Jun

Verbraucherschutztag-Vortrag

Address to the German Data Protection Conference.

On 03 Jun 2013, F.A.Z. feuilleton publisher Frank Schirrmacher gave a talk titled “Information as a fetish: Consumer protection in the new information economy” at Germany’s national Data Protection Conference. Some of his thoughts:

“Data protection in the information economy will become a job that is very politically important. It will have… to develop into an instrument that secures freedom.”

“It’s become normal for us, we journalists and you [data protection officers] too, some of you, to talk about spying. About spying on people in every possible way in the internet. About tracking, about data hunters and data kraken. It’s no accident that we use all this vocabulary from intelligence services and spy agencies. In this sense, data protection must be intelligent counter-intelligence. It must disclose the operational and systemic rationality of the algorithms, so people can understand at all what texts are being written elsewhere about their lives and what conclusions can be drawn from those texts. … We must thus end a kind of illiteracy about these matters.”

He said today’s situation isn’t Orwellian because Orwell described an open suppression system. It’s more Brave New World: “In Orwell they burned books; in Brave New World books just aren’t read.”

“Data protection in our world’s future will have the actual task of becoming personality protection. The inviolability of the person, which all of us believe in as a basic principle, presents completely new challenges in a digital age. To quote again from Eric Schmidt’s book, and he is entirely right about this, when he writes, ‘Identity,’ in other words personality, ‘will be the most important raw material for burghers of the future, and identity will primarily exist online.'”

“Consumers don’t just buy a product. …They are actually becoming products. …They are read when they buy things, they are read when they move around, they are even read when they are reading, paying, even thinking as we now know. …In the age of ‘big data’ everything has the potential to be a market, including politics and social life. When even the most private acts, as is possible today, make people into market participants, such as reading an ebook, then conversely it’s clear that even the most private space can become the object of market research, and increasingly at a stage before the consumer is aware of it.”

He said we can’t go back to analog. We can’t switch the tracking off either. Even if we manage to not be recorded by our own devices, other people’s devices are recording us. Also, some companies keep lists of everyone who chooses to opt out.

The question of anonymity is in many cases already over because of the patterns that can be spotted now (last year): so many behaviors can be a fingerprint or a voice print. Consumers must learn what patterns of theirs are being read.

Proposals:

“The question of how to handle data I think must be anchored in our society as firmly as the status of a physician’s confidentiality and responsibility. We know that a huge number of people are being educated for big data, who will evaluate these data for companies. On the whole, we need in our society an awareness that these data are a judgment about personality. Whether a consumer will get a loan, has a future at his job, etc.”
“We need what the Americans call ‘external algorithmicians.’ Meaning, we can’t all understand what’s going on there. So, as was the case for nuclear power for example, scientists will have to verify, from the other side so to speak, what’s working and what isn’t working. Or Stiftung Warentest, the consumer testing magazines, who use their fantastic technical expertise in counter-intelligence, so to speak. That’s what I mean by counter-intelligence: countercheck how a system is functioning. And we need this for algorithms too. We will need people who are capable, if it’s possible at all, of decoding these algorithms and then telling people, okay. If you just spent ten days messing around on Facebook, you can assume that this and this are now known about you.”
“Finally, at the European level: We are all seeking a vision for Europe. We can see that in the information economy, together with globalization, two supersystems are arising. Of course the U.S.A. on the one hand, and the second one is Asia, especially China. Europe is looking so hard for its own task, vision and identity. We have a different history, after all. Admirers of Silicon Valley should always be told that it was subsidized by the state for decades. Into the 1980’s. Silicon Valley did not arise from entrepreneurship alone. In that sense, one should ask whether we want to continue to make ourselves dependent on systems that exclusively come from the U.S.A., or whether we in Europe might not also want to use government subventions… whether we might not want, as some other countries are doing, to build up our own search engine, our own social networks, which would have the advantage that they could be new designs.”

(Fair BROW chh ah shoo uts tah chh FORE trah chh.)

10 years ago Short URL Comments

Consumer protection/Data protection/Datenschutz/Frank Schirrmacher

Jun

G10-Kommission

A Bundestag committee whose four members, not mandatorily Bundestag members, are appointed by the Bundestag’s intelligence-agencies-monitoring parlamentarisches Kontrollgremium. The G10 committee monitors compliance with the German constitution’s requirement for individuals’ rights to letter secrecy [Briefgeheimnis], postal secrecy [Postgeheimnis] and telecommunications secrecy [Fernmeldegeheimnis].

