Peter A Clarke

It is trite to say that technology has faced outpaced the common law and statute when it comes to regulating surveillance practices.  In Australia the Privacy Act 1988 has inadequate coverage with exemptions for journalists and political parties.  The Australian Privacy Principles contain exemptions which limit their effectiveness.  And finally the regulator is timid.  The surveillance devices legislation while technically neutral is drafted for an analog world.  Neither legislation nor legislators have considered the impact of persistent surveillance where devices could track individuals throughout the day with the assistance of Artificial Intelligence.  It is not a dystopian future.  It is real and, again, described in the Wall Street Journal’s article The Two Faces of China’s Surveillance State where the capacity of the State to monitor its citizens is significant which it seeks to use to crush dissent and potential dissent and offer a better future that such overweening controls brings.  The first is a human rights abuse as the Office of the High Commissioner on Human Rights report makes clear in OHCHR Assessment of human rights concerns in the Xinjiang Uyghur Autonomous Region, People’s Republic of China  while the latter is a Faustian bargain.

Meanwhile in Australia ASIC has found that there is “room for improvement” by life insurers in their use of surveillance.  In its review of 4,800 individual disability income insurance claims it found that where physical surveillance was used in mental health claims in half of those instances it was unwarranted. The total sample size was small, a total of 10 instances, but for half to be unwarranted is a concern.  Similarly it found that the user of surveillance was unwarranted in 17.5% of cases because the insurer could have at least Read the rest of this entry »

The Standing Committee on Access to Information, Privacy and Ethics has been examining investigation tools used by the Royal Canadian Mounted Police (“RCMP”), including spyware. Not surprisingly the Commissioner is playing catch up as the RCMP have not consulted/liased with the Commissioner notwithstanding the clear privacy issues and potential for misuse.  It is a classic and typical case of police and other agencies grabbing a new tool and then having to deal with the real policy issues of when and how to use it, usually after some publicity about its use. Such an investigation long overdue in Australia at the Federal and State level as the police forces embrace privacy intrusive technology and engage in ways inconsistent with respecting privacy.

The history of the enquiry is well described in Read the rest of this entry »

Given the tight time frame to report it was not a surprise that the Royal Commission would set up a homepage promptly.  Of course the commissioner was approached long before the announcement and has no doubt organised her team and had started preliminary work.  Nevertheless the alacrity in setting up the homepage is impressive. It is found here.

At this stage the published material from the Commission is limited to the Letters Patent.  That will no doubt change in the very near future.

The Letters Patent provides Read the rest of this entry »

The Robodebt program, for want of a better word, animated those who have an interest in privacy.  Data matching, through the use of algorithms, was a key function of the program.  The Australian Privacy Foundation as well as other civil society groups raised concerns from an early date.

The Federal Government today announced the Robodebt Royal Commission.  The media release provides:

The?Governor-General His Excellency General the Honourable David Hurley AC DSC (Retd) has issued Letters Patent establishing a Royal Commission into the?former?debt assessment and recovery scheme?commonly known as Robodebt. 

The inquiry will examine, among other things:  Read the rest of this entry »

Given the derth of detailed specialist guidelines from Australian regulators regarding the cyber risk it is useful to review what is being done overseas.  In July the Office of the Superintendent of Financial Institutions released guidelines for technology and cyber risk.

The media release provides:

Today, the Office of the Superintendent of Financial Institutions (OSFI) released its final Guideline B-13. This guideline sets out OSFI’s expectations for how federally regulated financial institutions (FRFIs) should manage technology and cyber risks such as data breaches, technology outages and more.

The widespread use of technology and the growing rate of cyber incidents has created an urgent need for enhanced regulatory guidance to FRFIs on technology and cyber risk management. OSFI’s final Guideline B-13 provides that guidance, while allowing FRFIs to compete effectively and take full advantage of digital innovation.

The Guideline is organized around three “domains,” each of which sets out key components for sound risk management: Governance and Risk Management, Technology Operations and Resilience, and Cyber Security. In turn, each of these domains includes a desired outcome aimed at helping FRFIs understand OSFI’s expectations, focusing on the “why” and “to what end” of technology and cyber risk management.

The final Guideline B-13 will be effective as of January 1, 2024, to provide financial institutions sufficient time to self-assess and ensure compliance with this new guideline.

Quote

“With today’s release of final Guideline B-13, OSFI has crafted a flexible, principles-based approach towards managing technology and cyber risk that takes into consideration the size, nature, scope and complexity of financial institutions.”

– Jamey Hubbs, Vice-Superintendent

Quick facts

• • Final Guideline B-13 is the product of extensive consultation with industry, starting with the September 2020 publication of a discussion paper and a consultation period from September to December 2020. Following the release of OSFI’s draft Guideline B-13 in November 2021, OSFI further consulted on its proposed guidance regarding technology and cyber risk from November 2021 to February 2022. The final Guideline B-13 published today is the result of that process.
  • Compared with the draft consultation version, the final Guideline B-13 is more streamlined and less prescriptive with clearer definitions and expectations.
  • Guideline B-13 is complemented by OSFI’s existing guidance and tools, including the Corporate Governance Guideline, Guideline E?21 (Operational Risk Management), the revised draft Guideline B?10 (Third-Party Risk Management), the Technology and Cyber Security Incident Reporting Advisory and the Cyber Security Self-Assessment tool.

The guideline relevantly Read the rest of this entry »

The National Institute of Standards and Technology (“NIST”) has released recommendations which specific techniques for the derivation of additional keying material from a secret key obtained through either a key establishment scheme or shared through other way. 

