Archive for the 'Privacy and Data Protection' Category

In the name of privacy…

Tuesday, August 3rd, 2010

If passed, a bill heavily supported by right wing Italian prime minister and media mogul , Silvio Berlusconi, will force the public prosecutors to wiretap suspect’s communication for a limited time and will punish harshly those who shares information related to a criminal investigation before the trial (that usually, in Italy, starts year after the alleged crime has been detected.)
This draft law is a ruthless attempt to shut down the check and balance system in Italy (thus, it is not a case that the bill is aimed at preventing prosecutors to investigate AND both traditional media and independent citizens to report information.)
That said, the reactions against the proposal were (and still are) short-sighted. Mainstream media talk about dangers for “bloggers” as if running a site with Drupal or WordPress actually gave a particular status to the information released. Technically speaking, whoever publish fake or offensive information is liable of his action. If those who commit the fact are journalists, then there is an additional liability for the editor-in-chief (in Italian: direttore responsabile.) Period.
I really don’t understand why a lot of “bloggers” complain for the (possible) introduction of a mandatory amendment of mistaken information. A law shouldn’t even be necessary, since it is matter of common sense to verify sources first and then, in case of error, fix it as fast as is possible.
Unfortunately, then, the criticisms against this law hit the wrong target, easing the work of the “Evil Forces”.

Google executives acquitted in Italy from defamation charges

Wednesday, February 24th, 2010

Today the Court of Milan made public the decision in the criminal trial against four Google executives, charged of defamation and illegal personal data handling in relationship to the publication on the video sharing platform  of a video containing act of bullyism against a person affected by the Down Syndrome.

The legal basis for the charges, following the prosecutor’s theory of the case, was that those executives failed to exercise a pre-emptive control over the contents published by Google final users’, thus allowing the infringement of the reputation of the concerned person and of an NGO representing Down-Syndrome-affected persons.

The Court acquitted all the defendant from the charges of defamation, while found them liable of the illegal personal data handling charge. The whole sentence (including the legal technicalities that support the decision) will be public within the next 30 days.

This indictment is the last component of a long series of court decisions that kill Network Neutrality and turn ISPs and Telcos into Digital Vigilantes while, in the meantime, no actual protection is given to the victims of online crimes.

The Peppermint and The Pirate Bay cases, the legal argument against Youtube and the one between an entertainment-backed lobbying group by one side and Telecom Italia, the ISP’s association and the Data Protection Authority on the opposite and – finally – this indictment are all linked through the same connection: to erode the absence of the legal duty to preemptively contol internet users’ activity established by the UE directive on e-commerce.

What is bizarre, in this Google trial, is that for the very first time the existence of the ISP’s duty to perform a mass-control of user activities has been asserted thank to the data protection regulation. The same data protection regulation that forbade the disclosure of the identities of people allegedly accused by the entertainment industry of copyright infringement through P2P networks.

Is still to early to understand the Court mind (since the basis for the decision will be disclosed within the next 30 days. It is, nevertheless possible to try an educated guess based on the Court records. To put it short, here is a probable explanation for the decision:

1 – there is a rule of law into the Criminal Code that says: to not stop a fact equals to cause it,
2 – data protection law requires a prior authorization to be obtained before handling personal data,
3 – a video to be posted online is personal data,
4 – therefore Google executives had to check whether the user who posted the video got the preemptive authorisation from the people of the video, and
5 – by failing to do so, they infringed the data protection law
6 – furthermore, by not controlling in advance, they let the video to libel the victim of the violence (this charge has been dismissed.)

It is too early to assess the damages provoked by this decision, but it is not unreasonable to imagine that – should this court decision become “case law” – the telco market will suffer an alteration of the competion among the various players. The smallest one can’t handle the increasing risk (and cost) of being sued or investing in momentum-generating policies. Big international players might find Italy a lesser attractive place to do business in.

Corporate liability for copyright infringements in Italy?

