Greenleaf, Graham (compiled) --- "Private parts" [2000] PrivLawPRpr 23; (2000) 7(1) Privacy Law and Policy Reporter 20

• Senate e-privacy inquiry
• South Africa’s access rights
• Is P3P ‘pretty poor privacy’?
• Plymouth rocked

---

Private parts

Compiled by Graham Greenleaf

Senate e-privacy inquiry

The Australian Senate Select Committee on Information Technologies is to hold an inquiry into protection of information obtained about consumers through their electronic transactions (e-commerce, EFTPOS and the internet). The Committee has resolved to evaluate and report on:

• the protection of consumer information obtained through electronic transactions, including browsing on the internet and ‘EFTPOS’ transactions;
• the privacy and disclosure obligations of organisations that have access to consumer databases; and
• the access by consumers to personal information held in consumer databases.

Chair of the Senate Select Committee on Information Technologies, Senator Jeannie Ferris, says that the terms of reference provide scope for examination of issues such as the following:

• technologies for collecting consumer information on the internet (for example, cookies);
• measures for minimising the collection of personal information on the internet (for example, anonymous payment systems and digital certificates);
• the adequacy of the existing legal and technological regime for protecting personal information in the electronic age;
• the nature of personal information stored on consumer databases;
• standards for encryption and its effectiveness in protecting information that is stored electronically and transmitted over the internet; and
• time and cost involved when consumers access personal information stored on consumer databases.

Senator Ferris cited surveys indicating consumer suspicions about how their information was being used, and said these concerns about privacy diminish consumer confidence in e-commerce.

The closing date for submissions to the IT Committee is 28 July. It proposes to conduct public hearings, most likely on 21 and 22 August 2000. No reporting date is yet fixed. For further details, contact Senator Jeannie Ferris, Committee Chair, 02 6277 3440; Committee Secretariat, 02 6277 3646; Committee’s website <http://www.aph.gov.au/it> or email <[e-mail]>.

The Senate inquiry terms of reference do not refer directly to the Privacy Amendment (Private Sector) Bill, but the inquiry provides an additional opportunity to raise concerns about the Bill and about the House of Representative Legal and Constitutional Affairs Committee Report (see 7(1) PLPR 1), at least insofar as electronic transactions are concerned.

South Africa’s access rights

South Africa’s new Promotion of Access to Information Act 2000, passed in February 2000, gives individuals the right to access their personal data held by public or private sector organisations, irrespective of when the records were created. Where records of private bodies are concerned, there is only a right of access where it is ‘required for the exercise or protection of any rights’. The Act does not provide for correction rights, or other privacy rights. See <http://www.polity.org.za/govdocs/legislation/2000/act2.pdf> for the text of the law. The new law is a limited measure, but still a significant step in the global extension of information privacy rights to another major region of world.

Is P3P ‘pretty poor privacy’?

EPIC (Electronic Privacy Information Centre) and Junkbusters have released a report on the Platform for Privacy Preferences (P3P) developed by the World Wide Web Consortium (W3C). Pretty Poor Privacy: An Assessment of P3P and Internet Privacy (21 June 2000) examines whether P3P is an effective solution for online privacy protection. P3P allows consumers to set up privacy preferences regarding their personal information and automatically compares those settings to websites’ stated practices. P3P proposes the development of an elaborate range of privacy ‘choices’ that require individual internet users to make selections about the collection and use of personal data, even for online activities that would not normally require the disclosure of personal information, such as simply visiting a website. ‘The incredible complexity of P3P, combined with the way that popular browsers are likely to implement the protocol, would seem to preclude it as a privacy-protective technology,’ the report states. ‘Rather, P3P may actually strengthen the monopoly position over personal information that US data marketers now enjoy.’

The report goes on to argue that P3P fails to comply with fair information practices, the internationally accepted baseline standard for privacy protection, and concludes that there is little evidence to support the industry claim that P3P will improve user privacy. Instead of P3P, the report recommends adoption of privacy standards built on fair information practices and genuine privacy enhancing techniques (PETs) that minimise or eliminate the collection of personally identifiable information. The report is available at <http://www.epic.org/reports/prettypoorprivacy.html> . For more information about the W3C’s work on P3P see <http://www.w3.org/P3P/> .

Item provided by EPIC Alert Volume 7.12, June 27, 2000 <http://www.epic.org/alert/EPIC_Alert_7.12.html> .

Plymouth rocked

Ben Franklin’s web site: Privacy and curiosity from Plymouth Rock to the Internet by Robert Ellis Smith, publisher of the USA’s Privacy Journal, explores the ambivalence of Americans’ yearning for privacy and their insatiable curiosity. The book takes a panoramic view of American privacy from Puritan surveillance practices to tabloid journalism, wiretapping, and the internet. The book costs US$24.50, plus $4 for shipping. Contact Privacy Journal at [phone], <http://www.privacyjournal.net> or email <[e-mail]>.