The G10 committee supposedly must approve each surveillance or search of German citizens’ phones or computers by Germany’s intelligence agencies, which can only be possible if such surveillance is done on a very small scale. In July 2013, Spiegel-Online wrote that only 156 surveillance actions were approved by the G10 committee in 2011. And that the foreign intelligence service BND is permitted to ask for broadly-defined surveillance that is not however allowed to exceed 20% of the information out there and usually supposedly hovers at only 5%.

(Gay TSAYN comb eess y own.)

10 years ago Short URL Comments

Briefgeheimnis/Bundesnachrichtendienst/Bundestag/Data protection/Datenschutz/Fernmeldegeheimnis/G10/Human rights/Militärischer Abschirmdienst/Postgeheimnis/Verfassungsschutz

Jun

SFÜ

Strategische Fernmeldeüberwachung, “strategic telecommunications monitoring,” what Germany’s foreign intelligence service is calling its dragnet surveillance of international telecommunications transmissions. Süddeutsche Zeitung noted that Germany’s “G10 law” prevents the BND from accessing more than 20% of communications data traveling outside Germany’s borders, but even the BND does not verify the BND’s compliance with that limit.

10 years ago Short URL Comments

Bundesnachrichtendienst/Data protection/Datenschutz/G10/Quis custodiet

May

Schlichtungsstelle für Suchmaschinen

Mediation board for search engines.

Since the European Court of Justice’s recent decision that Google (and all search engines) must delete on request links to pages that E.U. burghers feel violate their personality rights, thousands of deletion requests have been sent to the company.

Germany’s coalition government announced they want a board to be created to help search engines process these requests so the search engines are not the sole deciders. They said they want clear rules about how these requests are evaluated. Clear credible rules for how the “forget” requests are handled are also necessary: in the U.S.’s data protectionless jungle, companies frequently respond to consumers’ requests to forget or correct information with demands for more information, all of which is certainly not deleted. Who will be allowed access to the forget requests? Who can make copies of them, and how secure are the copies?

Germany’s data protection officers have demanded they have a significant role in the evaluation of the link deletion requests.

Update on 30 May 2014: Germany’s data protection officers have criticized that the “forget” request page Google has provided requires a scan of the requestor’s passport or other photo identification. Hamburg state data protection officer Johannes Caspar, who deals with Google questions, said that the automatic saving of personal ID’s by non-public entities was illegal and must be changed immediately. Google promptly changed the wording on the online submission form to “Please attach a legible copy of a document that identifies you.”

(SHLIH chh toongs SHTELL ah fir ZOO chh mosh ee nen.)

10 years ago Short URL Comments

Archives/Data protection/Datenschutz/European Court of Justice/Memory/Transparency

Apr

Big-Brother-Awards 2014

The Verein Digitalcourage has announced its 2014 Big Brother awards for the best violations of consumer data protection in the past year. The association posted English translations of each award announcement online, which is awesome.

Politics category
“The German BigBrotherAward in the Politics Category goes to the Federal Chancellery (Bundeskanzleramt) for their involvement in the NSA surveillance scandal and for their lack of defensive and protective action. One of the Chancellery’s roles is top-level supervision over the foreign agency, Federal Intelligence Service (Bundesnachrichtendienst, BND) and over the three federal secret services’ cooperations between each other and with other agencies in Germany and abroad. German secret services work closely with the US intelligence agency NSA, whose actions have violated international and human rights law, and with other secret services. The Federal Intelligence Service and their interior counterpart, the Federal Office for the Protection of the Constitution (Bundesamt für Verfassungsschutz), have participated with NSA surveillance measures, spying programmes and infrastructures. German governments, past and present, have failed to defend against crimes and violations of civil rights linked to mass eavesdropping and digital espionage. They have recklessly neglected to protect German citizens and companies subjected to industrial espionage from further hostile attacks.”

Transportation
“The Big Brother Award 2014 in the category Economy goes to MeinFernbus GmbH (approx.: My Long-Distance Bus, Ltd.) for obliging passengers to always show an official ID along with the travel ticket they booked online. This makes anonymous bus journeys impossible. MeinFernbus GmbH does not give any legal or other reasons why producing an ID should be necessary. There is the option to try buying a ticket in cash when boarding, but this entails the risk that the bus is fully booked and one cannot travel. Additionally, buying tickets on board is more expensive than booking them in advance via the Internet.”

Technology
“The BigBrotherAward in the ‘Technology’ category goes to the ‘Spies in our Cars’, which look over our shoulders wherever we drive, collecting data, and sometimes even uploading it to the ‘cloud’. It is difficult to name a culprit: car manufacturers cite legal requirements on the one hand, and on the other hand they point to third-party providers that offer services such as localisation and navigation to the driver. This BigBrotherAward also looks to the future: the planned European distress call system ‘e-Call’ will have to prove in practice that it really has been implemented in a way that respects privacy.”

