Peter A Clarke

The Privacy Commissioner has released draft chapters of the guidelines as part of the consultation process.  Comments close on 20 September 2013. They can be found here.

The Guidelines (absent index)provides:

Chapter A — Introductory matters
Purpose
A.1    The Australian Information Commissioner issues these Australian Privacy Principles Guidelines (APP guidelines) under s 28(1) of the Privacy Act 1988.  These guidelines are not a legislative instrument (s 28(4)).
A.2    The APP guidelines outline how the Information Commissioner interprets and applies the APPs when exercising functions and powers under the Privacy Act relating to the APPs.
Australian Privacy Principles (APPs)
A.3    The APPs are the cornerstone of the privacy protection framework in the Privacy Act. The APPs set out standards, rights and obligations in relation to Read the rest of this entry »

I have posted on the Australian Privacy Commissioner’s findings of his review of privacy policies on the internet (found here).  It was part of a global internet sweep by privacy authorities.

The Canadian Privacy Commissioner’s office also released its findings which are as broadly similar to the Austrlian Privacy Commissioner’s findings but much more detailed.  The picture is not particularly good.  Too many policies are poorly drafted, incoherent and generally do not “get” what a privacy policy should do.

The Findings are set out below (and found here):

Privacy policies should be easy to understand and provide meaningful information, Privacy Commissioner says after the Office of the Privacy Commissioner of Canada and other global data protection authorities sweep more than 2,000 online privacy policies.

OTTAWA, August 13, 2013 — From tweet-sized privacy statements Read the rest of this entry »

The UK Information Commissioner has prosecuted a probation officer who revealed a domestic abuse victim’s new address to the alleged perpetrator.

The ICO’s media release is found here and provides:

A probation officer who revealed a domestic abuse victim’s new address to the alleged perpetrator Read the rest of this entry »

The Privacy Commissioner has issued a media release, Privacy Commissioner: Website privacy policies are too long and complex, announcing the release of what he calls as “privacy sweep” of websites used by most Australians.  He found nearly 50% of website policies were difficult to read.  In my professional experience it is usually more than that and sometimes difficult merges into completely incoherent.

The summary of the sweep is:

the OAIC examined Read the rest of this entry »

The Information Commissioner’s Office has recently undertaken a study of data breach incidents reported in the period 1 April – 30 June of this year.

The diagram of the findings are show:

Incident type

Incidents Read the rest of this entry »

Der Spiegal reports on paparazzi using drones to take photo’s at Tina Turner’s recent wedding in Switzerland.

The story provides:

When Tina Turner got married at her estate in Switzerland over the weekend, she wanted to keep paparazzi away. But photographers used drones and other aircraft to get the exclusives they needed. The battle for pictures is increasingly moving into the airspace.

Tina Turner and German music producer Erwin Bach wanted to make sure that their wedding would not be disturbed. The ceremony, with its roughly 120 celebrity guests, took place on Sunday behind the high walls and trees surrounding Turner’s Villa Algonquin estate in the suburb of Küsnacht, on Lake Zurich. The couple set up large red cloth to block the lakeside garden from prying eyes and photographer’s lenses.

 Shortly after the Buddhist ceremony, the wedding party was startled by a small plane overhead. Toto Marti, a photographer for the Swiss tabloid Blick, leaned forward in the copilot seat and hit the shutter release. The publication landed a scoop and cashed in. Tabloids and magazines all over the world printed the photo. In Germany, it was the cover photo on both the mass-circulation daily Bild and the popular glossy Bunte.

It was exactly this that Turner, 73, and Bach wanted to prevent — and most likely, in the interest of their media partners, were obligated to prevent. They expected that photographers Read the rest of this entry »

The Information Commissioner’s Office has served the Bank of Scotland with a monetary penalty for wrongly and repeatedly faxing personal information, to unintended recipients.

