Facebook looks out for stolen passwords

When a data controller embarks on a great initiative, they should be congratulated. Even Facebook. So today I’m glad to acknowledge the sterling work that has been going on behind the scenes to check whether passwords associated with Facebook accounts have been misappropriated.

Facebook monitor a selection of different 'paste' sites for stolen credentials and watch for reports of large scale data breaches. They collect the stolen credentials that have been publicly posted and check them to see if the stolen email and password combination matches the same email and password being used on Facebook. This is a completely automated process that doesn't require them to know or store actual Facebook password in a plain text, or unhashed form.

To check for matches, Facebook take the email address and password and run them through the same code that is used to check user passwords at login time. If they find a match, they'll notify the Facebook account holder the next time they log in, and guide them through a process to change the password.

Isn’t this a great idea?

And a sign of a responsible data controller acting in the best interests of their customers?

So, Facebook, just in case no one else bothers to say it, please accept my thanks, at least, for providing such a useful service.

Source:

https://www.facebook.com/notes/protect-the-graph/keeping-passwords-secure/1519937431579736

.

Dealing with dementia

What do you do with aging relatives? How can you offer them the care that they might need in the future, by making appropriate arrangements today?

I’m not thinking of booking them one-way tickets to the Dignitas clinic in Switzerland (yet). But, I am thinking of arranging, while they are still of extremely sound mind, the necessary legal powers to act on their behalf and in their best interests should there come a time when their minds are such that they are no longer able to express their best interests themselves.

To whom can you turn to get a decent briefing on the relevant issues? Thankfully, the Alzheimer’s Society has just published some new guidance 'Accessing and sharing information: acting on behalf of a person with dementia'. It explains, in simple terms, how personal information can be shared in compliance with the DPA to help manage the affairs of a person with dementia.

I like the guidance because it uses the sort of language that my relatives can understand. So, l can leave the booklet with them and then discuss it when they’ve read and thought about these issues.

Evidently, only 22% of people affected by dementia feel that businesses and organisations understand a person's rights around a lasting power of attorney. Even fewer can explain the difference between a lasting, an enduring and an ordinary power of attorney. Or a deputyship.

So, I warmly recommend this booklet to anyone who has, and cares about, their aging relatives.

Sources:

http://www.alzheimers.org.uk/site/scripts/news_article.php?newsID=2313
http://www.dignitas.ch

Peter Hustinx lives on as EDPS – official

Peter Hustinx lives on as European Data Protection Supervisor.

And you thought he had been replaced?

Think again.

If any website ought to be capable of clearing this confusion up, it ought to be the European Commission’s website.

So, do what I did today.

Surf over to the Commission’s website, click on the link to the Article 29 Working Party, and then to the list of members of the Working Party. Surely it’s an official record. After all, the page was last updated on 24 February 2015.

Billy Hawkes also evidently remains as the Irish Data Protection Commissioner - which ought to come as a surprise to his successor, Helen Dixon. 

Poland continues to be represented by Wojciech Wiewiorowski while, at the bottom of the list, Peter Hustinx is listed as the EDPS. 

And for Giovanni Buttarelli? Who? There’s no mention of him at all on this part of the Commission’s website.

So much for the principle that personal information must be accurate and up to date.

As the Article 29 Working Party can't manage to maintain an up-to-date list of their own members, I suppose they don't feel it's always necessary to lead by example. 

Source:

http://ec.europa.eu/justice/data-protection/article-29/structure/members/index_en.htm#h2-21

What are we to make of the recently leaked DAPIX draft GDPR?

Tongues are wagging and the twittersphere has the usual suspects sharing their opinions on the latest leaked DAPIX draft.  According to whom you believe, it either represents a watering down of the European Parliament’s proposals, or it is a welcome step in the right direction. 

To my eyes, it’s an interesting attempt to ensure that whatever forms of processing are to be permitted, processing for the public interest (ie processing by Member States) appears to have a slightly easier ride than processing for private interests (ie processing carried out by commercial organisations).

Naturally, this is what might you expect when the text is being considered by, wait for it, representatives of the public interest.

But, in following the mantra “nothing is agreed until everything is agreed”, I won’t be spending any more time carefully analyzing this document. The proposed rules are bound to change – after all, even the 30 pages of leaked text has 90 footnotes reporting on the reservations that Member States have lodged.

