Home | Databases | WorldLII | Search | Feedback EPIC Alert

EPIC Alert 16.15 [2009] EPICAlert 15

E P I C A l e r t

http://www.epic.org/alert/EPIC_Alert_16.15.html

"Defend Privacy. Support EPIC." http://epic.org/donate

EPIC submitted comments to the Office of Management and Budget recommending that the existing ban on the use of cookies at federal government websites be maintained. Such technologies typically use persistent identifiers. A White House policy memorandum of June 2, 1999, on "Privacy Policies on Federal Web Sites," directs agencies to post clear privacy policies on agency principal websites, as well as at any other known, major entry points to sites, and at any web page where substantial amounts of personal information are posted. The memo states that privacy policies must be clearly labeled and easily accessed when someone visits a web site.

The memorandum directs that "cookies" should not be used at Federal web sites, or by contractors when operating web sites on behalf of agencies, unless, in addition to clear and conspicuous notice, the following conditions are met: a compelling need to gather the data on the site; appropriate and publicly disclosed privacy safeguards for handling of information derived from "cookies"; and personal approval by the head of the agency.

The OMB is now considering a policy change with the implementation of a three-tiered approach to the use of internet tracking technologies on Federal Government websites: The first tier consists of single-session cookies which track users over a single session; the second tier consists of using tracking technology to track users over multiple sessions to "gather data to analyze Web traffic statistics;" the third tier attempts to track users over multiple visits with the intent of remembering data, settings, or preferences unique to that visitor through the use of persistent identifiers. This change in framework will encourage tracking of users who visit government websites.

EPIC also proposed several safeguards if the new framework on persistent identifiers is ultimately adopted. EPIC's recommendations included not tracking users once they have left the government websites; prohibiting commercialization of information gathered from users; the application of meaningful rules for public participation; promoting open government and protecting privacy; availability of federal agency sponsored cookie data; respecting browser privacy and security settings; and prohibiting web-analytics or publishing the algorithm used.

EPIC also suggested that the OMB publish an annual survey outlining each federal government agency's use of Web tracking technology that should reflect the URLs, cookies, tracking technologies and processes adopted and their intended purpose. The placing of tracking technology for law enforcement, fusion center, national intelligence must conform to court oversight, and be subject to an annual reporting requirement to the appropriate Congressional Oversight Committees, EPIC urged.

The OMB had invited public comments on the framework that should govern Federal agency use of web-tracking technology including appropriate tiers, basic principles of use, degree of clear and conspicuous notice on each site, the applicability and scope of such framework on Federal use of third-party applications or websites.

In May, EPIC submitted comments to the President's Office of Science and Technology and urged the Government to not track users on Government websites. EPIC stated that since President Obama established the collaboration between executive departments and agencies and the public, tracking individuals who access government information would contradict these goals.

EPIC's Comments to the Office of Management and Budget: http://epic.org/privacy/cookies/comnts-to-OMB-cookie.pdf

Office of Management and Budget: http://www.whitehouse.gov/omb/

Federal register: July 27, 2009: Proposed Revision of the Policy on Web Tracking Technologies for Federal Web Sites: http://edocket.access.gpo.gov/2009/E9-17756.htm

M-00-13, OMB Memorandum for the Heads and Executive Departments and Agencies: http://www.whitehouse.gov/omb/memoranda_m03-22/

EPIC's Submission to White House Open Government Initiative - Users Are Not Tracked on Government Sites: http://opengov.ideascale.com/akira/dtd/3544-4049

Proposed Cookie Policy: http://blog.ostp.gov/category/cookie-policy/

Office of Science, Technology and Policy: http://www.ostp.gov/

EPIC FOIA Request to the GSA: http://epic.org/privacy/socialnet/gsa_foia_4-30-09.pdf

EPIC Cookies: http://epic.org/privacy/internet/cookies/

Judge Sonia Sotomayor was sworned-in as the 111th Justice of the Supreme Court of the United State by Chief Justice John Roberts on August 8, 2009. Earlier, on August 6, 2009, the United States Senate voted 68-31 to confirm Judge Sotomayor to be an Associate Justice. On July 28, 2009, the Senate Judiciary Committee approved the nomination of Judge Sonia Sotomayor, 13-6.

The Committee action had paved the way for a full Senate vote and a confirmation required only simple majority of Senators present and voting. The Senate vote was held after the Judiciary Committee delivered of a report, which presented the views both of committee members supporting and those opposing the nominee's confirmation. The Senate usually, but not always, has agreed with Judiciary Committee recommendations that a Supreme Court nominee be confirmed.

According to a CRS Report, after the Senate confirms a nomination, the secretary of the Senate usually attests to a resolution of confirmation and transmits it to the White House. In turn, the President signs a "commission," officially appointing the nominee to the Supreme Court. The signed commission is returned to the Justice Department for engraving the date of appointment and for the signature of the attorney general and the placing of the Justice Department seal. The deputy attorney general then sends the commission by registered mail to the appointee, along with the oath of office and a photocopy of the confirmation document from the Senate.

