DATA PROTECTION LEADERS FOCUS ON SOCIAL- NETWORKING PRIVACY

Data protection authorities from a range of countries held a teleconference to discuss how they can work together to protect what they see as a steady erosion of privacy by social networking services, and the European Union too is studying what role it can play. They may not be able to hold the social networking wave back, but policymakers are looking at what they can do to limit what they see as the “Big Brother”-like role of some sites.
Read the article: http://gigalaw.com/2010/04/22/data-protection-leaders-focus-on-social-networking-privacy/ (Source: Reuters)

SEC WORKERS VIEWED PORN ONLINE

As the country was sinking into its worst financial crisis in more than 70 years, Security and Exchange Commission employees and contractors cruised porn sites and viewed sexually explicit pictures using government computers, according to an agency report obtained by CNN. “During the past five years, the SEC OIG (Office of Inspector General) substantiated that 33 SEC employees and or contractors violated Commission rules and policies, as well as the government-wide Standards of Ethical Conduct, by viewing pornographic, sexually explicit or sexually suggestive images using government computer resources and official time,” said a summary of the investigation by the inspector general’s office.
Read the article: http://gigalaw.com/2010/04/23/sec-workers-viewed-porn-online-report-says/ (Source: CNN.com)

TEN COUNTRIES TELL GOOGLE TO STRENGTHEN PRIVACY

Privacy officials from ten countries sent Google Inc. a letter demanding that the Internet giant build more privacy protections into its services, the latest sign of increasingly international anxiety over Google’s power. The letter, reviewed by the Wall Street Journal, was signed by officials in Canada, France, Germany, Ireland, Israel, Italy, the Netherlands, New Zealand, Spain and the United Kingdom.
Read the article: http://gigalaw.com/2010/04/19/ten-countries-tell-google-to-strengthen-privacy/ (Source: The Wall Street Journal)

SUPREME COURT HEARS CASE ON E-MAIL PRIVACY AT WORK

An Obama administration lawyer urged the Supreme Court to rule that employees usually have no right to privacy when they send personal messages on computers, cellphones or other devices supplied by their employer. Nationwide, most employers have adopted policies telling workers they have no right to privacy when they use computers and cellphones supplied by an employer, said Deputy Solicitor Gen. Neal Katyal.
Read the article: http://gigalaw.com/2010/04/19/supreme-court-hears-case-on-e-mail-privacy-at-work/ (Source: Los Angeles Times)

FACEBOOK TO DISCUSS CHILD PROTECTION ISSUES

Facebook executives are due to meet the head of a British child protection agency in Washington to discuss safety measures on the social networking site. It has been criticized by the Child Exploitation and Online Protection (CEOP) center for not installing “panic buttons” on every page.

Read the article: http://gigalaw.com/2010/04/12/facebook-to-discuss-child-protection-issues/ (Source: BBC News)

FINALLY, THE LAW IS HERE

By Abu Bakar Munir

The long wait is over. On Monday 5 April 2010, the Dewan Rakyat at about 7.30 p.m, after quite an exciting and interesting debate, passed the Malaysian Personal Data Protection Bill. It was a special privilege to be able to assist the Minister in responding to the questions from the Members of Parliament (MPs). All of them, from BN and opposition parties, acknowledged and supported the Bill. They differ, however, in term of what should be in it. It is a special thrill to see the passage of this crucial law.

The first in ASEAN, the law provides rules and regulations as to how data users should manage and process personal data of their workers, customers, suppliers, etc. The law also gives certain rights to the data subjects. Some new criminal offences have been created in relation to processing of personal data.

For the existing data users, they are required to comply with the law within three months from the date of coming into operation of the Act. Companies and organizations are required to be registered as data users to enable them to process personal data.

Data subjects, under the law, among others, would have the right to prevent processing likely to cause damage or distress. More importantly, the law empowers data subjects the right to prevent processing of personal data for purposes of direct marketing.

Data protection is not rocket science. It is about respect and common sense. Good data protection is good business.

LAWMAKERS WANT FTC PROBE OF GOOGLE BUZZ

By Grant Gross

DG News Service - Eleven U.S. lawmakers have asked the U.S. Federal Trade Commission to investigate Google's launch of its Buzz social-networking product for breaches of consumer privacy. The representatives -- six Democrats and five Republicans from the House Energy and Commerce Committee -- noted in their letter that Google's roll-out of Buzz exposed private information of users to Google's Gmail service to outsiders. In one case, a 9-year-old girl accidentally shared her contact list in Gmail with a person who has a "sexually charged" username, the lawmakers said in the letter, sent to the FTC Friday and released Monday.

"Due to the high number of individuals whose online privacy is affected by tools like this -- either directly or indirectly --- we feel that these claims warrant the commission's review of Google's public disclosure of personal information of consumers through Google Buzz," said the letter, organized by Representative John Barrow, a Georgia Democrat.

In the original public version of Buzz, launched in February, the program compiled a list of the Gmail contacts the users most frequently e-mailed or chatted with and automatically started following those people. Those lists were made public, giving strangers access to the contacts of Buzz users.

There were a flurry of complaints from Gmail users, and Google made changes to Buzz within a couple of days. Asked for a response to the letter, a Google spokeswoman said user transparency and control are important to the company. "When we realized that we'd unintentionally made many of our users unhappy, we moved quickly to make significant product improvements to address their concerns," she said, repeating Google's past statements on Buzz. "Our door is always open to discuss additional ways to improve our products and services moving forward. "

The lawmakers asked the FTC to get answers to four questions from Google, including whether the company will revise its Gmail privacy policy to obtain consent from consumers for sharing their information. The lawmakers also want to know if Google was using the personal information collected through Buzz to deliver targeted advertising. The representatives also questioned how Google's planned acquisition of mobile advertising vendor AdMob will affect consumer privacy. In mid-March, outgoing FTC member Pamela Jones Harbour ripped into Google for its handling of Buzz, calling the product's launch "irresponsible conduct."

In February, the Electronic Privacy Information Center (EPIC) filed a complaint with the FTC, saying that Google Buzz engaged in unfair and deceptive practices that violated Google's privacy policy and federal wiretap laws.

GOOGLE EXECUTIVE URGES TRADE AGREEMENTS FOR INTERNET

A top Google executive called for new rules to crack down on governments that filter the Internet, saying the practice was hindering international trade. Alan Davidson, director of United States public policy for Google, told a joint Congressional panel that the United States and other democracies should draft trade agreements that incorporate pledges to keep Web sites uncensored.

Read the article: http://gigalaw.com/2010/03/24/google-executive-urges-trade-agreements-for-internet/ (Source: The New York Times)

FRENCH MAN ARRESTED FOR HACKING OBAMA'S TWITTER ACCOUNT

A French man has been arrested for hacking into the Twitter account of President Barack Obama, French police said. The 25-year-old man, who lives in central France, also stole information online about other celebrities, including Britney Spears, stealing passwords for email accounts and publishing personal information on the Web.

