Home | Databases | WorldLII | Search | Feedback EPIC Alert

Special EPIC Alert [2005] EPICAlert 1

EPIC ALERT

2 0 0 4 P R I V A C Y Y E A R I N R E V I E W

Privacy debates continued in the United States in 2004 as proposals for passenger profiling and new identity cards provoked public protest and legislation. Google announced a new email service that offered lots of free storage while also peeking at the users' private messages. ID theft continued to be a national problem. And some states, most notably California, adopted new laws to safeguard personal privacy. Here are the Top Ten Privacy Stories of 2004 from the Electronic Privacy Information Center (EPIC):

* * * * * * * * * * * * * * * * * * * * * * * *

Foreign Opposition to USA PATRIOT Act The USA PATRIOT Act, which gave government new authority to collect information about American citizens and visitors to the United States, came under increasing criticism from foreign governments in 2004. Latin American countries objected to sending census data and voter records to U.S. law enforcement agencies. Canadian officials warned that the Patriot Act would violate Canadian law.

* * * * * * * * * * * * * * * * * * * * * * * *

Google Datamines Private Email Apparently, there is a shortage of advertising on the Internet. At least that must be part of the thinking behind Google's Gmail. The new email service links keywords in private messages with web-based advertising. Messages to business colleagues, family members, and loved ones now produce discount travel offers and 10% off restaurant deals. Question to Google CEO Eric Schmidt: do we get to read your email?

* * * * * * * * * * * * * * * * * * * * * * * *

Expansion of US-VISIT US-VISIT, an entry-exit border control system, launched in 2004. Europeans bristled when fingerprinted at U.S. airports. In Brazil a judge retaliated. He okayed the fingerprinting of U.S. tourists, citing the U.S. government's treatment of visitors. US-VISIT expanded rapidly following the award of a $15 billion contract to Accenture, a Bermuda-based corporation that entered the U.S. to take the money and then exited the country to avoid the corporate taxes. How about better border control for corporate outsourcing?

* * * * * * * * * * * * * * * * * * * * * * * *

Death of Airline Passenger Profiling . . . Maybe At a press conference in Washington, DC earlier in the year, Secretary of Homeland Security Tom Ridge raised his hand as if to put a wooden stake through the heart of "CAPPS II," the much-criticized passenger profiling system. An independent government review decided that assigning a "terrorist threat index" was not a great idea. Congress and civil liberties groups slammed the program. The funding was pulled. However, by year-end, a new passenger-screening program called Secure Flight was moving forward. Next time, use garlic.

* * * * * * * * * * * * * * * * * * * * * * * *

U.S. Medical Records Go Overseas Offshore outsourcing dramatically increases privacy risks, said a government report in 2004. So U.S. accountants proposed corporate disclosure of outsourcing practices. California passed a law to notify consumers when their personal information went abroad. But elsewhere, countries expressed concern about privacy protections in the United States. Canada pulled out of a contract with a U.S. company that would have provided services for the 2006 Canadian census.

* * * * * * * * * * * * * * * * * * * * * * * *

Data Disclosures -- Mission Creep Continues The IRS reported that it made 3.7 billion disclosures of tax return information in 2003 for tax and non-tax law enforcement and statistical purposes. Meanwhile, the Pentagon proposed to use tax returns to find "out-of-touch" reservists. The General Accounting Office and the Technology and Privacy Advisory Committee issued reports on government data mining and sharing of public and private sector personal information data. The Census Bureau revised its information sharing policy when it came to light that it has provided information to Homeland Security on persons identifying themselves as being of Arab ancestry.

* * * * * * * * * * * * * * * * * * * * * * * *

States Pull Out of Mini-Total Information Awareness Project Of the thirteen states originally agreeing to participate in the Multistate Anti-Terrorism Information Exchange (MATRIX), only five remain. The program was an effort to establish a state-level data mining project similar to the Total Information Awareness project killed by Congress in 2003. State governors and attorneys cited their own states' privacy laws.

* * * * * * * * * * * * * * * * * * * * * * * *

ID Theft a Growing Problem; Laws Stiffen Penalties ID theft was the number one consumer complaint received by the Federal Trade Commission in 2004. In response, Congress enacted laws to provide stronger penalties for ID theft and "phishing," the use of fake email addresses to lure sensitive personal information such as credit card numbers from people.

* * * * * * * * * * * * * * * * * * * * * * * *

Prevent More Stringent ID Requirements for Voters The Help America Vote Act placed greater identification requirements on voters registering for the first time. This meant an excessive burden was placed on those who wished to vote, but did not drive or have a need for a state-issued identification card. However, charges of voter fraud during the 2004 election season persisted, which may spur Congress and state legislatures to make greater identification demands on current and newly registered voters as well as anyone attempting to vote.

* * * * * * * * * * * * * * * * * * * * * * * *

California Continues Privacy Reforms While lawmakers in Washington dined with lobbyists, legislators in Sacramento were enacting some of the best new privacy laws in the United States. Among the new safeguards from the country's leading privacy state -- laws that limit electronic surveillance in rental cars, controls on the Social Security Number, a crackdown on spam and spyware, and new protections for wireless phone numbers.

The USA PATRIOT Act is up for renewal, state drivers licenses may become national identity cards, big companies will go after privacy laws, and new tags in your food may be telling your refrigerator when you need to buy more OJ. George Orwell may have been off by a few years, but privacy and technology are prepared to do battle again as a new year unfolds.