The penalty notice relevantly provides (found here):

Last week, on 1 August, the Office of the Information Commissioner commenced the consulation process of Guidelines for recognising external dispute resolution schemes under section 35A of the Privacy Act 1988.  The Privacy Commissioner’s post on line is found here.  The consultation process closes on 30 August 2013.

The draft guidelines relevantly provides as follows:

Key messages

1. In developing these guidelines, the Information Commissioner acknowledges the expertise and experience of existing industry external dispute resolution (EDR) schemes, and the important role these schemes play alongside the Office of the Australian Information Commissioner (OAIC) in relation to privacy complaint handling.
2. The Information Commissioner also acknowledges that there are a range of existing recognition mechanisms for those schemes, and the importance of not unduly burdening existing schemes where their existing recognition mechanism generally covers the same matters required by the Privacy Act 1988 (the Privacy Act) for recognition.
3. Recognition of an EDR scheme is undertaken by the Information Commissioner under s 35A of the Privacy Act. EDR schemes must demonstrate their accessibility, independence, fairness, accountability, efficiency and effectiveness to be recognised by the Information Commissioner. The recognition requirements, as set out in s35A, are based on the Benchmarks for Industry Based Customer Dispute Resolution Schemes developed in 1997 by the then Australian Government Department of Industry, Science and Tourism. Most existing EDR schemes are required to, or do, design their operations in accordance with these benchmarks.
4. To be recognised under the Privacy Act, EDR schemes should also meet additional requirements in relation to privacy-related complaints. In most cases existing schemes handling privacy complaints will already be meeting most of these additional requirements.
5. Additional requirements for recognition of an EDR scheme under the Privacy Act involve accountability, reporting and regular reviews. Again, most existing schemes will already be subject to similar requirements from their existing recognition mechanism. Wherever possible these existing requirements can be utilised by existing schemes in relation to the requirements under these guidelines. Some additional supplementary requirements may be required for ongoing Privacy Act recognition.
6. The detail in these guidelines should generally assist a proposed new EDR scheme which is not already recognised under another recognition scheme, and/or does not have a statutory basis for their operation, in seeking recognition under the Privacy Act to understand the full extent of what is required for initial and ongoing recognition.

Part 1 – Purpose and objectives of the guidelines

The purpose of these guidelines

1.1              The Office of the Australian Information Commissioner (OAIC) developed these guidelines to assist external dispute resolution (EDR) schemes to understand:

• the Information Commissioner’s process for recognising EDR schemes
• how the Information Commissioner will Read the rest of this entry »

Today 3 journalists, Royce Millar, Nick McKenzie and Ben Schneiders, have penned a letter of apology on page 2 of the Age. It is found here. The Herald Sun reported (no doubt very reluctantly) on the three having their cases diverted and therefore they are released without conviction and a good behaviour bond of 12 months.

The apology provides:

In November 2010, while researching a story for The Age newspaper, we the undersigned journalists accessed the ALP’s Electrac database without authorisation.

The focus of the story, published on 23 November 2010, was upon databases maintained by political parties, which contain private information concerning voters, and how that information is used for election campaigning. The Electrac database is such a database. Other political parties have similar databases.

We were able to access Electrac through the use of passwords provided to one of the undersigned. We accept that we did not have authorisation Read the rest of this entry »

The Federal Trade Commission in Federal Trade Commission, Plaintiff v. Asset & Capital Management Group & ors  obtained a restraining order against defendants using illegal practices against consumers, including interfering with their privacy.  The orders are found here.

The Federal Trade Commission’s press release, At FTC’s Request, Court Orders Halt to Debt Collector’s Illegal Practices, Freezes Assets, relevantly provides:

At the request of the Federal Trade Commission, a U.S. district court has halted a debt collection operation that allegedly extorted payments from consumers by using false threats of lawsuits and calculated campaigns to embarrass consumers by unlawfully communicating with family members, friends, and coworkers.  The court order stops the illegal conduct, freezes the operation’s assets, and appoints a temporary receiver to take over the defendants’ business while the FTC moves forward with the case.

The lawsuit Read the rest of this entry »