Business
“The BigBrotherAward 2014 in the ‘Business’ Category goes to CSC Corp. (Computer Sciences Corporation). The company is currently working on commissions by 10 Federal German Ministries on security-related projects, such as the electronic identity card, the De-Mail project for exchanging legal electronic documents, and the nation-wide firearms registry. At the same time, the parent company functions as the external IT department of US secret services, and it has organised rendition flights to torture prisons for the CIA.”

Consumer protection
“The South Korean electronics manufacturer LG receives the Big Brother Award in the Consumer Protection category because the ‘smart’ TV sets they sell transmitted detailed information about what people were watching to the firm’s HQ in South Korea, via the Internet. With the help of such information, so-called metadata, one can find out the most intimate details about individual people. The LG devices thus invaded the private lives of unsuspecting people.”

The world of work
And the winner is: the utility RWE, for using surveillance software to measure the performance of its subcontractors’ call center employees. “This software can, without the employees’ knowledge, do complete, continuous recording of phone calls and onscreen actions.” [Spiegel.de]

Neowordisms prize: “Metadata”

Blame category honorable mentions
Honorable mentions in the blame category go to: Debeka; Contipark; the Wiesbaden spa’s parking garage operator/s [?]; church tax [on? to? into?] flat-rate withholding tax [?]; WhatsApp; Talents4Good; and recordings of phone conversations and the public perception thereof.

Julia and Winston Award (the Positive Prize)
“For the first time, we introduce a positive award this year. The ‘Julia and Winston Award’ was named after the ‘rebellious’ main characters in George Orwell’s dystopian novel ‘1984’, from which the ‘Big Brother’ is also taken. The award is to honour persons who have taken an extraordinary stand against surveillance and data collection mania. The award comes with an endowment of one million – not one million Euro, though.

“The award speech for the first Julia and Winston award is held by Heribert Prantl, senior editor and head of the interior politics section of Süddeutsche Zeitung.”

Heribert Prantl’s speech:

“The winner of the first Julia and Winston Award is Edward Snowden.

“In Berlin, the German parliament (Bundestag) has established a committee of inquiry to investigate the NSA scandal. It is strange that the majority of the committee do not want to invite the person who uncovered this scandal. The committe’s CDU/CSU¹ members talk about Snowden as if he had an infectious disease. And there is hardly any objection from SPD members. That is gross ingratitude.

“The man has already said all he has to say, the argument goes; so there is no need to question him again. That is premature consideration of evidence, which is forbidden in all areas of law and in the German parliament as well. Snowden offers critical evidence, as everyone knows. The real reason why nobody wants to invite him is this: Chancellor Angela Merkel fears a peeved and harsh reaction from her hosts during her US visit in May. That is more than just fainthearted. The Chancellor has sworn in her oath of office to protect the German people from harm. Protecting from harm – that entails taking action against the harm inflicted by the NSA. Instead, the German government acts as if that Snowden, not the US, was the injuring party.

“Edward Snowden is an enlightener. He uncovered the global US inquisition and had to take refuge from the Grand Inquisitor. Personally, he has gained no benefits from his whistleblowing, only disadvantages. The only benefit is for the integrity of the rule of law in Western democracies – well, it could be a benefit if those democracies used the scandal as an incentive to reign in their secret services.

“So Snowden is not just an enlightener, he is also a motivator. He deserves better than a shaky and temporary asylum in Russia. The Americans are pursuing him as if he was the reincarnated Bin Laden. But he is just a single refugee, a textbook case of a refugee. So how should, how must Germany act towards Edward Snowden? Most of all, with gratitude! Snowden deserves protection and support. He is a classic case of a refugee.

“We should, indeed we must give Edward Snowden a stable permit of residence in Germany. We should and must offer him safe passage. All this is legally possible. Instead, the politicians of our ‘grand coalition’ act as if the United States’ power were a legislative force. Germany needs enlightenment about the comprehensive US eavesdropping. Enlightenment is the way out of self-inflicted immaturity.

“Snowden’s actions may be punishable in the US, due to violations of US law; but what is truly criminal are the circumstances and the machinations that he is denouncing. Snowden has acted against US secrecy regulations. Does that make him a traitor? No. The people who call him a traitor have betrayed basic rights themselves. Snowden has given emergency aid to the democratic state under the rule of law.

“His actions deserve recognition from the judiciary and the state, in Germany as well as the United States. He has kickstarted a debate that will hopefully lead to the democratic state protecting itself from the threat constituted by the NSA attacks. He may not really need a German medal; that would not sustain him. But he needs protection and support.

“‘Unhappy the land that has no heroes!’ says Galileo’s scholar Andrea Sarti in Bertolt Brecht’s play. So America can consider itself lucky to have someone like Snowden. But Galilei’s response to Sarti is this: ‘No. Unhappy the land that needs a hero’. That is true as well.