* * * * * * * * * * * * * * * * * * * * * * * *

National ID The queen of England has proposed that her subjects need a biometric identifier, but the rest of the world is not so certain. The United States took a half step toward national ID with federal mandates for the states' drivers licenses, but stopped short of a full-blown domestic passport. Expect a debate focused on the links between an upgraded state drivers licenses and federal agency databases.

* * * * * * * * * * * * * * * * * * * * * * * *

USA PATRIOT Act Renewal The USA PATRIOT Act passed not long after the Senate was evacuated because of anthrax. Now it's 2005 and Congress will need to decide whether the Constitutional rollback will be permanent. At issue are the electronic surveillance provisions that minimized the role of the courts and gave the Attorney General broad new powers. Note to Congress: real patriots defend the Constitution. And question to the FBI: who was responsible for the anthrax?

* * * * * * * * * * * * * * * * * * * * * * * *

Telemarketers Attack Privacy Rules The telemarketers are gearing up in 2005 to go after the most popular privacy rules in the Unites States. The federal Do Not Call list now includes more than 80 million subscribers who have just said no to telemarketing calls at dinnertime. But the direct marketers have a new strategy to open up loopholes in the rules and resume the calls. Also, watch the opt-in privacy safeguards for the wireless phone directories collapse unless Congress passes legislation. "Can you hear me now?" "Yes, and please take me off your list."

* * * * * * * * * * * * * * * * * * * * * * * *

Google Tracks Reading? The Net's number one search engine (and number one advertiser) is now planning to convert many of the nation's libraries into digital format. A tremendous boon for the public domain, but the cost may be the loss of reader privacy. Remember to delete those Google cookies.

* * * * * * * * * * * * * * * * * * * * * * * *

Is it a Phone? Is it the Internet? It's VOIP! Internet-based telephone service -- "VOIP" as the geeks and the policy wonks say -- was expected to reach one million users by the end of 2004. But is VOIP a telecommunications service or an information service? There are high stakes for privacy protection. Will the Do Not Call Registry apply to it? Will providers be required to help law enforcement access it? And will we be able to prevent "spit" -- the new term for unsolicited commercial messages delivered to VOIP users? Stay tuned!

* * * * * * * * * * * * * * * * * * * * * * * *

Smart Barcodes, RFID, and Products that Spy Now that the next-generation standard for RFIDs has been agreed to and adopted, we'll see an expansion of RFID products developed for the market and more organizations beginning to switch to RFID tracking systems for their own convenience. It will be necessary to develop guidelines outlining the duties of RFID-using organizations and setting out the rights of individuals who are exposed to RFID-enabled products. Must wonder if such guidelines are needed to address RFIDs in biometric passports approved by the International Civil Aviation Organization . . .

* * * * * * * * * * * * * * * * * * * * * * * *

Internet Privacy Expect a continuing state of flux when it comes to Internet communications and your privacy. With spyware legislation, the ongoing battles against spam, and the development of "spit," questions about VOIP regulation and the application of law, not to mention the upcoming decision in United States v. Councilman expected in spring 2005, the boundaries keep shifting.

* * * * * * * * * * * * * * * * * * * * * * * *

Outsourcing: Frying Pan or Fire? Outsourcing continues to be an issue on both the domestic and international front. Americans continue to be concerned about privacy and security of offshore/outsourced data processing, tax return preparation and call centers. Meanwhile, Canada and other countries are reviewing their own outsourcing to the U.S. after concerns were raised about the capacity of U.S. authorities to access such records. It is ironic to recollect that one of the motivating factors of data protection schemes was concern about facilitating international relationships -- will the USA PATRIOT Act and its consequences put an end to such profitable relations?

* * * * * * * * * * * * * * * * * * * * * * * *

Centralized Voter Registration Databases The Help America Vote Act requires that all states develop and implement centralized voter registration databases by 2006. The lack of technical expertise on the part of state election administrators may leave the centralization of voter registration lists to private contractors or very insecure systems with poor administration. Either case will make it difficult to ensure that personally identifiable information of registered voters will be protected from misuse or abuse. Expect Congress to take a closer look at the privacy standards for voter registration records.

* * * * * * * * * * * * * * * * * * * * * * * *

WHOIS Directory WHOIS, the online database of the millions of people who registered web sites, still lacks basic privacy safeguards. After years of review, the Internet Corporation for Assigned Names and Numbers (ICANN), the folks who demand the data, should make 2005 the year it finally establishes safeguards. Note to ICANN: self-regulation does not mean no regulation.

The EPIC Alert mailing list is used only to mail the EPIC Alert and to send notices about EPIC activities. We do not sell, rent or share our mailing list. We also intend to challenge any subpoena or other legal process seeking access to our mailing list. We do not enhance (link to other databases) our mailing list or require your actual name. In the event you wish to subscribe or unsubscribe your e-mail address from this list, please follow the above instructions under "subscription information."

The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues such as the Clipper Chip, the Digital Telephony proposal, national ID cards, medical record privacy, and the collection and sale of personal information. EPIC publishes the EPIC Alert, pursues Freedom of Information Act litigation, and conducts policy research. For more information, visit http://www.epic.org or write EPIC, 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. +1 202 483 1140 (tel), +1 202 483 1248 (fax).

If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "EPIC" and sent to 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. Or you can contribute online at: http://www.epic.org/donate

Your contributions will help support Freedom of Information Act and First Amendment litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and expanding wiretapping powers.

Thank you for your support.

------------------ End EPIC 2004 Year in Review ------------------ .