Read the article: http://gigalaw.com/2010/03/24/french-man-arrested-for-hacking-obamas-twitter-account/ (Source: Reuters)

ICANN MAY REVISIT DECISION DENYING .XXX DOMAIN

A global Internet oversight agency is reopening discussions about whether to create a “.xxx” domain name as an online red-light district where porn sites can set up shop away from the wandering eyes of children and teenagers. The Internet Corporation for Assigned Names and Numbers, which oversees the allocation of Internet addresses globally, may revive ICM Registry’s bid yet again as ICANN meets this week in the Kenyan capital of Nairobi.

Read the article: http://gigalaw.com/2010/03/11/icann-may-revisit-decision-denying-xxx-domain/ (Source: USA Today)

U.S WEIGHING CHINA INTERNET CENSORSHIP CASE

WASHINGTON (Reuters) - The United States is studying whether it can legally challenge Chinese Internet restrictions that hurt Google and other U.S. companies operating in China, but direct talks with Beijing might yield faster results, the top U.S. trade official said on Tuesday.

At the same time, U.S. trade officials are "trying to make our own determination whether we believe in fact this is not WTO compliant and if the best resolution is to go forward and file an appeal," Kirk said. "We are still dialoguing not just with Google, but with other Internet providers, to make sure we fully understand what is happening in China," U.S. Trade Representative Ron Kirk said in remarks at the National Press Club.

A U.S. free speech group known as the First Amendment Coalition had been urging such a case for years before Google threatened to leave China in January due to hacking incidents and Web restrictions. A case challenging censorship practices that affect Google and other Internet providers who operate in China would be the first of its kind at the WTO.

U.S. companies cannot wait that long for a solution in the current economic environment, although the United States will not hesitate to go to the WTO when that is the only solution it has left, Kirk said.

Kirk said trying to resolve the issue through bilateral forums such as the U.S.-China Joint Commission on Commerce and Trade (JCCT) was "much more preferable than the uncertain path of what can be a two-, three-, four-year legal battle in the WTO." Kirk noted Google and China have been in "very intense negotiations" since the company's threat to leave.

The government procurement policy is intended to spur Chinese companies to be more innovative, but the United States argues it is essentially a trade barrier that does not reflect how products are developed in the global economy. On another matter, Kirk said the United States also hoped to persuade China to change "indigenous innovation" rules favoring companies that develop the intellectual property for new products in China.

"This was one of the prime topics of concern" in preparatory talks with the Chinese for two upcoming high-level bilateral forums, the U.S.-China Strategic and Economic Dialogue this spring and the JCCT next fall, Kirk said.

"Our objective is just to get the government's thumb off the scale," Kirk said.

(Reporting by Doug Palmer; Editing by Xavier Briand)

GERMAN DATA RETENTION LAW CANNOT BE RETAINED

By Abu Bakar Munir

On 6 January 2010, under the title, "E.U Data Retention Directive: Would It Survive?, I mentioned about the Germany's biggest-ever class action challenging the Germany's law implementing the E.U Data Retention Directive. Germany's Constitutional Court, on 2 March 2010, has made its decision that the law which requires telecommunication and Internet providers to retain personal information for six months is unconstitutional. Storing or retaining the information has been regarded as "grave intrusion' to personal privacy rights and must be revised.

The Court held that section 113 of the Telecommunications Act violates the privacy of German citizens and that the lacks the controls to ensure the data is secured and properly utilized. The Court also ruled that all data stored until now must be immediately deleted and no more data may be held until the national law is revised to conform with the country's basic law.

Justice Minister Sabine Leuthesser-Schnarrenberger, one of the plaintiffs as private citizen, welcomed the decision. The Interior Minister Thomas de Maiziere, however, expressed disappointment with the decision of the Court and said that the government would look to draw up new law quickly. Civil rights activists who had fiercely opposed the law welcomed the ruling. Germany's federal data protection watchdog said, "The government must not only refrain from collecting data, it must also protect citizens from the excessive gathering of information and building of profiles by the private sector."

The ruling hasn't scrapped the law altogether, but has effectively suspended it until massive amendments limiting its scope have been implemented. Many plaintiffs had hope the Court would rule that storing data per se was unconstitutional and scrap the law altogether.

German NGO Working Group on Data Retention demands the resignation of the responsible Minister of Justice, social democrat Brigitte Zypries who negotiated the data retention rules.

ITALY CONVICTS GOOGLE EXECS OVER UPLOADED VIDEO

By Hibah Yousuf, staff reporterFebruary 24, 2010: 7:52 AM ET
NEW YORK (CNNMoney.com)

A judge in Milan found three Google executives guilty Wednesday of violating Italy's privacy code over a video that was uploaded on the search giant's video platform, the company said.
After being notified about the video -- which showed students bullying an autistic classmate -- by Italian police in 2006, Google took the video down within hours, said Matt Sucherman, the company's vice president and deputy general counsel for Europe, the Middle East and Africa, in a blog post.

He added that the company continued to work with authorities to help identify the student who uploaded the video, and she and other students involved were sentenced to 10 months of community service by a court in Turin, Italy. The video was uploaded to Google Video, prior to the company's purchase of YouTube. Sucherman said a public prosecutor in Milan then indicted four Google executives -- senior vice president and chief legal officer David Drummond, chief privacy counsel Peter Fleischer, marketing executive Arvind Desikan and former chief financial officer George Reyes -- for criminal defamation and violation of the country's privacy code. All but Desikan were found guilty of the privacy charge, and the judge found all four executives not guilty of criminal defamation.

Google said it plans to appeal the court's decision because its employees "had nothing to to do with the video in question" and for its implications on Internet freedom and censorship."In essence this ruling means that employees of hosting platforms like Google Video are criminally responsible for content that users upload," Sucherman said. "Common sense dictates that only the person who films and uploads a video to a hosting platform could take the steps necessary to protect the privacy and obtain the consent of the people they are filming."

Following the sentencing, Google's lawyer Giuseppe Banan told reporters that legal codes do not require Google, the Internet or any other company to control content before it is uploaded to the Web. But prosecutor Alfredo Robledo said "the right of enterprise cannot rule over that of dignity of the human being," and expressed his satisfaction with the judge's ruling.

INTERNET CRASHES IN MOCK CYBER WAR

Ten former White House advisors and other top officials joined forces in a rare public cyber war game designed to highlight the potential vulnerability of the nation’s digital infrastructure to crippling attack. The results were hardly reassuring.
Read the article: http://gigalaw.com/2010/02/17/internet-crashes-in-mock-cyber-war/ (Source: Los Angeles Times)

BROAD NEW HACKING ATTACK DETECTED

By SIOBHAN GORMAN (THE WALL STREET JOURNAL)

Hackers in Europe and China successfully broke into computers at nearly 2,500 companies and government agencies over the last 18 months in a coordinated global attack that exposed vast amounts of personal and corporate secrets to theft, according to a computer-security company that discovered the breach. The damage from the latest cyberattack is still being assessed, and affected companies are still being notified. But data compiled by NetWitness, the closely held firm that discovered the breaches, showed that hackers gained access to a wide array of data at 2,411 companies, from credit-card transactions to intellectual property.

