EU’s Data-Protection Reform Should Inspire U.S., Reding Says – Businessweek

European Union reforms of 16-year-old data-protection rules should inspire the U.S. to strengthen its privacy regime, the EU’s justice chief said.

The EU data privacy reforms, which the European Commission plans to present by the end of next month, should be “an inspiration for changes in the U.S. and elsewhere,” EU Justice Commissioner Viviane Reding said today. Referring to cloud companies that lure clients by promising to protect their data from the U.S. government, she urged for the free flow of information.

“I do encourage cloud computing centers in Europe. We need more innovation, more research and more investment in the ICT industry,” Reding said in prepared remarks for a speech in Brussels. “But this cannot be the only solution. We need free flow of data between our continents. It doesn’t make much sense for us to retreat from each other.”

Deutsche Telekom AG’s T-Systems information technology unit is pushing regulators to introduce a certificate for German or European cloud operators to help companies shield data from U.S. government access through the Patriot Act. Some of the surveillance powers of the act, passed after the Sept. 11, 2001, terrorist attacks, have been opposed by lawmakers and outside groups, including civil liberties activists.

via EU’s Data-Protection Reform Should Inspire U.S., Reding Says – Businessweek.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

A Proposal for E.U.-Wide Data Protection Regulation – NYTimes.com

A top lawmaker on Tuesday proposed harmonizing European Union privacy rules so that an Internet company could operate across the 27-country bloc as long as its data protection policies had been approved by a single member state.

Viviane Reding, vice president of the European Commission, said unnecessary hurdles created by privacy rules that date to 1995, when the Internet was in its infancy, were costing companies €2.3 billion, or $3.1 billion, a year as regulators in 27 different nations applied their own rules.

Ms. Reding acknowledged the apparent incongruity of discussing the harmonization of E.U. rules at a time of extreme discord within the bloc over economic policy, with debt woes straining the ties that bind together the euro zone. But she said an overhaul of the privacy regulations was crucial to increasing the competitiveness of the European economy to help it surmount the crisis.

“I think I am persuaded that while bringing member states out of their debt crises, we have to do everything we can to help our companies grow,” Ms. Reding said during a speech to privacy lawyers and other data protection professionals in Paris.

Ms. Reding said she planned to detail her plans in January in what is expected to be a sweeping overhaul of the 16-year-old Data Protection Directive. Internet companies, which would be most immediately affected by the new rules, have been urging E.U. lawmakers to simplify the existing practice, and mostly welcomed her proposals Tuesday.

via A Proposal for E.U.-Wide Data Protection Regulation – NYTimes.com.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Zuckerberg: Google, Yahoo, Microsoft Collect Data ‘Behind Your Back’ | News & Opinion | PCMag.com

Facebook chief Mark Zuckerberg appeared on the Charlie Rose show Monday evening with chief operating officer Sheryl Sandberg, and the duo touched on everything from privacy and the future of sharing to Steve Jobs and hitting one billion users.

In a clip released earlier today, Zuckerberg downplayed the notion that Facebook is “at war” with competitors like Apple, Google, and Microsoft. But he took shots at those rivals tonight when it comes to privacy, arguing that his social network is a lot more transparent than some Internet companies out there.

Here are a few highlights from the 60-minute interview.

GOOGLE AND YAHOO AND MICROSOFT, OH MY!: Zuckerberg asserted that Google, Microsoft, and Yahoo collect far more information about their users than Facebook does. “It’s just that they’re collecting that about you behind your back,” Zuckerberg said. “You’re going around the Web and they’re collecting this huge amount of information about you and you never know that.” He alluded to services like Google Dashboard, which show you the data collected about you, but “very few people” actually look at that, Zuckerberg said.

FACEBOOK PROVIDES THE MOST CONTROL: “I think it’s really about control,” Zuckerberg said of Facebook’s policies. “The real question for me is do people have the tools that they need in order to make those decisions well?” In the beginning, Facebook was focused on tech-savvy kids in college but has expanded to include 800 million people, some of whom only use their computers for Facebook and maybe the occasional email, he said. So Facebook needs to make privacy controls “easier and easier.”

via Zuckerberg: Google, Yahoo, Microsoft Collect Data ‘Behind Your Back’ | News & Opinion | PCMag.com.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Facebook may track users who leave service, data agency says | The Detroit News

Facebook Inc. may be tracking users’ Internet activity even after they cancel their accounts with the social-networking site, a German privacy watchdog said.