“Snowden is a symbol for courageous resistance by an individual against a powerful state system. He is a tiny David that stood up against a super Goliath. Snowden has resisted, and he continues to do so until today.

“Resistance is a word that people associate with rebellion against a dictatorial regime. But resistance is also a necessity in a democracy, even under the rule of law. Resistance only has a different name in a democracy: it is called dissent, civil courage, standing upright – or simply, Edward Snowden.

“If dissent is penalised: dissidents hazard the consequences. They do so to instigate change, to eliminate deficits and injustice. Arthur Kaufmann, the late Philosopher of Law, once called resistance in a democracy ‘the small resistance’. This small resistance had to be offered ‘to make the large resistance unnecessary’. But sometimes this so-called small resistance is in fact a very large one. That is the case with Edward Snowden. His resistance fully involves the physical and psychological existence.

“Thank you, Edward Snowden.”

“¹ The CDU and CSU (Christian Democratic Union and Christian Social Union) are Germany’s major conservative parties. They are ‘sister’ parties, with the CSU operating in the Federal State of Bavaria and the CDU in the other 15 Federal States.”

(Beak BRUZZ ah ah vorts tsvoat ow! zanned FIAT seine.)

10 years ago Short URL Comments

Bundeskanzleramt/Central Intelligence Agency/Computer Sciences Corporation/Data protection/Datenschutz/De-Mail/Digitalcourage e.V./e-Call/Edward Snowden/George Orwell/Heribert Prantl/LG Electronics/MeinFernbus/National Security Agency/RWE

Apr

“Wer Grundrechte einschränkt, ist beweispflichtig.”

“Anyone limiting fundamental rights must provide proof.”

From former federal data protection officer Peter Schaar’s blog post just before the European Court of Justice announced its groundbreaking, wonderful and “remarkably clear” decision on 08 Apr 2014 overturning mandatory dragnet data surveillance because it violates fundamental human rights [Grundrechte].

“Anyone limiting fundamental rights must provide proof. They must provide evidence that the limitations to personal freedom are necessary in the predominant interest of the general public—that’s what our constitution requires. This principle also applies in the European Union, at the latest since 2009 when the E.U. Charter of Fundamental Rights became enforceable law of the Member States with the Treaty of Lisbon. This guideline’s origins go back before Lisbon. In December 2013, the attorney general at the European Court of Justice said in his vote that he was of the opinion that the guideline violated the protection of the private sphere guaranteed in Article 8 of the Charter of Fundamental Rights.

“The authors and proponents of the mandatory retention of communications traffic data [Vorratsdatenspeicherung] have not yet provided proof of the necessity and efficacy, to this day. But surely it would have been easy for them to provide the evidence, after eight years—if their arguments were accurate ones. It ought to have been easy to show that law enforcement had been harmed by the German Constitutional Court’s finding in 2010 that the Vorratsdatenspeicherung law was unconstitutional. Did conviction rates fall in Germany? Is Germany worse off than its neighbors who implemented Vorratsdatenspeicherung? No. Furthermore, neither the governments of the Member States nor the European Commission were able to provide conclusive proof in any other way for the necessity of Vorratsdatenspeicherung.”

(Vair GROONED rechh tah eye n shrenked, issed bev ICE flichh tichh.)

10 years ago Short URL Comments

Data protection/Datenschutz/European Court of Justice/Peter Schaar/Suspicionless surveillance/Warrantless wiretapping

Apr

NSA-Untersuchungsausschuss

N.S.A. investigative committee of the Bundestag, which began meeting on 03 Apr 2014.

The committee’s chair is Clemens Binninger (C.D.U.), a former policeman.

It is tasking itself with investigating the involvement of German police and intelligence agencies—domestic, foreign and military—in the massive spying on people and companies that is now known to have been done by the U.S. and U.K. governments and their contractors.

Also it will now be investigating Germany’s culpability in the U.S.’s drone wars. Since the Süddeutsche Zeitung, Norddeutscher Rundfunk (NDR) and Westdeutscher Rundfunk (WDR) reported that the U.S. is using its Ramstein airbase inside Germany to support drone attacks in Somalia, Yemen and Pakistan, violating international law while killing hundreds of civilians, Germany’s government (C.D.U./C.S.U. + S.P.D.) can no longer pretend they don’t know this is happening.

The committee repeated that they would like Edward Snowden and other informed whistleblowers to give statements and answer questions for these Bundestag inquiries. Journalists repeated that the whole world will be watching this inquiry to see what the committee discovers and which stones they leave unturned.

