The Federal Privacy Commissioner delivered her annual report on privacy under PIPEDA to parliament yesterday. It summarized the offices activity duing 2005, and sets out their thoughts going forward.

One noteworthy item is the tougher stance being taken to follow through and ensure that promises to fix privacy problems uncovered by complaints are actually fulfilled. Its also encouraging to see that the federal government seems to be consulting more with the Privacy commissioner on policy issues.

I’ll have more to say about this in this Saturday’s Free Press column.

Read the press release

Read the report

The press reports that Westjet has admitted to Internet espionage, apologized to Air Canada, and settled the lawsuit for a payment of $5.5 million to cover costs, and a $10 million donation to charity.

Its interesting that they made the admission and apology public – that’s often not done.

Seems that Westjet managers obtained Air Canada passwords and accessed internal Air Canada web sites. They found information to identify things like their most profitable flights.

I only know what has been in the press, but it illustrates some points.

Password protocols are important. Make sure access to sensitive material is properly controlled.

Just because you can access the system of a competitor or some other party, doesn’t mean you should. There is a huge difference between checking out a competitors public website to see what you can find about them, and entering into an area that they do not intend to be public and have tried to protect.

That thought is part of the bigger issue that surrounds new technology. For some reason, when something new comes along, people using it often forget to think about it in context. People often forget that just because you are able to do something, it doesn’t make it right to do it.

Its similar to bloggers who have been fired for revealing sensitive internal information on their blogs. They would never have put that information in a letter, but for some reason don’t think twice about using the new medium to do that.

Westjet learned an expensive lesson here – hopefully others will take notice.

Read an article from the London Free Press

David Canton – For the London Free Press – May 27, 2006

Read this on Canoe

Legal rights are rarely, if ever, absolute. A recent Supreme Court of Canada ruling involving the Access to Information Act demonstrates this.

In H.J. Heinz Co. of Canada Ltd. v. Canada (attorney general), the court stated there is a “delicate balance between privacy rights and the right of access to information.”

The Canadian Access to Information Act was enacted to give people access to information for records under government control or with a government institution. The act is meant to address the need for transparency, recognizing the principle that government information should be available to the public.

It does recognize there should be exceptions to this right of access, but these should be limited and specific, and the disclosure of government information should be reviewed by the courts.

Anyone may request information that is in government control. If there is a possibility the information requested may contain confidential business information, the government agency must inform the party who may be affected by the request.

This party then has the option of objecting to the release of the information, arguing it contains confidential business information that should not be made public due to legitimate confidentiality concerns. If this objection fails, the party may then apply to the courts for a review.

The act also has a separate provision that says the head of a government institution must not release personal information about an individual unless the person consents to disclosure, the information is already public or the request was made by another government institution.

Unlike the business information provision, there is no specific provision providing for an application for judicial review in this circumstance.

The Heinz case involved a situation in which a third party was notified there had been a request for information. The party believed the information requested included personal information and wished to argue this fell under the same review mechanism used for confidential business information.

While the wording of the statute didn’t seem to provide for making such a review application, the Supreme Court ruled it also didn’t preclude it.

The court noted Parliament’s protection of personal information was given even greater weight than confidential business information in legislation such as the Privacy Act and the Access to Information Act.

Although there was no judicial review mechanism specific to personal information, the court felt there were clear legislative goals underlying the acts and these goals should be respected.

This decision demonstrates the court’s recognition of the paramount importance of the individual’s right to privacy. Although it may appear to be judicial activism to some, the Supreme Court felt the policy and spirit underlying the legislation was of greater import than the strict wording of the act.

The blogsphere is buzzing about a demand letter sent by O’Reilly saying another party can’t use “web 2.0″ for a conference, because they have trade-marked it for conference use.

I might as well add my 2 cents worth (or should that be 2.0 cents worth?)

This is one of those cases where legal reasoning gets in the way of business judgement.

At best “web 2.0″ is a weak trade-mark, in that it is arguably descriptive, and is not distinctive.

One irony is that they perhaps have been a victim of their own success. They did such a good job of using, promoting and publicising the term web 2.0, that it has become generic.

Another irony is that web 2.0 is all about collaboration and sharing. Hardly collaborative if you won’t even let others use the term!

The best trade-marks are memorable and distinctive, not descriptive.

In my view, this one is not worth protecting at this point from a business perspective.

A techmeme post has a lot of good commentary on this.

Also take a look at Rob Hyndman’s thoughts which are noteworthy in that he was one of the organizers of the recent Mesh web 2.0 conference in Toronto.

Read the Techmeme posts

Read Rob’s post

Read the actual US Web 2.0 TM registration

Read the proposed Canadian Web 2.0 TM application

That’s the title of an article in the latest Info-Tech Advisor, a regular newsletter of the Info-Tech Research Group. The article starts off by saying:

Despite all the media buzz surrounding Microsoft’s new Ultra-Mobile PC (UMPC) form factor, the existing ultraportable notebook is still a superior mobility solution. The recent price drop in ultraportables brings high-end mobility to cost-conscious enterprises.

Its a good read.

I like the UMPC concept, but its just too expensive. Microsoft itself has expressed its disappointment about the cost.

The Info-Tech Advisor is only available by paid subscription, but a pdf of this article is at the link below, with their permission.

And take a look at their web site – including the chart comparing them with other providers.

Read the article

Look at the Info-Tech web site

Tim Berners-Lee, often called the inventor of the Internet, expressed his support for net neutrality at a conference. In essense, net neutrality means that the owner of the pipe should not discrimiante against those who use the pipe for either sending or receiving.

