The strange case of all these preserved text messages

I don’t know about you, but I’m a bit confused. You see, I’m following the proceedings of the Leveson Inquiry, and am constantly amazed at the amount of evidence that gets unearthed whenever someone wants to ask a significant question.

Take, for example, the current line of questioning about the links that exist between members of the media and the political classes. I’m enthralled at the torrent of detail that gushes out each day about precisely who sent what text message to whom – but I don’t really understand how someone has been able to preserve (and subsequently provide) the content of the text messages we are hearing so much about.

I’m absolutely certain that the requesting parties wouldn’t have been able to use RIPA powers to demand that the content of these messages be handed over by the mobile phone companies, as they don’t keep them. All they are required to know is when a message was sent, not what was in the message.

So, who is storing this stuff?

Do our politicians have special phones, with huge memories, that retain them? Or are they forwarded to some central political database, to ensure that regulatory authorities can access them when investigating political misbehaviour? Does everyone who uses this special database make sure that all their friends don’t sent them incriminating messages, which would prove incredibly embarrassing should they be required to be produced to people like Lord Leveson?

I really would like to know.

It’s especially important, I think, because soon the Government will be unveiling its own cunning plans to require communication and internet service providers to retain more information about how people use their services. I hope no-one gets confused, and assumes that the Government will be requiring these providers to retain the content of their communications.

So, the sooner we all understand just where the evidence about the content of these text messages is coming from, the faster we will be able to trust the Government when it assures everyone that it is not going to be requiring communication and internet service providers to keep this stuff.


Image credit:
http://www.ipipi.com/images/help/text-message-from-phone.jpg

.

Cookies: Thank goodness we operate from ‘Blighty!

Not only can we Brits celebrate the Queen’s Diamond Jubilee, England’s (relative) success in the Euro 2012 Football Championships and the impending Olympics, we now have another reason to cheer.

Information Commissioner Christopher Graham was on sparking form when speaking to the assembled crowd at the Evidon Empower II summit in Central London today. In typical no-nonsense style, he set out to bust three “cookie myths” that had emerged, and left everyone impressed with his determination to apply fairness and common sense to a community that is in a pretty fragile state right now.

Christopher Graham only made one tactical mistake. Had he not have had to leave half way through the proceedings, he would almost certainly have been carried, shoulder high, around the audience to wild acclaim at the end of the event. Why? Because the audience was also treated to a view of the cookie conundrum from the perspective of German and French privacy regulators, and from a Dutch lawyer who spoke about the Dutch regulatory climate.

Believe me, ‘Blighty is the place to do data protection business in.

The German data protection regulators evidently can’t even decide if their Government has enacted a sufficiently wide cookie law – and they are so concerned about the matter that all 18 of them will hold a meeting in September (yes, in September) to consider the issue. Turning to the Netherlands, all Dutch webmasters are expected to comply (already) with a law that came into force last Tuesday, with (apparently) no period for reflection as to what it actually means. At least the Brits had a year to think about things before the ICO got tougher. And the French – well, let’s just be glad that British webmasters aren’t expected to take the steps evidently required by our chums at the CNIL.

Very tellingly, though, a CNIL official paid the ICO an extraordinary compliment, indicating that perhaps even they accept that French webmasters were likely to face significant compliance issues if they were to follow the letter of the French law: “If all of the companies in France followed even the ICO’s guidance, we would be very happy”. So, even our French chums are capable of displaying that touch of pragmatism that is so often necessary in data protection land.

Christopher Graham was on sparkling form when he put his (metaphorical) myth-busting pants on to slam allegations (1) that this cookie stuff is all the ICO’s fault, (2) that at the last minute the ICO changed its mind on the consent rules, and (3) that no-one takes any notice about cookies. All good stuff. He then dropped the bombshell that the Article 29 Working Party had, very recently, reached an agreement (yes, a unanimous agreement) as to which cookies, under certain conditions, can be placed without the requirement of informed consent. The opinion also gives guidelines for deciding whether a cookie is exempt from the principle of informed consent.

Personally, given the huge difference of views that those speaking for the French, German and Dutch regulators expressed, I’m looking forward to reading it to work out just what it is that everyone can agree on, for it does seem to be the case that there is a lot that regulators can’t quite agree on just yet. However, as I’m a “glass half full” rather than a “glass half empty” blogger, I want to celebrate the bright side of things.

Here is a link to the actual document, and the press release. Let me know what you think. It might just be one of those that really is worth reading!


Source:
http://ec.europa.eu/justice/data-protection/article-29/press-material/press-release/art29_press_material/20120612_pr_cookie_consent_exemption_en.pdf

Looking at good data protection

One of my nephews asked me a very challenging question during a family lunch over the weekend.

“What does good data protection look like?” he asked.

