Large tech firms to welcome softer EU line on personal privacy

Irish Times - 7th March, 2013.

Brussels will be forced to water down tough data protection rules in a move that will come as a relief to tech groups after many of the EU’s member states called for a softer approach to the privacy push.

The climbdown will be welcomed by companies that collect large amounts of personal data, such as Google and Facebook, which have lobbied furiously against the proposed regulation, as well as the US government.

Washington has repeatedly voiced its concern that the rules, which include the power to fine companies up to 2 per cent of global turnover for breaching onerous data protection standards, were targeted specifically at US technology groups.

Resolving the transatlantic dispute over data protection rules could ease the way towards a new EU-US trade agreement over the next two years, which boasts huge commercial potential but is also rife with complications. 

The plan will be softened after at least nine countries – including the UK, Germany, Sweden and Belgium – said they were opposed to several proposed measures. 

Copyright The Financial Times Limited 2013

European Parliament to vote on united Data Protection Legislation

Members of the European Parliament will vote this week on a European Commission proposal on Data Protection.

Private companies such as Google and Facebook are under constant scruting in respect of their privay policies and the EU are under pressure to be seen to be taking some action. The newest propsal advocates the establishment of a single set of rules on data protection and online privacy. Currently each member state applies its own laws and sanctions. The main focus of the proposal is to target large companies so it will be important that the new regulations do not impose overly onerous administrative burdens on small and medium sized companies.

Under the new propsals, each national data protection authority will be responsible for implementing the new EU law. At the moment the administrative costs of complying 27 different regulations from the member states stands at £2.3 billion a year.

A united set of regulations for all Member States is common sensical from a cost-effective perpective but it is important that the new regulations take account of the differing circumstances and resources of companies.

Church defection website seeks record

Irishtimes.com - : Tuesday, January 29, 2013.

JASON KENNEDY - The founder of a website formerly used to allow people leave the Catholic Church is asking people who still wish to defect to retrieve their records from their parish.

Paul Dunbar, who runs countmeout.ie, is asking people to request a copy of their records from the parish they were born in. Mr Dunbar hopes that data protection legislation can be used to force the church to amend their records to reflect the member’s desire to leave the organisation.

Catholics may no longer formally defect from the Church after a change in canon law that took place in 2010. Before that, countmeout.ie said more than 12,000 copies of its online form to defect had been downloaded.

A spokeswoman for the Archdiocese of Dublin would not comment on Mr Dunbar’s campaign, but reiterated the statement issued in 2010, saying it was a change that did not just affect the Church in Ireland, but also the world. “The Archdiocese of Dublin plans to maintain a register to note the expressed desire of those who wish to defect. Details will be communicated to those involved in the process when they are finalised,” she said.

Despite this, Mr Dunbar says people are still unable to leave the church of their own accord, even through excommunication. “During April 2011, we assisted 16 people in their effort to have an Act of Apostasy recognised as a formal declaration of their wish to leave the church,” he said.
However, the Archdiocese of Dublin has decided it cannot accept these declarations, meaning those who wish to leave the church “continue to be denied this option”, he said.

“We have sent letters to Archbishop Martin and the Vatican over the last few months and we never got reply. If people don’t wish to be a part of the institution, it has no right to bind them there. It’s frustrating.”

FBD appeals against Data Breach Award

The Irish Times - Saturday, January 12, 2013

An Insurance company has appealed to the High Court against an award of €15,000 damages to a man over breach of his data protection rights.

FBD Insurance claims painter and decorator Michael Collins suffered no loss from the admitted breach after he made a claim when his work van was stolen outside his home at Mellowes Park, Finglas, Dublin, in September 2008.

Mr Collins said he lost work due to not having the van until it was recovered three months later, when he withdrew his claim. During that period FBD, on the basis of confidential information on him which it failed to disclose to him in accordance with data protection law, declined to deal with his claim, he said.

Inquiry into breaches of Experian's databases

Experian, a credit-reporting service with financial information on more than 740 million consumers, is being investigated by Irish regulators following breaches of the company’s databases. 

The Office of the Data Protection Commissioner has opened a preliminary inquiry into the security practices of Dublin-based Experian, said Gary Davis, the agency’s deputy commissioner. He said the move was prompted by reports that Experian’s database was invaded at least 80 times, leading to the theft of almost 15,500 credit reports since 2006. Hackers infiltrated Experian using passwords stolen from its customers, and invasions were not immediately detected. Mr Davis said regulators have asked Experian whether breaches have affected Irish consumers or businesses, and requested information on what steps the company was taking to prevent unauthorized access to its databases and safeguard records.

