UK Data Protection Authority Takes Surprisingly Flexible Approach to Sale of Consumer Data

Upholding its reputation as one of the most flexible EU data protection authorities (DPAs), the Office of the UK Information Commissioner recently released Good Practice Note taking a surprisingly flexible approach to sale of databases containing consumers' personal data. To the initial question "Can databases be sold?," the Information Commissioner gave a qualified "Yes." The first circumstance in which the Information Commissioner notes that consumer databases may be sold is where the consumers included in the database have given their consent. The second, and more controversial, circumstance is the Information Commissioner's statement that if a business is insolvent, bankrupt, going out of business, or being sold, the "[UK Data Protection] Act will not prevent the sale of a database containing the details of individual customers, providing certain requirements are met." The "requirements" relate mainly to using the information for the "same or similar" purposes to those for which the information was gathered, and providing notice to consumers in the database of the sale. But nowhere does the Information Commissioner say that consumers must be given the chance to object to further use of their information upon a sale, and the authorization of "similar" use is quite flexible. Such guidance will certainly raise a few eyebrows at other EU DPAs.

© Copyright 2006 Steptoe & Johnson LLP

IT Security: Hacking law updates are overdue

It's taken some time for MPs to decide how to update the UK's laws against hackers. Nevertheless, the proposals in the new Police and Justice Bill don't look too shabby.

Apple argues that blogger can't protect source

A US appeals court has been hearing arguments in a case that tests the right of a blogger to protect his sources. Apple Computer wants to know who leaked details of a product called 'Asteroid' and expects bloggers to reveal the names.

IT Security: What's the Inside Attacker Profile?

What's the Inside Attacker Profile?
The United States Secret Service and the Carnegie Mellon University Software Engineering Institute's CERT Coordination Center published an insider threats study report in 2005 which offered critical insights into the mind and motivation of the "inside attacker." According to the statistics gathered, the inside attacker is usually:

• Male
• 17-60 years old
• Holds a technical position (86 percent chance)
• May or may not be married (50/50 chance)
• Racially and ethnic diverse

Sufficiently broad pool? Absolutely. Here are some additional statistics, again from the same CERT study:

• In 92 percent of the incidents investigated, revenge was the primary motivator.
• Sixty-two percent of the attacks were planned in advance.
• Fifty-seven percent of the attackers surveyed would consider themselves "disgruntled."
• Eighty percent exhibited suspicious or disruptive behavior to their colleagues or supervisors before the attack.
• Only 43 percent had authorized access (by policy, not necessarily via system control).
• Sixty-four percent used remote access to carry out the attack.
• Most incidents required little technical sophistication.

Worker can't be fired for Web surfing

A New York City employee cannot be fired for surfing the Web from work, an administrative law judge has ruled.

High costs hamper domain resolution

The Department of Communications expects progress to be made on the development of an alternative domain name dispute resolution process within the next three months. The absence of an alternative dispute resolution process (ADRP) has led to high costs for businesses, say industry players...

ICANN mulls .tel domain for contact info

Reaching out and touching someone used to be as simple as dialing a string of numbers.

But now there are home, cell and work phone numbers from which to choose, and sometimes work extensions to remember. There are also e-mail addresses -- at home and at work -- and instant messaging handles, perhaps separate ones for the various services, some of which now do voice and video besides text.

Some people even have Web pages -- through their employer or Internet service provider, or perhaps a profile or two on MySpace.

To help people manage all their contact information online, the Internet's key oversight agency is considering a ``.tel'' domain name. If approved, the domain could be available this year.

Wireless TV all-clear

Is this something that we will see in South Africa when it comes to the braodcasting of TV over wireless devices or over the internet?

See what was said in Canada:
Cellphone TV services started with hockey clips and news but now the broadcasting regulator has given wireless carriers carte blanche to move beyond traditional television.
Mobile TV services from Telus Corp., Bell Mobility Inc. and Rogers Wireless Communications Inc. are delivered over the Internet and aren't subject to the same rules as those provided by cable operators and broadcasters, the Canadian Radio-television and Telecommunications Commission said Wednesday....

See Canadian Radio-television and Telecommunications Commission's Public Notice on Regulatory framework for mobile television broadcasting services - click here

source: www.theglobeandmail.com

Court rules that an email address is not a signature

A High Court judge has ruled that the presence of a sender's email address in the header of an email does not amount to a signature – although a typed name would have sufficed to form a binding contract.

Corporate blogs are a liability

EDITORIAL: Many bloggers wear suits, not pyjamas. A recent proliferation of corporate blogs has given numerous workers a new platform for self-expression. But while employers hope to see business benefits, lawyers will see nothing but trouble.

ID thect and fraud - The weakest link - uneffective policy implementation!!!

