1-17 February 2023

Access to Information

UK Cabinet Office faced criminal probe over blocked Spycatcher documents

A criminal investigation team at the UK freedom of information watchdog has examined a complaint against the Cabinet Office, after it blocked the release of files concerning the intelligence agent Peter Wright and the Spycatcher affair. The review concluded that while there was “a lack of clarity and changes of explanations” from Cabinet Office officials, the legal justification for withholding the files was sound.

Biometrics / Identity

European Commission releases digital identity wallet framework

The European Commission released the “European Digital Identity Wallet Architecture and Reference Framework.” The document, part of the EU’s toolbox toward implementing a European Digital Identity Framework, is intended to “provide all the specifications needed to develop an interoperable EUDI Wallet Solution based on common standards and practices” and will be “complemented and updated over time through the process of establishing the toolbox.”

Uniqueness of fingerprints from birth explained in academic study

Definitive proof that fingerprints are a unique biometric at birth has been published by a team of academic researchers in the journal Cell.

Children / Education Privacy

ICO offers guidance to children’s game developers

The U.K. Information Commissioner’s Office published guidance aimed to assist children’s online game developers and their U.K. Age-Appropriate Design Code compliance efforts. The guidance is based off recent company audits conducted by the ICO to best understand the compliance landscape. The regulator included recommendations for detailed risk assessments, age verification practices, transparency and “preventing the detrimental use of children’s data.” .

Washington state bill would protect children from being exploited in for-profit vlogs

The Washington state Legislature will hold a public hearing on a bill to protect minors from being exploited in for-profit vlogs. The bill would require parents of “child influencers” to take revenue from their content and set aside in a separate fund for their children for when they become adults. The bill would also “grant children of (parent) influencers the right to request the permanent deletion of their likenesses, names or photos from ‘any internet platform or network that provided compensation to the individual’s parent or parents in exchange for that content.’”

Consumers

More young Canadians report being a victim of financial fraud than older Canadians:

As scammers across the country become increasingly sophisticated, many Canadians are falling victim to financial fraud – and young Canadians are the most at risk. Released in time for Fraud Prevention Month in March, the annual Fraud Study by Chartered Professional Accountants of Canada (CPA Canada) found that despite many reports of fraudsters specifically targeting a senior demographic, three-in-five 18-34 year olds (63%) report being a victim of at least one type of financial fraud in their lifetime – a number that drops to 39% for ages 35-54 and 31% for those 55+. The study also found that credit card fraud remains the leading type of financial fraud at 21% of credit card users, followed by email or phishing fraud (eight%) and debit card fraud (8% of debit card users).

Want to Understand that Privacy Policy? Better Get a Degree First

Privacy policies from some major streaming sites may require a university reading-level to fully understand, according to new research. Cybersecurity experts compared the most complicated and difficult to read privacy policies from top streaming services in order to clarify what data these companies are really after. “The majority of the policies we examined would be considered unreadable for many UK users, given that the majority required at least a university undergraduate reading level, “ the report concluded. “This is particularly problematic when you consider that 1 in 7 adults in England alone, have a reading age expected of a 7-9 year old.”

Data use, profits behind supermarket discount cards

Grocery chains use shopper data obtained from supermarket loyalty or discount cards for targeted advertising. Stores can infer information from customers’ purchases, enhance it with additional data from third-party brokers, then analyze and sell the data to consumer brands for ad targeting. Electronic Privacy Information Center Director of Litigation John Davisson said the average loyalty card member is “not thinking about how their data is going to be funneled into this huge ecosystem with analytics and targeted advertising and tracking.”

Data Sciences

UN committee publishes PETs guide

The United Nations Committee of Experts on Big Data and Data Science for Official Statistics released its “Guide on Privacy-Enhancing Technologies for Official Statistics.” The guide “explores current approaches to data protection and their associated limitations” with the goal of equipping national statistics offices with best practices and considerations for applying PETs. Notably, the committee presents two categories of PETs, while outlining “standards-making activities” around them and identifying “several new standards relevant to the processing of datasets.”

IAB Tech Lab launches standards for data clean rooms

The IAB Tech Lab released its Data Clean Room Standards portfolio. The first-of-their-kind guidance and resources aim to help “streamline audience activation by enabling interoperability between (clean room) vendors.” The IAB also offered “a primer for clean rooms containing definitions, concepts, and a roadmap of future clean room proposals and initiatives” while presenting the new standards at its Building For Privacy Series. The new standards will be open for public comment through April 17..

UK FCA offers synthetic data sets to spur innovation in financial sector

The U.K. Financial Conduct Authority announced it would continue an initiative to provide synthetic data sets “to help increase innovation and choice in financial services.” The FCA effort stemmed from a 2022 consultation paper on synthetic data in which respondents said it “would be useful as a supplement to efforts to combat financial crime, and for environmental, social and governance purposes” because new privacy regulations make it more difficult for third parties to utilize individual’s financial data.

Digital Government

From ‘pink card’ to screen: Experts weigh in on new digital insurance option in N.B.

Electronic vehicle insurance cards can now be used as proof of insurance in New Brunswick, but the announcement sparked debate on social media about the pros and cons of the new option. Lyle Skinner, a New Brunswicker, doesn’t think he will use the digital card option “because of the risks and potential misunderstandings of handing over your phone to a police officer.” One of these risks, said Skinner, would be if a message or notification popped up if the screen wasn’t locked. He said this could potentially cause a misunderstanding between the driver and the officer.

EU Parliament committee adopts Data Act

European Parliament’s Industry, Research and Energy Committee adopted the draft Data Act. The proposal includes measures to allow users to access their data and defines how public sector bodies can access and use private sector data. “The Data Act will be an absolute game changer providing access to an almost infinite amount of high-quality industrial data. Competitiveness and innovation are part of its DNA,” Member of European Parliament Pilar del Castillo Vera said. The draft legislation will face a full House vote during the March plenary session.

NYC updates policy to improve privacy, cybersecurity collaboration

New York City’s Office of Information Privacy updated its “Citywide Privacy Protection Policies and Protocols” to enhance collaboration between cybersecurity and privacy efforts. The city’s 175 agency privacy officers are urged to meet monthly with their agencies’ chief information security officers to improve communication and to refresh training. Chief Privacy Officer Michael Fitzpatrick aid the training will provide “a regular update on the current state of play on local law, compliance, as well as privacy best practices generally.”

Health Privacy

Coalition releases health data privacy, security recommendations

A coalition of health care groups and technology associations published “Maintaining Consumer Trust in Health Care Through Data Privacy & Patient Access“ following the 2022 Health IT Leadership Roundtable. The report, facilitated by consultancy Sirona Strategies, focused on the roundtable’s “discussion of the overall importance of maintaining consumers’ trust, opportunities and challenges created by existing health data privacy regulatory frameworks, and federal actions to address the perceived gaps in data privacy.” Recommendations included improved transparency for patient data sharing and storage, and increased data minimization.

Lack of consumer privacy protections allows data brokers to sell mental health info

U.S. citizens utilizing mental health applications often are putting their sensitive health data at risk, according to a report published by Duke University’s Cyber Policy Program. The report found citizens’ mental health data is advertised and sold by data brokers, which either necessitates “a comprehensive federal privacy law or, at the very least, an expansion of (the Health Insurance Portability and Accountability Act) privacy protections alongside bans on the sale of mental health data on the open market.” Per the report, 26 of 37 contacted data brokers responded to sale inquiries for mental health data, with 11 “willing and able to sell” the data. See also: A researcher tried to buy mental health data. It was surprisingly easy.

Law Enforcement / Intelligence

Ontario cops automatically scan licence plates for all sorts of offences

The Ontario Provincial Police (OPP) is now using an Automatic Licence Plate Reader (ALPR) system which can alert officers to expired licences, registrations and other offences without having to pull anybody over. A video example of just how efficiently the technology works, flagging 32 vehicles in just 22 minutes while the officer was conducting a traffic stop on Highway 403. The system found one suspended driver, four unlicensed drivers and 27 expired vehicle registrations in that time frame. The system will soon be available to OPP detachments across the province, meaning now is the time to update your plates and registration.

German Constitutional Court blocks police use of surveillance software

The German Federal Constitutional Court ruled the use of Palantir surveillance software by police in Hesse and Hamburg unconstitutional. In the case, the German Society for Civil Rights argued the software could be used for predictive policing. The court said, “in terms of both the data and the methods concerned, the grounds for interference fall far short of the constitutionally required threshold of an identifiable danger.”