During the closing statement on the nomination hearings, Senator Patrick Leahy thanked the Senators who evaluated the nomination. "I believe that experience, perspective, an understanding of how the world works and people live and the effect decisions will have on the lives of people, are very important qualifications," Senator Leahy said. "By striving for a more diverse bench drawn from judges with a wider set of backgrounds and experiences we can better ensure that there will be no prejudices and biases controlling our courts of justice. All nominees have talked about the value they will draw on the bench from their backgrounds. That diversity of experience is a strength and not a weakness in achieving an impartial judiciary."

During the Judiciary Committee hearing, several Senators asked questions concerning privacy. She was queried on the general right to privacy under the Constitution, on Open Government issues, Foreign Intelligence Surveillance Act, and National Security.

Judge Sotomayor has ruled on several cases affecting the Fourth and First Amendment, and open government issues. Her opinions have included cases regarding the opening and reading of a prisoner's mail, strip-searches of young girls at juvenile facilities and of adult males in jails, concerning errors in police computer databases, addressing the validity of a warrant based upon lies or questionable facts, child pornography on the internet, search of state employee's computer, investigations regarding FBI misconduct, inter-agency documents and tax law administration, gag orders on the media from publishing jury names, contract formation in cyberspace, and concerning the sale of illegal wiretapping devices.

EPIC prepared an extensive page on Judge Sotomayor's view on privacy and other related issues. EPIC also provided running coverage of the nomination hearings and the Committee vote over Twitter at @privacy140 using #sotomayor, #scotus, and #privacy.

Senator Leahy's Closing Statement on the Nomination: http://leahy.senate.gov/press/200908/080609c.html

The President's Nominee: Judge Sotomayor, The White House Blog Post, May 26, 2009: http://www.whitehouse.gov/sotomayor/

Supreme Court Appointment Process: Roles of the President, Judiciary Committee, and the Senate (CRS Report for Congress, July 6, 2005): http://fpc.state.gov/documents/organization/50146.pdf

Testimony of Judge Sonia Sotomayor: http://epic.org/redirect/072009_Sotomayor_Senate_Testimony.html

Twitter - privacy@140: http://www.twitter.com/privacy140

Statement of the Honorable Patrick Leahy: http://epic.org/redirect/072009_Sotomayor_Leahy_Open.html

Rules of Procedure United States Senate Committee on the Judiciary: http://judiciary.senate.gov/about/committee-rules.cfm

EPIC - The Nomination of Judge Sotomayor: http://epic.org/privacy/sotomayor

Transcript of Sotomayor Senate Judiciary Committee Hearing: http://epic.org/privacy/sotomayor/sotomoyor_transcript.pdf

A new bill, the Personal Data Privacy and Security Act of 2009, has been introduced in Congress. The statute, introduced by Senator Patrick Leahy, intends to prevent and mitigate identity theft, ensure privacy, provide notice of security breaches, enhance criminal penalties, law enforcement assistance, and attempts to provide protections against security breaches, fraudulent access and misuse of personal information.

The proposed law defines "personally identifiable information", "sensitive personally identifiable information" and "identity theft victim." The statute prescribes penalties for knowingly concealing data breaches and provides for the review and amendment of the federal sentencing guidelines related to fraudulent access to or misuse of PII. The section sets forth various requirements that the United States Sentencing Commission is required to consider in its review.

The act mandates data brokers engaged in interstate commerce to adhere to the provisions of the act for any product or service that allows access or use of sensitive PII. Procedures are outlined for disclosure

of collected information to the concerned individuals upon request and in case of adverse actions taken by third parties. Processes for ensuring accuracy and the dispute of personal information are also detailed. The bill prescribes civil penalties for data brokers for violations and empowers the Federal Trade Commission to enforce the act against errant data brokers.

State Attorneys General may be authorized under State consumer protection laws to bring a civil suit against a data broker for violation of State laws in a district court of the appropriate jurisdiction. However, the PDPSA directs the Attorney Generals to provide the FTC with a written notice and a copy of the complaint. Further, the statute preserves the right of the FTC to move to stay the action; intervene in the action; or file petitions for appeal. The act, however, expressly forbids the establishment of a private cause of action against a data broker for a violation.

Title III of the statute states that business entities engaged in interstate commerce that involves the collecting, accessing, transmitting, using, storing, or disposing of sensitive personally identifiable information is subject to the requirements of the data privacy and security program as outlined in the concerned title. The program directs business entities to comply with the safeguards outlined in the section as well as safeguards identified by the FTC in a rulemaking process. A business entity is however deemed to be in compliance with the privacy and security program if it complies with or provides protection equal to industry standards as identified by the FTC. The FTC in turn is precluded from endorsing any regulation requiring the application of any specific technology.