The hacking operation, the latest of several major hacks that have raised alarms for companies and government officials, is still running and it isn't clear to what extent it has been contained, NetWitness said. Also unclear is the full amount of data stolen and how it was used. Two companies that were infiltrated, pharmaceutical giant Merck & Co. and Cardinal Health Inc., said they had isolated and contained the problem. Starting in late 2008, hackers operating a command center in Germany got into corporate networks by enticing employees to click on contaminated Web sites, email attachments or ads purporting to clean up viruses, NetWitness found. In more than 100 cases, the hackers gained access to corporate servers that store large quantities of business data, such as company files, databases and email.

They also broke into computers at 10 U.S. government agencies. In one case, they obtained the user name and password of a soldier's military email account, NetWitness found. A Pentagon spokesman said the military didn't comment on specific threats or intrusions. At one company, the hackers gained access to a corporate server used for processing online credit-card payments. At others, stolen passwords provided access to computers used to store and swap proprietary corporate documents, presentations, contracts and even upcoming versions of software products, NetWitness said.

Data stolen from another U.S. company pointed to an employee's apparent involvement in criminal activities; authorities have been called in to investigate, NetWitness said. Criminal groups have used such information to extort sensitive information from employees in the past. The spyware used in this attack allows hackers to control computers remotely, said Amit Yoran, chief executive of NetWitness. NetWitness engineer Alex Cox said he uncovered the scheme Jan. 26 while installing technology for a large corporation to hunt for cyberattacks.

That discovery points to the growing number of attacks in recent years that have drafted computers into cyber armies known as botnets—intrusions not blocked by standard antivirus software. Researchers estimate millions of computers are conscripted into these armies. "It highlights the weaknesses in cyber security right now," said Adam Meyers, a senior engineer at government contractor SRA International Inc. who reviewed the NetWitness data. "If you're a Fortune 500 company or a government agency or a home DSL user, you could be successfully victimized."

Disclosure of the attack comes on the heels of Google Inc.'s allegation that it and more than 20 other companies were breached by Chinese hackers. This operation appears to be more far-reaching, infiltrating some 75,000 computers and touching 196 countries. The highest concentrations of infected computers are in Egypt, Mexico, Saudi Arabia, Turkey and the U.S.
NetWitness, based in Herndon, Va., said it was sharing information with the companies infected. Mr. Yoran declined to name them. The company provides computer security for U.S. government agencies and companies. Mr. Yoran is a former Air Force officer who also served as cyber security chief at the Department of Homeland Security.

Besides Merck and Cardinal Health, people familiar with the attack named several other companies infiltrated, including Paramount Pictures and software company Juniper Networks Inc. Merck said in a statement that one computer had been infected. It said it had isolated the attack and that "no sensitive information was compromised." Cardinal said it removed the infected computer from its network. Paramount declined to comment. Juniper's security chief, Barry Greene, wouldn't speak about any specific incidents but said the company worked aggressively to counter infections.

ISP DEFEATS HOLLYWOOD COPYRIGHT CLAIM

By David Kravets (WIRED)

A leading Australian internet service provider was cleared of copyright allegations Thursday when a federal judge ruled against Hollywood’s lawsuit that iiNet was responsible for infringing BitTorrent data traveling its pipes. The Australian Federal Court decision siding with the country’s third-largest ISP was a legal blow to worldwide efforts to make ISPs liable for the unlawful behavior of their customers.

“I find that the mere provision of access to the internet is not the means of infringement,” Federal Court Justice Dennis Cowdroy ruled. “If the ISPs become responsible for the acts of their customers, essentially they become this giant and very cheap mechanism for anyone with any sort of legal claim.”

However, the judge’s ruling against the studios’ consortium called Australian Federation Against Copyright Theft comes amid deepening pressure from the Recording Industry Association of America and the Motion Picture Association of America for internet service providers to take some copyright responsibility. The ISP said in a statement that “this case has been important not just for iiNet, but the entire internet industry.” (.pdf) Almost all BitTorrent traffic consists of infringing material.

Meanwhile, the Anti-Counterfeiting Trade Agreement secretly being negotiated between the United States, European Union and others might require ISPs to terminate copyright scofflaws’ internet access or assume copyright liability for their customers’ behavior, according to leaked documents. What’s more, Italy this week announced proposed new measures that would make YouTube and other video-sharing sites liable for infringing material posted by their customers.

Similar claims are being made in the United States, where Viacom is suing YouTube, accusing it of being vicariously liable for the infringing activity of its users. That 2007 case is pending. Viacom alleges that Google-owned Viacom undertakes a “brazen disregard of intellectual property laws.”

By David Kravets

February 4, 2010 |

2:24 pm

Read More http://www.wired.com/threatlevel/2010/02/isp-defeats-hollywood-copyright-claims/#ixzz0ehyozXE0

By David Kravets

February 4, 2010 |

2:24 pm

Read More http://www.wired.com/threatlevel/2010/02/isp-defeats-hollywood-copyright-claims/#ixzz0ehyozXE0

IN EUROPE, CHALLENGES FOR GOOGLE

Demonstrators in Berlin in September protesting the storage of personal details by Internet companies, which they call ‘‘data octopuses.’’

By ERIC PFANNER (THE NEW YORK TIMES)

Published: February 1, 2010

Google has a problem in China. But it may have bigger headaches in Europe.

On issues as varied as privacy, copyright protection and the dominance of Google’s Internet search engine, the company is clashing with lawmakers, regulators and consumer advocates. And the fights are escalating across Western Europe. The stakes are high — potentially higher for Google than anything that happens in China — because Google’s operations in Europe are so much larger and more lucrative. In Britain alone, Google has roughly 10 times its estimated sales in China. Across most of the Continent, Google is by far the most popular search engine, with a substantially larger market share over its rivals than it has over those in the United States.

Google’s border-straddling scale and its brash ambitions raise alarms with some European politicians. The government of Prime Minister Silvio Berlusconi of Italy has proposed a law making online video services like YouTube liable for invasions of privacy, violations of copyright and other transgressions that occur in user-generated content. Meanwhile Google is contesting a copyright lawsuit from Mediaset, Mr. Berlusconi’s family company, which is the largest commercial television broadcaster in the country. “It’s a full-scale battle against Google in Italy,” said Paolo Brini, a spokesman based in Perugia for ScambioEtico, a group that campaigns for civil liberties online.

In Germany, the minister of justice, Sabine Leutheusser-Schnarrenberger, complained recently about Google’s instinct for “pressing ahead” and its “megalomania.” She said the company was tearing down privacy protections. “On the whole, I see a giant monopoly developing, largely unnoticed, similar to Microsoft,” she said in an interview with the magazine Der Spiegel. A spokesman later clarified that she had not meant to express an opinion on antitrust matters, which are outside her jurisdiction.

Google says that ordinary Europeans do not have similar fears. It says the complaints are from competitors like Microsoft and media companies whose longtime business models are threatened by technological change. “We love being in Europe, and we have many users across many countries who enjoy our products,” the company, which threatened last month to withdraw from China in response to an attack on its computer systems, said in a statement. “Our popularity means some people will complain. The important thing for us is to do the right thing, and that means not locking our users into our products and working well with our partners.”