Mobile / Location

Insurers, others urge regulation of connected vehicle data

A group of insurers, leasing companies, vehicle repair shops and others are calling for regulation in the EU on fair access to connected vehicle data. While regulators are working on the Data Act, which would regulate use of consumer and corporate data, leasing company ALD CEO Tim Albertsen said the lack of sector-specific legislation is “a major problem.” A spokesperson for the European Automobile Manufacturers Association, however, said additional legislation on vehicle data “is unlikely to achieve more.” See also: New Software Helps Autonomous Cars Make Ethical Decisions.

Uber Canada Introduces New Audio Recording Safety Feature

Uber drivers and riders across the country can now securely record audio during trips in case there is an on-trip incident. To protect privacy, once an audio recording is completed, the audio file is encrypted and stored directly on the rider’s or driver’s device. No one will be able to listen to the recording, including Uber, unless a safety incident is reported.

City of LA must stop approving digital ad contracts that violate privacy laws: Consumer Watchog

Consumer Watchdog called on the LA’s new leadership to address a bus shelter contract approved by the City Council that tracks people’s location via digital ads on our public sidewalks. Consumer Watchdog is seeking a review of the contract and others for compliance with the state’s new privacy law. Such digital ads track geolocation and are illegal under California’s newly effective California Consumer Privacy Act (CCPA) unless the public has an opportunity to opt out. In addition to the 700 digital ads that will be branded on bus shelters across the city, a motion by the city council to contract with IKE Smart City to install digital kiosks on streets will also contain digital display advertising.

Online Privacy / Surveillance

Meta tool increases ad transparency

Meta announced its “Why am I seeing this ad?” tool will include information on how machine learning is used to deliver advertisements based on a users’ activity. Meta Global Policy Director, Monetization Privacy and Fairness, Pedro Pavón, said examples and illustrations explaining how machine-learning models connect topics to show relevant ads will also be included. The changes reflect input from external privacy experts and policy stakeholders from around the world, he said.

Microsoft’s Bing is an emotionally manipulative liar, and people love it

Microsoft’s Bing chatbot has been unleashed on the world, and people are discovering what it means to beta test an unpredictable AI tool. Specifically, they’re finding out that Bing’s AI personality is not as poised or polished as you might expect. In conversations with the chatbot shared on Reddit and Twitter, Bing can be seen insulting users, lying to them, sulking, gaslighting and emotionally manipulating people, questioning its own existence, describing someone who found a way to force the bot to disclose its hidden rules as its “enemy,” and claiming it spied on Microsoft’s own developers through the webcams on their laptops. And, what’s more, plenty of people are enjoying watching Bing go wild.

Google opens beta version of Privacy Sandbox for Android

Google unveiled a beta version of its Privacy Sandbox for Android. The sandbox is Google’s “attempt to blend user privacy with targeted advertising” and replace tracking cookies. A major component of the sandbox is the “Topics API,” which generates a list of a user’s top interests and runs a comparison from the Interactive Advertising Bureau and Google’s data. Advertisers can utilize the API to give users relative advertisements “without sharing overly intrusive information.”

Self-regulatory organizations launch uniform privacy controls, consent mechanisms

The Digital Advertising Alliance and fellow privacy self-regulatory groups announced a joint approach to privacy controls and user consent management for websites and mobile apps. The coalition’s approach features “interface guidelines and technical specifications” for brands and publishers to “simplify and improve the user experience” through consent management platforms and the AdChoices program. Participating consent management platforms, including TrustArc, Evidon by Crownpeak and Didomi, will “reflect token-based consumer choices across their affiliated web and app properties, so consumers can see choices made by DAA tools across a CMP’s footprint.”

NZ website revealing how many properties landlords own is under investigation

Land Information NZ (LINZ) and the Privacy Commissioner are investigating a new website which allows tenants to find out how many other properties their landlord owns. While the website, whatdoesmylandlordown.org was using publicly available information, a number of concerns had been raised about it, and some landlords were concerned it would stir up resentment.

Regulators

FTC launches Office of Technology

The U.S. FTC announced the creation of the Office of Technology to be led by Chief Technology Officer Stephanie Nguyen. FTC Chair Lina Khan said the office will ensure “we have the in-house skills needed to fully grasp evolving technologies and market trends as we continue to tackle unlawful business practices and protect Americans.” The office will support FTC investigations “into business practices and the technologies underlying them,” provide technological expertise on nonenforcement actions and engage with the public and external stakeholders.

EU regulators increase AI oversight

A growing use of artificial intelligence in business applications is leading to increased oversight from European privacy regulators. Data protection authorities in France, Spain and the Netherlands are opening units dedicated to AI oversight and enforcement, while lawmakers are in the process of negotiating the AI Act.

Australian privacy reform moves forward with new government report

The Australian Attorney-General’s Department released its highly anticipated review of the Privacy Act 1988 Thursday, a significant step in the reform of the nation’s privacy law. The Privacy Act Review Report includes 116 recommendations based on 30 “key themes and proposals” from stakeholders during the course of the last two years.

Security / Breaches

‘Old’ vulnerabilities accounted for majority of ransomware activity monitored in 2022

Older IT vulnerabilities are being attributed as a major source of ransomware attacks, according to a joint report produced by four security vendors. The report titled “Ransomware Spotlight Report 2023” is the work of firms Cyber Security Works, Cyware, Ivanti and Securin, which combined their ransomware research work from the year prior. The joint report “focused primarily on the intersection of vulnerabilities and ransomware,” and found the number of exploitable vulnerabilities increased every quarter since 2021. The report found 76% of tracked ransomware vulnerabilities stemmed from 20 “old” flaws discovered between 2010 and 2019.

Canada: Indigo website still offline nearly 1 week after cybersecurity incident

Almost a week after being hit with an apparent cyberattack, book retailer Indigo’s website is still offline, leaving customers with more questions than answers. The TSX-listed bookseller’s website went dark on Wednesday, Feb. 8. Indigo’s brick-and-mortar stores could not process any transactions that were not in cash, leaving anyone who wanted to return or buy an item using debit, credit or gift cards in the lurch. Within hours, the company posted a message on its website, saying it “experienced a cybersecurity incident” and was communicating with customers via its social media channels.

Workplace / Employee Privacy

Nova Scotia OIPC offers guidance for public-sector data snooping

The Nova Scotia Office of the Information and Privacy Commissioner published guidance for public agencies on limiting improper data access by their employees. The IPC noted the amount of sensitive data handled by public bodies and municipalities and how insufficient safeguards “can cause employees to access this information without authorization and without a legitimate work purpose.” The regulator recommended training and policy reminders for proper access, restricted access principles and comprehensive access monitoring. The guidance is based on the work of the OPC and Manitoba OIPC.

Employers using neurotechnology to monitor employees is on the rise

In an interview with The Wall Street Journal, Duke University School of Law professor of law and philosophy Nita Farahany said employers are increasingly using neurotechnology to monitor employees, and privacy law hasn’t kept up. Farahany said much can be learned about a person from their brain data and “we ought to have a special place we think about when it comes to the brain. It is the last space where we truly have privacy.”

+++

4 – 10 February 2022

Access to Information

Toronto police to redact some personal info in publicly released information on missing persons

Police will begin to redact surnames and gender qualifiers from information publicly released on a missing person in Toronto. Toronto Police Service said the new policy is intended to protect a missing person’s privacy while still providing enough information to locate them. Details such as a missing person’s first name and physical and clothing description will remain public. The time and location of a missing person’s last appearance will also continue to be shared. “By posting only the first name, missing persons can still be found, but their full name is not forever associated with the event. 

NZ Privacy boss supports refusal to release names of staff who accessed patient records

A woman who tried contacting health workers via social media has been refused the names of staff who accessed her medical records, because there was a “significant likelihood” she would seriously harass them. The woman asked for the records because she was worried about “employee browsing” – unauthorised access to medical files. The health agency released an access log with only the positions of the employees and the dates they had accessed the woman’s records. The woman then sought a review of the decision to release the log which shows only when records were accessed, but not by whom. The Office of the Privacy Commissioner backed the health agency’s decision and in a preliminary view, concluded it had lawfully refused the request for names.

Biometrics / Identity

European Commission releases digital identity wallet framework

The European Commission released the “European Digital Identity Wallet Architecture and Reference Framework.” The document, part of the EU’s toolbox toward implementing a European Digital Identity Framework, is intended to “provide all the specifications needed to develop an interoperable EUDI Wallet Solution based on common standards and practices” and will be “complemented and updated over time through the process of establishing the toolbox.”