“Shut up and finish your trifle” I felt like replying – but I didn’t. It’s a question that I’ve been asked on more than one occasion, recently, so I’ve been developing an answer which I hope won’t sound too rehearsed each time that deceptively hard question is raised.

I must confess that, until very recently, I was not fully aware at the extent of public knowledge about data protection issues. You see, I’ve obviously led too sheltered a life. When you surround yourself with data protection professionals, and spend lots of time answering hard questions posed by people who need reassurance on data protection matters, you tend to forget what a small world this can actually be.

I’m now spending increasing amounts of time with people whom I might previously just have criticised as “not getting it”. I now need to spend far more of my time trying to paint a picture of what it is that good data protection standards will actually achieve, so that these people can do the maths for themselves and work out whether the investment needed to reach this standard will actually pay off.

Individually, we may feel worried about losses of personal information when responding to ICO surveys’ etc, but how many people actually do anything about it? How many of us have waited for an email from our chums at LinkedIn to advise us that, very regrettably, our passwords may have been compromised due to a recent security incident, so, as a precautionary measure, we should change the password? And how many of us have actually changed these passwords, regardless of whether we received an email?

And yet we are the privacy professionals. So when enough of us can’t get sufficiently concerned about our own security to carry out basic password-changing routines, we should hardly complain when the great unwashed haven’t the faintest idea about what good data protection actually looks like.

Anyway, as my nephew finished his trifle, I explained to him what good data protection looks like. He liked it. Both the trifle and my explanation. And then he spent the rest of the afternoon making funny images and playing games on my iPad, demonstrating a far higher level of technical proficiency on the thing than I’ve ever managed.

If you want to hear my explanation about what good data protection look like, it looks as though you’ve got two choices. You can either invite me to Sunday lunch, and slip the (data protection) question into the conversation, preferably as we’re enjoying our pudding. Or, you can pop along to one of the information governance networking events sponsored by the British Standards Institute and hear me talk about this very subject. I’ll be speaking at the BSI’s offices in Milton Keynes on 14 June and in West London on 3 July.

My next challenge will be to turn this explanation into a popular ditty, that can be sung to the tune of a well loved song. But I won’t work on that project that until I’ve had some audience feedback on whether what I see as good data protection practice is considered credible in their eyes.


Source:
http://www.telegraph.co.uk/technology/news/9322228/Think-Tank-LinkedIn-gets-hacked-and-nobody-cares.html

Image credit:
http://i488.photobucket.com/albums/rr250/KimiVengenz/Textures/Cracked-Mirror-psd40874.png

.

How many events can a data protector reasonably attend each year?

I left the Hampstead Theatre last night on a high. It was a brilliantly exhilarating production of Chariots of Fire, which will shortly be heading its way to London’s West End for a season. That haunting tune by Vangelis is still buzzing in my head. And as the production developed, I really began to engage with the lead characters. They were sprinting in front of me, behind me, right through the audience, in wonderfully choreographed episodes that really made me feel part of, rather than just watching, an event.

Who were these characters? Basically, they were a bunch of people who enjoyed running around in circles, developing an unremitting routine that would involve exposure to the “same old, same old”, each and every day. It reminded me very much of today’s data protection practitioner, who trudges wearily (and occasionally joyfully) to event after event, hoping for inspiration or a nugget of wisdom from some practitioner in the field who has actually spotted a new angle on stuff that’s gradually developing and which may become something important at some stage.

Since the end of February, I’ve kept a list of data protection events that are of likely to be interest to British data practitioners. The upcoming ones are listed here, while an archive contains brief details of those that have already been held. Of course, I’m not counting them all – only those I become aware of. But, I have become aware of 45 events that have already happened, and my list contains details of another 33 that are on their way. Most of these events occurred in London – so I must be missing out on many of them.

Even so, that’s an awful lot of events. Basically, if you had nothing better to do, I think you could almost live off the canapés and wine which are in abundance, up to three times a week. The trouble is, I don’t think that there’s really enough news out there to fill all of the presenting space that is now available. And I ought to know. I am finding it ever harder to find fresher ways of showing how much I care about data protection stuff. But, I will be speaking at a number of events over the next few weeks, so I really should not bite the hand that offers me so much public exposure. Especially since I am now be available for private consultations as well as public performances.

Unlike athletics, though, data protection isn’t a race. No one wins. Ever. It just never ends. Just when you think you’ve dealt with one event, another one crops up. Or, there’s media pressure for the regulator to open up an issue that almost everyone had thought had already been settled. And everyone is only as good as their last win (or speech). Few people care about celebrating the great work that has already been achieved, the focus always appears to be on finding new ways of addressing the fresh challenges ahead.