An in-depth probe of the way cookies are installed after a user opens and then closes their Facebook account has made the Hamburg Data Protection agency “suspicious” the company is unlawfully tracking users, the watchdog said on its website today. While rejecting Facebook’s justifications for the use of cookies, the agency welcomed the company’s offer to explain the technical processes.

“Arguments that all users have to remain recognizable after they leave Facebook to guarantee the service’s security can’t stand up,” Johannes Caspar, the Hamburg data protection representative, said on his agency’s website. “The probe raises the suspicion that Facebook is creating user tracking profiles,” which would be unlawful if users aren’t alerted.

The German regulator’s action adds to probes of Facebook by the Irish data-protection agency and Norway’s privacy watchdog. A group of EU regulators has said they will look for possible privacy violations in Facebook’s facial-recognition feature.

The social network “does not track users across the Web,” and instead uses cookies to personalize content or for safety and security reasons, Palo Alto, California-based Facebook said in an e-mailed statement. The company said it deletes account-specific cookies when a user leaves Facebook and doesn’t receive personally identifiable data when logged-out users browse the Web.

Remaining cookies are used in “identifying spammers and phishers, detecting when somebody unauthorized is trying to access your account, helping you get back into your account if you get hacked,” and blocking underage users from re-registering with a different birth date, Facebook said.

The German privacy regulator said that, while Facebook gave detailed explanations of how it uses cookies — small data files that track browsing habits — the company’s arguments don’t justify its practices.

via Technology | Facebook may track users who leave service, data agency says | The Detroit News.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Google agrees to privacy audits for 20 years – chicagotribune.com

Google Inc. agreed to submit to third-party privacy audits for the next 20 years to settle allegations it misused users’ personal information.

The settlement with the Federal Trade Commission would resolve the agency’s complaint over Google Buzz, a social notification service the company built last year into Gmail. The feature allowed users to share photos, videos and updates with friends but attracted controversy when the automatically enabled service effectively made users’ email contacts public.

Under the proposed settlement, Google would prominently disclose when it transfers user information to third parties, identify the kind of third parties receiving the data and explain the purposes of sharing the data. The disclosures would come apart from the company’s standard end-user license agreement.

The agreement also requires biennial assessments of its privacy safeguards by an independent third-party professional.

via Google agrees to privacy audits for 20 years – chicagotribune.com.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Getting a Grip on Filings With International Data Protection Authorities | Baker & McKenzie

Multinational businesses have to overcome a number of hurdles in their strides to share personal data across geographies and keep all subsidiaries in compliance with data privacy laws in their respective jurisdictions. One of the many compliance tasks is keeping up with government notification and authorization requirements. In this article, we provide an overview and some practical recommendations, in particular with respect to requirements under French law.

Read Article

via Getting a Grip on Filings With International Data Protection Authorities | Publications | Baker & McKenzie.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

How global laws protect your data | Cloud technology | guardian.co.uk

In February last year, three Google executives were handed suspended six month prison sentences by an Italian court for violating the privacy of a boy with Down’s Syndrome by allowing the website to broadcast video of him being bullied in a school in Turin. Although the video had been uploaded in Italy back in 2006, it had been processed by servers in the US and Ireland. No content had been hosted in Italy, but Google’s Italian office was enough to give the Italian courts jurisdiction.

For companies wanting to store data in the cloud there is a minefield of data protection laws to negotiate, so it is essential to know which country your data is physically stored in. “Most organisations don’t even know what data they have,” says Tony Lock, programme director at IT services consultancy Freeform Dynamics. “They are unsure where all the data is and once they’ve found it they are unsure how to protect it.”

The European Union’s Data Privacy Directive is crucial for UK firms. Created to facilitate the free movement of sensitive private information within Europe, it also makes it hard for data to be moved outside the region. Implemented across Europe but with local variations, the requirement for UK firms is to take “appropriate technical and organisational measures” to protect data. Italy goes further and sets out what those measures should be and Denmark requires internet transmission of such data to be encrypted.