It is common that a cryptographic key is not sufficient.  Usually additional Read the rest of this entry »

In my professional experience cyber attacks are not predominantly made on large organisations or businesses.  Those attacks get most press because they commonly involve a large number of people whose personal information was accessed.  Attacks on small businesses are frequent and often crippling.  This is highlighted in a recent Age report Hackers target small businesses’ social media accounts.   Small businesses tend to have a smaller IT spend, a lack of knowledge about cyber security practices and less diligence in maintaining proper cyber security, for example by patching regularly.  Phishing attacks on small businesses are Read the rest of this entry »

The UK Information Commissioner has highlighted the case of Christopher O’Brien who was prosecuted for unlawfully accessing patient records of 14 patients of the South Warwickshire NHS Foundation Trust, all of whom were known to him.  The media release provides:

and

A former health adviser has been found guilty of accessing medical records of patients without a valid legal reason.

Christopher O’Brien, 36, was working at the South Warwickshire NHS Foundation Trust when he unlawfully accessed the records of 14 patients, who were known personally to him, between June and December 2019. He did so without a valid business reason and without the knowledge of the Trust.

One of the victims said the breach left them worried and anxious about Mr O’Brien having access to their health records, with another victim saying the breach put them off from going to their doctor.

Mr O’Brien pleaded guilty to unlawfully obtaining personal data in breach of section 170 of the Data Protection Act 2018 when he appeared at Coventry Magistrates’ Court on 3 August 2022. He was ordered to pay £250 compensation to 12 patients, totalling £3,000.

Stephen Eckersley, ICO Director of Investigations, said:

“This case is a reminder to people that just because your job may give you access to other people’s personal information, especially sensitive data such as health records, that doesn’t mean you have the legal right to look at it.

“Such behaviour can be extremely distressing for the victims. Not only is it an invasion of their privacy, it potentially jeopardises the important relationship of trust and confidence between patients and the NHS.

“I would urge organisations to remind their staff about their data protection and information governance responsibilities, including how to handle people’s sensitive data responsibly.”

This sort of misbehaviour is not confined to the United Kingdom. The National Public Radio in 2015 did a piece on hospital workers snooping on celebrities medical records, including George Clooney, Kim Kardashian and Michael Jackson, to name a few.  It is a chronic problem in Australia within the health sector.  Last year the Health Care Complaints Commission prosecuted a complaint against registered nurse Ms Cody Rae Payne at the NSW Civil and Administrative Tribunal (‘the Tribunal’). Between January and August 2019  Payne accessed her own medical records as well as those of 34 other persons, including family members involved in family court legal proceedings without lawful authority. She provided information to her husband that she acquired as a result of that unauthorised access.

The hearing before the NSWCAT occurred after Payne had been criminally prosecuted for Read the rest of this entry »

The US Federal Trade Commission (the “FTC”), as close as the US gets to a privacy regulator, has announced an inquiry into the use of surveillance in a commercial context.  It is wide ranging, covering cookies.

The FTC first announced the Proposed Rule Making on Commercial Surveillance on 11 August with FTC Explores Rules Cracking Down on Commercial Surveillance and Lax Data Security Practices which provides:

The Federal Trade Commission today announced it is exploring rules to crack down on harmful commercial surveillance and lax data security. Commercial surveillance is the business of collecting, analyzing, and profiting from information about people. Mass surveillance has heightened the risks and stakes of data breaches, deception, manipulation, and other abuses. The FTC’s Advance Notice of Proposed Rulemaking seeks public comment on the harms stemming from commercial surveillance and whether new rules are needed to protect people’s privacy and information.

“Firms now collect personal data on individuals at a massive scale and in a stunning array of contexts,” said FTC Chair Lina M. Khan. “The growing digitization of our economy—coupled with business models that can incentivize endless hoovering up of sensitive user data and a vast expansion of how this data is used—means that potentially unlawful practices may be prevalent. Our goal today is to begin building a robust public record to inform whether the FTC should issue rules to address commercial surveillance and data security practices and what those rules should potentially look like.” Read the rest of this entry »

The Victorian Information Commissioner undertook an examination of the privacy and information handling and training of the Victoria Police.  To anybody familiar with the Victoria Police’s dismal history of privacy breaches the Commissioner found that Victoria Police provided inadequate training.  In fact there had been no training for over a year and Victoria Police had starved its Privacy and Education Unit of funding. As a result the Commissioner found the Victoria Police non compliant with its obligations under IPP 4.1.

I have posted regularly on privacy issues involving Victoria Police because they are so serious and so regularly occurring.  A Victoria Policeman took photographs of Dani (Dean) Laidley while he/she was in custody, and distributed them to other serving officers which resulted in Laidley suing the Victoria Police.    In 2016 the Victorian Commissioner for Privacy and Data Security set out in his annual report 453 information security incidents and a 30% increase of incidents year on year.  Police were caught misusing the LEAP database in 2015.  And in 2014. In 2006 the ABC reported on 18 Victoria Police being disciplined for misuse of the the LEAP database.

The Commissioner’s media release provides:

Part of OVIC’s role as Victoria’s privacy regulator includes oversight of Victoria Police and its management of law enforcement data.

On 30 September 2021, OVIC commenced an examination into the privacy and information handling training at Victoria Police.

The objective was to examine whether the training provided to Victoria Police personnel meets the requirements of Information Privacy Principle (IPP) 4.1 under the Privacy and Data Protection Act 2014 (Vic).

IPP 4.1 outlines that an organisation must take reasonable steps to protect the personal information it holds from misuse and loss and from unauthorised access, modification, or disclosure.

During this examination, OVIC staff gathered information from relevant Victoria Police personnel on how training is developed, delivered, and evaluated at Victoria Police, with an interest in information handling and privacy both generally and within the context of family violence investigations. Read the rest of this entry »