All hope is not yet lost. A really clever bod at the Data Protection Forum has had a brilliant idea. Perhaps, just once a year, we data protectors could relax for a few hours and celebrate some of the highlights of the last season. Something like an awards ceremony. Awards could come in the form, say, of “ICO Indulgences”, ie a “get out of regulatory hell free” token for the next awful incident that the poor Data Protection Manager experienced.

Data Protection Hero of the Year could expect to have lunch with Commissioner Viviane Reding. Data Protection Villain of the Year could expect 2 lunches with Commissioner Reding.

Let me know what you think. Tell me if you have any bright ideas for categories (or recipients) of suitable awards.

And, please, let me know if you also think that there are too many data protection events currently being organised in ‘Blighty. (Or, alternatively, if you want to book someone like me as a motivational speaker for your own event!)


Image credit:
http://vlstatic.com/visit/whats-on/theatre/chariots-of-fire/59638-640x360-chariots-fire-640.jpg

.

Wanted: a (British) patron saint for data protection

A very impressive crowd comprising the usual suspects attended the summer meeting of the Data Protection Forum today. I had the honour of chairing the proceedings, and thanks to the usual Data Protection Forum –style democracy, the Annual General Meeting went off without a hitch. Yours truly has been duly returned to Chair the Forum meetings for the next twelve months, and I am extremely lucky to be able to rely on the everso impressive Jenny Gallagher to share the Chairing duties with me.

If the cunning plans that I revealed to the membership, following some intensive brainstorming work by the other Committee Members, come to fruition, the Forum will be in a very different shape this time next year. Copies of these plans are available to anyone – well, anyone who fancies joining the Forum, anyway.

The main part of the day, though, was spent considering the data protection implications of “emerging technologies”. We data protection folk need to be as cool and as savvy as the current crop of school leavers. We need to understand what’s happenin out there, so we can advise on ways of remaining cool & wiv it.

Actually, this is hard. The pace of change is bewildering. This is both in terms of the computing technologies that are being developed, and the electronic toys that we will – and increasingly already can - buy to exploit these technologies.

Anthony Nagle from the London office of Morrison & Foerster gave delegates some extremely useful tips about the pitfalls of the way companies currently feel obliged to use social media. Olivier Proust had kindly travelled from the Brussels office of Morrison & Foerster to provide an update on the cookie issue, and how the key debates were being played out by different Member States. (Top tip – ask your friends what the Bulgarian implementing legislation provides, and then ask yourself how long it will be before the Data Protection Taliban wakes up to what they’ve done!) In my view, the international data protection community has excelled itself, and has created a monster even more complicated than transborder data flows to implement.

John Morrison, of Sapphire reminded us of the insatiable demand for employees, at all levels, to bring their own devices to work, and the security implications that follow. Finally, Gail Crawford, of Latham & Watkins, reminded us that most of this stuff was likely to end up being processed “in the cloud” , and the implications of this were still unknown. It made me think whether, given the trajectory of the pace of technological change currently taking place, we should actually first try and understand the implications of these technologies before designing laws that are supposed to regulate them. Or should we continue on our current path, which is to amend current laws before we really know how the new technologies will be capable of being applied to them?

Fear not, I suggested. We data protection folk are hardy folk, and we’ll all enjoy careers for life – and this ought to bode well for the future of institutions like the Data Protection Forum.

One issue was nagging me throughout the day. It’s been mooted that the British data protection community needs a patron, someone to whom everyone could look to for inspiration and guidance. Should we extent invitations to the established legends of the British data protection world? People like Eric Howe, the first Data Protection Registrar? Or Elizabeth France or Richard Thomas, both former Commissioners? It would not be fair to invite current ICO folk as they are currently too close to the game.

My view, for what it’s worth, is that our first patron ought to be someone like the legendary actress Thelma Barlow. Why? Because of her catch phrase as the incomparable Mavis Riley in Coronation Street. That lingering phrase, raising to a crescendo and then tailing off into ... futility ... “I don’t really know” –is one that is likely to cross our lips with increasing frequency, especially when we are asked if we know whether the European data protection regulators are likely to develop a common position on so many of the important emerging issues of the day.

Note:
The September session of the Data Protection forum, scheduled for 12 September, promises to be a cracker. Get in touch if you want some advance news on those who will be astounding the delegates with their amazing insights into the way regulators develop opinions – and then have their minds changed.

Image credit:
http://static.wix.com/media/ee7c55f33c79ca61447ef903b61205e1.wix_mp

.

Branching out

After over twenty years of having enjoyed the honour of being an employee for various companies, and being paid for doing the data protection work I love, I’ve branched out on my own.

The next twelve months – at least – will be a period during which I will be determined to prove to myself that I can create a bespoke consultancy practice, where likeminded people will congregate to help each other out and find solutions that fit the lives of British – and European - citizens.

I hope that I’ve picked up enough skills along the way to demonstrate to potential clients that I care about this data protection stuff. I do care about fairness and transparency, and I care about being able to deliver solutions that are ethical and far-sighted.