The proposed law also addresses the obligation to issue security breach notifications, the timeframe for such issuance and delays or exemptions for law enforcement or national security purposes. Other provisions of the bill describes methods of notice, content of notification, notice to law enforcement and reporting to Congress by the US Secret Service on the number and nature of security breach notification exemptions.

The Personal Data Privacy and Security Act of 2009 also establishes the Office of Federal Identity Protection within the FTC. The FIP is charged with assisting consumers with identity theft and all related issues including addressing consequences of compromise of PII, accessing remedies and restoring the accuracy of PII.

Similar legislation has been introduced before the Congress twice before. The version before the 109th Congress (S.1332) did not preclude a private right of actions and also preserved the State laws with respect to access and use of PII by data brokers.

EPIC has advocated for strong protections against identity theft. In 2008, EPIC encouraged the FTC to impose monetary penalties on companies that exposed their customers' data to criminals. In addition, EPIC has long supported the right of individuals to preserve their anonymity, particularly in the face of ever more intrusive government identification requirements. Earlier this year, EPIC testified before the House Subcommittee on Information Policy, Census and National Archives. EPIC's testimony had also pointed out that the loss of control over the credentials that allow financial transactions and receive medical care poses a different problem than the hazards associated with traditional theft. In another testimony on the Data Accountability and Trust Act, EPIC had opposed the preemption of stronger state laws and warned that adopting such a law would be a mistake as security issues are rapidly changing. EPIC had also urged the Committee to add a private right of action to the bill.

Personal Data Privacy and Security Act of 2009: http://thomas.loc.gov/cgi-bin/query/z?c111:S.1490:

Press Release - Leahy Introduces Cybersecurity Legislation: http://leahy.senate.gov/press/200907/072209b.html

Personal Data Privacy and Security Act of 2005: http://thomas.loc.gov/cgi-bin/query/z?c109:S.1332:

EPIC Testimony - House Subcommittee on Information Policy, Census and National Archives: http://epic.org/privacy/idtheft/epic_idtheft_rotenberg_6-09.pdf

EPIC Testimony - House Subcommittee on Commerce, Trade and Consumer Protection: http://epic.org/linkedfiles/rotenberg_house_ctcp2221_1319.pdf

H.R. 2221, the Data Accountability and Trust Act: http://epic.org/redirect/051509_HR2221.html

Federal Trade Commission: http://www.ftc.gov

EPIC - Identity Theft: http://epic.org/privacy/idtheft

EPIC - Personal Data and Privacy Protection: http://epic.org/privacy/consumer/

The Senate Committee on Homeland Security and Government Affairs held a Business Meeting on July 29, 2009 on the "Providing for Additional Security in States' Identification Act of 2009." (S.1261). The PASS ID Act declares that beginning one year after the final regulations are issued, no federal agency can accept a driver's license or state issued ID card unless the issuing state is "materially compliant." Material compliance is determined by the Secretary of Homeland Security, based on whether a state has begun to issue PASS ID drivers licenses and state issued ID cards.

The Committee conducted a mark-up session and approved several substituted amendments on substantive provisions of the underlying bill. The amendments pertained to directing states to provide valid and verifiable birth records. Also discussed at the hearing was the discretion granted to a TSA official in denying an individual the right to board an aircraft if he or she did not have a compliant identification. Concerns were expressed that the bill did not provide for a review or an appeal in case of such denials. Sen. Akaka also suggested to the Committee to include an amendment requiring the Department of Homeland Security to perform annual report on the privacy implication of PASS ID. The markup was reported to the Senate favorably.

The PASS ID bill sets a deadline of 6 years after the final rule that prohibits all federal agencies from accepting any non-compliant driver's license or state identification card for any official purpose which includes boarding an airplane; applying for Social Security benefits; opening a post office box; and entering a federal building. This raises questions regarding the physically challenged, children, poor people, and the elderly who received benefits from federal government agencies and there are reasons why each may not hold a federally sanctioned state issued identification document. The PASS ID Act does not specify limits on the requirement of an approved identification document to access federal government services, benefits, or meet with federal employees in official settings.

Another hearing was held by the Subcommittee on Immigration, Border Security and Citizenship of the Senate Judiciary Committee. At the hearing, "Ensuring a Legal Workforce: What Changes Should be Made to Our Current Employment Verification System?" Sen. Charles Schumer proposed the implementation of a "non-forgeable, complete and accurate immigration system" that relies on biometric identifiers and identifies legal employees. Sen. Schumer stated that the biometric card should include fingerprint or enhanced biometric pictures and apply uniformly to all US citizens and non-citizens alike. Sen. Schumer also added that such system must have extensive checks at the inception to prevent illegal aliens from entering into the database. Sen. Cornryn stated that the E-Verify system, although flawed, was headed in the right direction and suggested that the program be given expanded legal authority, additional resources and improvements.

