Consider yourself (notified)

On Wednesday I blogged about being really impressed with the way that a Newham youth group had worked with the people behind the VOME (Visualisation and Other Methods of Expressions) project. Members of the youth group had produced a great music video, very cleverly setting out the principal concerns in song - and in dance moves that may well soon be copied in the clubs when the video goes viral.

Ironically, their reward is that Newham Council have announced the imminent closure of the youth group, so that the building they currently use can be made available to the Canadian Olympic Team for a couple of months next year. Some reward.

Anyway, their video is not out on YouTube yet, so there’s still chance for the staff at the Information Commissioner’s to pip them to the post by releasing a video of their own. Or perhaps they can form a choir to perform a series of songs at the ICO’s Xmas Party.

So, in case the ICO’s staff are up for it, and are on the lookout for a number with a full chorus, they might want to try belting out this one. (After they’ve apologised to Lionel Bart, that is...)


Picture it: The curtain opens to reveal a data controller handing over their £35 annual notification fee to a grey haired man in the cafe around the corner from a workhouse in Wilmslow, cunningly disguised as the Information Commissioner’s Office. The audience’s attention shifts from the data controller to the grey haired man. No, he’s not Gandalf. But he is an enforcer, and educator and a master of data protection. Yes, he’s a Deputy Commissioner. The Director of Data Protection.

He steps forward. He speaks, before singing to an oddly familiar tune.

[DIRECTOR OF DP (spoken)]
So, Data Controller, now you’ve paid your notification fee, you're coming with me.

[DATA CONTROLLER (spoken)]
Are you sure Mr. Graham won't mind?

[DIRECTOR OF DP (spoken)]
Mind?!

Consider yourself at home
Consider yourself one of the family
We've taken to you so strong
But my, your privacy policy is too long
Consider yourself well in
Consider yourself taking our literature
There isn't a lot to spare
Who cares?..Whatever we've got we share!

When it will chance to be
You will see
Some awful days
Data breaching days
Why worry?
We will rely on you
To step right in
And sort it out
Then you can take us out for a curry!

Consider yourself first rate
Stopping practices we hate,
And after some consideration, we can state
Consider yourself
One of us!

Consider yourself...

[DATA CONTROLLER]
At home?

[DIRECTOR OF DP]
Consider yourself...

[DATA CONTROLLER]
One of the family

[HEAD OF ENFORCEMENT]
We've taken to you

[DATA CONTROLLER]
So strong

[HEAD OF GOOD PRACTICE]
But my

[ENTIRE OFFICE]
Your privacy policy is too long.

[DIRECTOR OF DP]
Consider yourself...

[HEAD OF CUSTOMER CONTACT]
Well in!

[DIRECTOR OF DP]
Consider yourself...

[HEAD OF GOOD PRACTICE]
Taking our literature

[HEAD OF FINANCE]
There isn't a lot to spare

[ALL]
Who cares?
Whatever we got we share

[DIRECTOR OF DP]
Nobody tries to be lah-di-dah or uppity--
There’s a drinks machine for all

Only it's wise to be handy with a staple gun
When the MoJ wants a brawl!

[HEAD OF ENFORCEMENT]
Consider yourself
First rate.
Stopping practices we hate

[ALL]
And after some consideration we can state

[DATA CONTROLLER]
Consider yourself

[DIRECTOR OF DP]
Yes!

[ALL]
One of us!


.

Privacy on mobile devices: Not bad

Thud. Landing in my in-box yesterday was a hefty email from the GSM Association, giving me details of the views of over 4,000 mobile phone users in Singapore, Spain and the UK, on some privacy issues, particularly relating to the use of the mobile Internet and mobile applications. The research follows the January publication of the GSMA’s Mobile Privacy Principles, which described the way in which mobile consumers’ privacy should be respected and protected.

I’ll quote quite extensively from the study, as it’s quite interesting.

This study was designed to help mobile operators understand to what degree privacy interests were of concern to mobile users, as well as how they influence attitudes towards, and usage of, mobile Internet services and applications.