There's some good news and some bad news to report concerning the fight against identity theft and cyber fraud. The good news is that financial institutions and other companies continue to batten down their information security with high-end tecnological measures such as two-stage identification and multifactor authentication. The bad news is that even the most advanced information security systems often have an Achilles heel -- usually in inadequate, or unenforced, policies covering employees and contractors. The recent spate of thefts of employee or contractor laptops thefts, resulting in the loss of sensitive information, is a perfect example. No matter how much money a company spends on fancy data security measures, these less sexy links in its security chain will continue to be vulnerable to exploitation by clever fraudsters. This doesn’t mean companies should give up on the high-end technological measures. Rather, it means companies need to pay as much attention to the more mundane, less glamorous aspects of security, like establishing and enforcing rules on the handling of sensitive data, and regularly using encryption.

© Copyright 2006 Steptoe & Johnson LLP. Steptoe & Johnson LLP

Do you read the License?

Open Content Movement Finds a Poster Child From MTV
In early March, the District Court of Amsterdam ruled that Dutch gossip magazine Weekend infringed the copyright in four photos which were posted on photography website flickr. Adam Curry, who, among other things, is a former MTV "video jockey," had posted the photos under the Creative Commons Attribution-NonCommercial-ShareAlike license, which allows photos to be used freely (with attribution) for non-commercial purposes, but not for commercial purposes (such as the use by Weekend). Weekend defended Curry's action by arguing that it was misled by the notice "This photo is public" that was posted with the photos, and therefore did not click on the Creative Commons "CC" symbol accompanying a "some rights reserved" notice (also posted with the photos), which led to a summary of the terms of the license. The court rejected this argument, stating that "it may be expected from a professional party like [the publisher of Weekend] that it conduct a thorough and precise examination before publishing in Weekend photos originating from the internet." The Curry decision thus holds (at least under Dutch law) that not only are Creative Commons licenses valid, but more suprisingly that publishers are under a duty to understand and investigate such licenses even in the face of a confusing statement like "This photo is public."

Source: Steptoe & Johnson LLP. Steptoe & Johnson LLP

The first move in the direction of web accessibility standards

Separating coders from cowboys with PAS 78

A guide published earlier this month about how to commission accessible websites will transform web accessibility in the UK, according to Chris Rourke of User Vision. The firm is also seeking your views in a short online survey.

P2P Crackdown - soon in South Africa?

Crackdown on corporate P2P users in Britain - Is your company addressing this risk?!

The Federation Against Software Theft is about to take action against a number of companies in the UK that have been caught making illegal copies of software available for download from their networks – which may come as a complete surprise to the companies.

IMPORTANT - Cryptography Regulations

As of Friday 10 March 2006, providers of cryptography products or services will have to register at the Department of Communications certain information before they can provide cryptography services and/or cryptography products.

It is important to know that failure to register could lead to fine or up to two years imprisonment.

If you are unclear whether you are a cryptography service / product provider - here are the definitions as per the Electronic Communications and Transactions Act 2002:

This is according to the cryptography regulations published in the government gazette on 10 March in terms of the Electronic Communications and Transactions Act of 2002 (ECT Act):
"cryptography provider" means any person who provides or who proposes to provide cryptography services or products in the Republic.

"cryptography service" means any service which is provided to a sender or a recipient of a data message or to anyone storing a data message, and which is designed to facilitate the use of cryptographic techniques for the purpose of ensuring
a) that such data or data message can be accessed or can be put into an intelligible form only by certain persons;
b) that the authenticity or integrity of such data or data message is capable of being ascertained;
c) the integrity of the data or data message; or
d) that the source of the data or data message can be correctly ascertained.

"cryptography product" means any product that makes use of cryptographic techniques and is used by a sender or recipient of data messages for the purposes of ensuring-
a) that such data can be accessed only by relevant persons;
b) the authenticity of the data;
c) the integrity of the data; or
d) that the source of the data can be correctly ascertained;

Contact van Gaalen Attorneys today to find out about their special offer to register you / your organisation as a Cryptography Service- / Product provider

Tel: 011 782 9511/2
Fax: 086 631 8898
email: info@vangaalenlaw.co.za (heading - cryptography special offer)

Security 'not a problem' for IT managers

The top two IT-related problems facing companies today are operational incidents and staffing issues, according to a study commissioned by the IT Governance Institute (ITGI).

Communications bill ushers in demise of Telkom’s monopoly

COMPETITION in the telecoms industry will get a major boost from the Electronic Communications Bill now awaiting presidential approval, the chairman of Parliament’s communications portfolio committee believes.

No TV licence fees for IPTV

Those planning to receive TV on their mobile devices or PCs using broadband technology will not have to pay a TV licence fee for this.

OSS: The alternative in digital forensics?

Open source software (OSS) tools can be credible and reliable in digital forensics, says Cobus Venter, senior researcher at The Cyber Security Science Centre, a division of the Council for Scientific and Industrial Research (CSIR).

Morgan Stanley offers $15m to make up for missing emails

Investment bank Morgan Stanley has offered to pay the Securities and Exchange Commission (SEC) $15m to settle an investigation by the regulator into an alleged failure by the firm to produce email evidence during a legal dispute.