If I were Sir Richard Branson, I might well consider tweaking the notice that is currently displayed on all Virgin Rail loo seats, to urge privacy pros not to stuff their copy of this draft down the pan.

Yes, the draft needs to be discarded, but surely not in that way.

Source:

http://www.euractiv.com/sections/innovation-industry/member-states-hope-soften-data-protection-reform-talks-312639?utm_source=EurActiv+Newsletter&utm_campaign=78bd6c2820-newsletter_daily_update&utm_medium=email&utm_term=0_bab5f0ea4e-78bd6c2820-245671226

The 2015 ICO Data Protection Practitioners Conference

A lot of people were pleased at how the ICO’s conference on Monday went.  Only a few nerves were frayed as delegates walked past a good natured picket line to get into the actual conference venue. Times are tough, and people need a way of letting off steam. If the demonstration helped raise awareness of their feelings, then all well and good.

It’s only the second time that demonstrators have been seen outside an ICO conference. The first occasion was back in the days when Richard Thomas was Information Commissioner, when a motley crew turned up to protest outside Manchester's swanky Lowry Hotel, evidently unhappy that privacy professionals were meeting to attend a conference on Privacy Impact Assessments. (Don’t ask why – it was a long time ago.)

Once inside, it was down to the usual stuff. The market stalls were pretty busy – exhibitors represented the private sector as well as the not for profit organisations this time. Introductions were made. Contact details were exchanged. The gallant National Association of Data Protection Officers crew, always so eager to comply with DP laws, even displayed a privacy notice on their raffle tickets. Did people want to win a £25 M&S voucher but not be contacted by NADPO after the event? If they did, they could exercise that choice. 

The usual soundbites were uttered by the usual suspects.  The ICO is “bringing clarity to a confusing and complex landscape of guidance, standards ad practices”. Such a remark couldn’t be made by (at least) some other European privacy regulators, who don’t particularly appear to see it as their job to simplify local laws.

“It’s about behaviours, not compliance” – again a remark that some other privacy regulators might think twice about making.

“Data protection is not an absolute right. We have to be there to ensure that rights are adequately applied.” Ouch. The folks manning the Fundamental Rights Agency won’t like an approach as pragmatic as that.

“The ICO is in the possibilities business just as much as it is in the prohibition business.” Wham. Not every regulator seems to wish to engage with data controllers (and data subjects, to be fair) as does the ICO.

“There is more to life than the Regulation.” Pow. A welcome reminder that life goes on, and that many of the issues that are faced by privacy professionals won’t change – even when the new legal framework is known. People should concentrate on trying to comply with the current law. It may be 14 years old, but it still presents very significant challenges to a large number of organisations.

Of course, the real benefit to such events is what is transacted at the margins of the meeting. And with some 700 privacy professionals packed together, tongues do start to wag. Privacy folk can be a notoriously indiscreet bunch.

The best news (for the private sector) is that, with the exception of enforcing the marketing rules, the ICO’s sights are pretty firmly set on the public sector. This year will see national health institutions gearing up for compulsory ICO audits. Next on the ICO’s target list is local government. After all, that is where a lot of sensitive personal data is being processed. And where an awful lot of damage can be inflicted on an awful lot of people.

What about criminal penalties for people who commit data protection offences? That old chestnut? Unlikely. Despite a law just waiting to come into force, the problem lies in the (lack of suficient) political will to bring the relevant provisions into force. Data Protection Minister Simon Hughes was keen to stress that the fault did not lie with the Liberal Democratic wing of the coalition Government.

If I were to propose changes to Britain’s constitution, I would require every Act to contain a “sunrise” clause – which effectively abolishes a legislative provision if it is not brought into force within 5 years of the Act receiving Royal Assent. This lets an incoming Parliament reconsider the provision – and it prevents others from just wishing laws were properly implemented when it is clear that Governments have different views. 

Delegates left the conference venue on a note of optimism. Things aren’t all bad – and the ICO is determined to offer those who try to comply a helping hand. And, when the new European data protection framework is clearer, the ICO plans to be around to adopt a particularly British approach to regulation. It won’t simply be about ticking boxes and admonishing Google & Facebook.