Overall, it showed that while privacy concerns can discourage consumer engagement with mobile Internet services, mobile applications and advertising, users greatly value the services and the opportunities they bring.

And the chief learning is that it’s necessary to strengthen consumer confidence and trust by giving users meaningful transparency, choice and control over how their personal information is used. So, there’s still a way to go, but consumers generally like what they’re getting.

Key Research Findings

About half of users were concerned about sharing their personal information while using the mobile Internet or mobile applications. Around 81 per cent of mobile users surveyed felt that safeguarding their personal information was very important and 76 per cent said they were very selective about whom they gave their information to. Key areas of user concern, which focused on trust and confidence, were highlighted as behavioural advertising, location-based services, mobile applications and third-party sharing. Other study findings include:

• 89 per cent of users think that it is important to know when personal information is being shared by an application and to be able to turn this off or on;
• 89 per cent think it important to have the option of giving permission for personal information to be used by third parties and 78 per cent are concerned with third parties having access to the location of their mobile without permission;
• 74 per cent want to be told if their personal information is collected to target them with offers or promotions; and
• 92 per cent of respondents have concerns when applications collect personal information without their consent and 79 per cent would like to know when and what type of personal information is being collected.

Practical services such as maps and weather are the most frequently used location-based services and are highly valued by over 70 per cent of respondents. 79 per cent think it is important to have the choice whether to receive location-based advertising with 86 per cent believing it important to be able to turn LBS promotions or advertising on or off.

Over 60 per cent of respondents were familiar with behavioural advertising, with 35 per cent finding it valuable, but 84 per cent thought it important to be able to have the choice whether to receive behavioural advertising that is based on browsing history and 81 per cent remained concerned about receiving behavioural advertising without their consent.

So, it’s somewhat of a thumbs up, and not a “doom and gloom” message for those who fear that a bit more transparency and control will result in customers switching off the behavioural advertising and other tracking technology in droves. The message is pretty clear – if consumers understand what it is that they are trading some of their privacy away for, they are going to be happy with the deal if, in return, they get stuff which is valuable to them.

The trick, therefore, is for the providers of this stuff to make their offerings sufficiently compelling, so that they’re not characterised as money- or privacy-grabbing bodies who simply want to take, rather than give back.

Simple, huh?

Source:
http://www.gsm.org/newsroom/press-releases/2011/6474.htm

How can young people better manage their online identities?

To many people, on-line privacy is a joke. To some it's a game. And this morning, on the 49th floor of One Canada Square in Canary Wharf, a select group of people assembled to play a new privacy game.

What am I on about?

Well, a Group of academic researchers from the Information Society Group at Royal Holloway College, University of London, have been working on a 3 year research project with other academics, consultants and Sunderland City Council. They've been learning how young people engage with concepts of information privacy and consent in the on-line world.

It's called the VOME project, which is an acronym for the Visualisation and Other Methods of Expressions project.

What they have learnt has turned their world upside down. In an age where it can be the teenager who does the on-line banking for the family because their parents don't understand the Internet, it seems clear that many of these young people have got a better understanding of what can go on than their parents.

The researchers have also found that young people communicate amongst each other in terms that are vastly different to older generations. Image and attitude can be more important than the actual words that are used. And when the searchers offered a youth group the funds to produce a video explaining their privacy concerns, they were astounded with the results. No, it wasn't a series of talking heads, earnestly discussing privacy issues. These guys had actually produced a music video, very cleverly setting out the principal concerns in song - and in dance moves that may well soon be copied in the clubs when the video goes viral.

Watch out for "Internet Saint or an Internet Demon", which should be out on YouTube pretty soon. You too can be one of the first to have seen it.

Regular readers will appreciate that I also know the value of slipping privacy messages into songs, and am developing a series of ditties based on various privacy issues. You can see some of my earlier efforts in the blogs I posted on 6 November 2009, 16,17,18 & 19 June 2011 and 12 July 2011.