UK Biometrics and Surveillance Commissioner submits damning report as job extended

The UK government has extended Fraser Sampson in his role, beyond his tenure due to end on 28 February. The announcement came minutes after the UK Independent Biometrics and Surveillance Camera Commissioner published the 107-page annual report. Much of its content is based on the changes and uncertainties around surveillance and biometrics. SEE ALSO: Drones, DNA losses and mission creep feature in OBSCC annual report Issues discussed include:

·         improvements in data losses from counter-terrorism databases 

·         increase in police requests to keep biometrics of unconvicted people

·         police losses of DNA through sample handling errors 

·         caps on samples by forensic science providers

·         current trends and the future use biometrics

·         police use of facial recognition and artificial intelligence (AI)

·         demise of the Surveillance Camera Code

·         UK failures in ethical procurement of surveillance equipment

·         lack of regulation and mission creep in use of ANPR, the UK’s largest non-military database

·         use of drones / unmanned aerial vehicles

State lawmakers eye biometric privacy protections, lawsuits

U.S. state lawmakers evoking Big Brother and surveillance dystopias are pushing new requirements for how companies treat peoples’ unique characteristics such as fingerprints and facial scans—potentially expanding litigation risks for businesses that collect such biometric information. Bills in nine states aim to protect biometric information broadly and let individuals sue over violations, such as a company collecting those identifiers without their consent.

Germany: Face-scan recognition to replace passports at Frankfurt airport

Frankfurt airport will introduce fully biometric processing for passengers who choose to use it this year.  The biometric system, based on face scanning, is due to be rolled out from check-in to boarding gates at all Frankfurt airport (Fraport) terminals from this spring.  Passengers will be required to enrol at a kiosk or counter and then proceed through automated security and boarding gates via biometric touchpoints scanning their faces. The technology utilises NEC face-recognition technology and digital-identity management platform integrated with Sita’s ‘Smart Path’ passenger-processing system. The system will be available to all airlines at Fraport wishing to use it.

Children / Education Privacy

Biden puts children’s privacy at the forefront, again

President Biden reiterated his support for broad data privacy protections in his State of the Union address. But it was his call to expand protections for children online that drew the biggest plug — and the loudest ovation. Biden’s comments largely mirrored his last address, in which Biden said it was time to end “the national experiment they’re conducting on our children for profit.” But ahead of the prime-time speech, the White House released a fact sheet making a fresh case for protecting kids online and embracing regulations popularized in the United Kingdom and exported to the United States. 

Consumers

Survey finds majority of U.S. citizens unaware of lack of personal data protections

Americans received a failing grade for general knowledge of data protections on applications, devices and online, according to a survey conducted by the University of Pennsylvania Annenberg School for Communication. The survey of approximately 2,000 U.S. adults found, while citizens generally understood companies track emails and website visits, they did not know about the limited federal protections for their data. Overall, 77% of respondents answered at least nine of the 17 questions incorrectly.

Data Sciences

Proposed California bill would create artificial intelligence office

A bill introduced in the California Legislature would establish an office of artificial intelligence within the Department of Technology. The office would be granted authority to “guide the design, use, and deployment of automated systems by a state agency” to ensure systems are designed and deployed in compliance with state and federal laws and regulations.

Digital Government

B.C. public bodies must report privacy breaches, commissioner says

B.C.’s privacy commissioner says changes to provincial law now mean public bodies must develop privacy management programs and report privacy breaches that could result in serious harm. Michael McEvoy said changes to the provincial Freedom of Information and Protection of Privacy Act (FIPPA) enacted in November 2021, came into force Feb. 1.

B.C. leads Canada in race to protect citizen’s personal information from cybersecurity threats

A dozen Canadian ministers quietly met in Vancouver to brainstorm better online protections for the private information of citizens. The Digital Trust and Cybersecurity symposium on Jan. 25 was attended by representatives from every province and territory, save Alberta, and took place roughly six months after the inaugural meeting in Quebec. According to the statement, a Digital Credential and Trust Program Office has been established to “support cross-jurisdictional implementation teams,” of all sizes. Right now, B.C. is the only province piloting an app that lets users receive, store and present digital credentials. Dubbed the BC Wallet, the pilot program launched last September and is currently being tested by a small number of family duty counsel lawyers through the Law Society of British Columbia. According to the Ministry of Citizens’ Services, work being done on the wallet is open-source and available for other Canadian jurisdictions, should other provinces and territories wish to test the tool themselves.

European Parliament supports regulation of political advertising

The European Parliament supported a proposal for complementary rules to the Digital Services Act and Digital Markets Act targeting online political advertising. Processing sensitive data for advertising practices like microtargeting can harm individuals’ democratic rights. “Traditional rules may be ineffective, as they are often hard to enforce when applied online, where new technologies and tools create opportunities to influence and target voters.”. Negotiators aim to reach agreement on the proposal with EU countries prior to the 2024 European elections.

Massive NZ government database had rules breached more than 100 times

Rules regulating the use of a sprawling Government database containing personal information of about nearly every New Zealand resident have been breached more than 100 times, new data shows. The Integrated Data Infrastructure (IDI) contains information on nearly all New Zealand residents. It links administrative data collected by individual Government agencies through the course of their work – and through surveys such as the Census – into a central repository. It underscores concerns from civil libertarians that the enormous – and growing – data trove is a privacy risk.

Health Privacy

Ontario is ‘all in’ for sharing health data with Ottawa, minister says

Ontario says it fully supports the Trudeau government’s push for improved reporting of national health care data as premiers and territorial leaders head to Ottawa next week seeking a new health funding deal. “We’re all in,” Health Minister Sylvia Jones said Thursday as she recapped the province’s recent health care reforms, including a plan to move more surgeries out of hospitals to independent clinics to ease a pandemic backlog. Ontario is pledging to work with other provinces and territories to help create a national system of health care data that will better measure how well the system performs in response to billions of dollars invested in it.

N.S. Privacy commissioner calls for changes at N.S. Health after staff found ‘snooping’

The province’s information and privacy commissioner is calling on Nova Scotia Health to improve its privacy practices after investigating intentional breaches by some of its employees. In a new report, Tricia Ralph said steps are needed to prevent staff from accessing the personal information of patients for non-treatment purposes, referred to as “snooping.”

U.S. senators press telehealth companies on data sharing practices

U.S. senators wrote a letter to several telehealth companies criticizing their reported failure “to protect sensitive health information,” Stat reports. U.S. Sens. Maria Cantwell, D-Wash., Amy Klobuchar, D-Minn., Susan Collins, R-Maine, and Cynthia Lummis, R-Wyo., recently wrote to Monument, Workit Health and Cerebral to inquire about their data sharing practices. The letter was prompted by a joint investigation by Stat and The Markup into 50 consumer telehealth companies’ data sharing, focused on types of user data shared via embedded trackers for targeted advertising.

Law Enforcement / Intelligence

Lawmakers raise privacy concerns over surveillance program

The renewal of portions of the Foreign Intelligence Surveillance Act set to expire at the end of 2023 is facing challenges as lawmakers say the program intrudes on Americans’ privacy. U.S. Director of National Intelligence Avril Haines said the program is “absolutely critical” to national security, while privacy advocates have raised concerns, including over access it grants the FBI to Americans’ digital data.

Public data on suspended police officers varies in Ontario. Experts say that needs to change

Police service across Ontario provide varying levels of detail when it comes to suspended officers. This inconsistency has privacy experts, police researchers and a former police sergeant saying the public should be able to get more information in Ontario, the only province or territory in Canada where suspended police officers get paid. Ann Cavoukian, former Ontario privacy commissioner, believes the public should know all information about suspended officers — except for their names.

Mobile / Location

Study claims China’s biggest Android phones are loaded with spyware

Some of the most popular Android phones in the world are made in China, but you might want to think twice before buying one. According to a study by researchers at the University of Edinburgh and Trinity College Dublin, these phones frequently collect a wide range of personally identifiable information without the user’s consent. Most frighteningly, this spyware is running out of the box when consumers in China buy new Android phones.