Despite whatever rules come into force, it appears that the ICO will continue to play fair with data controllers that care.

.

More positive news from the European Commission about the data reform package

If you want to cheer yourself up, just surf over to the European Commission’s website and read all about the amazing benefits that the impending data protection reform package will deliver.

Wow, it’s impressive.

Benefits for citizens and businesses – particularly small and medium sized businesses. Citizens will be put back in control of their own data. The “right to be forgotten” gets another airing. Consent cannot be assumed. Saying nothing is not the same as saying yes. Businesses will save €2.3 billion a year by dealing with one law, not 28.

If we are to believe the hype, "It is a golden opportunity. By fostering a Digital Single Market, we can create up to €250 billion in additional growth, hundreds of thousands of new jobs, and a vibrant knowledge-based society."

So what’s the problem? Why the delay? Who’s opposing this wonderful measure?

This is where the Commission’s website fails to deliver.

Nowhere is there even a summary of the principle issues that have yet to be resolved, with an explanation about why Member States continue to have significant concerns. For that sort of information, you need to dive deep into the footnotes of the DAPIX documents that occasionally appear online.

This is a lost opportunity – if you expect the Commission to be even-handed in its reporting of the issue, that is.

What we read is a one sided summary of the issue, full of stock paragraphs that could so easily be inserted into the speech of any politician / public official tasked with delivering a homily on the benefits of the reform package.

Journalists that want to cover the potential deficiencies of the reform package have to work a lot harder if they are to file a decent report. The lack of an alternative narrative is unsettling. If the package were so good, why is the gestation period proving to be so difficult? 

Perhaps the Commission’s website is not the place to go for impartial news about legislative proposals. Perhaps it exists purely to promote the Commission’s aims and aspirations.

But if it wishes to rise about the political debate, it should be bold enough to acknowledge that every proposal has its detractors, and that their views could also be made available to European citizens, perhaps through hyperlinks from the Commission’s website, in order that citizens can determine for themselves whether public policymakers are taking appropriate decisions.

Source:

http://europa.eu/rapid/press-release_MEMO-15-3802_en.htm

.

The Subject Request App

Those clever bods over at Allen & Overy have developed a handy app to remind Data Protection Officers how to deal with Subject Access Requests. First released in May 2012, I must admit that I’ve only just seen it.

It makes a change from having to refer to 10 separate ICO publications that touch on particular aspects of Subject Access Requests. If you didn’t realise that there were 10 separate guidance documents, take a squint at A&O’s reference materials. Some of the hyperlinks to materials on the ICO’s website are currently broken – but a decent internet search engine should be able to locate the original documents eventually. Perhaps, in the fullness of time, an ICO archivist will develop a list of “live” and “withdrawn” guidance notes, to avoid too much confusion amongst the privacy anoraks, for whom guidance from the ICO is as greatly revered as an original copy of the Magna Carta. But I do appreciate that, given the current financial constraints, such a task is well down the ICO's priority list.

As well as bite size summaries of relevant ICO advice, the AccessAssist app includes an interactive Q&A-based tool, an analysis of the usual exemptions, frequently asked questions, links to support materials and subject access fee tables.

Having used the app for a few minutes, I can see its potential to comprise a key item in a DPO’s toolbag. Any decent DPO needs some props to reassure their clients that they’ve got all the tools of the trade. I usually carry an original copy of the Data Protection Act, carefully annotated with notes and comments made by a key civil servant that was responsible for implementing it. And a tatty copy of an old ICO data protection guide.

From now on, when I’m advising on tricky Subject Access Requests, I’ll make sure that the client sees me using this reference tool, too – which ought to provide sufficient assurance that I both know my stuff and am completely up to date with the very latest legal thinking.

The best bit – particularly for hard pressed public sector information rights folk – is that the app is free. All you need is an iPad. It's not yet available for the iPhone, and I’ve no idea whether there are plans to develop a version specifically for the small screen.

The app has also been scrutinised by the ICO. According to Deputy Commissioner and Director of Data Protection David Smith, “we congratulate Allen & Overy on the development of this app. The right of subject access is at the heart of the Data Protection Act. Any tool that makes it easier for businesses to understand and meet their obligations to those individuals they hold information about can only be welcomed.”

Download it and let me know what you think.

.