Anyway, back to the on-line privacy game. The developers have found a way to use the rules of a game to model the way that information flows around the online environment as it does in real life. Players seek to collect and use different types of personal information cards. Some of the information can be swapped. Other types of information are supposed to remain private. Each player assumes the identity of a secret character (such as a hacker, online shopper, advertiser or bank. Players then trade cards with each other to obtain the highest scores.

And, to mix up the game, the players have to contend with a "random event" deck. Events such as "super injunction" or "game network hack" make life difficult for the players; perhaps by stopping them from using certain types of cards for a round.

Plans are afoot for this game to feature in the GameCity event in Nottingham, which will be held from 26-29th October. At this event, experienced gamers will be playing it and they'll be invited to develop online prototypes of it.

The game’s good. And it's still I development, although the version we played today was certainly at a very advanced stage. It has all the hallmarks of a great teaching tool. Particularly for those of us who like to learn by doing things, rather than by having a teacher just standing up in front of a class and saying things.

Sources:
www.vome.org.uk
http://gamecity.org/

.

Cookie compliance – Govt website suggests a new way to do it

The webmasters at the main Government website appear to have ignored the pioneering route the ICO’s team took to ensure compliance with the new cookie rules. Whether it’s absolutely lawful only time will tell, but as it’s the Government’s main website, I think they would be hard pressed to criticise many who adopted their cunning plan.

They’ve found a way of operating their site by giving users the option of objecting to the use of cookies – so long as the users burrow through the cookie explanations until they find the right hyperlinks.

Clever, huh? If it works, certainly.

Read on if you want to learn how they’ve managed this feat.

First, just an explanation of the site. Directgov is the website which is supposed to save public funds by enabling citizens to use this single portal to access all other Government services.

So, from the home page, in just In 3 clicks the user can navigate to the page explaining freedom of information and data protection. Interestingly, as well as briefly outlining the data protection principles, subject access rights and guidance on how to stop direct marketing, it also provides advice on how people can appeal against decisions made by the Information Commissioner. I’ve never seen a popular Government site carrying such prominent advice on how people can appeal against these decisions.

The Data Protection stuff is available by clicking on:
Government, citizens and rights
Your rights & responsibilities
Data protection & freedom of information

Anyway, the Directgov privacy policy (helpfully located by clicking on the link when you have scrolled to the bottom of the landing page) provides the usual stuff, and explains, in a section headed “Changes to this privacy policy”:

If this privacy policy changes Directgov will update this page. You should visit this page regularly so you know:

• What personal information Directgv collects
• how Directgov uses your personal information
• when (if ever) Directgov shares your personal information with someone else

Then, there’s a link to the cookies page.

The text explains that: Cookies allow Directgov to improve the services we provide, by telling us how people use them. Cookies are also used to make some parts of the website work properly. Find out what cookies Directgov uses and what they're for.

Under the heading “Why Directgov uses cookies” the following explanation is available:

When we provide services, we want to make them easy, useful and reliable. Where services are delivered on the internet, this sometimes involves placing small amounts of information on your device, for example, computer or mobile phone. These include small files known as cookies. They cannot be used to identify you personally.

These pieces of information are used to improve services for you through, for example:

• enabling a service to recognise your device so you don't have to give the same information several times during one task
• recognising that you may already have given a username and password so you don't need to do it for every web page requested
• measuring how many people are using services, so they can be made easier to use and there's enough capacity to ensure they are fast.

And then there’s another hyperlink “Internet browser cookies - what they are and how to manage them”

An interesting section (for the cookie anorak brigade) is called “Your privacy - how cookies are used by Directgov.”

I like it. It contains a list of the cookies that have been found on the websites operated by the companies and and government departments Directgov works with. The list is to be updated as more information emerges.

The section “Cookies for measuring use of services” states that: by understanding how people use Directgov, we can improve the information provided. This also ensures that the service is available when you want it and fast. We use a number of different methods of gathering this data, including services provided by the following companies.

