DPI16_Banner_300x250 WITH COPY


By Terry McQuay

Commissioners Release Report on TJX Companies Inc./Winners Merchant International L.P. Breach

On Sept. 25, 2007, the Canadian federal privacy commissioner and the Alberta information and privacy commissioner issued a report on the joint investigation into the TJX/WMI breach. The purpose of the investigation was to examine the collection, retention and safeguarding practices of the organization, in order to determine whether the breach could have been prevented.

TJX is an off-price retailer of apparel and home fashion in the United States and around the globe. WMI owns and operates 184 Winners and 68 HomeSense retail stores across Canada. In December 2006, TJX learned that suspicious software had been detected on a portion of it computer system. TJX had strong reason to believe that TJX's computer system had been intruded upon and that the intruder continued to have access to the system. TJX notified its customers, U.S. and Canadian regulatory agencies, its contracting banks, credit card, debit card and cheque-processing companies of the suspected intrusion.

The personal information relevant to the investigation consisted of:

  • Credit card numbers, including expiration dates. This information was collected and retained in order to process payments;
  • Canadian drivers' licences and other provincial identification numbers, and names and addresses used by WMI customers. These were collected to prevent fraud.

    The three issues identified in the investigation were:

  • Did the organization have a reasonable purpose for collecting the personal information affected by the breach?
    • The credit card numbers and expiration dates were necessary to complete a sales transaction and are therefore reasonable to collect;
    • For the purposes of deterring fraud during the return of goods, the collection of names and addresses is acceptable, but the recording of drivers' licence numbers is excessive and unnecessary;
    • The report recommended that the company: 

        Cease collecting drivers licence numbers and purge such information from its databases; and   
        Clearly notify customers about the purposes, uses and potential disclosures of all personal information in its new returns policy

  • TJX/WMI proposed an alternative refund-authorization procedure which converts the drivers' licence numbers into a new number referred to as a "hash" value where actual drivers' licence numbers will be unreadable to employees. This was found to be acceptable.
  • Did the organization retain the information in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Personal Information Protection Act (PIPA)?
    • TJX retained credit card data as far back as 2003 for troubleshooting purposes;
    • The commissioners recommended that the company only retain credit card data the amount of time required for processing payments in accordance with company contracts; 
    • They also recommended that retaining the company data for "troubleshooting" purposes was not acceptable as it is not for "legal or business purposes." Did the organization have in place reasonable safeguards to protect the personal information in its custody?
  • The commissioners concluded that the company could have forseen the risk of the breach based on the amount of sensitive personal information retained. They also found that TJX did not meet the safeguard provisions of PIPEDA and PIPA.
  • The commissioners recommended:
    • Moving from WEP to WPA encryption standard;
    • Information should have been segregated; and
    • The systems better monitored.- TJX agreed to implement the safeguarding recommendations.

    Terry McQuay, CIPP, CIPP/C, is the Founder of Nymity, which offers
    Web-based privacy support to help organizations control their privacy risks. Learn more at


By Richard van Staden ten Brink

Dutch Regulator Shifts Focus to Enforcement

In a policy document of August 8, Jacob Kohnstamm, President of the Dutch Data Protection Authority (DDPA), announced that the DDPA will make enforcement a priority for the coming years. The DDPA also intends to strengthen its investigatory and legal skills in this respect. According to Kohnstamm, a higher level of enforcement is necessary to increase compliance.

Kohnstamm notes that, due to budget restrictions, a consequence of the new focus on enforcement is that the DDPA will be less able to advise businesses, governmental institutions and the public on data protection issues.

Earlier this year, Kohnstamm called on the Dutch legislature to increase the fines for violations of data protection legislation.

Richard van Staden ten Brink is advocaat at De Brauw Blackstone Westbroek in Amsterdam. He may be reached at


This e-mail address is being protected from spam bots, you need JavaScript enabled to view it



By Stewart Room

Information Commissioner Issues Data-Sharing Guidance

On October 10, Information Commissioner Richard Thomas published much-welcomed guidance on data sharing for the public and private sectors.

His "Framework Code of Practice for Sharing Personal Information" reiterates the essence of the data protection principles. It also recommends that organisations should conduct impact assessments before commencing data sharing and extends an invitation to organisations to present their own Codes of Practice for official approval. The invitation for the submission of private sector codes represents another step toward a pragmatic self-regulatory approach to data protection compliance, as best illustrated by the EU model for international data transfers, Binding Corporate Rules.

Gaol Sentences for Data Theft
The Criminal Justice and Immigration Bill 2007, introduced in the House of Commons in June, contains at section 75 an amendment to section 55 of the Data Protection Act, which will introduce prison sentences for data theft. Currently the unlawful obtaining, disclosure and sale of personal data is subject to fines and community service orders. Once the amendment becomes law, offenders will be exposed to gaol sentences of up to two years.

Court Confirms that Private Investigators are Data Processors,
not Controllers

On Sept. 13, the criminal courts confirmed that private investigators generally should be regarded as data processors for the purposes of investigations, when they act on behalf of another, rather than data controllers. The writer defended the firm of private investigators and their managing director in this case, with the result that the defendants were acquitted of all charges. This case is the one mentioned in section 5.19 of the Information Commissioner's May 2006 report to Parliament, "What price privacy?"

Stewart Room is a Partner in the Privacy and Information Law Group at Field Fisher Waterhouse. He may be reached at


This e-mail address is being protected from spam bots, you need JavaScript enabled to view it

By Michael T. Spadea

SWIFT to Build New Data Centers

The Society for Worldwide Interbank Financial Telecommunication (SWIFT), the financial messaging network, will build two new facilities in Switzerland and Hong Kong, so that intra-European messages only will be stored in Europe and no longer in the U.S.

