires.

  • Restrict calls to the following time periods:

- 9 a.m. to 9:30 p.m., Monday - Friday;
- 10 a.m. to 6 p.m., Saturday and Sunday;

  • Achieve an abandonment rate of 5 percent;
  • Prohibit the use of sequential dialing;

- Includes exemptions relating to
- Voicemail broadcasts;
- Account collections;
- Surveys; and
- Market research.

Terry McQuay, CIPP, CIPP/C, is the Founder of Nymity, which offers Web-based privacy support to help organizations control their privacy risks. Learn more at www.nymity.com.

EU

Cross-National Enforcement Actions Are Reality in Europe
The European Article 29 Working Party published its findings on the coordinated audit of the health insurance sector by the European national DPAs.

For the first time in history, the European DPAs bundled their forces to conduct a data protection audit of one specific business sector cross-nationally. Although compliance insufficiencies will be further followed up by national DPAs, the audit served also as a test case to refine the audit methodology for future actions. The report contains the following interesting highlights:

  • Information security measures, data retention and data economy will gain attention in future audits;
  • The Working Party announced potential collaboration with other international authorities or organizations, such as the Federal Trade Commission, Organization for Economic Cooperation and Development, APEC, etc.;
  • While this audit was based on a questionnaire sent to health insurers, random checks will be conducted in the future.

The Working Party did not reveal what business sectors may be audited next, but sectors that process important amounts of sensitive personal information or that process personal information as a main service activity (or a part thereof) are high on the Working Party's audit list.

— Jan Dhont                                   

SWEDEN

By Carolina Hammarqvist

The "Misuse Model" in Sweden: A Way to Limit the Effects of the Broad Definition of Personal Data
The Article 29 Working Party recently released an opinion on the definition of personal data.

In Sweden, the initial implementation of the 95/46/EC Directive led to many difficulties for companies trying to apply the Swedish Data Protection Act.

This was mainly due to the fact that the definitions of "personal data" and "processing" data, as well as the way it was interpreted by the Data Inspection Board, is broad. For example, personal data was interpreted to include anonymous data.

Since Jan. 1, 2007, most of the provisions of the act do not apply when processing personal data in unstructured material, which is personal data that does not form part, and is not intended to form part, of a set of personal data that has been structured to significantly facilitate searches for, or compilations of, personal data.

In short, the basic rule of the act with regard to processing of personal data in unstructured material (such as emails, word processing documents, sounds and images) is that such processing is permitted, provided that the processing does not lead to infringement of the data subject's privacy.

To date, there have been few decisions by the Data Inspection Board based on this new model, so it is uncertain how it will be interpreted. However, it is obvious that it will be easier for data controllers storing data, for example in an inbox in an email system, to comply with the act on a day-to-day basis.

Carolina Hammarqvist is an Associate in Technology, Media & Telecommunications at Linklaters Advokatbyrå Aktiebolag, Stockholm. She may be reached at

carolina.hammarqvist@linklaters.com

This e-mail address is being protected from spam bots, you need JavaScript enabled to view it

.

UK

By Steve Kenny

Regulator Seeks Additional Privacy Safeguards

The UK Information Commissioner has called on chief executives to improve outmoded data protection compliance systems, stating that "privacy must be given more priority in every UK boardroom. Organisations that fail to process personal information in line with the Principles of the Data Protection Act not only risk enforcement action by the ICO, they also risk losing the trust of their customers."

Businesses increasingly recognise data protection as a reputational risk, and reputational risk as ‘the risk of risks.' The UK Data Protection Act sets out eight principles UK organisations are required to comply with. All eight principles require operational controls, yet only the 7th principle, relating to information security, is approaching operational maturity in theory, if not always in practice.

Steve Kenny is Principal Advisor, Privacy Services Leader for KPMG, based in London. He may be reached at

steve.kenny@KPMG.co.uk

This e-mail address is being protected from spam bots, you need JavaScript enabled to view it

.