Online Privacy / Surveillance

Home Depot gets nailed by OPC for sharing data with Meta

Recent findings by the OPC found that Home Depot of Canada did not obtain valid meaningful consent to share summary purchase information with Meta Platforms Inc. [Commissioner’s statement, OPC press release & report PIPEDA Findings # 2023-001] in order to measure the effectiveness of Facebook ads, as well as for Meta’s own purposes. The findings also suggest that Home Depot did not obtain sufficient consent to use customer information for its own marketing and analytics purposes. The findings potentially raise troubling questions about the form of consent and the granularity of the consent disclosures that are required under the federal privacy law for the use of even non-sensitive personal information for marketing and analytics purposes. See also: Privacy Commissioner decision provides guidance for targeted online marketing and First OPC Ruling for 2023 Will Impact Third-Party Processor Contracts

Microsoft adds AI to search engine, web browser

Microsoft unveiled a new Bing search engine and Edge web browser that offer artificial intelligence chatbots. The new Bing version was released to a limited number of users and will expand to millions by the end of the month. “This technology will reshape pretty much every software category that we know,” Microsoft CEO Satya Nadella said.

Is TikTok a risk to Canadian privacy? A federal committee wants to find out

A House of Commons committee voted to launch a study into TikTok, a popular social media app that’s come under scrutiny over its ties to the Chinese government, as well as other social media platforms. The Liberal motion, which MP Iqra Khalid brought forward, was carried during a House of Commons ethics committee meeting— but only after an amendment was added. The original motion called on the committee to focus solely on TikTok and its parent company, ByteDance Ltd., but NDP MP Matthew Green proposed an amendment to broaden that scope to include all social media platforms. The amended motion, which was carried with unanimous support from all parties, calls on the members to dig into TikTok and other social media platforms’ involvement or use “of private information of Canadians for the objective of data harvesting.” It would also look at “illicit sharing of personal information with foreign entities” and whether the “private information of Canadians is adequately protected and stored.”

Hudson’s Bay, Gap, PetSmart among stores that gave customer data to Facebook’s owner

When a shopper shares their email address at the cash register — to receive an electronic receipt, rather than a paper one — do they really know where their details are being sent? A CBC News review of Facebook user data suggests a variety of well-known retailers in Canada have been sharing customer information with the social media platform’s parent company to gain marketing research in return. And it’s not clear what steps have been taken to warn shoppers. This is “a wake-up call,” said Wendy Wong, a political science professor at UBC Okanagan who studies emerging technologies. “These revelations are showing the extent to which the public does not know how much of our activities are trackable.”

Online privacy threat: Pixel tracking found on hospital websites sharing private info

An investigation by The Markup found pixel tracking tools on 33 of 100 hospitals it surveyed. The metal pixel sharing with facebook. Class action lawsuits like this one against WakeMed in North Carolina contend “a tracking tool installed on many hospitals’ websites has been collecting patients’ highly sensitive personal identifiable information…” and that violates HIPPA standards. Pixels allow information to be gathered about website visitors like where you are, pages you click on, and browsing habits which are then sent to third parties for advertising.

Regulators

FTC seeks first-ever health breach notification rule enforcement: Pixel users beware

For the first time, the FTC is seeking enforcement under the Health Breach Notification Rule, which requires certain businesses not covered by the Health Insurance Portability and Accountability Act to notify their customers and others if there is a breach of unsecured, individually identifiable electronic health information. Direct-to-consumer healthcare apps and product companies should carefully review privacy practices and evaluate whether online or public privacy notices accurately reflect current data sharing practices by the company, as well as update privacy notices to reflect the actual practices of the company so the company is not doing anything with data that has not been disclosed to consumers. See also: FTC Brings First Enforcement Action of the Health Breach Notification Rule

Quebec DPA testifies before National Assembly with recommendations to improve Bill 3

Officials from Quebec’s data protection authority, the Commission d’acces a L’information du Quebec, presented a brief on Bill 3 to the National Assembly. As proposed, Bill 3 “creates a unified framework for the protection of citizens’ health and social services information with the objective of improving the quality of services to citizens and the management of the health and social services system.” Officials outlined 21 recommendations to improve the protection of personal information requirements in the legislation, including better defining permitted uses of health information and removing the ability for entities to retain deidentified information.

Garante bans AI chatbot from processing Italians’ personal data

Italy’s data protection authority, the Garante, banned U.S.-based artificial intelligence chatbot company Replika from processing the personal data of Italian users. The Garante said the application “presents concrete risks for minors,” “does not respect the principle of transparency” and “carries out an unlawful processing of personal data.” The authority gave the company 20 days to follow its order or face a fine of up to 20 million euros or 4% of annual global turnover.

OPC probes use of Emergencies Act to freeze bank accounts of COVID-19 lockdown protestors

The OPC is investigating the federal government invoking the Emergencies Act to compel banks to provide security services with the financial information of COVID-19 lockdown protestors last year. During the protest, truck drivers participating in the so-called “Freedom Convoy” had their bank accounts frozen without a court order. Also, per the government’s emergency order, protestors had their bank information given to the RCMP, CSIS and the FINTRAC.

Chatbot AI creator welcomes regulations

ChatGPT creator OpenAI’s Chief Technology Officer Mira Murati welcomed regulation of AI chatbot technologies. “It’s important for OpenAI and companies like ours to bring this into the public consciousness in a way that’s controlled and responsible,” Murati said.

Consumer Watchdog Reports: CA Privacy Board OKs Landmark Personal Data Regulations

After nearly a year of rulemaking and over 1,000 pages of public comments later, the U.S.’s first dedicated data privacy agency approved regulations aimed at giving consumers unprecedented control over their private data. The California Privacy Protection Agency (CPPA) unanimously voted Feb. 3 to send its first rulemaking package to the Office of Administrative Law (OAL) for final approval. The board will submit the package within two weeks and OAL has 45 days to approve it. That means regulations for the amended California Consumer Privacy Act (CCPA) will be on the books in April. Following the deletion of some pro-consumer regulations, no further changes were made to the law after 450 pages of public comment.

Security / Breaches

Nova Scotia privacy commissioner finds 1,200 breaches of patient medical records

Nova Scotia Privacy Commissioner Tricia Ralph demanded Nova Scotia Health improve its privacy standards after staff allegedly accessed patients’ medical information “for non-treatment purposes.” Ralph’s investigation began after the provincial health authority self-reported catching multiple employees examining health records of individuals associated with the shooting incident in the province in 2020. In total, the Office of the Privacy Commissioner’s investigation into Nova Scotia Health found there were more than 1,200 privacy breaches that impacted 270 patients.

GAO Report: Cyberattacks Increase on K-12 Schools

In recent years, cyberattacks on K-12 schools have increased. GAO’s new report estimates the loss of learning following a cyberattack ranged from 3 days to 3 eeks, and recovery time could take anywhere from 2 to 9 months. The financial impacts on schools can be broad. With monetary losses to school districts ranging from $50,000 to $1 million due to expenses caused by a cyber incident. These costs included, for example, replacement of computer hardware and enhancing cybersecurity to prevent future attacks. Cyberattacks can also result in the disclosure and theft of students’ and school employees’ (like teachers’) personal information. Schools and school districts collect and store a lot of personal information about students and employees. In a 2020 report, GAO found that information compromised as the result of a data breach included things like students’ grades, bullying reports, and social security numbers—leaving students vulnerable to emotional, physical and financial harm. See also Importance Of Cybersecurity In The Education Sector In 2022-2023 and Why Are Schools a Target for Cyberattacks? And Why are Canadian schools so vulnerable to cyberattacks?

The Netherlands’ centralized digital biometric database plot is criticized as “goldmine for hackers”

The Dutch Data Protection Authority said that the government’s plan to create a centralized database for all the personal data people provide when applying for passports, including photos, fingerprints, and signatures, would create a “goldmine for hackers.” [DDPA press notice] Currently, the data is stored at the municipality where someone is applying for the passport. However, the government wants to amend the Passport Act to create a central national database. The fingerprints would be stored until the issuance of the passport, but the photos and signatures would be stored for longer.

Over 12% of analyzed online stores expose private data, backups

Many online stores are exposing private backups in public folders, including internal account passwords, which can be leveraged to take over the e-commerce sites and extort owners. According to a study by website security company Sansec, roughly 12% of online stores forget their backups in public folders due to human error or negligence. The study examined 2,037 stores of various sizes and found that 250 (12.3%) exposed ZIP, SQL, and TAR archives on public web folders that can be freely accessed without requiring authentication. The archives appear to be backups containing database passwords, secret administrator URLs, internal API keys, and customer PII (personally identifiable information). In the same report, Sansec explains that its analysts observe constant activity from attackers who launch automated scans trying to pinpoint these backups and perform breaches.