The use of PASS ID and identification cards with biometric data can become a de facto national ID card. National ID cards have long been advocated as a means to enhance national security, unmask potential terrorists, and guard against illegal immigrants. The REAL ID Act of 2005 created a national identification card. The implementation of the statute posed a number of privacy threats because of document collection, retention, sharing, and use. EPIC and 24 experts in privacy and technology submitted detailed comments to the DHS in May 2007 on the draft regulations explaining the many privacy and security threats raised by the REAL ID Act. "The fundamentally flawed national identification system is unworkable and the REAL ID Act must be repealed," EPIC stated. Further, EPIC and the Privacy Coalition had organized a national campaign against REAL ID implementation. DHS's own Data Privacy and Integrity Advisory Committee has refused to endorse the agency's plan.

National Identification systems are established for a variety of reasons. In the past, the fear of insurgence, religious differences, immigration, or political extremism have been all too common motivators for the establishment of ID systems that aim to force undesirables in a State to register with the government, or make them vulnerable in the open without proper documents. EPIC has urged the alternative model of a system of decentralized identification which reduces the risks associated with security breaches and the misuse of personal information. Technological innovation can enable the development of context-dependent identifiers and a decentralized approach to identification is consistent with commonsense understanding of identification. However, Federal, state, and local government agencies are already engaged in efforts to develop an Information Sharing Environment through the use of Fusion Centers which seeks to breakdown barriers to information controlled by all levels of government.

Senate Hearing on Biometrics: http://judiciary.senate.gov/hearings/hearing.cfm?id=3982

The Senate Committee on Homeland Security and Government Affairs, Business Meeting, July 29, 2009: http://epic.org/redirect/081209_Senate_DHS_Biomet.html

National Campaign: http://privacycoalition.org/stoprealid/

Privacy Office - DHS Data Privacy and Integrity Advisory Committee: http://www.dhs.gov/xinfoshare/committees/editorial_0512.shtm

Comments of the DHS Data Privacy & Integrity Advisory Committee, May 2007: http://epic.org/privacy/id-cards/dpiac_comm_050707.pdf

EPIC - ID-Cards: http://epic.org/privacy/id-cards/

EPIC's Comments on Minimum Standards for Driver’s Licenses and Identification Cards: http://epic.org/privacy/id-cards/epic_realid_comments.pdf

REAL ID Implementation Review: Few Benefits, Staggering Costs: http://epic.org/privacy/id-cards/epic_realid_0508.pdf

EPIC, in promoting open government, frequently requests documents under the Freedom of Information Act to obtain information from the government regarding surveillance. Public disclosure of obtained information improves government oversight and keeps the public informed about the activities of the government. EPIC is currently pursuing records to gain more information regarding several government surveillance programs.

On June 25, 2009, EPIC sent FOIA requests to the Department of Homeland Security and the National Security Agency requesting the release of the National Security Presidential Directive 54 and the subsequent Comprehensive National Cybersecurity Initiative. It was under the purview of the Directive, issued in 2008, that the intelligence community developed the CNCI to "improve how the federal government protects sensitive information from hackers and nation states trying to break into agency networks." Although these documents are the foundation of national policies to protect citizens' information held by government agencies, neither document has been released in full to the public. EPIC filed an appeal with both the agencies for failing to disclose these records.

EPIC also is pursuing records requests for information regarding the Whole Body Imaging systems being used by the Transportation Security Administration for passenger security screening in airports. This millimeter wave technology produces photo-quality images of travelers as if they were undressed. Although the TSA claims it is not storing images of passengers screened by the system, the scanners are capable of such storage and there is no law that prevents this practice. EPIC filed requests with the TSA, the Department of Defense, and the U.S. Marshal's Service. EPIC is seeking information including: the contracts with the companies providing the scanners; materials used for training TSA employees operating the scanners; copies of images produced by the scanners; and other uses of the technology, such as security screening in federal court buildings. No documents have been approved, but appeals have been filed with the TSA and the Marshal's Service.

EPIC also filed a FOIA request with the Food and Drug Administration, which announced the "Sentinel Initiative" in May 2008. One of the goals of this Initiative is to develop an integrated system, using electronic data from healthcare information holders, to analyze electronic health data in order to identify potential risks concerning medical products that have been approved by the FDA and are available to the public. EPIC is seeking records regarding FDA’s readiness for compliance with statutory privacy protections in the development and use of this extensive database of sensitive personal information. The FDA has provided some documents regarding the development of the database, but has not responded to the requests specifically seeking information on privacy policies. EPIC filed an appeal with the FDA for the release of this information.

