Legal Commentary

Level of privacy protection under attack

By David Canton

For the London Free Press – November 8, 2010

Read this on Canoe

Security: New report uncovers substantial deficiencies in protection by numerous federal agencies

When it comes to the protection of privacy, Canada’s federal agencies have some serious changes to make.

In its 2009-2010 annual report on the Privacy Act, Canada’s Office of the Privacy Commissioner exposed significant deficiencies in privacy protection by a slew of federal agencies.

The privacy commissioner examined five major federal entities, and found none of them had fully assessed the threats and risks inherent in using wireless communication.

Though most afforded the recommended level of encryption, only three of them required strong password protection for smart phones, and none insisted that data stored on the phones be encrypted. Certain entities were also found to have inadequate encryption for wi-fi networks.

There were weaknesses in the management of surplus mobile devices. The privacy commissioner found only one of the organizations could demonstrate all phones were wiped of data before being sent for disposal.

Additional deficiencies were exposed in the area of disposal of personal information.

Though satisfactory policies and procedural rules were in place for the disposal of paper documents and surplus technology, the practical implementation of the policies was deficient.

Tests on surplus computers donated by 31 federal agencies to Canadian schools revealed 90% of the computers had not been thoroughly wiped of data. Confidential, highly sensitive and even classified data remained on many of the computers.

The report also highlighted some key investigations into inappropriate disclosures of personal information from 2009-2010.

As a result of both faulty procedures and deliberate malfeasance, federal agencies wrongfully exposed personal information on numerous occasions.

Full post as published by eLegal Canton on November 08, 2010 (boomark / email).