Google’s most immediate challenges may be in Italy. This month, a decision is expected in a trial in Milan, where four Google executives were charged with defamation and privacy violations in a case involving videos posted on a Google Web site that showed the bullying of a boy with autism. The company says a guilty verdict might require it to edit content on YouTube before it is posted, which it says, would be incompatible with the open spirit of the Internet, as well as European Union guidelines. Prosecutors say Google was too slow to remove the video.

On another front, Italian authorities last summer raided the company’s offices in Milan, opening an investigation of Google News, which displays excerpts from online news articles. Italian publishers contend that Google News violates their copyrights, but say they cannot remove their articles from the service without slipping in Google’s search rankings, which would cost them ad revenue. Google says there is no such link between Google News and the search engine.

German newspaper and magazine publishers have complained to their government, saying that all of their Web sites together earn only about 100 million euros a year from advertising, while Google generates an estimated 1.2 billion euros from search advertising in Germany. The federal anticartel agency is gathering information, but has not yet decided whether to open a formal investigation. German publishers have persuaded the government of Chancellor Angela Merkel to support a new kind of copyright protecting journalistic content on the Web. Analysts say the measure, which has not yet been introduced, could require Web companies like Google to buy special licenses to cite content published elsewhere.

Attitudes toward Google in Germany have been colored by a heated debate over privacy. Several German towns and cities have moved to block Google from taking pictures of storefronts and homes for its Street View service, which links street-level pictures to maps — though not yet in Germany. While Street View has been popular in some European countries, Swiss data protection authorities recently sued Google to try to press it to increase privacy protections.

The European Commission in Brussels has pushed Google and other American Internet companies to shorten the period for which they retain consumer data. But Google has largely avoided run-ins with the commission’s powerful competition arm, which has struck fear in American boardrooms because of its dogged pursuit of antitrust cases against Microsoft, Intel and other American multinational companies.

With a new commission set to take office, rivals of Google, including Microsoft, are stepping up their lobbying efforts, highlighting the strength of Google’s position in Europe. “Whenever you have a company that has more than a 90 percent market share in a key market, it is inevitable that people will have questions to ask,” Brad Smith, Microsoft’s general counsel, told reporters in Brussels last week. “We say that with some experience.”

According to comScore, a research firm, Google handles 80 percent of European Web searches — compared with 65 percent in the United States. Yahoo with 17 percent, and Bing, from Microsoft, with 11 percent, offer modest competition in the United States, but they are nearly nonexistent in Europe, with less then 2 percent each, according to comScore.

Commission officials have said that a dominant market share is insufficient cause for an antitrust case; there must be evidence that a company is abusing this position to stifle competition. Analysts say the dearth of homegrown rivals to Google could also undermine any move to take regulatory action against the company. “Brussels may not want to pick a fight with Google,” said C. Evan Stewart, an antitrust expert at the law firm of Zuckerman Spaeder, “because there is no one to reward if they win.”

GOOGLE FIXES TOOLBAR PRIVACY FLAW

By Thomas Claburn
InformationWeek
January 26, 2010

In a report published on Tuesday, Harvard assistant professor and security researcher Benjamin Edelman presented findings about a privacy flaw in the Google Toolbar, Web browser add-on software that makes Google Search more easily accessible through Internet Explorer and Firefox. In order to do things like compute the PageRank of visited Web pages or list Related Web Pages, the Google Toolbar sends the URLs of Web pages that users view to Google's servers. The Google Toolbar does so only after the user allows this data to be sent. But the Google Toolbar turns out to be less attentive to users who seek to disable page tracking. Though a user may choose to disable the Enhanced Features that prompt Web page tracking, the Google Toolbar does not respond, at least until the user restarts his or her browser.

"I'm reminded of The Eagles' Hotel California," muses Edelman in his report. "'You can check out anytime you like, but you can never leave.'"

Edelman acknowledges in a disclosure statement that he has served as a consultant for Google's competitors and has litigated against the company on behalf of plaintiffs. But such relationships, though invariably mentioned by Google representatives, do not change the validity of his findings. Indeed, Google has acknowledged that its Toolbar wasn't working as it should have been and has issued fix. "To be clear, this is only an issue until a user restarts the browser, and it only affects the currently open tabs for a small number of users," said a Google spokesperson in an e-mailed statement. "Specifically it affects those using Google Toolbar versions 6.3.911.1819 through 6.4.1311.42 in Internet Explorer, with enhanced features enabled, who chose to disable Toolbar without uninstalling it. Once the user restarts the browser, the issue is no longer present. A fix that doesn't require a browser restart is now available on www.google.com/toolbar and in an automatic update to Google Toolbar that we are starting tomorrow."

Google has become more attentive to privacy issues in the past two years as critics have increasingly depicted the company's appetite for data as a threat. While Google's popularity suggests that the majority of users trust the company and aren't all that worried about potential privacy risks, competitors nonetheless see online privacy as a point of differentiation.

Search engine Ixquick, for example, plans later this week to introduce a way to browse Web sites privately, using a proxy service, to complement its search service that does not track users. Online application provider and storage service TransMedia recently changed the default search engine in its Glide OS service from Google to Bing as a show of support for Microsoft's data retention period reduction and promised not to use user data for targeted advertising. The company is also looking into a new legal structure for cloud computing that offers users stronger privacy protection.

Whether privacy moves beyond being something that's theoretically desirable but sacrificed for convenience or discounts remains to be seen. Past efforts to sell privacy as a consumer service failed because the market wasn't there. Moreover, the ongoing success of services like Facebook suggests that sharing trumps privacy.

BRAINS CAN'T HANDLE ALL OUR FACEBOOK FRIENDS

From The Sunday Times
January 24, 2010

WE may be able to amass 5,000 friends on Facebook but humans’ brains are capable of managing a maximum of only 150 friendships, a study has found. Robin Dunbar, professor of Evolutionary Anthropology at Oxford University, has conducted research revealing that while social networking sites allow us to maintain more relationships, the number of meaningful friendships is the same as it has been throughout history.

Dunbar developed a theory known as “Dunbar’s number” in the 1990s which claimed that the size of our neocortex — the part of the brain used for conscious thought and language — limits us to managing social circles of around 150 friends, no matter how sociable we are. These are relationships in which a person knows how each friend relates to every other friend. They are people you care about and contact at least once a year.

Dunbar derived the limit from studying social groupings in a variety of societies — from neolithic villages to modern office environments. He found that people tended to self-organise in groups of around 150 because social cohesion begins to deteriorate as groups become larger. Dunbar is now studying social networking websites to see if the “Facebook effect” has stretched the size of social groupings. Preliminary results suggest it has not.

“The interesting thing is that you can have 1,500 friends but when you actually look at traffic on sites, you see people maintain the same inner circle of around 150 people that we observe in the real world,” said Dunbar. “People obviously like the kudos of having hundreds of friends but the reality is that they’re unlikely to be bigger than anyone else’s. “There is a big sex difference though ... girls are much better at maintaining relationships just by talking to each other. Boys need to do physical stuff together.”

Dunbar’s study is due to be published later this year.