In addition to these requests, EPIC has also filed FOIA requests with the Federal Bureau of Investigation regarding use of the powers granted under the Patriot Act and resulting in potential legal violations; the Department of Education and the Department of Defense regarding collection of student data for military recruitment purposes. EPIC also is pursuing an appeal under FOIA with the General Services Administration for contracts between the U.S. government and social network service providers.

EPIC - Open Government: http://epic.org/open_gov/

Freedom of Information Act Gallery: http://www.epic.org/open_gov/foiagallery/

EPIC's FOIA Litigation Docket: http://epic.org/privacy/litigation/

FOIA Letter to NSA Seeking Documents on National Cybersecurity Policies: http://epic.org/open_gov/foia2009/foia-nsa-cybersec.pdf

FOIA Letter to DHS seeking Documents on National Cybersecurity Policies: http://epic.org/open_gov/foia2009/foia-dhs-cybersec.pdf

FOIA Appeal to NSA regarding documents on National Cybersecurity Policies: http://epic.org/open_gov/foia2009/foia-appeal-nsa-cybersec.pdf

FOIA Appeal to DHS regarding documents on National Cybersecurity Policies: http://epic.org/open_gov/foia2009/foia-appeal-dhs-cybersec.pdf

EPIC - Whole Body Imaging Technology http://epic.org/privacy/airtravel/backscatter/

FOIA Letter to DHS seeking documents regarding Whole Body Imaging (4/14/2009): http://epic.org/open_gov/foia2009/foia-dhs-wbi-4142009.pdf

FOIA Letter to DHS seeking documents regarding Whole Body Imaging (7/3/2009): http://epic.org/open_gov/foia2009/foia-dhs-wbi-732009.pdf

FOIA Letter to USMS seeking documents regarding Whole Body Imaging: http://epic.org/open_gov/foia2009/foia-usms-wbi.pdf

FOIA Letter to DOD seeking documents regarding Whole Body Imaging: http://epic.org/open_gov/foia2009/foia-dod-wbi.pdf

FOIA Appeal to TSA regarding the April 14, 2009 request: http://epic.org/open_gov/foia2009/foia-appeal-tsa-wbi.pdf

FOIA Appeal to TSA regarding the July 3, 2009 request: http://epic.org/open_gov/foia/foia2009/foia-appeal-tsa-wbi.pdf

FOIA Appeal to USMS: http://epic.org/open_gov/foia/foia2009/foia-appeal-usms-wbi.pdf

FOIA Letter to FDA seeking documents regarding the Sentinel Initiative: http://epic.org/open_gov/foia/foia2009/foia-fda-sentinel.pdf

FOIA Appeal to FDA: http://epic.org/open_gov/foia/foia2009/foia-appeal-fda-sentinel.pdf

DHS Outlines Progress in 9/11 Recommendation Report

The Department of Homeland Security has released a progress report on 9-11 Commission Recommendations. The recommendations pertain to guarding against terrorism and ensuring transportation security, border security; increasing "preparedness efforts;" protecting privacy and civil liberties; and improving collaboration and information sharing. The recommendation include developing a risk-based plan for transportation security, airline passenger pre-screening, airline passenger explosive screening, and checked bag screening. The tracking and disrupting terrorist financing, standardizing secure identification, integrating border security into larger network of screening points including transportation system are also recommended. The DHS also advised allocating homeland security funds based on risk and improving interoperability of communications at all levels of government and establishing a unified incident command system. The DHS report also recommended balancing security and civil liberties and safeguarding individual privacy when sharing information. EPIC had testified before the 9-11 Commission and had emphasized the important history of privacy protection, the problems with new systems of surveillance, and the specific need to preserve constitutional checks and balances. EPIC also urged the Commission to consider the important role of public oversight in evaluating the federal government's intelligence-gathering authority rather than focusing exclusively on Congressional oversight.

Progress in Implementing 9/11 Commission Recommendations: http://epic.org/redirect/081209_911Comm_Prog_Rpt.html

DHS: Secretary Napolitano and National Security Preparedness Group Discuss DHS Progress in Fulfilling 9/11 Commission Recommendations: http://www.dhs.gov/ynews/releases/pr_1248455026046.shtm

EPIC - The 9/11 Commission Report: http://epic.org/privacy/terrorism/911comm.html

The 9/11 Commission Report: http://epic.org/privacy/terrorism/usapatriot/sec12.pdf

Social Network Privacy Study Reports Serious Concerns

A Cambridge University study covering 45 social networks has reported serious concerns about the extent such sites fail to keep users' personal information private. While inaccurate privacy policies and inaccessible guidelines have been reported before, the Cambridge report provides numerical statistics to confirm their scope. The researchers found faults with the amount of personal information required to be handed over, the standards of encryption protocols, default privacy settings, and confusing user-interfaces. Testing each site against 260 criteria, the researchers examined features such as log-in procedures and configuration controls. The study concluded that "the naive application of utility maximization theory fails to capture all the intricacies of the market for privacy in social networking." The report also stated that "a major problem was the lack of accessible information for users, encouraged by the sites' strong incentives to limit privacy salience as part of the privacy communication game: the data suggests that sites may have evolved specifically to communicate differently to users with different levels of privacy concern." Recently, the Canadian Privacy Commissioner held that although Facebook had taken some steps to address privacy, more safeguards were necessary.