Update on 09 Apr 2014: Clemens Binninger stepped down as chair of the N.S.A. investigative committee after only six days. He said he was resigning from the position because he felt people from the opposition parties were too interested in hearing from N.S.A. whistleblower Edward Snowden.

Update on 10 Jul 2014: A Spiegel article about Germans’ angry responses to spying by the U.S. mentioned that Clemens Binninger is chairing the Parlamentarisches Kontrollgremium, the secret Bundestag committee supposed to monitor Germany’s intelligence agencies.

(Enn ess ah oon tah ZOO chh oongs OW! ss shoes.)

Mar

Kanzleramtschef, ChefBK, Kanzleramtsminister

“Chief of the chancellory,” Angela Merkel’s chief of staff, whose duties include coordinating and controlling/monitoring Germany’s secret services as the boss of the federal government’s intelligence agencies officer [of the person with the job title Beauftragter der Bundesregierung für die Nachrichtendienste].

Update on 25 Jul 2013: After Bundeskanzleramtschef Ronald Pofalla testified secretly before the Parlamentarisches Kontrollgremium, the parliamentary committee that is pro forma in charge of Germany’s intelligence services, he made a statement to the press saying absolutely everything done so far by Germany’s spy agencies had been legit and in compliance with German law. Also that German data protection law had not been reinterpreted. Supervisory committee members from opposition parties (parties that were in the ruling coalition when the information exchange began between German and U.S. intelligence agencies, as far as we know so far) gave counterstatements to the press indicating they were not satisfied with Mr. Pofalla’s responses to their catalog of questions about the U.S.A.’s Prism program.

Amusingly, artists at one news show edited Mr. Pofalla’s sound bite into their report to begin just he was saying “This statement is clearly false…”

(KANT’s lah omts chef, CHEF bay kah, KANT’s lah omts minn iss tah.)

10 years ago Short URL 1 Comment

Art/Bundesnachrichtendienst/Data protection/Datenschutz/German Chancellery/National Security Agency/Organization/Parlamentarisches Kontrollgremium/Parliamentary democracy/Police/Prism/Ronald Pofalla/Spies

Mar

Handschrift des Arztes muss lesbar sein

“Physicians’ handwriting must be legible” in patients’ medical records according to the current version of Germany’s patients’ rights law, passed last year.

Frank Leopold, head of a Verein that advocates for medical patients, told Spiegel.de some other salient aspects of the patients’ rights law [German Civil Code, §630a et seqq.]:

Upon request, patients must be given access to view their full medical records, unless it could harm them or endanger the rights of third parties. If the patient so desires, this access must be granted directly after treatment, “without delay” [unverzüglich]. If physicians use the “harm” reason as grounds to refuse patients access to their full medical records, an appropriate diagnosis must have been made.

Patients have the right to get copies of their medical records, though the patient must pay for the copies.

Everything in a patient’s medical record must be left there. Any corrections and changes must be made so that the original content is still apparent, and must be signed and dated by the physician.

Software that keeps medical records must meet the same requirements. All changes and original content must remain apparent.

Handwriting in medical records must be legible, even physicians’ handwriting.

Mr. Leopold was skeptical about preventing manipulation to electronic records, but said he didn’t know enough about the software to comment.

He said it’s important to talk about this in public fora, because it’s important for patients and physicians to know patients’ current rights, to prevent confusion.

(HONNED shrift dess OTTS tess moose LAZE bah z eye n.)

10 years ago Short URL Comments

Archives/Data protection/Datenschutz/Medicine/Patient rights/Records

Mar

Doktrin der Dritte

“Third-party doctrine.”

An interesting loophole in the few privacy protections U.S. Americans and their customers think they have. Any information you have deliberately shared with a company is no longer protected against “unwarranted search and seizure” by the U.S. government. Does this also apply to information you have inadvertently shared with a company?

(DOCKED rin dared RITT ah.)

10 years ago Short URL Comments

Consumer protection/Data protection/Datenschutz/Human rights

Mar

Bildungsbroker-Blödsinn

Education broker balderdash.

A British charity called the Universities and Colleges Admissions Service (Ucas.com) which “controls admissions to U.K. universities,” charging fees of ~£23 per student to help >700,000 students sign up for university courses in the U.K. each year, has been selling marketers the data of those students and the data of ~15,000 of their parents and the data of younger children aged 13 to 16 who sign up for courses via another program they offer.

The charity has a “commercial arm” that apparently made £12 million in 2013 from selling the students’ information, to customers such as mobile phone companies, a large software company and a beverages company. The charity’s spokesperson told reporters they are “strictly legal,” selling children’s data within the requirements of British law.

The level of civilization this implies is lower than expected.

Achtung: an analyst said the sort of “carefully selected third parties” checkbox Ucas used “is usually preceded by a triple negative question so you don’t know if ticking the box gets you more mail or less.” In the case of Ucas, students didn’t dare opt out of sharing their contact data for fear of not receiving college offers.