I’m reminded of the advice that Aaron Sorkin gave to this year’s graduates when delivering his Commencement Speech at Syracuse University. I know that there will be times when I’m going to fall down. But I’m not going to care about how many times I fall down, so long as it’s one fewer than the number of times I get back up again.

I sense I’m going to rock the boat along the way, too. Not everyone will approve of the way I work, or of the way I (occasionally) speak out about the issues that grip me each day. But, like Aaron Sorkin, I’m well aware that decisions are made by those who show up. And I intend to keep on showing up, on the conference circuit and around the Westminster village, and beyond, to gently remind the principal decision makers of the consequences of particular choices that they feel need to be taken.

I’m also determined to remain on the best of terms with everyone I’ve previously worked with. We are all people with a passion, and all we have our own opinions – and I’m far too modest to suggest that my current opinion is the only one worth listening to. In a way, that’s the challenge that I’m most looking forward to – I know my current clients extremely well, and so I know what advice best suits their particular risk appetites. And, I hope to continue to develop the great working relationship I have with them. Equally, I’m really looking forward to understanding just why it is that new clients will have slightly different desires, different challenges and different risk appetites. Critically, the customers of these new clients are likely to be the same individuals whose interests I've been protecting for the past two decades anyway, so I'm confident that I know what they need.

Starting a business for the first time, dealing with lawyers and accountants on issues about which until recently I had no understanding, is invigorating and great fun. Lots more decisions need to be taken before I can fully apply my thoughts to the creative side of data protection advice. But I’m so glad to have taken the opportunity to see what creating a business is all about. And I do hope to continue to show up, as it were, on this blog, to offer a slightly different take on data protection than one would get just by reading the professional journals.

My blog may well offer a less serious approach than other commentators adopt, but who ever said that data protectors shouldn’t be allowed have fun as they worked!

The tale of King Otto and the cookies

I’ve been preparing a presentation on cookies for a bunch of marketing professionals. I’m guessing that they will already be bored stiff of hearing about the legal minutiae, and will switch off almost as soon as I mention either of the dreaded phrases “European Commission” or “data protection”.

So, how should I craft something new that makes a few serious points, while at the same time keeping an audience like this engaged? I’ve formed a cunning plan. I’ve be wearing a pair of red specs and will use linguistic terms that these guys get. And when I’ve told them the tale of King Otto, I’ll explain the relevance it has to the development of cookie regulation over the past few years. Then, they might understand what I’m on about.

Some of the language used by those who told the original tale of King Otto is quite rude, so I’ll clean it up, but I will let them know where they can read the unexpurgated version. The original tale was narrated by John Cleese in a 1972 episode of the amazing Monty Python’s Fliegender Zirkus.

The tale is of a wise old king called Otto (pictured), who played strange songs on his Hammond Organ up in the beautiful castle where he lived with the gracious Queen Syllabub (also pictured), and their lovely daughter Mitzi Gaynor. One day, Mitzi suddenly fell in love with the most beautiful young man she had ever seen. Luckily he was a prince. So she looked him up in the Observer's Book of Princes, learned his name, and went and introduced the subject of marriage to her father.

King Otto, as was his want, before giving permission to marry, always set the same task to princes, which, if they succeed, proved them worthy of his daughter's hand. At nine o'clock the next morning, armed only with their sword, they had to go to the highest tower in the castle, and jump out of the window. Invariably, dressed in a beautiful white robe, and gripping their magic sword, they would plummet to a painful death.

One day, when Princess Mitzi was out hopefully kissing frogs, she spotted a flash of gold beneath a weeping willow tree, and there, sure enough, was a prince. His name was Walter. He was rather thin and spotty, with a long nose and bandy legs, and nasty unpolished plywood teeth, and bad breath, and a rare foot disease, 'But', thought Mitzi, 'a prince is a prince,' and she fell in love with him without another thought and rushed into his arms. And after a time, or a few times anyway, he too fell in love with her, and very soon they were on their way to ask King Otto's permission to wed.

This time, giving into pressure from Queen Syllabub, King Otto changed the task. Prince Walter was excused of jumping out of the tower, and instead the following exchange took place:

“King Otto: Uh, oh, you must, oh... go down to the town and get me twenty Rothmans.

Prince Walter: What, now?

King Otto: No, tomorrow morning!”

And what’s all this got to do with cookies?

Well, are all old enough to remember the dire warnings of an impending disaster as web masters protested that were to be required to ask internet users to “consent” to something that everyone believed would be far too hard to explain. And yet, what’s happened since the ICO’s recent compliance milestone passed? Have internet users miraculously become better educated? Or has someone changed the task?

All will be revealed should you amble along to my presentation during the Marketing Week Live exhibition at London’s Olympia later this month.