The Privacy Jungle: On the Market for Data Protection in Social Networks: http://epic.org/redirect/081209_SNS_Study_Cambridge.html

Report of Findings into the Complaint Filed by the CIPPIC against Facebook, Inc. under PIPEDA: http://www.priv.gc.ca/cf-dc/2009/2009_008_0716_e.cfm

Article 29 Working Party Opinion of Social Networking Sites: http://epic.org/privacy/socialnet/Opinion_SNS_090316_Adopted.pdf

EPIC - Facebook Privacy: http://epic.org/privacy/facebook/

EPIC - Social Networking Privacy: http://epic.org/privacy/socialnet/

FTC Postpones Red Flags Rule

The Federal Trade Commission has delayed the enforcement of the Red Flags Rule until November 1, 2009 in an effort to give creditors and financial institutions more time to review, develop and implement written Identity Theft Prevention Programs. The Rule was scheduled to come into force on August 1, 2009. The Red Flags Rule require financial institutions and creditors to maintain identity theft prevention programs that identify, detect, and respond to patterns, practices, or specific activities that could indicate identity theft. The program was supposed to become effective on November 1, 2008 and subsequently was postponed to May 1, 2009. The FTC decided to further extend the enforcement so as to enable businesses to gain a better understanding of the Rule and any obligations that such businesses may have under it. The delay in enforcement does not affect other federal agencies' enforcement of the original November 1, 2008 compliance deadline for institutions subject to oversight. The rules were developed pursuant to the Fair and Accurate Credit Transactions Act of 2003. EPIC had testified before Congress regarding the FACTA, supporting the inclusion of stronger privacy and identity theft protections in the law. "Americans need greater protections to address problems with identity theft, privacy, and inaccuracy," EPIC argued.

FTC Announces Expanded Business Education Campaign on "Red Flags" Rule: http://www2.ftc.gov/opa/2009/07/redflag.shtm

FTC Red Flags Guide and other documents: http://www.ftc.gov/redflagsrule

Federal Register Notice Issuing "Red Flags" ID Theft Rules: http://ftc.gov/os/fedreg/2007/november/071109redflags.pdf

Agencies Issue Final Rules on Identity Theft Red Flags, October 31, 2007: http://ftc.gov/opa/2007/10/redflag.shtm

EPIC's Page on Identity Theft: http://epic.org/privacy/idtheft

Privacy Opposition to Google Books Settlement Grows

Civil liberties organizations are urging Internet users to tell Google to adopt privacy protections for the Google Book Search Settlement. The Google service creates a framework that gives the company access to substantial personal information concerning book buyers, library patrons, and rightsholders while placing no meaningful restrictions on the company's use of the data. A judge in New York will determine later this year whether to approve the proposed settlement. EPIC has an extensive page on the settlement and highlights the privacy concerns faced by readers if the settlement is approved as it is.

EPIC - Google Book Settlement and Privacy http://epic.org/privacy/googlebooks

ACLU - Google: Don't Close the Book on Reader Privacy: http://epic.org/redirect/081209_ACLU_Google_campaign.html

Google Books: http://books.google.com/

Google Books Settlement: http://www.googlebooksettlement.com/r/view_settlement_agreement

Bill to Curb SSN Misuse Introduced Before House

A bill to preclude federal, state and local government from selling or displaying Social Security Numbers to the general public has been introduced in the House. Rep. John Tanner (D-Tenn.) introduced and Sam Johnson (R-Texas) co-sponsored the "Social Security Number Privacy and Identity Theft Prevention Act of 2009" (H.R. 3306). The bill would amend the Social Security Act to enhance SSN privacy protections, prevent fraudulent misuse of SSN, and attempts to enhance protection against identity theft. The bill also restricts display of SSN on government IDs and tags, and prescribes uniform standards for truncation of SSN. The proposed law also prescribed criminal penalties for SSN misuse and extends civil monetary penalty authority. Similar legislation was introduced before the last Congress, and although approved, the bill was never voted on by the entire House.