(BILL doongz broke ah BLID zinn.)

10 years ago Short URL Comments

Children/Civilization/Data/Data protection/Datability/Datenschutz/Education/Marketing/Meta/United Kingdom

Feb

Patienteninformation & Patienteneinwilligung

“Patient information form and patient consent form,” often translated into English as “informed consent” which sounds like a single document rather than the German pair of patient information materials + patient’s consent statement [Einwilligungserklärung].

Medical ethics require patients agreeing to participate in pharmaceutical testing to be adequately informed about the drug or device trial and associated risks and benefits, and then to give their written consent to participate in the trial so described. Translators of these forms must take extra pains to render them in clear language because the people reading them might not be in the best of health.

As recovering law student and standup comedian Susan Calman said, “there’s no consent without informed consent!”

General practitioners in the U.K. are concerned, she said, that people there have not been sufficiently informed about the National Health Service’s plans to put physicians’ records and hospitals’ records on a “superserver,” central database, to which more than just health professionals will have access. The patient data will be at least partially anonymized, proponents said. It’s unclear what the rules will be for selling or sharing patients’ data with third parties.

People not worried about data privacy might nevertheless be concerned about any unclarity in David Cameron’s government’s communications about how it will share or not share the U.K.’s digitized medical records because his coalition’s recent privatization projects have been accused of selling at too-low prices. Protection adequacy is also in question now since the Snowden revelations.

Update on 24 Feb 2014: Despite reassurances from the British agency currently in charge of patient medical records in the U.K., the Health and Social Care Information Centre, that “data held in the new giant database would never be used for insurance purposes, stating that any such actions would represent a criminal offence,” the Telegraph.co.uk has discovered that David Cameron’s government already sold the N.H.S. medical records, to an actuarial firm that advises “insurers and actuaries on how to ‘refine’ critical illness cover,” in 2012, for two thousand pounds.

The contract to extract and anonymize patient data from individual physicians’ office records for the new central database has been awarded to a company called Atos. Atos has asked for early release from its previous government contract because of death threats to its employees.

Update on 03 Mar 2014, from the Guardian:

“A prominent Tory MP on the powerful health select committee has questioned how the entire NHS hospital patient database for England was handed over to management consultants who uploaded it to Google servers based outside the UK.”

This database contained H.E.S., hospital episode statistics, and these management consultants called themselves PA Consulting. In addition to Google, anyone tapping communications lines leading to Google, actuaries and consultants, N.H.S. patient records might have already been obtained by or available to “pharmaceutical firms, government departments [including police] and private health providers.”

(Pot YENT en in foh mah tsee own oont pot YENT en eye n vill ee goong.)

10 years ago Short URL Comments

2012/2220/Atos/Consent/Data protection/Datability/Datenschutz/David Cameron/Fire sales/Informed consent/Institute and Faculty of Actuaries/Medicine/PA Consulting/Police/Privatization/United Kingdom

Feb

Verbandsklagerecht der Verbraucherschutzorganisationen

Right for an association to file suit, for consumer protection organizations.

The new justice minister and consumer protection boss, Heiko Maas (S.P.D.), said he is thinking about making it possible for consumer protection organizations to file lawsuits on behalf of consumers in response to data protection violations.

Currently, consumer protection organizations in Germany can only file data protection lawsuits if a company’s terms and conditions contain data protection violations. Mr. Maas wants to have draft legislation “closing this loophole” ready by the end of April 2014.

The Spiegel.de article continued,

Maas and Germany’s data protection officer Andrea Voßhoff [(C.D.U.)] furthermore admonished companies to treat their customers’ privacy with more respect. Customers’ trust is, in the end, the fundamental basis of all business models in the internet, they said. Instead of pages and pages of terms and conditions, what [customers] need is true freedom of choice when it comes to what’s allowed to happen to their own data, said Maas. “If some providers want to stubbornly persist in the digital Flegeljahren [boor, churl, cub, lout years, meaning teenagers], if they disesteem/disregard/disdain/ignore/flout/violate their customers, and if they refuse transparency, then the state will have to intervene regulatorily to protect users.”

(Fair BOND sklah geh rechh t dare fair BROW chh ah SHƏTS oregon ee zot see OWN en.)

10 years ago Short URL Comments

Andrea Voßhoff/Consumer protection/Data protection/Datenschutz/Heiko Maas/LongCompoundWords/Tort reform/Transparency

Feb

Doch drohnenfähige Handydaten!

Cell phone data are droneable after all!

