Chapter 2

Chapter 2

1. Self-regulation

   • Creation of codes by company, industry or independent body.
   • There may not be any generally applicable data protection law that creates a legal framework.
   • PCI - Payment Card Industry Data Security standard.
     • Collecting and Storing - This involves the secure collection and tamper-proof storage of log data so that it is available for analysis. Reporting - This is the ability to prove compliance should an audit arise. The organization should also show evidence that data protection controls are in place. Monitoring and Alerting - This involves implementing systems to enable administrators to monitor access and usage of data. There should also be evidence that log data is being collected and stored.
   • Groupe Speciale Mobile Association
   • OPA= Online Privacy Alliance
   • Seal programs: Where participants must abide by codes of info practices and submit to monitoring to ensure compliance.
     • TRUSTe
     • BBBOnine
     • WebTrust
     • AMIPCI Trust Mark
     • TrustSG
   • Emphasis of the industry to inform of its own personal information practices.

2. Comprehensive model in EU

   • 1. To remedy past injustices 2. Ensure consistency with EU privacy laws 3. Promote electronic commerce
   • Netherlands has developed code in close consultation with industries. Breach is considered violation of the Netherlands Data Protection Act.
     • Same for Ireland. Approval from Data Protection Commissioner and Parliament.
   • CRITICISMS: 1. 'One size fits all' costly, impractical for small operations 2. Discourages IT innovation
   • FIPS: Adecuate fairly and lawfully, accurate..
   • BCRs = Binding Corporate rules
     • Legally binding internal corporate privacy rules fro transferring personal information within a corporate group established by te EU Article 29 Working Party
       • Retraceable pseudonymized data may be considered information of individuals who are indirectly identifiable.
   • EU e-privacy directive (2002/58/EC
     • 1. Opt-in, opt-out consent, 2. Cookie notice, 3. Stronger individual subscriber rights, 4. Value-added services through location 5.
     • EU Cookie directive 2009
   • Data Protection Directive
     • Formed Article 29 Working Party, a group of data protection authorities that provided guidence on a wide range of data protection issues.
       • Laws enforced by national DPAs of member states as well as DPA of the European Commissiion itself.
   • EU-US Safe Harbor Agreement
     • US Dept of Commerce with European Commission
       • Companies subject themselves to the authority of a US enforcement authority.
         • FTC or Deptartment of Transportation (DOT)
     • 1. Notice 2. Choice 3. onward transfer 4. Access 6. Security 7. Data Integrity 8. enforcement
   • EFTA=European Free Trade Association
   • Europe outside EU
     • Andora: Qualified Law 2003
     • Armenia: Law of the Republic of Armenia on Personal Data 2003
     • Azerbaijan
     • Bosnia and Herzegovina
     • Belarus
     • Croatia
     • Kosovo
     • Moldova
     • Russia
     • Serbia
     • Ukraine

3. Sectoral model in US and Japan

   • Fair Information Practices
   • Financial Services Modernization Act 1999
   • Consumer Privacy Bill of Rights, not enacted into law.
   • Federal Privacy Laws
     • HIPAA Act 1996
       • Required US Dept of Health and Human Services to promulgate comprehensive regulations to protect privacy.
     • HITECH Act 2009
     • COPPA
       • Compliance with code is sufficient for compliance with statute, once code is approved by FTC.
         • FTC = -Federal Trade Commission.
           • Independent agency in USA. IP addresses ARE personal information.
     • FCRA
     • Gramm-Leach-Bliley Act (GLBA)
     • The Privacy Act 1974
     • FOIA: Freadom of Information Act 1966
       • eFOIA: Updated 1996
   • America outside US
     • Canada: Privacy Act of 1983 and PIPEDA 2000.
     • Latin America
       • Argentina
       • Bahamas
       • Chile
       • Colombia
       • Costa Rica
       • Mexico
       • Paraguay
       • Perú
       • Triniada and Tobago
       • Uruguay

4. Co-regulatory model in Australia and NZ

   • Industry development of enforceable codes or standards from privacy / data protection (against the backdrop of legal requirements of government.
   • National laws encourage creation of industry-specific codes. Once promulgated, they have effec in place of the underlying statutory protection.
   • Australia: Telecommunications Act 1997, National Health Act 1953, Data Machning Programs Act 1990, Crimes Act 1914.
   • Asia/Pacific outside Australia
     • Hong Kong
     • India
     • Indonesia
     • Japan
     • Kyrgyz Republic
     • Macau
     • Malaysia
     • NZ
     • Mongolia
     • Singapore
     • South Korea
     • Taiwan
     • Thailand