Friday, July 17th, 2009

Among the measures to fight the economic crisis announced by the Italian Government, sect. 15 para 1 lett. c) of the Anti-Crisis decree deserves a special mention: to put it short, the provision asserts corporate liability (under legislative decree 231/01)  for copyright infringement committed by top management.

Although it may seems that the new law is of a little impact on corporate life (is highly unlikely that a top manager has time to waste doing file sharing) a second glance prove this first opinion not entirely correct.

The inclusion of copyright infringements into the list of crimes implying specific corporate liability forces a company to revise its (mandatory) prevention model to reflect new changes; thus – de facto – establishing a specific set of controls aimed at downloads, website surfing and file sharing. Failing to do so might lead some zealous prosecutor to think that the company actually allows copyright abuses.

A side effect of this regulation – when it will come into full force – is that workplace privacy will get another heavy blow. For the sake of copyright abuse prevention, indeed, all of employees’ Internet activity will be deeply inspected.

So long, Mr. Data Protection Commissioner…

Aggregate data and Italian Data Protection Authority

Tuesday, June 30th, 2009

An Italian Data Protection Authority decision issued on June, 25, 2009 set the deadline of Sept. 30, 2009 for telco operators and ISPs that must notify the Data Protection Authority the list of their mining activities executed on customers’ aggregate data (such as traffic volumes, paths and so on.) The aim of this decision is to spot illegal (at least, under Data Protection Authority opinion) data handling “masked” by activities performed to keep the infrastructure running

The Data Protection Authority, after having received the information, will decide what can be still done without informing the customer, what can be done AFTER having informed the customer and obtained his approval and what cannot be done at all. Furthermore, the Data Protection Authority will release a set of technical and management rules to ensure the concerned subjects’ compliance.

If these new set of rules will mimic those recently established for data-retention purposes and system administrators, telcos and ISPs will face again a mayhem of useless bureaucracy so hard to understand that the Data Protection Authority itself did release a FAQ to explain what these regulation actually meant (and we’re still waiting for the FAQ interpretation.)

Although the decision is limited to the Internet and telephony world, it is clear that in the near future it will affects too energy firms, banks, insurance companies and, in general, everybody who relies upon aggregate data to tweak its supply chain of services.

Once again, the Italian Data Protection Authority is proved to be one of the biggest blocking factor of Italian telco market, while not granting citizens some sort of protection.

Italy to ban on-line anonimyty?

Monday, March 9th, 2009

A contribution for ALCEI.ORG
There is a disturbing, arising trend in Italy, of former showpersons now MPs of Berlusconi’s party to propose free speech and anonimity regulation “to protect minors” (but fact shows that they’re mostly concerned of copyright.)
Between January and March 2009 Luca Barbareschi (actor) and Gabriella Carlucci (anchor woman), proposed two draft laws whose declared intent was to enforce copyright protection by shutting down civil liberties.
To be clear:
- Mr. Barbareschi’s Proposal is aimed at create a “single point of cultural control” by granting the Italian State backed royalty collecting agency, the role of exclusive gateway between artists and market. Furthermore, Mr. Barbareschi’s draft law contains so loose statements about ISPs liability that the Government is allowed to do
basically whatever he wants.
- More dangerous, if possible, is Mrs. Carlucci draft law that wants to ban anonymity from the Net, refusing even to consider intermediate forms such as “protected anonymity” (where the ISP act as trusted third party).
Mrs. Carlucci want to establish a committee under the Communication Authority with power of interpreting Internet-related law (in Italy, only magistrates and the Parliament is supposed to), receiving “confidential notice” of infringement, acting as Alternative Dispute Resolution provider, counseling magistrates about the enforcement of preemptive activities ruled under rule of evidence code, like searches and seizure, termporary jail rescrition etc.)
If approved, these (draft) laws will cause the concentration of power in goverrment’s hands, by weakening the possibility (or the right) to defend ourselves in Court.
Another step toward the ethical state?