ITALY TRYING TO CLAMP DOWN ON INTERNET VIDEOS

By Natalie Weinstein

An Italian decree that would require the vetting of videos with sexual or violent content could take effect as soon as February 4, according to reports. The government decree, which affects sites such as Google's YouTube, would also require sites that regularly upload videos to obtain a license to operate in Italy, the Associated Press reported Friday.

Companies and organizations, including Google, telecommunications providers, and press watchdog groups, are seeking changes in the proposed decree. They assert that it would hurt freedom of expression and be extremely difficult to enforce and monitor. The draft decree "poses yet another threat to freedom of expression in Italy," Reporters Without Borders said in a statement this week.

Marco Pancini, European senior policy counsel of Google Italia who testified this week before an Italian parliamentary committee, said Friday that he expects that the proposal will undergo changes and be delayed. "We are concerned over the fact that [companies], like YouTube, that simply make content available to the general public, are being bundled together with traditional television networks that actually manage content," Pancini told the newspaper La Stampa, according to Time. "It amounts to destroying the entire Internet system."

CLINTON URGES GLOBAL RESPONSE TO INTERNET ATTACKS

By MARK LANDLER

WASHINGTON — Declaring that an attack on one nation’s computer networks “can be an attack on all,” Secretary of State Hillary Rodham Clinton issued a warning on Thursday that the United States would defend itself from cyberattacks, though she left unclear the means of response. In a sweeping, pointed address that dealt with the Internet as a force for both liberation and repression, Mrs. Clinton said: “Those who disrupt the free flow of information in our society or any other pose a threat to our economy, our government and our civil society. Countries or individuals that engage in cyber-attacks should face consequences and international condemnation.”

Her speech was the first in which a senior American official had articulated a vision for making Internet freedom a plank of American foreign policy. While the details remained sketchy, her remarks could have far-reaching consequences, given the confrontation between Google and the Chinese government over the company’s assertion that its networks had been subject to a sophisticated attack that originated in mainland China. Mrs. Clinton called for China to investigate Google’s accusation and be open about its findings. She said that the United States supported Google in publicly defying the Chinese government’s requirement that it censor the contents of its Chinese-language search engine. “Censorship should not be in any way accepted by any company from anywhere,” Mrs. Clinton said. “American companies need to take a principled stand. This needs to be part of our national brand.”

This month Google announced that it was “no longer willing to continue censoring” search results for its Chinese users, pointing to breaches of Gmail accounts held by human rights activists in China. Several other companies had also been targets of hacking, the company found. Google has avoided placing direct blame on the government in Beijing, which has sought to describe the situation as strictly a business dispute.

The Obama administration has been similarly cautious. Last week, a senior administration official said the United States would issue a “démarche” — a diplomatic move often used to lodge a protest — against China in the coming days. An official said Thursday that the administration would hold off to see whether the Chinese responded to Mrs. Clinton’s call for an explanation of the Google allegations.

The administration’s dealings with China are further complicated by the American debt held by the Chinese government and issues like climate change, on which the United States is seeking its cooperation. Though Mrs. Clinton said the administration would air its differences with Beijing, she said it would be in the context of a “positive, cooperative, and comprehensive relationship” — a clause added to her speech at the last minute.

Mrs. Clinton also identified Saudi Arabia, Egypt, Tunisia, Vietnam and Uzbekistan as countries that constrain Internet freedom or persecute those who use the Web to circulate unpopular ideas. She pointed to an Egyptian blogger, Bassem Samir, who was in the audience at the Newseum in Washington for Mrs. Clinton’s speech and had been imprisoned by Egyptian authorities. Human rights groups applauded the speech, though some questioned how the United States would enforce the warnings.

Tom Malinowski, the Washington advocacy director for Human Rights Watch, said the United States should treat China’s forced censorship as an unfair trade practice, which could be confronted through the World Trade Organization or raised in future trade negotiations. Still, Mr. Malinowski said: “I really thought this was groundbreaking. She showed no hesitation in naming countries, including U.S. allies, for suppressing speech on the Internet. She made a very strong case for connecting Internet freedom to core American national security interests.”

As secretary of state, Mrs. Clinton has elevated the role of the Internet and digital technology in American diplomacy. She named Alec Ross, a technology entrepreneur who advised the campaign of President Obama, as her senior adviser for innovation. Mr. Ross has assembled a team that is pursuing programs like a social network for young people in Pakistan and a service that lets people in Mexico file electronic reports on drug-related activity.

Mrs. Clinton announced a new $15 million effort to help more young people, women and citizens groups in other countries communicate on the Web. None of the proposals she mentioned focused on China or Iran, and the financing is relatively modest. For Cameran Ashraf, 29, an Iranian-American information technology worker who has helped Iranian protesters circumvent government filtering of their messages, Mrs. Clinton’s tone was enough. “I didn’t expect such strong, forceful language,” he said. “I was beyond pleased.”

Brian Knowlton contributed reporting.

GOOGLE APOLOGIZES TO CHINESE AUTHORS

By Andrew Jacobs
The New York Times

BEIJING — Google has agreed to hand over a list of books by Chinese authors that it has scanned in recent years, company executives said on Monday, in an apparent effort to placate writers who say their works were digitized without their permission. In a letter sent to an association of 8,000 Chinese writers, Google also apologized for any misunderstanding that might have angered authors and said it would work to forge an agreement on digitizing books by early summer.

“We definitely agree that we haven’t done a sufficient job in communicating with Chinese writers,” Erik Hartmann, who runs the Asia-Pacific division of Google Books, wrote in a letter to the China Writers’ Association, which posted the letter Sunday on its Web site. The clash between Google and the Chinese writers group mirrors similar strife that has accompanied the company’s Books Search project, an ambitious effort to digitize every known book and make the contents searchable online.

Writers in the United States, France and Germany have filed lawsuits seeking to stop the company from digitizing works without the explicit permission of copyright holders. Some litigants have demanded monetary compensation for scanned books.

Last month Mian Mian, a novelist in Shanghai, became the first Chinese writer to sue Google for copyright infringement. A judge has urged both sides to settle the litigation. Google insists it is following Chinese and American copyright law and says digitized books are deleted upon the request of an author or publisher. It also rejects assertions that the company has made some Chinese books available on the Internet in their entirety.

“In China like everywhere else, if a book is in copyright we don’t show more than a few snippets of text without the explicit permission of the rights holder,” Courtney Hohne, a Google spokeswoman, wrote in an e-mail message. “In addition, we have a longstanding policy of honoring authors’ wishes, and authors or publishers who wish to exclude their book may do so at any time.” Ms. Hohne said that more than 50 Chinese publishers had agreed to allow 60,000 books to be included in the company’s scanning program.

Zhang Hongbo, the secretary general of the China Written Works Copyright Society, which manages Chinese copyrights, hailed the letter and the apology. “It is a result that all Chinese copyright holders have been waiting for,” he said. “We look forward to Google’s deeper understanding of this issue.”

Some media accounts suggested that the search engine giant had caved to the group’s demands, but Google insisted that it had agreed only to provide a list of scanned titles and to find a workable solution for both sides.

