Blog

Posted on

The EU Data Retention Directive Trashed by the EU Court of Justice

Today the Europan Court of Justice has declared invalid the Data Retention Directive that forced ISP’s to retain some traffic data to be made available for the law enforcement agencies. Though the decision is immediately effective, until the local parliaments don’t update the concerned internal regulations, as crazy as it may sounds, ? the data-retention is still a legal obligation to be fulfilled.

It would be of great help if the local data protection authorities would issue a statement saying that they will not enforce anymore their own controls on data-retention, since any activity in this direction could be challenged on the ECJ decision.

A final remark: how is it possible that the data-protection authorities all over Europe didn’t spot the “little”, “tiny” problem of the Data Retention Directive?

Posted on

There is no such thing as “Information Security”

Security is Security. Period. No matter whether you’re designing a network, traveling around some third world country or assessing the pollution of the food you’re going to eat: security prowess comes from the confrontation of danger(s).

There is something different in people who’s been exposed to dangers of every sort (soldiers, firefighters, ER personnel) and those who don’t: the former knows what they’re talking about, the latter don’t. You can read it in their eyes, demeanor and down-to-earth approach, contrary to the pompous, empty style of somebody who can’t even handle spending half an hour on Barcelona’s Las Ramblas without being pickpocketed.

Think about it, the next time a “security” consultant tells you that “you have a security problem” and that “he can fix it”.

Posted on

Google and the Italian Data Protecion Authority fine

The news is making the round that Google has been indicted to pay a 1.000.000,00 Euros’ fine for the Street View’s “privacy infringement” under Italian Privacy Act. But (at least in this case) Google didn’t violate the Italian Laws and the Data Protection Authority did a blatant mistake: let’s see why.

1 – Google has not been investigated under “privacy” law, the relevant statute being the Data Protection Act (as I wrote, there is no superimposition between the two legal concepts);

2 – The Data Protection Act, being an enforcement of the EU Directive 95/46/CE only handles “personal data”, i.e. data that either identify a natural person or make a natural person identifiable;

3 – As the Italian Supreme Court said more than once – and so did the same Data Protection Authority ? – outdoor there is no reasonable privacy expectation,

Then, as soon as Street View shots pictures in open spaces and doesn’t identify people, there is no “privacy” infringement.

But this is just a conclusion drafted by interpreting the law. Real life is a horse of different colour.

Posted on

EU “Privacy” Directives and the Haunted Companies

The right to privacy is a pre-requisite of the EU Directive 95/46/CE ? and not its object. Art. 1 states it loud and clear:

1. In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.

This means that that calling the data protection-related directive – as well as the upcoming new regulation – “privacy law” or whatever similar is not just a terminology’s mistake but an error with actual (and costly) consequences negatively affecting companies’ budget allocation, legal compliance and marketing capabilities.

Under the EU data protection legal framework, companies are not required to protect “privacy” as such, but only to handle personal data on a “need-to-know” basis provided that fundamental rights are not endangered. This has nothing to do with the “hush-hush” attitude commonly “sold” by “expert” consultants summoning the right to privacy as a threatening devil to haunt a company.

Stop using “privacy” as a substitute for “data protection” and your (corporate) life will keep smiling at you again.

 

Posted on

Friday Night (Data Retention) Fever

Here is a real case that happened just a couple of days ago, while helping an ISP to find a way to handle the deletion of data after the mandatory term imposed by the Eu Data Retention Directive expires. Whatever the solution, thank to the rigidity of the provisions, a law will not be obeyed.

Background:

  •  ? The automatic processing of the data-deletion is usually made so that a script matches daily the data-creation date with the current date, and if the match says that the retention term is expired, then the script delete the data,
  • The only exception is a “freeze” order issued by a Court or a prosecutor. In this case it is possible to avoid the requested data to be destroyed,
  • The “freeze” order are notified either by fax, secure email or direct order to the “Protocol department” (that handles the incoming communications, and that “route” the messages to the concerned people),
  • While when the offices are closed there is always at least one resource belonging to the technical department to be alerted in case of urgency, the administrative offices just shut down the curtains of Friday at – say – 5P.M.,

Scenario:
– let’s say that a secure mail or a fax containing the “freezing” order arrives when the Protocol Department is closed. This means that the request will be processed the next day,

– let’s say that the “freezing” order concerns data that are going to be destroyed the very same Friday night when the order arrived,

What happens is that the “freezing” order arrived timely, before the data were destroyed, but since the internal route of the order is handled when the term is expired, the data have been deleted.

A possible solution could be to extend the deleting time frame of three days (thus accounting for the week-end gap) but it doesn’t work. Here is why.

If I have to destroy the data on Friday, and I kept it until Monday just to check if some Court order has been notified in the meantime, it might happens that on the very same Monday a Court order might be notified in relationship to the Friday-to-be-deleted data (when the data are supposed not to exist anymore).

So, if I follow the DRD I must refuse to comply with the Court order because though the data are there, they can be processed only if the Court order were notified within the original term. On the other hand, I can’t refuse to obey to a Court order, if I still have the concerned information.

A contemporary version of the Buridan’s Ass Paradox.