This is in response to last year's news that the U.S. secretly was scrutinizing suspect transactions under its anti-terrorism laws. On Nov. 22, 2006, the Article 29 Working Party adopted Opinion 10/2006, in which it concluded that SWIFT was not only in violation of the EU Data Protection Directive, but was also a data controller under the directive. That opinion has potentially far-reaching implications in that it could change whether entities are categorized as a data controller or data processor under the directive, which could dramatically change their obligations under the act. In July 2007, the EU and U.S. reached an agreement on the U.S.'s receipt of data from SWIFT. The European facility expects to be operational by the end of 2009.

Refusal to Provide Encryption Keys Punishable by Jail
Pursuant to the Regulation of Investigatory Powers Act, as of Oct. 1, 2007, law enforcement authorities in the United Kingdom are able to compel holders of encrypted data to turn over decryption keys.

Refusal could result in a maximum 5-year jail term if the investigation relates to terrorism or national security, or a maximum 2-year jail sentence in other cases. A person can be prevented from telling anyone other than his/her attorney about receiving such a demand. The Investigatory Powers Tribunal will hear complaints about demands for encryption keys. The Home Office has drafted guidance for law enforcement authorities seeking encryption keys.

OECD Adopts Recommendations on the Enforcement of Privacy Laws
The Organization for Economic Cooperation and Development (OECD) recommends that domestic frameworks be improved to enable better international cooperation; develop effective internal mechanisms to facilitate cooperation; provide mutual assistance in enforcement or privacy laws including information sharing and investigative support; and engage stakeholders to discuss relevant issues.

The Committee for Information, Computer and Communications Policy is scheduled to report back in three years on progress and experiences with respect to its implementation.

Michael Spadea is a London-based privacy attorney. He may be reached at


This e-mail address is being protected from spam bots, you need JavaScript enabled to view it

, or at +44 (077) 80624543.


If you want to comment on this post, you need to login.


Board of Directors

See the esteemed group of leaders shaping the future of the IAPP.

Contact Us

Need someone to talk to? We’re here for you.

IAPP Staff

Looking for someone specific? Visit the staff directory.

Learn more about the IAPP»

Daily Dashboard

The day’s top stories from around the world

Privacy Perspectives

Where the real conversations in privacy happen

The Privacy Advisor

Original reporting and feature articles on the latest privacy developments

Privacy Tracker

Alerts and legal analysis of legislative trends

Privacy Tech

Exploring the technology of privacy

Canada Dashboard Digest

A roundup of the top Canadian privacy news

Europe Data Protection Digest

A roundup of the top European data protection news

Asia-Pacific Dashboard Digest

A roundup of the top privacy news from the Asia-Pacific region

Latin America Dashboard Digest

A roundup of the top privacy news from Latin America

IAPP Westin Research Center

Original works. Groundbreaking research. Emerging scholars.

Get more News »

Find a KnowledgeNet Chapter Near You

Network and talk privacy at IAPP KnowledgeNet meetings, taking place worldwide.

Women Leading Privacy

Events, volunteer opportunities and more designed to help you give and get career support and expand your network.

IAPP Job Board

Looking for a new challenge, or need to hire your next privacy pro? The IAPP Job Board is the answer.

Join the Privacy List

Have ideas? Need advice? Subscribe to the Privacy List. It’s crowdsourcing, with an exceptional crowd.

Find more ways to Connect »

Find a Privacy Training Class

Two-day privacy training classes are held around the world. See the complete schedule now.

Online Privacy Training

Build your knowledge. The privacy know-how you need is just a click away.

The Training Post—Can’t-Miss Training Updates

Subscribe now to get the latest alerts on training opportunities around the world.

New Web Conferences Added!

See our list of upcoming web conferences. Just log on, listen in and learn!

Train Your Staff

Get your team up to speed on privacy by bringing IAPP training to your organization.

Learn more »

CIPP Certification

The global standard for the go-to person for privacy laws, regulations and frameworks

CIPM Certification

The first and only privacy certification for professionals who manage day-to-day operations

CIPT Certification

The industry benchmark for IT professionals worldwide to validate their knowledge of privacy requirements

Certify Your Staff

Find out how you can bring the world’s only globally recognized privacy certification to a group in your organization.

Learn more about IAPP certification »

Get Close-up

Looking for tools and info on a hot topic? Our close-up pages organize it for you in one easy-to-find place.

Where's Your DPA?

Our interactive DPA locator helps you find data protection authorities and summary of law by country.

IAPP Westin Research Center

See the latest original research from the IAPP Westin fellows.

Looking for Certification Study Resources?

Find out what you need to prepare for your exams

More Resources »

GDPR Comprehensive: Spots Going Fast

With the top minds in the field leading this exceptional program, it's no wonder it's filling quickly. Register now to secure your spot.

Be Part of Something Big: Join the Summit

Registration is open for the Global Privacy Summit 2016. Discounted early bird rates available for a short time, register today!

Data Protection Intensive Returns to London

Registration is now open for the IAPP Europe Data Protection Intensive in London. Check out the program!

P.S.R. Call for Speakers Open!

P.S.R. is THE privacy + cloud security event of the year, and you can take a leading role. Propose a session for this year's program.

Sponsor an Event

Increase visibility for your organization—check out sponsorship opportunities today.

Exhibit at an Event

Put your brand in front of the largest gatherings of privacy pros in the world. Learn more.

More Conferences »

Become a Member

Start taking advantage of the many IAPP member benefits today

Corporate Members

See our list of high-profile corporate members—and find out why you should become one, too

Renew Your Membership

Don’t miss out for a minute—continue accessing your benefits

Join the IAPP»