Peter A Clarke

The New South Wales Police Commissioner recently raised the hoary old chestnut that we face a a stark and of course immutable dichotomy – privacy or security.  That is captured in the Sydney Morning Herald Article Time to trade privacy for safety, says NSW Police Commissioner. The context is the police and security services demands, if not obsession with expanded data retention laws.  The starting point is that it is not logical.  There can be both privacy and security.  It is not one or the other.  It would be wrong to only critisise the police for this utterly wrong headed nonsensical simplifying of what is a far more complex and Read the rest of this entry »

Apps are notorious for having minimal privacy protections, lousy to non existent privacy policies but an excellent source of data leakage for hackers. Privacy regulators have been focusing on privacy issues with apps in the recent past.  Breach of data security or loss of data through an app is just as much a breach of the Privacy Act at the Commonwealth level or the Victorian Information Privacy Act as if it was lost on the street or via a hacking attack on line.  Apps are becoming a necessary feature of service delivery for government agencies and organisations.

The findings, found here, provide:

Twenty-seven participating data protection authorities from around the world undertook a coordinated exercise to examine privacy protections and related issues raised by apps. Some of the issues considered were: whether consumers are clearly informed about the types of personal information an app collects and uses; why that data is needed; and how many apps collect information way beyond what is actually needed for an app’s functionality.

Privacy Victoria examined 64 mobile apps developed by Victorian public sector organisations. Each organisation has now been Read the rest of this entry »

The Age reports in Superannuation giant Cbus under the spotlight at Royal Commission into union corruption on a very serious allegation of strategic leak of personal information from Cbus to a union, the CFMEU in 2013.  The Privacy Commissioner is reportedly investigating the allegations.  Read the rest of this entry »

In the United States privacy regulation at a Federal level is sectoral.  There are some strong protections but a lack of general coverage.  The key regulator, the Federal Trade Commission (FTC) wants more powers and broader coverage.  At the moment it has power to take action over unfair and deceptive practices and has powers to enforce the Truth in Lending Act, the CAN-SPAM Act, the Children’s Online Privacy Protection Act, the Equal Credit Opportunity Act, the Fair Credit Reporting Act, the Fair Debt Collection Practices Act, and the Telemarketing and Consumer Fraud and Abuse Prevention Act.  Its enforcement activities and educational activities even with restrictions are quite impressive.  Certainly something for other privacy regulators to heed.  It has also been a regulator not afraid to take on and best large organisations .

In Federal Trade Commission 2014 Privacy and Data Security Update the FTC provides an update of its activities.  Its settlements and the undertakings it has extracted from organisations are hugely influential for privacy practitioners in the United States.  Given the issues Read the rest of this entry »

In Rescom Asia Pacific Pty Ltd v Reapfield Property Consultants Pty Ltd and Foxhat Employment Service Pty Ltd v Deputy Commissioner of Taxation the Victorian Court of Appeal and the Supreme Court considered applications to set aside statutory demands in very different circumstances.

Rescom Asia Pacific Pty Ltd v Reapfield Property Consultants Pty Ltd

The applicant sought leave to appeal a decision of Randall AsJ dismissing an application to set aside a statutory demand.  The grounds of appeal included a failure to find there was a genuine dispute or offsetting claim [2].

FACTS

The statutory demand relates to a claim for commission on the sale of various apartments in Carlton. The vendor retained Rescom as the underwriter for the sale of the apartments.  It was a term of the retainer that in the event that the total sale price of the apartments did not reach a pre-determined level, Rescom would pay the difference to the vendor [6]. If the total proceeds exceeded the predetermined level the vendor would pay the excess amount to Rescom. If the total proceeds exceeded a pre-determined level by a certain amount, then the excess would be shared between Rescom and the vendor [7].

Rescom engaged Reapfield as its sole marketing agent in Singapore on terms which included a 5% commission on the transacted price of all sales within Singapore[8].  The Agreement referred to a price schedule in an Annexure A of the agreement.