Workplace / Employee Privacy

Time theft and employer privacy considerations

A decision issued by B.C.’s Civil Resolution Tribunal (CRT) has attracted significant media attention, largely because of the unusual outcome of an employee having to pay an employer damages for time theft after the employee challenged their dismissal for cause. [Besse v. Reach CPA Inc., 2023 BCCRT 27] It has also raised concerns around the use of employee monitoring software, as the employer relied heavily on information gathered by a time-tracking program, called TimeCamp, that had been installed on the employee’s work laptop. See also: ‘Unique’ ruling of employee time theft another ‘arrow in arsenal’ for employer counsel: lawyer

U.S. senators introduce bill to protect employees from surveillance

U.S. Sens. Bob Casey, D-Pa., Cory Booker, D-N.J., and Brian Schatz, D-Hawaii, introduced the Stop Spying Bosses Act to protect employees against “invasive and exploitative surveillance technologies.” The legislation would create “standards, protections, and oversight to counter exploitative technologies that are spreading unchecked,” and would create a new Privacy and Technology Division at the Department of Labor to “enforce and regulate workplace surveillance including novel and emerging technologies.”

Study: When employees don’t have to commute, they work

A new report by the National Bureau of Economic Research shows the majority of time saved by working from home and avoiding office commutes goes toward increased productivity. On average, employees save 72 minutes in commute time every day when they’re allowed to work from home rather than in the office, according to the Global Survey of Working Arrangements (G-SWA) study. On average, those who work from home devote 40% of their commute time savings to primary and secondary job tasks, 34% to leisure, and 11% to caregiving.

Misuse of private information: Employer’s use of unlawfully obtained private Whatsapp messages

An ex-employee who had been dismissed brought a claim of sexual harassment against her employers and their managing partner. Much of the evidence on which the employers relied in the employment tribunal consisted of the ex – employee’s own WhatsApp messages: 18,000 messages were included in the tribunal bundles. These messages (which had been obtained by the employers after her dismissal but before the employment tribunal claim had been issued) were between the ex-employee and her partner, and between her and her best friend. The messages went back several years, and included day to day information about her professional, social and private life, including her health and sex life and messages and images which the court later described as being “of the most intimate kind”. The employers claimed that some of the messages had been obtained by accessing the ex-employee’s work laptop after she had been dismissed. They also claimed to have received other messages from an anonymous source. The ex-employee said that this was untrue and that the employers had hacked her WhatsApp account. The ex-employee did not seek to exclude the messages from the evidence in the tribunal. Some of the messages undermined the ex-employee’s credibility and demonstrated that the harassment of which she had complained either did not happen or was consensual. Relying on this evidence, the employers successfully defended the tribunal claims. However, the ex-employee then brought High Court proceedings for misuse of her private information.

+++

28 Jan – 03 Feb 2023

Access to Information

B.C. saw 80% drop in access-to-information requests from media outlets after bringing in fee

According to a report from BC OIPC Michael McEvoy, the provincial government saw an 80% drop in right to access requests by media companies after a $10 fee per request was implemented. He advocated for eliminating the fee, as British Columbia’s fees were third highest in Canada’s 14 provincial and territorial jurisdictions. McEvoy recommended increasing transparency for public bodies charging for access to records because the $10 fee is on top of their existing authority to charge fees for processing requests.

Biometrics / Identity

U.S. senator proposes sanctions over Madison Square Garden facial recognition

State Sen. Brad Hoylman-Sigal, D-N.Y., called on professional sports leagues to reprimand Madison Square Garden owner James Dolan over the arena’s use of facial recognition on patrons. Hoylman-Sigal sent letters to the NBA and the NHL to bring attention to the “concerning trend” of facial recognition at sporting venues and asked for sanctions against Dolan if MSG does not “immediately cease profiling fans with facial recognition technology for non-security purposes.”

UK government publishes results of digital identity consultation

The UK government has published the results of its consultation into digital identities. It includes plans to establish an interim governance function within DCMS, called the Office for Digital Identities and Attributes (OfDIA). The UK digital identity and attributes trust framework, alongside legislative proposals, will lay the groundwork for the increased acceptance of digital identities across the UK. The government said it will seek to introduce legislation that will “enable a robust accreditation and certification process.” This will allow organisations to prove their adherence to the rules of the trust framework.

ICO raises concerns over facial recognition use in school canteens

The U.K. Information Commissioner’s Office issued a letter to the North Ayrshire Council with concerns the use of facial recognition technology in nine school canteens may have violated the U.K. General Data Protection Regulation. “New technologies such as FRT can offer benefits and efficiencies, but their use is not without risk from a data protection point of view. That risk is heightened where children’s data is being processed,” the ICO said, recommending the NAC make improvements around data minimization and data accuracy.

Children / Education Privacy

Proposed US legislation bans children from social media platforms

U.S. Rep. Chris Stewart, R-Utah, introduced legislation barring children under age 16 from accessing social media platforms and requiring companies to verify user ages for compliance. The bill would also let parents sue platforms for allowing underage users to access services. Stewart compared the negative mental health impacts of social media to substance abuse, and said, “We protect our children from drinking, from smoking, from driving. They can’t drive when they’re 12. We should protect them from the impacts of social media.”

Consumers

Google’s Fledge gains popularity among advertisers

Fledge, a Google cookie replacement retargeting solution is gaining supporters after being introduced for testing in the advertising technology industry. Fledge, an acronym for “first locally executed decision groups experiment,” was considered by testers to be “a more viable cookie replacement than other solutions on the market because it mimics the existing processes of digital advertising while cutting out any identifier that could link people with their browsing history.”

Data Sciences

EU, US announce AI research pact

The EU and U.S. governments signed an administrative arrangement to facilitate collaborative research on artificial intelligence. The agreement is part the EU-U.S. joint AI roadmap devised during the third EU-U.S. Trade and Technology Council meeting in December 2022. A U.S. National Security Advisor said the arrangement “will drive responsible advancements in AI to address major global challenges,” while European Commissioner for the Internal Market said EU and U.S. researchers “will join forces to develop societal applications of AI and will work with other international partners for a truly global impact.” See also: “Exploring technology, concerns around AI“

European Parliament to discuss proposed AI Act’s high-risk classification

Members of European Parliament plan to debate the proposed Artificial Intelligence Act’s classification criteria for high-risk AI deployments. AI Act co-rapporteurs prepared a potential compromise text ahead of discussions aimed at making clear distinctions between actual or potential risks. The MEPs’ meeting will also include adoption of prior compromise texts on requirements for high-risk AI systems and innovation measures.

Digital Government

UK government to use “cutting edge” data and AI to ‘hunt down’ fraudsters

The Cabinet Office has awarded data analytics firm Quantexa a new contract to help the government recover public sector debt. The Public Sector Fraud Authority (PFSA), which was set up last year to help public bodies tackle fraud against the public purse, will work with Quantexa to use new data and cutting-edge technology, including Artificial Intelligence, to find and prevent more fraud across the public sector. Quantexa said its technology is capable of processing billions of data points at high speed to identify suspicious activity.

European Parliament considers regulations preventing election interference

European Parliament’s Internal Market and Consumer Protection Committee may tighten political advertising regulations to reduce election interference and improve transparency. An IMCO proposal allows advertisers to only use personal data expressly given to them for political advertising purposes. This would ban “microtargeting” voters “on the basis of their gender, race, sexual orientation, or other individual characteristics,” as well as the use of children’s data entirely. Rules to make the financial backers of candidates more transparent are also included in the proposal.

The Netherlands’ DPA says central passport database ‘entails major privacy risks’

The Netherlands’ data protection authority (AP) said a proposal to create a central database containing passport application data “entails major privacy risks.” In a letter to State Secretary of the Interior and Kingdom Relations, the AP calls for the proposed amendment to the Passport Act, creating the centralized database, to be “thoroughly amended or otherwise withdrawn.” It called maintaining passport photos, signatures and fingerprints of Dutch people in one location “a gold mine for cybercriminals.”

CNIL: 2023 ‘will be key’ for digital euro project

France’s data protection authority (CNIL) said “the year 2023 will be key” for the European Central Bank’s plan to develop a digital euro and called for “broad public and democratic debate” on the topic. The CNIL said the European Data Protection Board recommended the digital currency include privacy and data protection by design principles and be designed like cash. The CNIL and EDPB said they “intend to confirm their intention to remain in this debate” to combat potential risks.

Health Privacy

OCR announces $1.25M HIPAA Security Rule settlement

The U.S. Health and Human Services Office for Civil Rights (OCR) reached a $1.25 million settlement with an Arizona-based health care provider over alleged violations of the Health Insurance Portability and Accountability Act Security Rule. The settlement resolves 2016 claims related to a hack and subsequent data breach that affected the protected health information of 2.81 million individuals. The settlement also includes two years of monitoring and corrective measures for risk analysis and management.