Comments

If you want to comment on this post, you need to login.

Related

Board of Directors

See the esteemed group of leaders shaping the future of the IAPP.

Contact Us

Need someone to talk to? We’re here for you.

IAPP Staff

Looking for someone specific? Visit the staff directory.

Learn more about the IAPP»

Daily Dashboard

The day’s top stories from around the world

Privacy Perspectives

Where the real conversations in privacy happen

The Privacy Advisor

Original reporting and feature articles on the latest privacy developments

Privacy Tracker

Alerts and legal analysis of legislative trends

Privacy Tech

Exploring the technology of privacy

Canada Dashboard Digest

A roundup of the top Canadian privacy news

Europe Data Protection Digest

A roundup of the top European data protection news

Asia-Pacific Dashboard Digest

A roundup of the top privacy news from the Asia-Pacific region

Latin America Dashboard Digest

A roundup of the top privacy news from Latin America

IAPP Westin Research Center

Original works. Groundbreaking research. Emerging scholars.

Get more News »

Find a KnowledgeNet Chapter Near You

Network and talk privacy at IAPP KnowledgeNet meetings, taking place worldwide.

Women Leading Privacy

Events, volunteer opportunities and more designed to help you give and get career support and expand your network.

IAPP Job Board

Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.

Join the Privacy List

Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.

Find more ways to Connect »

Find a Privacy Training Class

Two-day privacy training classes are held around the world. See the complete schedule now.

NEW! Raise Staff Awareness

Equip all your data-handling staff to reduce privacy risk, with Privacy Core™ e-learning essentials.

Online Privacy Training

Build your knowledge. The privacy know-how you need is just a click away.

The Training Post—Can’t-Miss Training Updates

Subscribe now to get the latest alerts on training opportunities around the world.

Upcoming Web Conferences

See our list of upcoming web conferences. Just log on, listen in and learn!

Train Your Team

Get your team up to speed on privacy by bringing IAPP training to your organization.

Learn more »

CIPP Certification

The global standard for the go-to person for privacy laws, regulations and frameworks

CIPM Certification

The first and only privacy certification for professionals who manage day-to-day operations

CIPT Certification

The industry benchmark for IT professionals worldwide to validate their knowledge of privacy requirements

NEW! FIP Designation

Recognizing the advanced knowledge and issue-spotting skills a privacy pro must attain in today’s complex world of data privacy.

Certify Your Staff

Find out how you can bring the world’s only globally recognized privacy certification to a group in your organization.

Learn more about IAPP certification »

Get Schooled in Privacy

Looking to get some higher-ed in privacy? Check out these schools that include data privacy courses in their curricula.

Privacy Vendor List

Find a privacy vendor to meet your needs with our filterable list of global service providers.

NEW! Raise Staff Awareness

Equip all your data-handling staff to reduce privacy risk, with Privacy Core™ e-learning essentials.

The Industry of Privacy

Take stock, compare your practices to those of other organizations, and get budget with these studies on the industry of privacy.

More Resources »

P.S.R.—One Powerhouse Program

The program is too good to miss. The speakers are world-renowned. P.S.R. brings you the best of the best in privacy and security. Don't wait: Register now!

Speak at the Intensive!

The call for proposals for our London event, the Data Protection Intensive, is now open! Submit your session idea today.

Time to Get to Work at the Congress

Thought leadership, a thriving community and unrivaled education...the Congress prepares you for the challenges ahead. Register today.

GDPR Comprehensive London: Last Chance!

The IAPP GDPR Comprehensive heads to London this fall. This is your last chance at this popular program this year!

Sponsor an Event

Increase visibility for your organization—check out sponsorship opportunities today.

More Conferences »

Become a Member

Start taking advantage of the many IAPP member benefits today

Corporate Members

See our list of high-profile corporate members—and find out why you should become one, too

Renew Your Membership

Don’t miss out for a minute—continue accessing your benefits

Join the IAPP»