There was, and is, a dispute between the parties as to contents of Annexure A to the agreement with there being two schedules, one referring to lower prices than the other. That said Randall AsJ found he did not need to determine which schedule was incorporated into the agreement for the purpose of determining the application. Focusing on the terms of the marketing agreement and on contemporaneous conduct [9] he found that the agreement did not impose an obligation on Reapfield other than to use all due care, skill and diligence.  There were no consequences for failure by Reapfield to achieve a particular price [10].

Regarding the contemporaneous conduct the Randall AsJ found [16]:

• the vendor accepted offers made by purchasers procured by Reapfield and booking forms that set out the purchase price and were signed on behalf of Rescom [over the caption] “accepted by underwriter”
• email correspondence to the effect that Rescom “appreciated the good job” and that Rescom was in the “midst of arranging payment as promised”.
• text messages passing between Rescom and Reapfield accepting the invoice for the commissions claimed without complaint and advising that payment would be made when Rescom received draw downs “from equity partners.”
• there were over 20 text messages where Reapfield sought payment and Rescom repeatedly promised to make payment.
• No complaint was made about the invoice that set out the prices obtained for each of the apartments or the liability to pay the commission [17].

DECISION

The Court referred to and liberally quoted from the latest Court of Appeal authority on statutory demands, Troutfarms Australia Pty Ltd v Perpetual Nominees Ltd, handed down last year [3].  The key principles can be reduced to the following:

•  ‘a genuine dispute’ uses ordinary English words and its meaning Read the rest of this entry »

On line tracking can be irksome if not alarming for those who want some anonymity in searching the net.  It is a key privacy concern as Read the rest of this entry »

In the United States privacy protection is as much a focus at the state level as the Federal level.  Unfortunately at the Federal level the law has not changed for some time and when it does it tends to respond to a particular public policy crisis or concern.  Hence there is strong protection on Read the rest of this entry »

Data leakage and identity theft is a constant and ubiquitous problem.  Under Privacy Principle 11 of the Privacy Act an organisation or agency has obligations to maintain data security.  That deals with hacking or other unauthorised access, use and disclosure of personal information. For a recent example see Cybersecurity expert says little risk from Butler data breach which despite the headlines reports on hackers accessing records of 163,000 individuals who were students, employees, applicants and alumni of Butler University, Indianapolis, United States.

The other side of the problem is inadvertent release of information by individuals through phishing, spear fishing and other scams to obtain personal information and use that to defraud, blackmail or extort individuals.  The latter situation is highlighted in Personal data sold to scammers on black market.

The ABC report highlights not only the emotional distress associated with sensitive personal information being used against an individual but the reputational damage done to agencies, in this case the Australian Taxation Office whose name was used in vain by the scammers. Interestingly the story highlights that last week, 24 June, the Auditor General found that seven government agencies are vulnerable to cyber attacks.  Compliance in the private sector is anecdotally quite patchy.  Ineffective regulation in the past has lead to Read the rest of this entry »

In Gaining Insurance, Losing Privacy the Atlantic reports on a quirk in the provision of health insurance in the United States which compromises individuals privacy.  Many people have health insurance as part of their parent’s health plan, usually through work.  Accordingly the insurance company sends forms to the insurance policy holder setting out payments under the policy even if those payments relate to treatment of others in the family.  Details of treatment provided is sensitive and intensely private information.  Providing enough details to another Read the rest of this entry »

The current focus on inadvertent data leaks is upon losing USB sticks and memory cards and the theft of  laptops. The Information Commissioner’s office reports that the loss of documents inadvertently left in a filing cabinet which was then sold to a member of the public is just as much a problem. In Prison service warned after Maze records sold at auction the ICO reports on the prison service of Northern Ireland selling a filing cabinet at auction. The person who purchased the filing cabinet found some very sensitive records regarding the inmate and prison officers. Given the reorganisation of the prison service, with the incident occurring under the watch of the predecessor, and that the incident predated the powers of the ICO to take stronger action the ICO issued a warning and the Department of Justice entered into an undertaking.

Recycling and selling old office equipment is not a new phenomanon.  There needs to be proper Read the rest of this entry »