In his letter, Mr. Hartmann, the Google executive, described the agreement to release scanned book titles as “unprecedented” and asked Chinese writers to appreciate the company’s sincere interest in settling the issue amicably.

MALAYSIAN DATA PROTECTION LAW IS INADEQUATE

By Abu Bakar Munir

Soon, Malaysia will have a comprehensive data protection law governing the processing of personal data. As mentioned elsewhere, the Personal Data Protection Bill (PDP) has been tabled for the first reading in November 2009. The second reading will take place in March 2010. This discussion is based on the assumption that the PDP Bill is passed in its current form.

The European Union (EU) has adopted its 1995 Data Protection Directive (DPD). Article 25 of the DPD provides that the Member States shall provide that the transfer to a third country of personal data may only take place only if the third country in question ensures an adequate level of protection. In another words, transfer of personal data from any European country to Malaysia may only take place if there is an adequate protection afforded by the PDP Act.

The European Commission has the power to make a decision of adequacy upon consultation with the Article 29 Data Protection Working Party. This Working Party has developed the Working Document: Transfers of personal data to third countries: Applying Articles 25 and 26 of the EU data protection directive (WP 12). The WP 12 assessment framework consists of two parts: content principles and procedural/enforcement requirements.

Content principles sets out minimum requirements for the content of the law governing collection and processing of personal data. There are six contents principles that Malaysian PDP law should have: the purpose limitation principle, the data quality and proportionality principle, the transparency principle, the security principle, the right of access, rectification and opposition, and restrictions on onward transfers. The Malaysian PDP law does contain all these principles.

In assessing the adequacy, the Working Party will also consider the scope or reach of the regime. They are divided into: (1) scope with regard to the data controller, (2) scope with regard to the data subject, (3) scope with regard to the means of processing, (4) scope with regard to the purpose of the processing operations, and (5) territorial scope. The Malaysian PDP law may not be able to satisfy scopes (1) and (4). Under the former, the data protection law of a country must apply to all entities and organizations, all data controllers within the jurisdiction: public or private, corporate and individual, actual and potential. Here lies the problem, the Malaysian PDP Act, in section 3 exempts the Federal and State Government from its application. Under the latter, the law is to be applied to all processing of personal data regardless of purpose. Again, the Malaysian PDP Act in section 2 provides that the Act only applies to the processing of personal data in respect of commercial transactions.

Under the procedural and enforcement mechanisms or requirement, the WP 12 states that a system of external supervision in the form of an independent authority is a necessary feature of a data protection compliance system. In another words, there must be an independent supervisory authority to enforce the law. Under the Malaysian PDP Act, the supervisory authority is the Data Protection Commissioner (DPC). He or she will be appointed by and responsible to the Minister. Clearly, the DPC is not an independent authority.

The EU is one of the Malaysia’s largest trading partners. The total trade in 2008 alone amounted to USD41.0 billion. Free flow of personal data can further facilitate and stimulate trade and investment. The enactment of the PDP law is the best opportunity for Malaysia to achieve that. This very brief assessment, however, indicates that the PDP Act does not pass the EU’s adequacy requirement test. What is the implication? Transfers of personal data may still take place provided that the originating party takes additional measures to ensure that the data is adequately protected in Malaysia. It is a missed opportunity.

As the adviser to the Government of Malaysia on data protection, it is my duty to ensure that the PDP Law is in line with the international norms and standards, including the standards set by the EU DPD. However, I have been advised that the issues mentioned above are policy matters that could not be changed.

EU DATA RETENTION DIRECTIVE: WOULD IT SURVIVE?

By Abu Bakar Munir

The EU Data Retention Directive 2006/24/EC is being implemented. This Directive obligates the operators of public telephone services and internet service providers to retain trafiic and communications data for a period of between six months and two years for the purpose of investigation, detection and prosecution of serious crime. This means that each Member State should have its own version of the “data retention” directive embodied and incorporated into its national law. Unfortunately, the national legislation some of the Member States have been challenged and declared unconstitutional and in contravention with Article 8 of the European Convention on Human Rights (ECHR).

The Romanian Constitutional Court (RCC) in its decision no 1258 (1) from 8 October 2009 held that the Romanian Law 298/2008 which implements the Directive was unconstitutional. Among others, the RCC based its decision on the fact that Law 298/2008 which mandates data retention considers all citizens as potential criminals. The RCC held,"This operation equally addresses all the law subjects, regardless of whether they have committed penal crimes or not or whether they are the subject of a penal investigation or not, which is likely to overturn the presumption of innocence and to transform a priori all users of electronic communication services or public communication networks into people susceptible of committing terrorism crimes or other serious crimes.”

The RCC went further and held that Law 298/2008 has large applicability – practically to all physical and legal persons users of electronic communication services or public communication networks. It can't be considered to be in agreement with the provisions in the Constitution and Convention for the defence of human rights and fundamental freedoms regarding the guaranteeing of the rights to private life, secrecy of the correspondence and freedom of expression.

The Bulgarian Supreme Administrative Court (SAC) in December 2008 annulled Article 5 of the national legislation that implements the Data Retention Directive. A five-member panel of the SAC annulled the Article, considering that the provision did not set any limitations with regard to the data access by a computer terminal and did not provide for any guarantees for the protection of the right to privacy stipulated by the Bulgarian Constitution. The SAC held that Article 5 of the Regulation is in contradiction with the provision of Article 8 of the ECHR.

On 16 March 2009, the Administrative Court of Wiesbaden in Germany held that the blanket recording of the entire population’s telephone, mobile phone, e-mail and Internet usage was disproportionate. The court is of the opinion that data retention violates the fundamental right to privacy. It is not necessary in a democratic society. The Court held that Directive does not respect the principle of proportionality guaranteed in Article 8 ECHR and therefore is invalid.

On 15 December 2009, the Germany's biggest-ever class action lawsuit took place with over 34,000 plaintiffs which includes the Justice Minister challenging the local law that implements the Directive. The parties to this legal battle are anxiously waiting for the decision of the German Constitutional Court on this matter. So as the other Europeans and EU Member Countries. Constitutional Court President Hans-Jürgen Papier said at the beginning of the hearing that the complaint raises fundamental questions about the relationship between freedom and security. Let’s wait and see.

The Data Retention Directive, so far, has not been challenged in the U.K. However, in the landmark case from the country, S. Marper v The United Kingdom, the European Court of Human Rights had held that blanket retention of fingerprints, cellular samples and DNA profiles is in breach of Article 8 of the ECHR. In this case, the Court held:

“The blanket and indiscriminate nature of the powers of retention of the fingerprints, cellular samples and DNA profiles of persons suspected but not convicted of offences fails to strike a fair balance between the competing public and private interests and that the respondent State has overstepped any acceptable margin of appreciation in this regard. Accordingly, the retention at issue constitutes a disproportionate interference with the applicants’ right to respect for private life and cannot be regarded as necessary in a democratic society.”