Last summer Germany’s foreign intelligence service, the Bundesnachrichtendienst or BND, admitted they’d been sharing phone data with U.S. intelligence agencies for years but said it was okay because cell phone data couldn’t be used to locate people and something about the N.S.A. promised not to use German-supplied phone data to kill anyone. Regarding the first claim, whistleblowers from U.S. drone programs have now explained to reporters how phone data were used for targeting assassinations around the world.

One whistleblower, describing countermeasures persons of interest have taken to keep using phones while evading geolocation and how these countermeasures can deliberately or accidentally increase the drone strikes’ already terrible civilian casualties, called the U.S. drone programs “little more than death by unreliable metadata.”

Details from the article and online discussions included:
“Pods” on U.S. drones (and presumably on urban utility poles because this might be what police have been quietly installing in U.S. cities using Dept. of Homeland Security funds) can spoof cell phones into providing data and can vacuum information off wifi networks from altitudes of four miles. Telecommunications standards in some “countries of interest” make it possible for many users there to share data the U.S. uses to identify targets’ cell phones. Wireless “party lines” quietly shared by pools of low-income civilians increase the chances that countries indulging in drone assassinations will accidentally kill party line participants and their families and neighbors, or be tricked into killing their enemies’ enemies, such as by firing missiles at wedding parties or legislatures after someone hides a cheap phone there.

(Daw chh drone nen fey igga HEN dee dotten.)

Feb

Deutscher Verkehrsgerichtstag

“German Traffic Court Day,” a misleading calque. This is apparently a fruitful annual meeting of traffic experts, from government and academia, organized by an e.V. association.

This year’s topics included “Data Protection in Cars.” The president of the host association called for regulation of information protection in automobiles, saying modern cars contain up to 80 devices that record data, such as navigation systems and even airbags. He said at the moment it’s not clear whether these collected data belong to the car manufacturers or the drivers.

Cars with airbags, for example, collect information about how fast we’re driving and whether we’re alone. Onboard sensors record whether passengers are wearing a seatbelt. Courts are already hiring I.T. experts to read cars and car toys to determine whether drivers are telling the truth in hit-and-run cases. In leased electric vehicles, companies can remotely shut down the battery if payments are in arrears. A luxury S.U.V. in Cologne managed to trap an alleged car thief inside until police arrived, even though he tried to kick out doors and windows. Customers already using products that reroute them around Germany’s ubiquitous traffic jams by constantly pinging their cars’ locations can have their data unethically used for marketing and other purposes if no legislation controlling this is crafted.

In 2015 all new cars in Germany are scheduled to be equipped with “eCall,” a 911-type emergency services function that will automatically call for help after the car is in an accident but that can also be used to locate any one of these cars at any time. An E.U. press release about eCall said the system doesn’t transmit data about its users because it is usually “sleeping.”

(Doytcha fair CARES g’RICHHTS tochh.)

10 years ago Short URL Comments

Autos/Consumer protection/Data protection/Datenschutz/Ecall/Transportation

Dec

Internet-Ausschuss im Bundestag

Happy holidays! The Bundestag announced plans to create its own standing internet committee [ständiger Internet-Ausschuss], responsible for online issues. Though not entirely neglected, the interface between citizens and computers is not fully covered in Germany either. The Greens traditionally disliked technology, the Pirate party was trying to fix that lacuna but now seems possibly unterwandert by the German military (what was a Defense Department employee doing as party chair, one asks oneself now, post-Snowden). The new coalition has divided up online issues among a Wirrwarr of multiple ministers, some of whom oppose digital consumer protections such as network neutrality or individuals’ data privacy yet are now the designated advocates for them.

The press learned about the new Bundestag committee’s creation from Twitter.

Topics to be handled by the parliamentary committee include the expansion of broadband infrastructure, copyrights, data security.

Update on 13 Feb 2014: The Bundestag created its internet committee! It’s called Digital Agenda (dee ghee TALL awg EN dah).

(INN tah net OW! ss shoes imm BOON dess tochh.)

10 years ago Short URL Comments

Competition/Consumer protection/Data protection/Datenschutz/Network neutrality/Parliamentary democracy/Privacy rights/Suspicionless surveillance/Warrantless wiretapping

Dec

College Bescherming Persoonsgegevens

Dutch for “Data Protection Authority,” a government office in Holland.

Google has been invited to testify at a data protection hearing in Holland. Süddeutsche.de ‘s 29 Nov 2013 article said the head of Holland’s data protection office said, “Google is spinning an invisible network out of our personal data without our permission, and there’s laws against that.”

Update on 15 Dec 2013: Google said U.K. privacy complaint plaintiffs should sue the company in California courts. The U.K. plaintiffs wanted to sue the company for secretly tracking their internet browsing “by circumventing privacy settings” in Apple’s Safari web browser on different devices. The Guardian.co.uk said the company’s lawyers were expected to argue in court on Monday, 16 Dec 2013, that a similar privacy complaint had recently been dismissed from a U.S. court “and that no European regulators are currently investigating this issue.”