Italy, Data Protection, International Corporate Rules

Friday, August 22nd, 2008

Law n. 133 passed on Aug. 6, 2008 amends the Italian Data Protection Code and allow conglomerates and multi-national companies to freely exchange personal data, provided that their internal corporate rules system matches Italian Data Protection Regulation.

This is a way to circumvent the strict limits imposed by former regulation, that forbade the exchange of personal data with countries (like United States of America) with a lower level of personal data legal protection.

What’s ahead in security?

Saturday, February 2nd, 2008

This is the title of a speech Withfield Diffie gave in Rome at University La Sapienza last Jan. 31 2008, where I have been invited to attend the round table the followed. Other participants were Corrado Giustozzi, Giovanni Manca (CNIPA – National Centre for Information Technology in the Public infrastructures), prof. Luigi Mancini and Luisa Franchina (ISCOM).

There are a few online account for the day but none of them tells about the “content” of the conference. Mr. Diffie’s talk was professional and fascinating – if you don’t belong to the IT security professional’s circle. And this is the point: how is it possible that in 2008 we – Italians – still are so far from moving (even a few) steps ahead from what we were talking in 1995?

“Fighting terrorism” was – as usual – the “leading concern” to advocate defense and civil rights suspension in Italy. And each time I ear some Italian civil servant singing that song I remember about Michael Crichton’s State of fear, whose lesson – creating a state of fear to let powers and lobbies pursue their goals – is largely missed. This is not to say that terrorism is a fake issue. But when security of the State become a political (i.e. partizan) weapon, all we get is neither effective anti-terrorism measures nor freedom protection.

As Benjamin Franklin said,

They that would give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety

And this is what we are doing right now.

Schengen III Agreement. Italy is ready to adhere?

Wednesday, July 18th, 2007

Rumors say that Italy will be the next country to create a nation-wide DNA forensics database. A bill has recently been proposed, and the enforcement of the Schengen III Agreement seems closer than ever.

Italian Data Protection Law badly injured… whoduneit?

Friday, July 6th, 2007

Last June 5, 2007 the Italian Camera dei deputati (roughly, a sort of US “lower house” equivalent) passed a law to excuse Small Medium Enterprises (SME) employing no more than 15 people from the enforcement of mandatory security measures to protect personal data. To enter in full force the law need to be approved by the Senate, whose decision is exepcted in the very next weeks.

This law has been proposed because – as matter of fact – from 1996 to present days Italian Data Protection Law has become just a bureaucratic issue, made of form to fill, with no actual attention to substantive issus. And – that is worse – the Italian Data Protection Authority did almost nothing in the last twelve years to stop this trend.

The proposed SME’s exemption arouse the furious reaction of ICT security lobbies who claimed that this law endagers the whole Italian communication network “safety”.  This is a grossly misleading claim since data protection law only deals with a limited subset of data an the security measures related provisions basically provide “paper based security”.

True problem is that – on the contrary – Italian Data Protection Law has been drafted and enforced with a distinctive lack of  “reality check”, whose result is that now the Parliament is stepping back on its foot.

Peppermint, copyright and personal data

Sunday, May 20th, 2007

A side issue arising from the Peppermint affaire is the relationship between criminal and civil trials rule of evidence.

In a criminal investigation, access to ISP owned traffic data and log files is possible only with a public prosecutor search and seize warrant. One seized, these information are strictly confidential and cannot disclosed – even to the defense counsel – before the trial starts.

The very same data – as the Peppermint affaire shows – can indeed be obtained by a private entity alleging a civivl – not criminal, then – copyright infringement, just asking the civil court to force an ISP to disclose information.

This is a paradox of the Italian legal system, since criminal action is supposed to be the only reason to allow the breach of constitutional rights, while the a civil case only gives the court limited powers. This common-sense rule has been subverted when talking about copyright. Is it fair or acceptable?


Bad Behavior has blocked 654 access attempts in the last 7 days.