getting to privacy a presentation to: presented by: mike gurski

Getting to Privacy

A Presentation to:

Presented by:

Mike Gurski

Agenda

• Background on IPC

• Privacy why’s and what’s

• Online Risks (Offline too)

• Online Privacy– Tasks– Tools

• P3P

Information & Privacy Commission/Ontario• established in 1988• independent review of government

decisions and practices concerning access and privacy

• resolve appeals, • investigate privacy complaints, • ensure compliance with the Acts, • research access and privacy issues and• educate the public about these laws.

What’s Drives the Privacy Issue?• Large organizations disconnected

from clients, gathering detailed data• Increasing amounts of personal data,

held, consolidated, used • New privacy invasive technologies• Application of a technology paradigm

geared to manufactured goods on humans

Privacy & Security: the Difference

Security Privacy

Privacy & Data Security

AuthenticationData IntegrityConfidentialityNon-Repudiation

Privacy > Data SecurityPrivacy = Data Security + Data Protection (FIP)

Personal ControlInformational Self-determinationInformed Consent

Privacy Defined

• Informational Privacy: The protection and control of any recorded information about an identifiable individual.

Some Headlines

• Stealing cards easy as Web Browsing– Jan 14, 2000 NSNBC

• Vast online credit card theft revealed: Hacker hides 485,000 stolen cards on US government computer– March 20, 2000 MSNBC

• CD Universe 300,000 cards hijacked.

Some more Headlines

• The Illusion of Privacy– National Post, Dec. 14, 1999

• Woman’s one-way trip on information highway– Toronto Star March 23, 2000

• Web sites can follow a trail of your data, recording every move– Ottawa Citizen, Jan. 18, 2000

Online Risks

• Web Bugs

• Web Cookies…Cookie Synchronization

• Double Clicks

• Malicious code

• Viruses

More Online Risks

• Unauthorized Access

• Snooping

• Spoofing

• Identity Theft

Remedies

• Become Privacy Literate– Know the Laws

• International

• National

• Provincial

– Visit the Web Sites– Read the Books and Articles

Privacy Literacy

• Why are you asking?

• collection; purpose specification

• How will my information be used?

• primary purpose; use limitation

• Who will be able to see my information?• restricted access; third parties

• Will there be any secondary uses?

• notice and consent; unauthorized disclosure

Who Has What Laws:

E.U.

Canada

United States

Other Countries

Current Global Environment

• E.U. Directive on Data Protection

• OECD Guidelines on E-Commerce

• C.S.A. Model Code for the Protection of Personal Information• Canada’s Personal Information Protection and Electronic Document Act (Bill C-6)

• Principles for Consumer Protection in Electronic Commerce- A Canadian Framework

• U.S. Safe Harbor Proposal

Canadian Online Privacy Context• Bill C-6: Personal Information

Protection and Electronic Documents Act

The Canadian Privacy Legislative Framework• Purpose:

– support E-commerce strategy, – enable business with Europe, and– domestically to ensure Canadians feel

secure in delving into e-commerce

Bill C-6 & CSA Model Codes: The Ten Commandments• Accountability

• for personal information and shall designate an individual(s) accountable for compliance of principle

• Identifying Purposes• purpose of collection must be clear and done at or

before time of collection

• Consent• individual has to give consent to collection, use,

disclosure of personal information

The Ten Commandments

• Limiting Collection• collect only information required for the identified

purpose and information shall be collected by fair and lawful means

• Limiting Use, Disclosure, Retention• consent of individual required for other purposes

• Accuracy• keep as accurate and up-to-date as necessary for

identified purpose

• Safeguards• protection and security required appropriate to the

sensitivity of the information

The Ten Commandments

• Openness• policies and information about the management of

personal information should be readily available

• Individual Access• upon request, an individual shall be informed of the

existence, use and disclosure of her personal information and be given access to that information, challenge its accuracy and completeness and have it amended as appropriate

• Challenging Compliance• ability to challenge all practices in accord with the

above principles to the accountable body in the organization.

European Union (E.U.)Directive on Data Protection

• Non-E.U. countries must be able to meet the test of having an ‘adequate level of data protection’.

• The absence of private sector privacy protection will serve as a non-economic trade barrier with E.U. and Asia/Pacific-Rim countries.

U.S. Proposed Safe Harbor Privacy Principles• Notice

• Choice

• Onward Transfer

• Security

• Data Integrity

• Reasonable Access

• Enforcement

Other Jurisdictions

• Australia to introduce legislation in the first sittings of 2000 to strengthen self-regulatory privacy protection in the private sector.

• Asian countries, have developed or are currently developing laws in an effort to promote electronic commerce.

• Self-regulation is currently the policy promoted by the governments of Japan, and Singapore.

•

Other Jurisdictions

• “Many countries in the [South East] region have either adopted comprehensive [privacy]laws or are currently in the process. Hong Kong and New Zealand already have comprehensive acts in force. Taiwan’s act covers the public sector and eight areas of the private sector. The governments of Thailand, Malaysia and India are all currently developing comprehensive data protection legislation”. http://www.pco.org.hk/conproceed.html

More Remedies

• Tasks– Follow Ben Franklin’s Key Steps

• Be discreet

• Leave your SIN at home

• Go unlisted and non-published for your phone

• Get a P.O. Box

More Tasks

• Check out a Web’s Privacy Policy

• Never provide personal information– over the phone,– to unfamiliar web sites– to clerks (be positive and insistent)

• Get encrypted

Online Tools

• www.kburra.com (cookie control)• www.esafe.com ( security sandbox, personal

firewall, antivirus)• www.ipc.on.ca (e-mail encryption made

easy)• www.zeroknowledge.com (pseudonymisers)• www.iprivacy.com (secure financial

transactions)– Marit@koehntopp.de

Privacy Resources

• www.ipc.on.ca

• www.privacytimes.com

• www.epic.org/privacy/tools.html

P3P: A Proactive Approach• Platform for Privacy Preferences

– Consumer sets his/her privacy preference

– Web sites set their privacy policy– P3P built into Browsers and Web sites– Allows consumer to be more informed

and choose whether or not to proceed into a Web site

P3P: the June 21 Interop

• Invitation for your company to participate.

• www.w3c.org

• http://www.w3.org/P3P/interop

• Interested? Contact Lorrie Faith Cranor: lorrie@research.att.com

How to Contact Us

Dr. Ann Cavoukian Ph. D.Commissioner,Information & Privacy CommissionOntario, Canada, M5S 2V1Phone: 1-416-326-3333 Web: www.ipc.on.caE-mail: Info.ipc.on.ca Mike Gurski: mgurski@ipc.on.ca