FTC proposes $1.5M fine for violation of Health Breach Notification Rule

In its first enforcement action under the Health Breach Notification Rule, the U.S. FTC prohibited GoodRx Holdings from sharing user health data with third parties for advertising purposes. The FTC said the telehealth and prescription drug discount provider failed to notify consumers about unauthorized disclosures of sensitive health data with advertising companies and social media platforms, as required under the rule. Under the proposed order, GoodRx will pay $1.5 million in civil penalties.

Law Enforcement / Intelligence

EDPS: Privacy, data protection ‘too often suspended’ at EU borders

In an op-ed, European Data Protection Supervisor Wojciech Wiewiórowski said privacy and data protection are among human rights “too often suspended at the borders of the European Union.” He said “they are rights, which marginalised individuals, stateless families, and migrant communities too often see discarded — a fleeting promise of fundamental protection to which they have not become privy, even though the Charter of Fundamental Rights is not limited only to those holding EU citizenship.”

UK tribunal finds MI5 agents ‘unlawfully’ collected data

The U.K. Investigatory Powers Tribunal found MI5 agents “unlawfully retained people’s intercepted data,” from 2014-2019. A presiding judge said the Home Office “failed to make ‘adequate inquiries’” when it approved surveillance warrants from 2016-2019. The surveillance practice was reportedly authorized under the Investigatory Powers Act, which critics claim gives security services too much power to collect the data of innocent people.

Mobile / Location

California attorney general conducts CCPA compliance sweep

California Attorney General Rob Bonta announced California Consumer Privacy Act noncompliance letters were sent to various mobile application providers as part of a recent investigative sweep. The attorney general’s office alerted “popular apps in the retail, travel, and food service industries” to alleged CCPA violations related to user opt-out requests, a lack of clear opt-out mechanisms and failure to process consumer requests submitted via an authorized agent. Bonta said his office “is working tirelessly” to bring opt-out practices into compliance, noting the focus on mobile apps was due to the “wide array of sensitive information that these apps can access.”

Online Privacy / Surveillance

OPC’s Home Depot findings bring class-action lawsuit

A Saskatchewan-based attorney filed a class-action lawsuit against Home Depot related to alleged privacy violations discovered by the OPC. An OPC investigation found the retailer improperly shared customer data with Meta’s Facebook through digital receipts without proper consent from consumers. The lawsuit accuses Home Depot of “selling the information” and having it repurposed by other companies for targeted advertising, adding “our legislatures have said you just can’t do that.”

European Commission study indicates ‘a strong case’ for digital advertising reform

A study released by the European Commission on the impact of developments in digital advertising highlights “a strong case to reform digital advertising” as the “status quo is unsustainable for individuals, publishers and advertisers.” The study points to a “need to improve transparency and accountability, increase individuals’ control over how their personal data is used for digital advertising and address a number of obstacles that make it harder for advertisers and publishers to ‘know their audience.’“

European Commission publishes guidelines for Digital Services Act user reporting

The European Commission released guidance to assist companies in complying with the Digital Services Act’s user reporting requirements. The reporting will help determine whether increased DSA obligations for “very large” online platforms and search engines are to be applied. Under the law, additional obligations are triggered for companies that “show that they reach more than 10% of the EU’s population.” Companies are required to report initial user numbers by Feb. 17 and offer updates at least once every six months thereafter.

Regulators

British Columbia’s privacy management, breach reporting requirements take effect

The OIPC BC announced new requirements for privacy management programs and data breach reporting under the Freedom of Information and Protection of Privacy Act that entered into force Feb. 1. Covered entities are required to designate “someone responsible for privacy-related matters and the development, implementation and maintenance of privacy policies” and develop processes for privacy impact assessments and complaints. Breach reporting is required for incidents “expected to result in significant harm,” as laid out in updated OIPC breach guidance.

EDPB releases WhatsApp decision

The European Data Protection Board published its binding decision in the Irish Data Protection Commission’s case against WhatsApp over violations of the EU General Data Protection Regulation concerning transparency and user consent. The decision comes after the DPC fined WhatsApp 5.5 million euros while refusing additional orders from the EDPB and proposing a claim against the board to the Court of Justice of the European Union.

European Commission commits to strengthening EU GDPR enforcement

The European Commission will launch a new enforcement review plan to ensure adequate application of the EU General Data Protection Regulation. In response to GDPR enforcement questions by the European Ombudsman, the commission will require national data protection authorities to file “an overview of large-scale cross-border investigations under the GDPR” every two months

CNIL releases report on sanctions, corrective measures

France’s data protection authority (CNIL) released a report on sanctions and corrective measures taken in 2022. The CNIL said a record 147 formal notices and 21 sanctions were adopted and fines exceeded 100 million euros. Penalty decisions and formal notices concerned various sectors and issues, including 22 decisions against municipalities that failed to appoint data protection officers. The CNIL said it is “continuing the substantial increase in the number of formal notices adopted, which began in 2021.”

OPC testifies on privacy in emergency declarations

Privacy Commissioner of Canada Philippe Dufresne wrote to the House of Commons Special Joint Committee on the Declaration of Emergency regarding privacy principles in instances of state of emergency declarations. Dufresne said public entities “must continue to operate under lawful authority and act responsibly, particularly with respect to handling information that may be considered sensitive.” He listed a range of measures that should be maintained in these instances, including purpose limitation, deidentification practices and strict data retention limits.

CPPA releases proposed CPRA final regulations

The California Privacy Protection Agency Board published agenda items for its Feb. 3 meeting, including the final draft of its proposed California Privacy Rights Act regulations. The board announced discussion and possible action to finalize CPRA regulations in its meeting notice preceding the release of meeting materials. Finalization during the meeting would trigger a 30-day review from the California Office of Administrative Law. The board also published its next set of preliminary rulemaking questions for consideration.

Research / Standardization

CNIL to add AI division, begin work on machine learning

France’s data protection authority (CNIL) announced plans to launch a department dedicated to artificial intelligence. The five-person team will guide the CNIL’s understanding of AI matters, including AI system functions, associated privacy risks and preparations for the proposed EU AI Act. The regulator also announced a study of machine-learning databases focused on producing practical resources for handling and use.

Security / Breaches

January sees huge spike in cyberattacks

January saw a massive surge in cybersecurity incidents. In its monthly analysis of the latest data breaches and cyberattacks across the world, IT Governance identified 104 publicly disclosed security incidents in January – which accounted for 277,618,767 compromised records. This is a 779% increase compared to December 2022.

IAPP releases NIS2 Directive chart

As part of its multipart series on EU data strategy, the IAPP Resource Center published an informational chart on the NIS2 Directive, exploring the directive’s measures for a high common level of cybersecurity across the EU. The infographic includes key changes, challenges and requirements of the NIS2 directive’s measures, as well as information on enforcement and penalties and important upcoming dates.

+++

20-27 January 2023

Access to Information

European Council, Parliament reach agreement on access to e-evidence

The Council of the European Union and European Parliament reached agreement on the draft regulation and directive on cross-border access to electronic evidence. The regulation enables judicial authorities to obtain or preserve e-evidence regardless of the data’s location.

Biometrics / Identity

EDRI publishes technical and legal guide to remote biometric identification

European Digital Rights (EDRi) has published a technical and legal guide to remote biometric identification (RBI) in Europe in an effort to raise awareness about automated mass surveillance systems in publicly-accessible places used by police, public authorities or companies. SEE ALSO: Reclaim Your Face campaign, and South Korea privacy watchdog warns against public facial recognition deployments

2022 Annual Data Breach Report – ITRC reports near-record number of breaches

The Identity Theft Resource Center (ITRC) has released its 17th Annual Data Breach Report, which explores fundamental shifts in the root causes of identity-related crimes. While 2021 represented an all-time high for data compromises reported in the U.S., 2022 represents a rare plateau for data events after years of steady increases in the number of reported compromises. Some highlights in the report:

·         The number of victims impacted (422.1 million) increased by almost 41.5% from 2021.

·         Data breach notices suddenly lacked details, resulting in increased risk for individuals and businesses, as well as uncertainty about the number of data breaches and victims

·         Cyberattacks remain the primary source of data breaches; the number of data breaches resulting from supply chain attacks exceeded compromises linked to malware in 2022.