According to the European Digital Rights (EDRi), another action is pending in Ireland, while an application to the Constitutional Court of the Czech Republic is currently being prepared. As recently as December 2009, the EDRi and German Working Group on Data Retention (AK Vorrat) are calling on the European Union to repeal the 2006 Directive. Alternatively, they demanded that it is amended to introduce an opt-out right allowing Member States to decide whether or not to require the retention of communications data. The Directive is still very young but it is already facing a lot of challenges. In fact, it has received strong criticisms and resistances throughout since the very inception until its birth. But now it is a different kind of challenge – legal in nature. Would it survive?

FACE ME, YOU’RE BOOKED

By Abu Bakar Munir

Our lives are being “invaded” by the Social Networking Sites (SNS), allowing us to socialize in cyberspace. We are facing the world of Facebook, MySpace, Friendster, Twitter, etc. These SNS are extremely popular. The users and usages are very diverse; from children as young as ten years old to corporate and country leaders; from just chitchatting and posting photos to business and science applications. Obama uses SNS to get into, and, perhaps remain in power. Only recently in July 2009, Bill Gates said that he decided to give up using Facebook as he does not want to have too many friends. He said, “Facebook was just way too much trouble so I gave it up”. Social networking services are increasingly being used for criminal investigations. Information posted on the sites has been used by the police, probation, and university officials to prosecute users of the sites. Now, SNS are crawling into the courtrooms.

The Australian Capital Territory Supreme Court in the case of MKM Capitol Property Ltd v. Corbo and Poyser, ACT Sup Ct, 12 December 2008 (No. SC 608 of 2008) has allowed substituted notice be served through the Facebook. MKM, a lending company, obtained default judgment against two defendants. The company has made several attempts to reach the defendants, but still experienced difficulty serving the default judgment using traditional methods. MKM’s lawyers then discovered that both defendants had active Facebook profiles, and that they were “friends” with one another. In this case, the friends list of both defendants was visible. The lawyers sought permission for default judgment to be served on both defendants via Facebook. An application for substituted service was granted.

Just eight months earlier in April, in the case of Citigroup Plc Ltd v Weekaroon [2008] QDC 174 (16 April 2008), a similar application was made for substituted service of a statement of claim on a defendant through the Facebook. In rejecting the application, the Queensland District Court Judge Ryrie said:

"I am not satisfied in light of looking at the – the uncertainty of Facebook pages, the facts that anyone can create an identity that could mimic the person identity and indeed some of the information that is provided there does not show me with any real force that the person who created the Facebook page might indeed be the defendant, even though practically speaking it may well indeed be the person who is the defendant".

What are the distinguishing factors between MKM and this case that led to the differing of the decisions? In the former, MKM’s lawyers were able to show that the Facebook profiles were those of the defendants. The lawyers demonstrated that these profiles listed various personal details, such as their dates of birth, which were known to MKM. Neither defendant had used any of the various privacy settings, which would have restricted the outside world’s access to their pages. In granting the application, the judge in the MKM case even stipulated that the documents were to be served privately, which rules out the option to post anything on the defendants’ “walls” – the Facebook equivalent of a public notice board.

On 16 March 2009, the New Zealand court followed MKM case. In the case of Axe Market Gardens Limited v. Axe CIV-2008-485-2676, the High Court of Wellington granted an application for a substituted service on a defendant in the U.K through Facebook. In this case, the plaintiff company had difficulties in locating and serving the defendant. The latter was living in the U.K but his exact location was unknown. The defendant had corresponded via email and was also known to have a Facebook site. According to the New Zealand Free Press, “Justice Gendall did not bat an eyelid in the court room when approving the order after being assured that newspaper adverts could not be effectively targeted”.

The Canadian courts in several occasions have had to deal with the requests to produce personal information from the website of Facebook as evidence in litigations. The courts had to decide on the admissibility of the evidence. So far, in all the cases, the courts have decided that the evidence taken from the Facebook webpage is admissible in court. In the case of Kourtesis v. Joris (2007) O.J. No. 5539 (S.C.J), the request was for four color photos taken from Facebook. The Ontario Superior Court of Justice held that the photographs were highly relevant and admissible. The same court had another opportunity in the case of Murphy v. Perger (2007) O.J. No. 5511 (S.C.J). The judge ordered Facebook pages to be produced because of the public nature of the website.

In the case of Leduc v. Roman (2009) O.J. No. 681, Justice Brown concluded that a party who maintains a private or limited access, Facebook profile stands in no different position than one who sets up a publicly-available profile. He went further stated that both are obliged to identify and produce any postings that related to any matter at issues in action.

In the most recent case of Terry v. Mullowney (2009) NLTD 56, the defense lawyers were able to use the Facebook activities of the plaintiff to argue that the plaintiff exaggerated his injuries and claimed. The court accepted this evidence and held that without the evidence he would have been left with a very different impression of Mr. Terry, the plaintiff. Justice Adam stated, “Mr. Terry was claiming a $ 1.5 million payout and was given $40, 000 instead. His credibility was undermined because of his activities as displayed on his public profile on Facebook”.

Obviously, SNS and Facebook in particular are delighted by this court endorsement. In response to the decision of the Australian court in MKM case, Facebook stated, “We’re pleased to see Australian court validate Facebook as a reliable, secure and private medium of communication. The ruling is also an interesting indication of the increasing role that Facebook is playing in people’s lives…” Is this a beginning to the many invasions in the future? Would it spread into other courts in other countries? SNS in future, perhaps, would also mean Substituted Networking Services.

GOOGLE RESTS ITS DEFENSE OF EXECUTIVES IN ITALIAN PRIVACY CASE

By Eric Sylvers

MILAN — Lawyers for Google rested their case in defense of four executives charged in Italy with failing to comply with privacy laws, telling a judge that the company has a mechanism in place to rapidly remove objectionable video from its site.The attorneys, Giuliano Pisapia and Giuseppe Vaciago, said that Google removed a video showing high school students bullying an autistic classmate just hours after it learned it had been posted.

Italian prosecutors had argued at a hearing last month that Google, based in Mountain View, California, was negligent because the video remained on Google’s Italian-language video service for two months in 2006. Google did not dispute that in court. Mr. Pisapia and Mr. Vaciago argued that the company should not be held liable for not having known earlier that the video was on its site.

The attorneys said user complaints about a video are routed to a Google employee in Ireland who speaks Italian; the employee views the video and has the power to remove it if necessary. The hearing came during a controversy over the role played by Web sites in the attack that left Prime Minister Silvio Berlusconi with a broken nose and teeth this month. On Wednesday, the Italian interior minister, Roberto Maroni, said the country had dropped plans to seek out and close Web sites that were said to incite violence.

Last month, the Milan prosecutors asked for a one-year sentence for three current or former Google executives — David Drummond, senior vice president and chief legal officer; Peter Fleischer, global privacy counsel; and George Reyes, a former chief financial officer. Prosecutors are seeking a six-month sentence for Arvind Desikan, now head of consumer marketing for Google in Britain.

None of the four executives named in the suit had any direct involvement with the video. If found guilty, none would not serve time in jail because sentences of under three years are commuted in Italy for those without a criminal record. The prosecutors will respond to Google’s defense on Jan. 27. If only limited new material is presented, a ruling could come that day or soon after.

MADRID RESOLUTION: A STEP TOWARDS A PRIVACY TREATY?