The text then provides details about 5 cookies placed by Speed-Trap and 5 placed by Google Analytics. The details are set out as follows:

Name: jobseekerscsauvt
Typical content: which Directgov pages you have visited and when
This cookie is used by the Directgov jobs and skills search.
Expires: 1 year

Name: __utmmobile
Typical content: randomly generated number
Expires: 2 years
For further details on the cookies set by Google Analytics, users can click on yet another hyperlink.


Then, there’s an explanation about third party advertising cookies:

Where government uses advertising, it wants to make sure that this money is well spent. To help measure this, the following cookies are used on pages which are being marketed.

Doubleclick
Name: doubleclick.net
Typical content: randomly generated number
Expires: 2 years

GroupM
Name: b3-uk.mookie1.com or uk.gmads.net
Typical content: randomly generated number
Expires: 13 months

Then, there’s a section on “Cookies to make specific web services work”. These cookies are sorted into the following types:

Site customisation
Online forms
Cookies for using personalised answer tools (eg redundancy pay calculator)
Cookies for using mobile services
Cookies for using Local Directgov services
Cookies for using Directgov Innovate website - innovate.direct.gov.uk

Another hyperlink leads to more information on how to control or delete cookies. And yet other hyperlinks lead to more information about various cookies placed on some of the sites which can be accessed from the Directgov website.


There are some interesting details about some of the other cookies that are served under the Directgov domain. Virtually all of the cookies expire when the user exits the browser. But, for some reason, those set by the Schools and children centre finder (schoolsfinder.direct.gov.uk) last for 30 years. Don't ask why.

Finally, there are a few words on “Cookies on Directgov from social networking websites”: Directgov has links so you can use social networking websites (eg Facebook and Twitter) with Directgov. For example, you can bookmark and share links using the toolbar at the bottom of each page. These websites may place cookies on your computer. To find out more, users can click on the hyperlink 'How do you use this toolbar?'.


Clever, huh? By not making it too obvious about how to delete the Google Analytics cookies, these guys probably know far more about what users do when they browse onto these websites than the ICO does when users browse on the ICO’s website.

Sources:
http://www.direct.gov.uk/en/SiteInformation/DG_4004497
Privacy policy http://www.direct.gov.uk/en/SiteInformation/DG_020456
http://www.direct.gov.uk/en/SiteInformation/DG_196009

.

What comes first? St Valentine’s Day or a new draft DP Directive?

Brid-Aine Parnell of The Register has just posted an interesting statement from Matthew Newman a spokesman for EU Commissioner Viviane Reding.

It gives credence to the blog I posted on 21 September, when I announced: if my chums are to be believed, and believe me, I believe them, I’m likely to enjoy Xmas lunch with my friends and family well before the new draft Data Protection Directive may be published.

Apparently, Matthew Norman has recently said: the reform of the Data Protection Directive is ongoing and our proposals should be released in the next 20 weeks.

Getting my calandar out, that’s awfully close to February 14th.

So there’s even less chance of hearing much about the proposed amendments then, this side of Xmas.


Source:
http://www.theregister.co.uk/2011/09/26/viviane_reding_statement_withdrawn/

.

SMS spam: an odd remark in yesterday’s Hawktalk blog

Blog wars this is not. And nor should this be seen as a note of correction from the Provisional Wing of the mobile telecoms industry’s Rapid Rebuttal Unit. But, occasionally, even the great Chris Pounder makes remark that deserves to be challenged. Or, perhaps as he knows that I’m an avid reader of his blog, he was just trying to get me to comment on the accuracy of what he said.

Good try, Chris. And it is in a spirit of constructive criticism that I challenge his remarks. Not spite. We’re both on the same side – really, we are.

Anyway, readers of his blog will have noticed that yesterday he was commenting (as I did in my posting on 16 September) about the Information Commissioner’s recent appearance before the Justice Committee:

The IC is also concerned about “spamming texts” when they say something like “Our records show that you are in line for a compensation payment of £4,750 for that accident you had. Text CLAIM or STOP". The problem is, the IC said, was that “if you text either, you are confirming that you are there and providing a marketing lead, because these are randomly generated texts”.