Spiegel.de said Google has already had to pay two fines for this privacy practice in the U.S.: $22.5 million to the F.T.C. in August 2012 for tricking Safari into accepting cookies on various devices even when the consumer had set tracking to “off” and again $17 million in a Nov 2013 settlement to the attorneys general of ~37 U.S. states for the same issue.

Update on 08 Jan 2014: France’s data protection authority fined Google 150,000 euros, the largest fine C.N.I.L. ever issued, for violating France’s data protection laws. Since 2012, Süddeutsche.de explained, Google has been able to create search-based profiles for users of its search engine, YouTube, Gmail, Google+ and other enterprises and that enable sending targeted ads to consumers. France told Google to inform French users about how the company was handling their data and to obtain their consent before putting cookies on their computers that would track their online behavior. Google did not comply.

Update on 14 Dec 2013: Canada’s antitrust Competition Bureau is investigating Google’s business practices, to see “whether Google is abusing its dominance of the Internet search market to stifle competition and drive up digital advertising prices.”

Apparently authorities in Spain, Italy and France were also examining Google’s business practices, according to the Süddeutsche.de article.

10 years ago Short URL Comments

Canada/Commission nationale de l'informatique et des libertés/Competition/Data protection/Datenschutz/France/Holland/Italy/Jacob Kohnstamm/Privacy settings/Safari/Spain/United Kingdom

Nov

Detekteien

Private detective agencies. A Spiegel.de article dated 2008 said this was an unregulated and unsupervised but burgeoning security industry in Germany, sometimes employing former Stasi cooperators. The authors estimated there were ~1500 private detective companies in Germany in 2008 and about a dozen key world players, including the New York-based Kroll and London-based Control Risks. Many of these companies earned game-changing amounts of money in Iraq after the second U.S. invasion. They could be hired via law firms protected by attorney-client privilege, and subcontract jobs to other firms, obscuring cause-and-effect. A new C.E.O. of Control Risks said they were also hiring journalists to spy on other journalists.

A Detektei called Network Deutschland was “involved” in the German rail company Deutsche Bahn’s data privacy scandal when it was caught spying on its employees in 2009, leading to the retirement of C.E.O. Hartmut Mehdorn. Network Deutschland was also involved in the former-monopoly phone company Deutsche Telekom’s so-called “Telekom data scandal,” which is confusing but included T-mobile’s years of archiving communications data of members of its own supervisory boards, such as the head of the German trade union association Deutsche Gewerkschaftsbund. T-mobile was especially interested in any phone interactions with journalists. Deutsche Telekom was also accused of using private detectives to spy on journalists in other ways.

The 2013 Snowden revelations might provide some insight into the means private detective companies could have used to access these communications and banking data. Online ads and tech articles seem to be indicating that powerful N.S.A.-type tools are now trickling down into the regular economy, being sold to smaller and smaller entities.

N.B.: How early did the notoriously technophilic and well-funded U.S. National Football League know about some of these capabilities?

An English-language Spiegel.de article dated 2008 speculated about the separate huge data hoards controlled by the national rail (Deutsche Bahn), national airline (Lufthansa), post office (Deutsche Post) and phone company (Deutsche Telekom), all companies found to have made questionable investigations and hired detective agencies. The magazine couldn’t show that they had combined their data in 2008 though; they also only connected up e.g. that Deutsche Bahn and Deutsche Telekom hired the same detective agency but Lufthansa and (Telekom?) investigated the same journalist (Tasso Enzweiler from Financial Times Deutschland, which folded in 2012). The Spiegel article wanted to but could not show that the four big corporations also investigated each other, but it reminded us they were well positioned to investigate each other and anyone else in Germany. The Spiegel.de article didn’t want to feed conspiracy theorists but hoped the German government wasn’t asking these companies for access to their sensitive customer data. All four used to be state-owned and the German government still held large stakes in Deutsche Bahn and Deutsche Telekom.

(Day tect EYE en.)

Nov

L.K.W.-Maut

Truck toll.

Germany has a relatively new national toll on trucks. On 06 Nov 2013 it became known that interior minister Hans-Peter Friedrich (C.S.U.) had wanted to use data collected during the collection of that toll “to fight crime” but has supposedly been stopped from doing so.

Wikipedia said the toll was introduced in 2005 and is collected automatically by Toll Collect using G.S.M. and G.P.S. and on-board units on registered trucks or by toll tickets sold by off-ramp terminals.

(LOST croft VOG en m OW! T.)

Tag Archives: Datenschutz