But which laws apply, for example, to a British company storing data about UK customers via a contract with a US cloud provider whose servers are located in Poland? At the moment – all three. Within the EU, a company can be prosecuted if it has an established presence in the form of an office and staff, equipment it owns or operates or if it just makes use of a data centre or equipment in a European country.

via How global laws protect your data | Cloud technology | guardian.co.uk.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Google lets Wi-Fi hotspot owners opt out of location service – Computerworld

IDG News Service – Bowing to pressure from European privacy regulators, Google will soon allow owners of Wi-Fi access points to opt out of a Google service that allows smartphone owners to identify their location without using GPS (Global Positioning System), it said Tuesday.

On the same day, Google announced it will not appeal an order from the Dutch Data Protection Authority (CBP) requiring it to destroy records of 3.6 million Wi-Fi SSIDs (service set identifiers) it collected in breach of Dutch privacy laws, IDG’s Dutch news site Webwereld.nl reported.

By detecting the identity of a nearby Wi-Fi access point and looking up its geographic location in a database, Google can tell a smartphone owner roughly where they are. But so far, the owners of those Wi-Fi base stations haven’t had a say in how their location information is used.

Now Google plans to build an opt-out service so that access point owners can ask that their data not be used to determine the location of smartphones, it said Tuesday.

via Google lets Wi-Fi hotspot owners opt out of location service – Computerworld.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

White House pledges new Net privacy approach | Privacy Inc. – CNET News

A White House aide today previewed the administration’s forthcoming approach to Internet consumer protection, saying it will provide “privacy law without regulation.”

“Businesses that are engaged in responsible privacy practices today ought not to face any additional burdens,” said Danny Weitzner, associate administrator at the National Telecommunications and Information Administration (NTIA) who’s on assignment to the White House’s Office of Science and Technology Policy.

Weitzner suggested during a discussion at a Technology Policy Institute conference here that: “You can have stronger privacy law, clearer rules, clearer principles established in law, without the costs and downsides of a traditional regulatory structure.”

In December, the U.S. Commerce Department outlined proposals for how federal laws regulating companies’ data collection practices could be updated, but stopped short of specific recommendations for legislation. An administration-wide white paper is expected this fall.

Lawrence Strickling, the NTIA’s administrator (the agency is part of the Commerce Department) suggested to Congress in March that it should enact a “consumer privacy bill of rights” that would mandate broad privacy protections. Some possibilities–Strickling, too, avoided specifics–include requiring companies to describe the purpose for which they’re collecting data, and keeping it secure once collected.

via White House pledges new Net privacy approach | Privacy Inc. – CNET News.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare

Avoid Patriot Act surprises: Encrypt Cloud data on-premise – cloud computing, Amazon Web Services – CIO

CIOs the world over who do business with US organisations do so under the shadow of the US Patriot Act.

It has proven a thorn in the side of globalisation; this month members of the European Parliament demanded to know what lawmakers intend to do about the conflict between the European Union’s Data Protection Directive and the Patriot Act. The calls come after Microsoft admitted it may be forced to hand over European customers’ data on its Cloud service to US authorities and may also be compelled by the Patriot Act to keep details of any such data transfer secret.

Microsoft is hardly alone in this regard. As a US company, Amazon Web Services (AWS) is subject to the US Patriot Act and the data it manages may be accessed by the US government regardless of where it is stored around the world.

What’s a CIO to do? The answer, according to AWS chief technology officer, Werner Vogels, is to encrypt private data for transit to the Cloud — and to employ best practice when it comes to classifying data.

A coffee shop, ramen and a laptop — these days that’s all you need to start a company

“We take privacy very seriously,” Vogels told CIO Australia. “For any subpoena we receive, we notify customers, effectively giving them the ability to seek an injunction.”

Amazon uses the US Safe Harbor provisions to notify customers. The risk for CIOs, however, occurs when Cloud providers are bound to keep details of data transfers secret. By encrypting data where privacy is an issue, Vogels said, CIOs can regain a measure of control.

“The whole thing is moot if the data is encrypted,” he said. “Then they [the CIO] can interact with the enforcement agency.

“We need to obey the laws in the countries we operate in but at the same time we value the privacy of our customers.”

via Avoid Patriot Act surprises: Encrypt Cloud data on-premise – cloud computing, Amazon Web Services – CIO.

LinkedInPinterestEvernoteWordPressBlogger PostEmailShare