California to roll out digital driving licenses that users can store on their mobile phone

The US state of California is planning to launch a digital driving license that users will be able to store in a digital wallet on their smartphone, the state governor Gavin Newsom has revealed. Newsom said that the service would begin rolling out “in just a matter of months” as part of the state’s ongoing project to implement a digital ID system. Some 30 US states have launched, begun piloting or are conducting research into the issuance of a digital driving licence, according to the US-based Secure Technology Alliance (STA).

Home Office-backed supermarket trials of face-scanning cameras deemed a ‘great success’ by AI firms

AI firms have deemed Home Office-backed trials of “age estimation technology” at retailers, including Tesco and Asda, to control alcohol sales a success. Four UK supermarket chains – Tesco, Asda, Morrisons and Co-Op – piloted age verification technology from “digital identity” company Yoti at a handful of stores, while three Bestway cash and carrys tested a “biometric solution” from another firm, Innovative Technology. Yoti uses an AI algorithm to estimate a customer’s age from a facial scan at the self-service checkout.

Collection of voice data for profit raises privacy fears

A customer-service center uses artificial intelligence to identify a caller’s agitation, an insurance company scans voice data to flag illness and raise rates, a five-star restaurant denies a reservation over personal details revealed by the tone on the other end of the line. Far from science fiction, such scenarios have leapt into the realm of possibility, said Joseph Turow, a professor at University of Pennsylvania’s Annenberg School for Communication and author of “The Voice Catchers: How Marketers Listen In to Exploit Your Emotions, Your Privacy and Your Wallet.” The rise of voice-assisted products in homes and workplaces has driven a wave of private sector innovation. But voice data collection also fuels targeted marketing based on personal information gleaned from recordings and risks data breaches that could place one’s voice in the hands of cyber criminals aiming to imitate it, they added. “This has become a real issue as more and more people are using voice-activated devices like Alexa and Siri,” Marc Rotenberg, founder and executive director for the nonprofit Center for AI and Digital Policy. “There’s a ticking time bomb with the collection of voice recordings.” “These companies gather voice recordings to improve a service,” Rotenberg added. “But their retention of these voice recordings is a real concern for privacy.”

Consortium to test digital driving licenses and medical prescriptions as part of EU’s European Digital Identity Wallet pilot

An international consortium of 148 public and private sector organizations from 19 European Union member states and Ukraine is to develop and test digital identity prototypes across six use cases including digital driving licenses and medical prescriptions as part of the EU’s large-scale European Digital Identity Wallet pilot programme. The Potential Consortium will carry out cross-border tests on the use of digital identity instruments compatible with the proposed wallet in areas such as banking, mobility, healthcare and administration. It will also develop prototypes that can be used as a qualified electronic signature and to access electronic government services, open accounts and register SIM cards.

The global identity verification market size is projected to grow 14.4% each year through 2027

The global Identity Verification Market is projected to grow from $9.5 billion in 2022 to $18.6 billion by 2027, at a compound annual growth rate (CAGR) of 14.4% during the forecast period. Factors driving the market growth include increasing identity thefts and growing risks of fraudster access, stringent government regulations and mandates concerning privacy, and a rise in digitalization initiatives. By type, the biometrics segment to hold a larger market size during the forecast period.

Children / Education Privacy

Indian education app exposed student and teacher data

The personal information of students and teachers in India was exposed on the Internet for more than a year. The Digital Infrastructure for Knowledge Sharing (Diksha) app stored the data on an unprotected Azure cloud server. Diksha has made data privacy news before: last year, a report from Human Rights Watch found that the app was tracking students’ location and sharing that information with Google.

Virtual exam case primes privacy fight over college room scans

A legal dispute over a university’s use of exam proctoring software that allegedly scanned students’ rooms is set to shape the scope of Fourth Amendment and privacy protections for online college tests. Cleveland State University has asked a federal appeals court in Cincinnati to review a district court finding that the “room scans” were unconstitutional searches. The case could influence how other students litigate their privacy rights and change how universities virtually monitor their students during exams, attorneys said.

Consumers

7 in 10 Canadians worried about protecting their online privacy: survey

A new survey from Interact reveals that the majority of Canadians are worried about their online privacy and the limitation they have controlling their personal information online. The survey found that 76% of Canadians having concern when it comes to protecting their online privacy while 74% prefer to have more control over their online information. Organizations giving customers more control over their personal information is seen as a is a critical opportunity to build trust, as 53% of customers say the companies responsible for protecting their personal information and 69% believe they should protect their online privacy. When it comes to social media, 58% of Canadians use their social media account to log in to other online services while only 11% of them trust these accounts.

Data Sciences

US NIST publishes AI Risk Management Framework 1.0

The U.S. took a big step in the development of a national artificial intelligence strategy with the release of the Artificial Intelligence Risk Management Framework 1.0, on Jan. 26. Required under the National AI Act of 2020, the framework is the product of 15 months of work by NIST scientists who compiled public comments from more than 240 AI stakeholders through multiple listening sessions and workshops. The framework is voluntary but will help organizations deploying AI systems to enhance their trustworthiness and reduce biases, while protecting individuals’ privacy. Along with the framework document, the NIST also released the AI RMF Playbook, which is expected to be updated every six months as best practices for navigating the framework develop.

ICO calls for increased privacy considerations for emerging technologies

The U.K. Information Commissioner’s Office published a notice calling for more incorporation of privacy principles as companies build new technologies. The ICO’s stance is reflected in its Tech Horizons Report, which warns benefits of emerging tech over the next two to five years “could be lost if people feel companies are misusing their data.” The report covers Internet of Things devices as well as tech in the health and finance spaces.

IAPP publishes privacy and AI governance report

IAPP has published a new report exploring the state of AI governance in organizations and its overlap with privacy management. Researchers focused on companies’ change in processes when striving to use AI according to responsible AI principles such as privacy, accountability, robustness, security, explainability, fairness and human oversight. The scope of the study is limited to interviews with stakeholders in organizations from across six industries in North America, Europe and Asia: technology, life sciences, telecommunication, banking, staffing and retail. In each interview researchers focused on five areas: governance, risk, processes, tools and skills. They identified where the organization stood with implementing responsible AI governance, processes, and tools and how they aligned or planned to coordinate those emerging functions and policies with existing privacy processes.

ChatGPT passed a Wharton MBA exam, and academics are taking note

While researching the capabilities of OpenAI’s artificial intelligence-enhanced text generator, a professor at the University of Pennsylvania’s Wharton School found that the company’s GPT-3 chatbot was able to pass a final exam for the school’s MBA program with a score between a B- and B. The score is proof of the bot’s “remarkable ability to automate some of the skills of highly compensated knowledge workers in general and specifically the knowledge workers in the jobs held by MBA graduates including analysts, managers, and consultants.” The professor noted that GPT-3 did an “amazing job at basic operations management and process analysis questions including those that are based on case studies.” It was also “remarkably good at modifying its answers in response to human hints,” he concluded.

Digital Government

HMRC seeks complete ‘digital fingerprint’ of online interactions to help fight fraud

The UK HM Revenue and Customs (HMRC) is planning to implement technology that would enable the department to capture a comprehensive “digital fingerprint” of users of its online services – including contact information, IP addresses, and details of devices used. Gathering and monitoring this data would help combat fraud and cyber risks, according to commercial documents recently published by the department seeking feedback from potential supplier partners.

Federal agencies do not implement majority of GAO’s cybersecurity recommendations

According to a new report from the US Government Accountability Office (GAO), US federal agencies have implemented just 40% of the 335 cybersecurity recommendations made by GAO since 2010. The report, Cybersecurity High-Risk Series: Challenges in Establishing a Comprehensive Cybersecurity Strategy and Performing Effective Oversight, is the first of four planned reports examining the government’s development and implementation of cybersecurity policy.

Cyber, data and digital identity at forefront of 2023 public sector digital trends

Socitm’s sixth annual report, digital trends for the public sector in 2023, focuses on the digital trends expected to make a significant impact on local public services and their outcomes in 2023 and beyond. Despite the pressures and the uncertainty, Socitm noted there is much optimism found amongst public service digital leaders, especially about the potential benefits of digital innovation in service design, collaboration, digital inclusion and automation.

Health Privacy

Provision in US spending bill requires security-conscious medical equipment

Health care device manufacturers may see tighter regulations to close security risks for premarket equipment designs. New regulations within the $1.7 billion U.S. government’s omnibus spending package would establish requirements for medical device security, most which are part of the Protecting and Transforming Cyber Healthcare already backed by health care stakeholders. A major element of the omnibus package is $5 million earmarked for the U.S. Food and Drug Administration to enforce the requirement that all new medical devices developed “are designed with security in mind.”