As I have said before, network neutrality is crucial. Given recent indications from pipe providers (ie telcos), I belive governments need to make this clear.

Read a CNet article

Read a ZDNet article via Digg

David Canton – for the London Free Press – May 20, 2006

Read this on Canoe

Next time you make a purchase, look at all copies of the credit or debit card receipt. They shouldn’t, but often do, show your entire credit or debit card number.

Printing those numbers on the customer or merchant copy is dangerous if receipts fall into the wrong hands.

That happened at a beauty supply store in Edmonton, Alta. Receipts bearing debit and credit card numbers were discarded in a dumpster behind the store and retrieved by criminals searching for private information. As a result, a customer was the victim of credit card fraud.

Alberta’s privacy commissioner got involved when Edmonton police were tipped off that confidential client information was being improperly disposed of by the store. The tipster gave the police receipts from the dumpster as proof.

Police recovered more than 2,600 customer credit and debit card sales transaction receipts. Thousands of clients had been put at risk of fraud, identity theft and other privacy violations.

The commission found that the store had not adequately protected its customers, and made recommendations on how it could do better.

First, it recommended the store implement a system to abbreviate the credit and debit card information that gets printed on receipts.

It also recommended the store secure the receipts while they were on the premises, destroy them by shredding or other means before disposal, dispose of them only in locked garbage bins and trash cans and keep a log of who had access to them.

The commission stressed the importance of teaching all employees about the need to protect clients’ privacy.

Unlike the Alberta Privacy Commission, the federal privacy commissioner has yet to address the issue of printing credit and debit card data on receipt. While the Alberta privacy legislation is different than the PIPEDA legislation that applies in Ontario and other provinces, there is no reason to believe the outcome would be different.

Businesses protecting their customers in this way also safeguard their own interests. No business wants to face a privacy investigation, or to expose its customers to credit or debit card fraud.

There is no need to print full debit or credit card numbers on either merchant or client copies of receipts. By the time the receipt is printed, the bank or credit card company has already OK’d the transaction.

The next time you see your debit or credit card number on either your own or the merchant’s copy, complain to the merchant. If their practice does not change, complain to the privacy commissioner.

NOTE: See David Fraser’s comments about this

A lengthy list of privacy advocates sent an open letter to the Canadian government this week expressing concern about the privacy issues surrounding DRM (Digital Rights Management). This issue is relevant in light of upcoming copyright legislation. The previous draft legislation contained protections for DRM – the reality is that we need protection from DRM.

I read the letter and background paper yesterday, and agree with their position. It’s a must read for anyone interested in DRM or privacy, or anyone that followed the Sony rootkit fiasco.

Search for “DRM” on this site to see earlier comments of mine on the topic.

This has received a lot of attention from other legal bloggers as well.

Read the letter and paper on the group’s website

Read Michael Geist’s post

Read David Fraser’s post

Read Rob Hyndman’s post

Read an ITBusiness.ca article (even though it says I’m from Hamilton, not London)

I attended the Mesh Web 2.0 conference in Toronto this week. It was a great success.

Here are a few snippets that came from the conference.

- Web 2.0 is all about community based knowledge.

- A recent book actually sold more paper copies as a result of being made available on-line for free.

- More authors and creators need distribution than need protection for their works.

- One reason Silicon Valley has been so successful is that it has local successes to stand as role models.

- “Freemium” is the new word for the shareware model where basic services or software are available for free, but require payment for more features.

Audio recordings were made of all the sessions, and will be available soon.

Go to the Mesh site wiki for post conference info

David Canton – For the London Free Press – May 16, 2006

Read this on Canoe

There has been a push to create greater legal consequences for Canadians who defeat anti-piracy protections on items such as software, CDs and DVDs.

The Electronic Frontier Foundation (EFF) recently released a scathing review of the effects of the U.S. Digital Millennium Copyright Act that should be considered before passing this type of law in Canada.

The 1998 DMCA prohibits any act that circumvents protections put in place by copyright owners. These are often referred to as technological protection measures or digital rights management.

For example, it is unlawful to circumvent the protections used on DVDs. It also outlaws the manufacture, sale, distribution or trafficking of tools and technologies that make circumvention possible.

EFF’s review is entitled Unintended Consequences: Seven Years under the DMCA. The full text of the article, including numerous examples to back its claims, can be found at eff.org.

The EFF argues the anti-circumvention provisions in the act have been used to stifle legitimate activities that have nothing to do with copyright infringement. It perceives the DMCA as a threat to several public policy priorities.

The EFF argues the act chills free speech and legitimate research. Lawsuits, threats and even prison terms for individuals who were not infringing any copyrights have had a chilling effect.

For example, a Princeton graduate student was threatened with a DMCA lawsuit in 2003 after publishing an article about flaws in CD copyright protection. Negative press and public outcry prevented the lawsuit from going forward.

A few years later, the same graduate student discovered the existence of flaws in the Sony rootkit CD copy-protection software. He felt a need to consult with lawyers and the publication was delayed several weeks while millions were left at risk.

The DMCA also creates fair-use issues. Consumers who legitimately buy a product should have the right to use it as they see fit. If they wish to create a copy of a CD for use on their iPod, this is a legitimate use. Unfortunately, the DMCA ban applies even when the circumvention would otherwise be legitimate.

The DMCA has also been used to attack legitimate competition rather than copyright pirates. Apple used the DMCA to threaten a competitor’s attempts to sell music downloads for use on the iPod. The DMCA has been used to try to block aftermarket competition in laser printer toner cartridges, garage door openers and computer maintenance services.