Gerry Tschopp, a spokesman for Experian, declined to comment directly on the Irish inquiry. The breaches were “isolated security issues experienced by a small number of our clients in North America involving US consumers under US data-protection jurisdiction”, he said in an emailed statement.

Data Protection Commissioner investigating secondary schools’ security flaw

The data watchdog has asked the manufacturer of potentially vulnerable software to provide a full list of affected schools. The DPC is now investigating a security vulnerability with software used by hundreds of Irish schools. The DPC has contacted the manufacturer of a popular school management software product, asking for a list of the schools which run the software. 

The contact comes after it was revealed that the ePortal software, manufactured by Serco, was vulnerable to exploitation because of the existence of a username-and-password combination which would allow access to almost every Irish machine running the software. The issue is made particularly sensitive by the fact that many schools running the software have their systems set up so that they can be accessed remotely, from any internet-connected device. While this makes it more convenient for teachers to log in and update pupils’ records from home, it also means that school’s records are vulnerable to access by anyone who has the ‘master key’ combination of username and passwords.

The Department of Education has contacted school patrons asking them to advise their schools about the issue, but the Data Protection Commissioner is now also taking action to resolve the problem. Deputy data protection commissioner Gary Davis said last night the issue was “of huge interest of us” and that the office had been in contact with Serco seeking documentation about the product and the nature of the vulnerability. “We’re asking them for a copy of their client list, and then what we’ll probably do is approach the schools directly,” he said.

Thousands of pupils may be affected. While Davis said the fact that the ePortal software runs on servers physically housed within each school, the DPC was also keen to ensure that no similar difficulties arose with rival products where pupils’ data is stored ‘in the cloud’ - and therefore accessible to any internet user with the right password. Davis said such products “give rise to some concerns” about potential a similar vulnerability, if it existed, could leave pupils’ data open to access from inappropriate parties.

There are 722 second-level schools in the country, with a combined student body of 323,000 pupils. While each school is responsible for choosing and maintaining its own data products, it is thought that several hundred schools use the ePortal offering - suggesting that data of tens of thousands of pupils could be at risk. Though a minority of those schools have set up their systems to be accessible through the internet, most schools would make the system available to any computers on the network within their buildings, so the records would still be vulnerable to use by anyone within the school. Fianna Fáíl last night asked education minister Ruairí Quinn to clarify the details of the threat, after the Department of Education wrote to schools to warn them of the problem. “Parents across the country will be extremely worried to learn that the private and personal information of their children may have been accessed by unauthorised individuals,” the party’s education spokesman Charlie McConalogue said. “It is incumbent on Minister Quinn to explain how exactly this happened and what is being done now to rectify the situation.”

The ‘master key’ credentials, which were discovered last week, by a pupil in one school running the software, could allow anyone to access sensitive personal data - possibly including medical records - of thousands of Irish second-level pupils.

EU to unveil plans for cloud ‘boost’

EU telecoms regulators will spell out today how they want to accelerate the use of ‘cloud’ computing by public bodies and companies, in the hope of boosting the region’s GDP by nearly €1 trillion through the next eight years. Concerns about privacy and data loss have hampered the take-up in Europe of cloud computing, where customers’ data is stored on remote servers that can be accessed from anywhere over the internet.

The European Commission wants to address such worries by getting experts to clarify tricky legal questions on data protection and to develop a global privacy standard, it says in a draft of the strategy to be announced today and seen by Reuters. European customers complain that many cloud contracts do not specify who is liable when data is lost. And a proliferation of different standards for privacy and security can confuse prospective customers, though some companies have begun updating the commonly used global information security standard - ISO 27001 - to the cloud era. Commission research shows cloud computing can cut companies' costs by up to 20 per cent and groups like Amazon, Microsoft, Google and Salesforce.com have been developing new products and services to attract business "in the cloud".

EU Telecoms Commissioner Neelie Kroes will detail the strategy, which the Commission says could yield €957 billion in increased EU GDP in the years through 2020, creating 3.8 million jobs. Servers in the EU's public sector are up to 90 per cent under-used, commission research shows. Optimising their use would mean they were being accessed by clients in all time zones, so that when one region goes to sleep another wakes up and the server works around the clock.

For more information on Data Protection see our website at www.lawlorpartners.ie