Peter A Clarke

Data scraping has been a chronic problem for some time, particularly of social media sites. Regulators have not really grappled with it. Advances in programming and technology has made it both a chronic problem and a real harm to privacy of individuals. The Australian Information Commissionergf- and the UK Information Commissioner have issued a joint statement warning about the dangers of data scraping. The joint statement makes the obvious point that data scraping is a breach of the data security/privacy legislation, including the Privacy Act in Australia.

• Office of the Australian Information Commissioner
• Office of the Privacy Commissioner of Canada
• Information Commissioner’s Office – United Kingdom
• Office of the Privacy Commissioner for Personal Data – Hong Kong, China
• Federal Data Protection and Information Commissioner – Switzerland
• Datatilsynet – Norway
• Office of the Privacy Commissioner – New Zealand
• Superintendencia de Industria y Comercio – Columbia
• Jersey Office of the Information Commissioner
• CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel) – Morocco
• AAIP (Agency for Access to Public Information) – Argentina
• INAI (National Institute for Transparency, Access to Information and Personal Data Protection) – Mexico

Key takeaways 

• • Personal information that is publicly accessible is still subject to data protection and privacy laws in most jurisdictions.
  •  Social media companies and the operators of websites that host publicly accessible personal data have obligations under data protection and privacy laws to protect personal information on their platforms from unlawful data scraping. ?
  • Mass data scraping incidents that harvest personal information can constitute reportable data breaches in many jurisdictions. 
  • Individuals can also take steps to protect their personal information from data scraping, and social media companies have a role to play in enabling users to engage with their services in a privacy protective manner

I

f it wasn’t for bad luck the various UK police services would have no luck at all. The Times reports that the Metropolitan Police have suffered a data breach. This time the photos, names and rank of 47,000 personnel may have been exposed to hackers. The means of entry to the Metropolitan site, through a compromised IT system of a contractor engaged to print police warrant cards. The implications of this data breach are particularly serious and multi pronged.  Not only do the hackers have details of police and their warrant card numbers but also there is the potential of creating false warrant cards. 

Hackers regularly use 3rd party contractors as  means of access to the intended target or get data belonging to the intended target.  Small contractors tend to have less effective and extensive cyber security defences and large businesses use a lot of contractors. 

The Times article Read the rest of this entry »

It has been a bad month for the police in the United Kingdom. Privacy wise at least. The Northern Ireland Police Service had suffered a significant data breach Cumbria Police said that on March 6 it found out information about pay and allowances had been uploaded on its website following a “human error”. The force’s admission comes after an “industrial scale breach of data” in Northern Ireland this week which saw some details of around 10,000 officers and staff published online for a number of hours.

The Norfolk Police data breach involved personal details of 1,230 victims of abuse being shared accidentally. The breach occurred because of poor data handling, with data being attached as part of a response to a Freedom of Information Request. This has attracted the early attention of the Information Commissioner’s Office.

Most of the recent data breaches involving the loss of data from various police forces in the United Kingdom related to human error rather than criminal activity by hackers.  In short, poor privacy practices.  It highlights the need for proper training and processes.  That is particularly the case for police where the data is almost invariably Read the rest of this entry »

In keeping with the times and the speed of the UK Information Commissioner has commenced the guidance development process regarding the use of biometric data. The draft guidance is found here.

The guidance details how data protection law will apply in the use of biometric data in biometric recognition systems. To that end it is aimed at organizations that use or are considering using biometric recognition systems.

• the definition of biometric data and special category biometric data;
• how biometric data is used in biometric recognition systems; and
• the legal data protection requirements when using biometric data including when a Data Protection Impact Assessment (DPIA) is required.

Helpfully the guidance Read the rest of this entry »

In Texas a woman has won an award of $1.2 billion in a judgment where she claimed he had been the victim of revenge porn. The allegation was that her ex boyfriend posted intimate images of her on line to humiliate her. This follows a decision in 2021 when a judge ordered a former boyfriend pay $500,000 for posting nude photographs and videos of his girlfriend on a pornography site. In that case the court also ordered the former boyfriend to remove the images and destroy them, failing which he would be found in contempt of court.

The BBC’s coverage provides::

Read the rest of this entry »

It has been a dreadful week for cyber security in the United Kingdom. First, on 8 August the UK electoral commission publicly announced that it had detected access to its data in October 2022. It determined that the first attack had occurred in August 2021. The attackers gained access to its electoral registers, holding information of registered voters between 2014 – 2022. That has prompted an investigation by the Information Commissioner. Given the Read the rest of this entry »

The Office of the Information Commissioner has released the he Australian Community Attitudes to Privacy Survey (ACAPS) 2023 provides a comprehensive view of Australians’ privacy attitudes and experiences and how recent events have impacted them. The survey finds that Australians care about their privacy, they feel they have little control over it and are concerned how their information is handled. They want more to be done to protect their privacy. These findings reinforce findings of previous surveys in Australia. They are also consistent with the Pew Research Center’s 2019 survey of Americans with Americans and Privacy: Concerned, Confused and Feeling Lack of Control Over Their Personal Information in 2019.    

The problem has never been that discerning Australians’ attitude to privacy.  Repeated surveys show they value it and want it protected. The problems are well known as well; ineffective legislation & timid enforcement of what there is, chronic under investment in cyber security and privacy training and a lack of any right to take action for breaches.  Report after report into privacy legislation has made this clear.  What has been lacking is the will. Governments of both persuasions have alternated between hostility and tentativeness towards privacy reform.  The result has been minimum protection.   

The Government is considering the Privacy Act Review Report prepared by the Attorney General’s Department. The recommendations do not go far enough in legislating best practice privacy protections. If the Government accepted all of the recommendations the legislative structure will provide robust protections. Then it is a question of properly funding the regulator and staffing it with people who will be much more assertive in taking action against breaches. Even with greater powers provided in 2014 the Commissioner’s Office has been a timid regulator and poor litigator in the Federal Court.

The media release sets out a reasonable summary of the findings.  It provides:

There has been a sharp increase in the number of Australians who feel data breaches are the biggest privacy risk they face today, according to a major survey released today by the Office of the Australian Information Commissioner (OAIC).

The Australian Community Attitudes to Privacy Survey (ACAPS) 2023 provides a comprehensive view of Australians’ privacy attitudes and experiences and how recent events have impacted them.

The survey tested attitudes on topics such as data practices, privacy legislation, data breaches, biometrics, artificial intelligence and children’s privacy.

“Our survey shows privacy is a significant concern for Australians, especially in areas that have seen recent developments like artificial intelligence and biometrics,” said Australian Information Commissioner and Privacy Commissioner Angelene Falk. Read the rest of this entry »