CANADA
By Terry McQuay
Commissioners Release Report on TJX Companies Inc./Winners Merchant International L.P. Breach
On Sept. 25, 2007, the Canadian federal privacy commissioner and the Alberta information and privacy commissioner issued a report on the joint investigation into the TJX/WMI breach. The purpose of the investigation was to examine the collection, retention and safeguarding practices of the organization, in order to determine whether the breach could have been prevented.
TJX is an off-price retailer of apparel and home fashion in the United States and around the globe. WMI owns and operates 184 Winners and 68 HomeSense retail stores across Canada. In December 2006, TJX learned that suspicious software had been detected on a portion of it computer system. TJX had strong reason to believe that TJX's computer system had been intruded upon and that the intruder continued to have access to the system. TJX notified its customers, U.S. and Canadian regulatory agencies, its contracting banks, credit card, debit card and cheque-processing companies of the suspected intrusion.
The personal information relevant to the investigation consisted of:
- Credit card numbers, including expiration dates. This information was collected and retained in order to process payments;
- Canadian drivers' licences and other provincial identification numbers, and names and addresses used by WMI customers. These were collected to prevent fraud.
The three issues identified in the investigation were:
- Did the organization have a reasonable purpose for collecting the personal information affected by the breach?
- The credit card numbers and expiration dates were necessary to complete a sales transaction and are therefore reasonable to collect;
- For the purposes of deterring fraud during the return of goods, the collection of names and addresses is acceptable, but the recording of drivers' licence numbers is excessive and unnecessary;
- The report recommended that the company:
Cease collecting drivers licence numbers and purge such information from its databases; and
Clearly notify customers about the purposes, uses and potential disclosures of all personal information in its new returns policy
- TJX/WMI proposed an alternative refund-authorization procedure which converts the drivers' licence numbers into a new number referred to as a "hash" value where actual drivers' licence numbers will be unreadable to employees. This was found to be acceptable.
- Did the organization retain the information in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Personal Information Protection Act (PIPA)?
- TJX retained credit card data as far back as 2003 for troubleshooting purposes;
- The commissioners recommended that the company only retain credit card data the amount of time required for processing payments in accordance with company contracts;
- They also recommended that retaining the company data for "troubleshooting" purposes was not acceptable as it is not for "legal or business purposes." Did the organization have in place reasonable safeguards to protect the personal information in its custody?
- The commissioners concluded that the company could have forseen the risk of the breach based on the amount of sensitive personal information retained. They also found that TJX did not meet the safeguard provisions of PIPEDA and PIPA.
- The commissioners recommended:
- Moving from WEP to WPA encryption standard;
- Information should have been segregated; and
- The systems better monitored.- TJX agreed to implement the safeguarding recommendations.
Terry McQuay, CIPP, CIPP/C, is the Founder of Nymity, which offers
Web-based privacy support to help organizations control their privacy risks. Learn more at www.nymity.com.
NETHERLANDS
By Richard van Staden ten Brink
Dutch Regulator Shifts Focus to Enforcement
In a policy document of August 8, Jacob Kohnstamm, President of the Dutch Data Protection Authority (DDPA), announced that the DDPA will make enforcement a priority for the coming years. The DDPA also intends to strengthen its investigatory and legal skills in this respect. According to Kohnstamm, a higher level of enforcement is necessary to increase compliance.
Kohnstamm notes that, due to budget restrictions, a consequence of the new focus on enforcement is that the DDPA will be less able to advise businesses, governmental institutions and the public on data protection issues.
Earlier this year, Kohnstamm called on the Dutch legislature to increase the fines for violations of data protection legislation.
Richard van Staden ten Brink is advocaat at De Brauw Blackstone Westbroek in Amsterdam. He may be reached at
richard.vanstadentenbrink@debrauw.com
.
UK
By Stewart Room
Information Commissioner Issues Data-Sharing Guidance
On October 10, Information Commissioner Richard Thomas published much-welcomed guidance on data sharing for the public and private sectors.
His "Framework Code of Practice for Sharing Personal Information" reiterates the essence of the data protection principles. It also recommends that organisations should conduct impact assessments before commencing data sharing and extends an invitation to organisations to present their own Codes of Practice for official approval. The invitation for the submission of private sector codes represents another step toward a pragmatic self-regulatory approach to data protection compliance, as best illustrated by the EU model for international data transfers, Binding Corporate Rules.
Gaol Sentences for Data Theft
The Criminal Justice and Immigration Bill 2007, introduced in the House of Commons in June, contains at section 75 an amendment to section 55 of the Data Protection Act, which will introduce prison sentences for data theft. Currently the unlawful obtaining, disclosure and sale of personal data is subject to fines and community service orders. Once the amendment becomes law, offenders will be exposed to gaol sentences of up to two years.
Court Confirms that Private Investigators are Data Processors,
not Controllers
On Sept. 13, the criminal courts confirmed that private investigators generally should be regarded as data processors for the purposes of investigations, when they act on behalf of another, rather than data controllers. The writer defended the firm of private investigators and their managing director in this case, with the result that the defendants were acquitted of all charges. This case is the one mentioned in section 5.19 of the Information Commissioner's May 2006 report to Parliament, "What price privacy?"
Stewart Room is a Partner in the Privacy and Information Law Group at Field Fisher Waterhouse. He may be reached at
stewart.room@ffw.com
By Michael T. Spadea
SWIFT to Build New Data Centers
The Society for Worldwide Interbank Financial Telecommunication (SWIFT), the financial messaging network, will build two new facilities in Switzerland and Hong Kong, so that intra-European messages only will be stored in Europe and no longer in the U.S.
This is in response to last year's news that the U.S. secretly was scrutinizing suspect transactions under its anti-terrorism laws. On Nov. 22, 2006, the Article 29 Working Party adopted Opinion 10/2006, in which it concluded that SWIFT was not only in violation of the EU Data Protection Directive, but was also a data controller under the directive. That opinion has potentially far-reaching implications in that it could change whether entities are categorized as a data controller or data processor under the directive, which could dramatically change their obligations under the act. In July 2007, the EU and U.S. reached an agreement on the U.S.'s receipt of data from SWIFT. The European facility expects to be operational by the end of 2009.
Refusal to Provide Encryption Keys Punishable by Jail
Pursuant to the Regulation of Investigatory Powers Act, as of Oct. 1, 2007, law enforcement authorities in the United Kingdom are able to compel holders of encrypted data to turn over decryption keys.
Refusal could result in a maximum 5-year jail term if the investigation relates to terrorism or national security, or a maximum 2-year jail sentence in other cases. A person can be prevented from telling anyone other than his/her attorney about receiving such a demand. The Investigatory Powers Tribunal will hear complaints about demands for encryption keys. The Home Office has drafted guidance for law enforcement authorities seeking encryption keys.
OECD Adopts Recommendations on the Enforcement of Privacy Laws
The Organization for Economic Cooperation and Development (OECD) recommends that domestic frameworks be improved to enable better international cooperation; develop effective internal mechanisms to facilitate cooperation; provide mutual assistance in enforcement or privacy laws including information sharing and investigative support; and engage stakeholders to discuss relevant issues.
The Committee for Information, Computer and Communications Policy is scheduled to report back in three years on progress and experiences with respect to its implementation.
Michael Spadea is a London-based privacy attorney. He may be reached at
mspadea@gmail.com
, or at +44 (077) 80624543.
Comments
If you want to comment on this post, you need to login.