Social Security Number Privacy and Identity Theft Prevention Act of 2009 (H.R. 3306): http://thomas.loc.gov/cgi-bin/query/z?c111:H.R.3306:

Social Security Number Privacy and Identity Theft Prevention Act of 2007: http://thomas.loc.gov/cgi-bin/query/z?c110:H.R.3046:

EPIC - Social Security Numbers: http://epic.org/privacy/ssn/

EPIC - Identity Theft: http://epic.org/privacy/idtheft

EPIC - Personal Data and Privacy Protection: http://epic.org/privacy/consumer/

"Privacy Protection and Minority Rights" Edited by Mate Daniel Szabo

http://www.ekint.org/ekint_files/File/kiadvanyok/privacy_minority.pdf

The protection of a minority group in any country envisages the grant of protection by the state and in some cases, preferential selection in the grant of employment, education, and business from which such group has been historically excluded. Conferring such benefits necessarily begins with identifying members and then granting them protections. However, according to the editor, the freedom of identity means that the state does not have power to interfere with the decision of an individual to affirm or conceal one's ethnic identity or force someone to make a declaration to that effect.

This book is a collection of three essays and the compilation starts off by educating the readers about the foundation of minority registration in Hungarian Law. Ivan Szekely's article focuses on affirmative action and data protection. Szekely highlights the conflict when the realization of one fundamental right can conflict with another - the ban on compiling registers of minority origin and identities under data protection laws one the one hand is at cross purposes with fighting the abuses of claiming election seats or a role in distributing state subsidies on the other. As a solution, Szekely endorses the use of a "central registration of aggregate data" which does not attract data protection laws while allowing group-level realization of subsidies. The author also suggests various other solutions like application of unidirectional data transformation procedures, data dividing, application of privacy enhancing technologies and then discusses consequent advantages.

The next essay of the book addresses whether ethnic data in Hungary should be standardized. This article also examines the relationship between protection of sensitive data and the free flow of ethnic data required for unimpeded provision of additional rights. At the outset, Balazs Majtenyi and Laszlo Andras Pap point out people in need of protection are defined differently in cases of discrimination than when affirmative measures are at stake. The writers then review the constitutional background and regulatory environment with regard to data processing and make suggestions that could be implemented under Hungarian law. Majtenyi and Pap also suggest that although a legislative effort may rectify human rights violations, a shift in the mindset of lawyers would be equally desirable. The authors further call upon lawmakers and officials to have the courage to create and run a "genuinely functional system of minority protection."

The final essay of the compilation pertains to identification checks based on racial or ethnic stereotypes. Written by Kadar, Korner, Moldova and Toth, this paper cites to several reports which show that Roma - the minority community of Hungary - had a much lesser chance of avoiding liability if caught during the commission of a crime. The essay goes on to describe the "Strategies for Effective Police Stop and Searches," the proportion of ID checks in relation to the population and its effectiveness. Pointing out the ethnic disproportionality in the "ID-checked" population, the researchers conclude that ethnic profiling by police officers is a problem that must be acknowledged. The authors suggest amending the Police Act, institutionalizing relationship between local communities and the police, and the training of police officers.

While the book pertains to privacy protection and honoring minority rights in Hungary, it is equally applicable in a more macrocosmic sense. Virtually every country in the world has a minority population which are targeted by another group - be it the majority or a state-backed authority. These groups always end up suffering some sort of discrimination or another. Some suggestions contained in this book would indeed be helpful to anyone looking to understand human rights violations, offer possible remedies, and is certainly worth a read to human rights activists and lawmakers alike.

-- Anirban Sen

"Litigation Under the Federal Open Government Laws 2008," edited by Harry A. Hammitt, Marc Rotenberg, John A. Verdi, and Mark S. Zaid (EPIC 2008). Price: $60.

http://epic.org/bookstore/foia2008/

Litigation Under the Federal Open Government Laws is the most comprehensive, authoritative discussion of the federal open access laws. This updated version includes new material regarding the substantial FOIA amendments enacted on December 31, 2007. Many of the recent amendments are effective as of December 31, 2008. The standard reference work includes in-depth analysis of litigation under Freedom of Information Act, Privacy Act, Federal Advisory Committee Act, Government in the Sunshine Act. The fully updated 2008 volume is the 24th edition of the manual that lawyers, journalists and researchers have relied on for more than 25 years.

"Information Privacy Law: Cases and Materials, Second Edition" Daniel J. Solove, Marc Rotenberg, and Paul Schwartz. (Aspen 2005). Price: $98.

http://www.epic.org/redirect/aspen_ipl_casebook.html

This clear, comprehensive introduction to the field of information privacy law allows instructors to enliven their teaching of fundamental concepts by addressing both enduring and emerging controversies. The Second Edition addresses numerous rapidly developing areas of privacy law, including: identity theft, government data mining and electronic surveillance law, the Foreign Intelligence Surveillance Act, intelligence sharing, RFID tags, GPS, spyware, web bugs, and more. Information Privacy Law, Second Edition, builds a cohesive foundation for an exciting course in this rapidly evolving area of law.

"Privacy & Human Rights 2006: An International Survey of Privacy Laws and Developments" (EPIC 2007). Price: $75.
http://www.epic.org/phr06/

This annual report by EPIC and Privacy International provides an overview of key privacy topics and reviews the state of privacy in over 75 countries around the world. The report outlines legal protections, new challenges, and important issues and events relating to privacy. Privacy & Human Rights 2006 is the most comprehensive report on privacy and data protection ever published.

