Governance: Public Sector Perspectives Focus on Privacy and Intellectual Property Presentation to CGA-HK Charles Mok Internet Society Hong Kong 2009.10.31

Privacy and Personal Data: What happened in Hong Kong? Hospital Authority 10 cases: USB storage, digital camera, notebook, PDA, MP3 player HSBC IMMD, Police Foxy But, taking it in a global perspective... 10/07: 2 computer discs were lost in the mail by the tax authority, with personal data of 25M citizens, including names, addresses, national insurance numbers, and information on almost all children under 16 in Britain. (Password protection but no encryption.)‏

Hospital Authority

10 cases: USB storage, digital camera, notebook, PDA, MP3 player

HSBC

IMMD, Police

Foxy

But, taking it in a global perspective...

10/07: 2 computer discs were lost in the mail by the tax authority, with personal data of 25M citizens, including names, addresses, national insurance numbers, and information on almost all children under 16 in Britain. (Password protection but no encryption.)‏

The need for a new culture It is about people's behavior It is not about: Simply putting blames on the staff Avoiding the use of technology – trading off efficiency and even safety etc. Developing a new corporate culture Convenience vs. security and respect for other people's privacy Legal and institutional safeguards

It is about people's behavior

It is not about:

Simply putting blames on the staff

Avoiding the use of technology – trading off efficiency and even safety etc.

Developing a new corporate culture

Convenience vs. security and respect for other people's privacy

Legal and institutional safeguards

Data protection principle in PDPO Principle 1 -- Purpose and manner of collection. This provides for the lawful and fair collection of personal data and sets out the information a data user must give to a data subject when collecting personal data from that subject. Principle 2 -- Accuracy and duration of retention. This provides that personal data should be accurate, up-to-date and kept no longer than necessary. Principle 3 -- Use of personal data. This provides that unless the data subject gives consent otherwise personal data should be used for the purposes for which they were collected or a directly related purpose. Principle 4 -- Security of personal data. This requires appropriate security measures to be applied to personal data (including data in a form in which access to or processing of the data is not practicable). Principle 5 -- Information to be generally available. This provides for openness by data users about the kinds of personal data they hold and the main purposes for which personal data are used. Principle 6 -- Access to personal data. This provides for data subjects to have rights of access to and correction of their personal data.

Principle 1 -- Purpose and manner of collection. This provides for the lawful and fair collection of personal data and sets out the information a data user must give to a data subject when collecting personal data from that subject.

Principle 2 -- Accuracy and duration of retention. This provides that personal data should be accurate, up-to-date and kept no longer than necessary.

Principle 3 -- Use of personal data. This provides that unless the data subject gives consent otherwise personal data should be used for the purposes for which they were collected or a directly related purpose.

Principle 4 -- Security of personal data. This requires appropriate security measures to be applied to personal data (including data in a form in which access to or processing of the data is not practicable).

Principle 5 -- Information to be generally available. This provides for openness by data users about the kinds of personal data they hold and the main purposes for which personal data are used.

Principle 6 -- Access to personal data. This provides for data subjects to have rights of access to and correction of their personal data.

Current PDPO Consultation Biometric data as sensitive personal data Direct or indirect regulation of data processors Voluntary disclosure of data leakage 'Malicious' use of others' personal data Enforcement of Privacy Commissioner's Office IP address not part of consultation Consultation ends Nov 30, 2009 http://www.cmab.gov.hk/doc/issues/PDPO_Consultation_Document_en.pdf

Biometric data as sensitive personal data

Direct or indirect regulation of data processors

Voluntary disclosure of data leakage

'Malicious' use of others' personal data

Enforcement of Privacy Commissioner's Office

IP address not part of consultation

Consultation ends Nov 30, 2009

http://www.cmab.gov.hk/doc/issues/PDPO_Consultation_Document_en.pdf

Digital Copyright Consultation No criminalization of downloading activities Tripartite Forum MOU process for OSPs and copyright owners failed Notice-and-notice (e.g. Canada), notice-and-takedown (e.g. US DMCA), and graduated response (e.g. France's 'three strikes') 2009 Policy Agenda: Legislation process 'Fair Use' Superceded by limit on technological circumvention

No criminalization of downloading activities

Tripartite Forum

MOU process for OSPs and copyright owners failed

Notice-and-notice (e.g. Canada), notice-and-takedown (e.g. US DMCA), and graduated response (e.g. France's 'three strikes')

2009 Policy Agenda: Legislation process

'Fair Use'

Superceded by limit on technological circumvention

Q&A Thank you! Charles Mok Internet Society Hong Kong [email_address] www.isoc.hk www.charlesmok.hk

Thank you!

Charles Mok

Internet Society Hong Kong

[email_address]

www.isoc.hk

www.charlesmok.hk