The IC added that “We are working very hard with OFCOM and the telecom companies to try to get to the source of these spam texts, but it is a bit like looking for the launch sites of V2 bombers in the Second World War”. I don’t buy this explanation at all: telecom companies that do not know who is using their network. Come off it – they charge for texts don't they?

Believe it or not, Chris, the phone companies (almost certainly) don't know the identities of the bad guys. This is because these guys are applying some clever technology to something that was created over a decade ago. They are very likely to be using anonymous SIM cards. You know, the ones you can get at any newsagent or main railway station, or from a huge variety of retail outlets. And how might they be charging up these SIM cards? By using cash, rather than electronic money.

And these guys will be clever, too. They'll be trying to cover their tracks. And they'll also be relying on the hope that the spambusters who are investigating them won't have the analytical skills and technical toys that, say, the Anti Terrorism Squad probably has. We do need a healthy dose of proportionality in the resources that they have at their command. They are unlikely to have the sort of technology we see on Spooks or the Bourne Identity.

These crooks will also be quite clever in how they operate these spam campaigns. For obvious reasons I don't intend to speculate on how they operate. I don’t want to give the game away. But these crooks also don't know how much the spambusters know about them. They don't know how close they are. Nor do I. But I do hope it won't be too long before the police dogs bark as a specialist team of officials mount a dawn raid and catch them off guard.

So, Chris may have noted that what he Commissioner did not do in his evidence was criticise the phone companies for the part they are playing in disrupting and catching the crooks. Perhaps the Commissioner knows something that Chris Pounder does not.

In conclusion, a plea to Chris: go easy on the telecoms networks please. They may be doing quite a bit more than you think, behind the scenes, but even they won’t yet know just who is behind these scams.

Source:
http://amberhawk.typepad.com/

.

What's happening on September 28th?

September 28th is a rather special day in the calendar.

It’s the birthday of, among others, Confucius (551BC), Thomas Crapper (1836) Bridget Bardot (1934) Marilyn Manson (1966) and Dita von Teese (1972).

Those to have died on this day include Pompey the Great (48BC), Pyotr Tolstoy 1844), Harpo Marx (1964), Pope John Paul I (1984).

In addition, William the Bastard (as he was known at the time) invaded Britain in 1066, and Sir Alexander Fleming noticed a bacteria-killing mold growing in his laboratory, discovering what later became known as penicillin in 1928.

But did you know that next Wednesday is also the 9th International Right to Know Day?

Well, you do now. And to celebrate it, Christopher Graham, the Information Commissioner will be posting a speech on his youtube site at 10am.

It’s an occasion to commemorate the fact that people around the globe will all be exercising their right to know what their governments are doing. It’s not supposed to turn into a “Subject Access Request fest”, but I bet a few activists will do what they can to exercise whatever rights they can.

Last year Lord McNally, the (Lib Dem) minister responsible for Freedom of Information, said: Government, at national and local level, has become a lot better at delivering information requests. What we are promising to do is release lots of information which was within government, but stayed within government. That’s out there now for those with the initiative to request it. It remains a solid right of the citizen to ask for information. Perhaps Lord Henley, the current (Conservative) minister responsible for Freedom of Information, will provide us with an update.

And what’s the Commissioner going to say? I don’t really know. Other that he wants to mark the occasion with a view on the state of information rights here in the UK: the right to know and the right to privacy.

He is expected to explain why the Information Commissioner’s Office is already a key player in delivering an effective Right to Know; how our responsibility for both the right to know and the right to privacy equips us to assess where the public interest lies; and why the ICO should be an essential partner in delivering the much trumpeted transparency agenda - through to practical reality.

You just might have heard it here first.

Happy viewing next Wednesday.

http://www.youtube.com/user/icocomms

.