"The Public Voice WSIS Sourcebook: Perspectives on the World Summit on the Information Society" (EPIC 2004). Price: $40.

http://www.epic.org/bookstore/pvsourcebook

This resource promotes a dialogue on the issues, the outcomes, and the process of the World Summit on the Information Society (WSIS). This reference guide provides the official UN documents, regional and issue-oriented perspectives, and recommendations and proposals for future action, as well as a useful list of resources and contacts for individuals and organizations that wish to become more involved in the WSIS process.

"The Privacy Law Sourcebook 2004: United States Law, International Law, and Recent Developments," Marc Rotenberg, editor (EPIC 2005). Price: $40.

http://www.epic.org/bookstore/pls2004/

The Privacy Law Sourcebook, which has been called the "Physician's Desk Reference" of the privacy world, is the leading resource for students, attorneys, researchers, and journalists interested in pursuing privacy law in the United States and around the world. It includes the full texts of major privacy laws and directives such as the Fair Credit Reporting Act, the Privacy Act, and the OECD Privacy Guidelines, as well as an up-to-date section on recent developments. New materials include the APEC Privacy Framework, the Video Voyeurism Prevention Act, and the CAN-SPAM Act.

"Filters and Freedom 2.0: Free Speech Perspectives on Internet Content Controls" (EPIC 2001). Price: $20.

http://www.epic.org/bookstore/filters2.0

A collection of essays, studies, and critiques of Internet content filtering. These papers are instrumental in explaining why filtering threatens free expression.

EPIC publications and other books on privacy, open government, free expression, crypto and governance can be ordered at:

EPIC Bookstore
http://www.epic.org/bookstore

EPIC also publishes EPIC FOIA Notes, which provides brief summaries of interesting documents obtained from government agencies under the Freedom of Information Act.

Subscribe to EPIC FOIA Notes at: https:/mailman.epic.org/mailman/listinfo/foia_notes

Pan-European Dialogue on Internet Governance (EuroDIG), Geneva, Switzerland, September 14-15, 2009. For more information,
http://www.eurodig.org/

ASAP FOIA/Privacy Act Workshop, Chicago, Illinois, September 21-23, 2009. Registration: July 7, 2009 - September 11, 2009. For more information, http://www.accesspro.org/

2nd International Action Day "Freedom not Fear - Stop the Surveillance Mania," September 12, 2009, Worldwide Demonstrations, Events, Privacy Parties etc. in many countries. For more information,
http://wiki.vorratsdatenspeicherung.de/Freedom_Not_Fear_2009

3rd European Privacy Open Space, October 24-25, 2009, Vienna, Austria. For more information, http://www.privacyos.eu

Global Privacy Standards in a Global World, The Public Voice, Madrid, Spain, November 3, 2009. For more information,
http://thepublicvoice.org/events/madrid09/

31st International Conference of Data Protection and Privacy Commissioners, Madrid, Spain, November 4-6, 2009. For more information,
http://epic.org/redirect/072009_31Conf_IntlDPA.html

UN Internet Governance Forum, November 15-18, 2009, Sharm El Sheikh, Egypt. For more information, http://www.intgovforum.org/

Join the Electronic Privacy Information Center on Facebook

http//facebook.com/epicprivacy

http://epic.org/facebook

Start a discussion on privacy. Let us know your thoughts. Stay up to date with EPIC's events. Support EPIC.

The EPIC Alert mailing list is used only to mail the EPIC Alert and to send notices about EPIC activities. We do not sell, rent or share our mailing list. We also intend to challenge any subpoena or other legal process seeking access to our mailing list. We do not enhance (link to other databases) our mailing list or require your actual name.

In the event you wish to subscribe or unsubscribe your e-mail address from this list, please follow the above instructions under "subscription information."

The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues such as the Clipper Chip, the Digital Telephony proposal, national ID cards, medical record privacy, and the collection and sale of personal information. EPIC publishes the EPIC Alert, pursues Freedom of Information Act litigation, and conducts policy research. For more information, see http://www.epic.org or write EPIC, 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. +1 202 483 1140 (tel), +1 202 483 1248 (fax).

If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "EPIC" and sent to 1718 Connecticut Ave., NW, Suite 200, Washington, DC 20009. Or you can contribute online at:

http://www.epic.org/donate

Your contributions will help support Freedom of Information Act and First Amendment litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and expanding wiretapping powers.

Thank you for your support.

Subscribe/unsubscribe via web interface:
http://mailman.epic.org/mailman/listinfo/epic_news

Back issues are available at:
http://www.epic.org/alert

The EPIC Alert displays best in a fixed-width font, such as Courier.

.