ISP data retention plan hits Capitol Hill snag

Controversial legislation to require Internet providers to store logs about their customers for 18 months has run into an unexpected obstacle: a former supporter.

“This bill needs a lot of fixing up,” Rep. F. James Sensenbrenner, a Wisconsin Republican and previous chairman of the House Judiciary committee, said at a hearing today. “It’s not ready for prime time.”

The bill in question is H.R. 1981, which says Internet providers must store for “at least 18 months the temporarily assigned network addresses the service assigns to each account,” unless it’s a wireless provider like AT&T, T-Mobile, or Verizon.

Digital Agenda: Commission consults on practical rules for notifying personal data breaches

Brussels – The views of telecoms operators, Internet service providers, Member States, national data protection authorities consumer organisations and other interested parties are being sought by the European Commission on whether additional practical rules are needed to make sure that personal data breaches are notified in a consistent way across the EU. The revised ePrivacy Directive (2009/136/EC), which entered into force on 25 May 2011 as part of a package of new EU telecoms rules, requires operators and Internet service providers to inform, without undue delay, national authorities and their customers about breaches of personal data that they hold (see IP/11/622 and MEMO/11/320). The Commission wants to gather input based on existing practice and initial experience with the new telecoms rules and may then propose additional practical rules to make clear when breaches should be reported, the procedures for doing so, and the formats that should be used. Contributions to the consultation are welcome until 9th September 2011.

Protect sensitive data

With the escalation in frequency and severity of data breaches that have occurred over the past several years, many states, including New York, and industry regulation groups have created data privacy guidelines and requirements.

Even in the absence of such regulations, it makes basic business sense to properly protect your sensitive business data because it is the right thing to do for your customers and can prevent some embarrassing publicity for your business.

EU plans US company cloud ban

The dark satanic rumour mill is suggesting that the EU will ban cloud based services which are run by US companies.

Our sources say that European commissions are incandescent with rage after discovering that the US intends to apply its Partriot Act to all cloud based services in Europe. Microsoft has already said that it will have to comply.

But it appears to have caught the EU on the hop. Sophie in ‘t Veld, Dutch member of the European Parliament’s civil liberties committee, wants to know how it is possible that the Patriot Act overrules the European data protection laws.

Phone hacking: Police probe suspected deletion of emails by NI executive

News International’s claims of cooperating with police over phone hacking scandal brought into question. Photograph: Graeme Robertson

Police are investigating evidence that a News International executive may have deleted millions of emails from an internal archive in an apparent attempt to obstruct Scotland Yard’s inquiry into the phone-hacking scandal.

EU ready to fight Microsoft on access to cloud data

European Parliament members are up in arms after a recent admission by Microsoft that they may be required by the Patriot Act to secretly give U.S. authorities access to European data stored in Microsoft’s cloud.  The controversy stems from the EU’s Data Protection Directive, which dictates that companies must notify users if/when their data is handed over to another party.  If Microsoft is forced to follow Patriot Act guidelines, then that would mean the U.S. law would trump European law.  Some parliamentarians have taken up the cause to prevent that from happening.

Data Breaches Bring Back Failed Legislation From the Dead

Sen. Leahy and Rep. Bono Mack are pushing separate bills that would punish slow disclosure of data breaches. Versions of both bills failed earlier.

By John Adams

Public fallout from the data breaches that have affected Citigroup and other large enterprises in and out of finance in recent weeks has reached the political push back stage, with both Sen. Patrick Leahy (D-Vt.) and Rep. Mary Bono Mack (R-Calif.) hoping the events will breathe new life into data protection legislation that’s failed in the past.

What will new EU data breach rules mean for business?

Posted by Cath Everett

What can businesses expect from the European Commission’s much tougher data breach rules?

It has been announced that the European Union is planning to make it mandatory for all businesses in the region to notify customers should the security of their personal information be breached.

As part of plans to update EU data protection legislation that was first introduced in 1995, European Union justice commissioner Viviane Reding said that she was also considering whether to include an “accountability principle” to protect the privacy of cloud computing users as well as a “right to be forgotten”. Reding told the British Bankers’ Association’s Data Protection and Privacy Conference in London on Monday that the aim in streamlining existing data breach rules across different member states was to simplify the current regulatory environment and reduce the admin burden on companies.

Are we turning a blind eye to the data retention issue?

As some 20 internet companies, including Google, eBay and Facebook, file a complaint with the highest judicial body in France against a decree obliging them to keep users’ personal data for a year, why hasn’t there been a similar hue and cry in Ireland, where such data has to be retained for up to two years?

French Association of Internet Community Services (ASIC) is bringing the case before the State Council of France.