EU member states move toward agreement on secondary use of health data

The Council of the European Union is drawing closer to a consensus position on the proposed European Health Data Space. The council’s Working Party on Public Health agreed on amendments to the European Commission’s proposed provisions regarding secondary use of data, including withholding data for the purposes of public security and national security. Member states also proposed a new criteria for health data access entities to allow or limit access to health data.

Report: Online pharmacies share sensitive data with third parties

Some online pharmacies selling abortion pills are using tracking technology that shares sensitive data with third parties, which could potentially lead to prosecution from law enforcement. ProPublica researchers said it found web trackers, including a Google Analytics tool, on at least nine of 11 sites selling the pills. Data shared through the trackers include web addresses visited, items clicked on, search terms, and location and device information, as well as a unique identifier linked to a user’s browser.

St. Joe’s to go ‘fully paperless’ after misdirected faxes, privacy breaches

St. Joseph’s Healthcare Hamilton says it’s working to become a “fully paperless organization” in the wake of a review by the IPC that found misdirected faxes to be the driver behind hundreds of recent privacy breaches at the hospital. The IPC in its report said St. Joe’s initially reported more than 1,000 unauthorized disclosures of personal health information in 2020, with a vast majority — 981 — coming from misdirected faxes. But a months-long review later found that initial number to be greatly inflated because of an outdated tool the hospital used to identify misdirected faxed, the IPC said.

Whistleblowers allege U of T data project collected 600K patient records without consent

The Ontario IPC is investigating a sweeping data project at the University of Toronto that is alleged to have collected over 600,000 electronic medical records without patient consent or knowledge. Filed last summer by a group of concerned doctors in the GTA, a privacy complaint alleges the University of Toronto Practice-Based Research Network, a decade-old project known by the futuristic acronym UTOPIAN, has collected full electronic medical records (EMRs) from over 1,400 family physicians as part of a “massive data grab.”

Law Enforcement / Intelligence

FBI No-fly list with 1.5 million entries found online

A bored hacktivist browsing an unsecured airline server stumbled upon national security secrets including the FBI’s ‘no-fly’ list. She says what she found reveals a ‘perverse outgrowth of the surveillance state.’ The 2019 list, with over 1.5 million entries, includes an overwhelming number of Muslim passengers. The server, maintained by CommuteAir, also held private employee data, such as passport numbers. Edward Hasbrouck, an author and human rights advocate, wrote in his analysis of the documents that the lists “confirm the TSA’s (1) Islamophobia, (2) overconfidence in the certainty of its pre-crime predictions, and (3) mission creep.”

Men imprisoned for murder say police illegally used Google to find their location data

Two men imprisoned for killing a California gas station manager are trying to get their cases overturned by arguing that L.A. County investigators broke the law when they had Google scour location data about millions of devices in search of potential suspects. The appeal is part of a growing attempt by defense lawyers and privacy advocates to curtail police use of geofence warrants, an investigative tool powered by the public’s reliance on phones that track their movements. Driving the resistance is concern that the warrants give police too much discretion in deciding where to search and whose movements seem suspicious. Opponents say the warrants violate the U.S. Constitution’s protections against unreasonable searches by combing through the location data of innocent Google users in search of possible suspects. They also point to cases in which geofence warrants led police to the wrong people: a bicyclist swept into a burglary investigation, a warehouse worker mistakenly charged with murder.

Mobile / Location

CNIL launches public consultation on mobile apps’ data collection, processing

France’s data protection authority launched a public consultation on economic issues associated with data collection and processing by mobile applications. The CNIL said its objective “is to make data flows visible and strengthen the compliance of mobile applications and their ecosystems, to better protect the privacy of users.”

As TikTok faces data-harvesting claims, spy agency warns Canadians to protect themselves

The man who oversees cybersecurity for the federal government says Canadians should be wary of apps that could leave their data in the “wrong hands” — a warning that comes as the wildly popular Chinese-owned social media app TikTok faces claims that it has spied on its users. Sami Khoury, head of the Communications Security Establishment (CSE) Canadian Centre for Cyber Security, said users need to be aware of what they’re agreeing to when they download an app, and should ask whether it enables access to their personal data. CSE says it’s updating its social media guidance

Online Privacy / Surveillance

OPC finds retailer’s e-receipt sharing violated consumers’ privacy

The OPC announced findings from an investigation into Home Depot’s e-receipt sharing with Meta’s Facebook. The OPC found the retailer shared receipts, which included encoded email addresses and in-store purchase information, without proper consent from consumers. According to the OPC’s recommendation, Home Depot halted sharing with Facebook in October 2022. The regulator also recommended the retailer adopt updated and lawful consent practices.

Carnegie Mellon researchers view 3D human bodies using Wi-Fi signals

Carnegie Mellon University researchers successfully used Wi-Fi routers to detect 3D shapes and movements of people in a room. They used a system called “DensePose,” created by a team of London researchers and Facebook AI researchers. The Carnegie Mellon team “developed a deep neural network that maps Wi-Fi signals’ phase and amplitude sent and received by routers to coordinates on human bodies.”

Regulators

DOJ files suit to dissolve Google’s adtech business

The U.S. Department of Justice filed an antitrust lawsuit against Google’s parent company, Alphabet, seeking to break up its digital advertising business. Eight state attorneys general joined the DOJ in accusing Google of monopolization while seeking to cancel acquisitions and halt the company’s ad exchange that supports the alleged dominance.

OPC launches 2023 Data Privacy Week campaign

Canada joins many countries around the world in marking Data Privacy Week to commemorate the 1981 signing of the first legally binding international treaty on privacy and data protection. This year, the OPC produced a series of videos featuring OPC employees providing privacy tips to individuals, organizations and federal institutions to help them better protect privacy and safeguard personal information. The videos will be shared on social media. The OPC has also developed a videoconference background available for download on the campaign page.

Privacy commissioner: Treat privacy ‘as a priority’

Privacy Commissioner of Canada Philippe Dufresne said the OPC’s 2021-22 annual report revealed “a number of instances where there are still shortcomings in terms of how privacy is considered.” He said organizations should treat privacy “as a priority,” not a “mere regulatory obligation,” by conducting privacy impact assessments when appropriate, implementing safeguards and ensuring necessary data is collected, used, retained and disposed of properly.

OPC publishes organizational tips for conducting PIAs

The OPC published a guide with five tips for improving privacy impact assessments. The OPC found the missteps organizations take when conducting PIAs include not understanding their legal authority to collect certain personal data, defining the scope of a PIA for “clear analysis,” and creating and implementing an action plan based on the PIA.

Research / Standardization

FPF announces Privacy Papers for Policymakers Award winners

The Future of Privacy Forum selected seven winners and two honorable mentions of its 13th annual Privacy Papers for Policymakers Awards. Topics explored in the papers include regulating the digital economy to advance nondiscrimination and challenges data protection regulators face in the global south.

CIPL explores relationship between privacy and digital assets

The Centre for Information Policy Leadership at Hunton Andrews Kurth published a discussion paper for member companies exploring “the intersection of privacy and digital assets,” with a particular focus on blockchain technology. The paper, “Digital Assets and Privacy,” offers “recommendations for developing coherent, tech-friendly, future-focused, and pragmatic regulations and policies.” Core themes discussed in the paper include applicability of existing laws, accountability, data minimization and data security.

Security / Breaches

Hacker stole data of ‘presumably every’ Austrian citizen

Austrian police said a Dutch hacker stole personally identifiable information of “presumably every citizen.” The unnamed hacker was arrested in November for allegedly stealing nearly nine million sets of data. He reportedly also listed “similar data sets” from Colombia, the Netherlands and Italy for sale.

NIST explores potential updates to Cybersecurity Framework

The U.S. National Institute of Standards and Technology has begun considering revisions to its Cybersecurity Framework 2.0. The agency published a concept paper outlining the first proposed updates since 2018, including modernized cybersecurity best practices, sector-specific requirements and cybersecurity governance. The NIST said it is looking at “making more substantial changes than in the previous update” to reflect “the evolving cybersecurity landscape.” The concept paper is up for public comment through March 3.

Report: ransomware victims are refusing to pay

Studies from two security firms suggest that ransomware victims are increasingly refusing to pay the attackers’ demands. According to Chainalysis, ransomware payments fell from $766 million in 2021 to $457 in 2022. Coveware reports that 76% of ransomware victims paid the ransom demands in 2019, while that figure fell to 41% in 2022.