By Abu Bakar Munir

At the conclusion of the 31st International Conference of Data Protection and Privacy Commissioner in Madrid on 6 November 2009, over 50 countries adopted and approved “Madrid Resolution” on international privacy standard. The Madrid Resolution brings together all the multiple approaches possible in the protection of this right, integrating legislation from all five continents.

The approved resolution includes a series of principles, rights and obligations that any privacy protection legal system must strive to achieve. One of the most relevant chapters of the document is the one that refers to proactive measures, whereby States are encouraged to promote a better compliance with the laws applicable on data protection matters, and the need to establish authorities to guarantee and supervise the rights of citizens.

A group of 10 large companies (Oracle, Walt Disney, Accenture, Microsoft, Google, Intel, Procter & Gamble, General Electric, IBM and Hewlett-Packard) has signed a declaration in which they proudly welcome the initiative from the 31st International Conference for exploring frameworks to achieve an improved global coordination of the different privacy policies. In this declaration, the signing companies encourage Data Protection and Privacy Authorities to continue insisting and collaborating in the development of transparent systems that will allow the taking on of responsibilities and that will provide accurate information to the citizen, granting him/her the power to decide.

According to the Director of the Spain Data Protection Agency (AEPD), Artemi Rallo, these standards are a proposal of international minimums, which include a set of principles and rights that will allow the achievement of a greater degree of international consensus and that will serve as reference for those countries that do not have a legal and institutional structure for data protection. Even though the approved resolution is not directly binding at an international level, Artemi Rallo has pointed out that this document will have “immediate value” as a reference tool and, moreover, as a starting point for those countries that still lack legislation on the matter, and for the corporate world and international companies. He said that Madrid Resolution will, thus, become a “soft law” tool, widely demanded mainly by international companies, in order to respect the minimum privacy needs of citizens worldwide.

In existent, there are already several international instruments (binding and non-binding) which set up privacy standards to be observed by countries and companies around the world. They are the OECD Guidelines 1980, Council of Europe Convention 1981, EU Data Protection Directive 1995, EU E-Privacy Directive 2002, and APEC Privacy Framework 2004. Agreeably, the EU Data Protection Directive has set a very high privacy standard. Arguably, the APEC Privacy Framework provides the weakest standard of all the instruments. Where does the Madrid Resolution stand? Is it a step towards a universally binding privacy treaty?

The Madrid Resolution is available HERE.

CHINA TO REQUIRE INTERNET DOMAIN NAME REGISTRATION

BEIJING (Reuters) - China has issued new Internet regulations, including what appears to be an effort to create a "whitelist" of approved websites that could potentially place much of the Internet off-limits to Chinese readers. The Ministry of Industry and Information Technology ordered domain management institutions and internet service providers to tighten control over domain name registration, in a three-phase plan laid out on its website (www.miit.gov.cn) late on Sunday."Domain names that have not registered will not be resolved or transferred," MIIT said, in an action plan to "further deepen" an ongoing anti-pornography campaign that has resulted in significant tightening of Chinese Internet controls.

Only allowing Chinese viewers to access sites registered on a whitelist would give Chinese authorities much greater control, but would also block millions of completely innocuous sites. The rules did not specify whether the new measure applies to overseas websites, but local media reported the risk that foreign sites that have not registered could also be blocked. "If some legal foreign websites could not be accessed because they haven't registered with MIIT, it would be a pity for the Internet which is meant to connect the whole world," the Beijing News said on Tuesday.

Chinese Internet controls currently follow a blacklist strategy, whereby censors block sensitive sites as soon as they discover them. Earlier this summer, MIIT tried to require that all new Chinese computers be shipped with the Green Dam filter software, but partially backed off after an international outcry.

TWITTERERS' REVENGE

The anti-pornography drive since this summer has also netted many sites with politically sensitive or even simply user-generated content, in what many see as an effort by the Chinese government to reassert control over new media and its potential for citizens sharing information and organizing. "One interpretation is that all foreign websites would need to register in order not to be blocked in China," said Rebecca MacKinnon of the Journalism and Media Studies Center at the University of Hong Kong. "These are the folks who brought us Green Dam so anything is possible. They are people with a track record of emitting unreasonable schemes."

The registration requirements could constitute a barrier to trade, if Chinese citizens are prevented from accessing legitimate overseas businesses, added MacKinnon. China banned a number of popular websites and Internet services in 2009, including Google's Youtube, Twitter, Flickr and Facebook, as well as Chinese content sharing sites, including sites popular for music and film downloads.

Angry Chinese Twitter users flooded a Twitter look-alike service (t.people.com.cn) launched by the official People's Daily on Tuesday, causing it to be immediately shut down. Many virtual private network, or VPN, services used to get around Web restrictions have also become harder to use from China, while 20 million people living in the frontier region of Xinjiang have been cut off from the Internet and international telephone services since deadly ethnic riots in July.

"What usually happens when suddenly compiled rules appear without warning is that they are rarely enforced. My gut reaction is that this is yet another of those cases," said Beijing-based technology commentator Kaiser Kuo.

FRENCH COURT RULES AGAINST GOOGLE OVER BOOK COPYING

PARIS (Reuters) - A Paris court on Friday found U.S. Internet giant Google guilty of violating copyright by digitizing books and putting extracts online, following a legal challenge by major French publishers. The court ruled against Google's French unit after the La Martiniere group, which controls the highbrow Editions du Seuil publishing house, argued that publishers and authors were losing out in the latest stage of the digital revolution.

Google was ordered to pay 300,000 euros ($431,700) in damages and interest, far less than the 15 million euro fine sought by plaintiffs. It must stop reproducing any copyrighted material by French publishers it has not struck deals with. The popular search engine announced it would appeal, but Friday's ruling will be enforced immediately pending any further court action. "We believe giving online users access to very short extracts from works is in line with copyright," Google lawyer Benjamin du Chauffaut said. "French online users will be the only ones deprived of a great part of their literary heritage."

Shares in Google were up 2.24 percent at $596.19 by 11:15 a.m. EST (1615 GMT). An executive said they would need to study the ruling before being able to comment on the business impact.La Martiniere, the French Publishers' Association and authors' groups SGDL had argued that Google was exploiting that heritage, and called scanning an act of reproduction."Even if we can't undo the process of digitalization, this means they cannot use any of the digitized material any more," Yann Colin, lawyer for La Martiniere told Reuters.

FRENCH FIGHT

The publishing houses accused Google of scanning the books free of charge, letting users browse the content for free, reaping revenues from advertisers but not adequately compensating the creators and original publishers of the works. Philippe Colombet, head of partnerships for Google Books in France, could not give details on how many books might be affected, though he pointed out in a conference call that French was one of the most widely used languages on the Internet. "More than ever, we're determined to collaborate with editors in all commercial areas," he said.

As electronic readers gain popularity and online libraries expand, companies and governments are keen to learn from the mistakes that the film and music businesses made when their content moved online.

French politicians including President Nicolas Sarkozy have been particularly vocal, pushing for a broader public digitization program that would be partly funded through a big national loan. Google has so far scanned 10 million books through partnerships with libraries. It displays searchable snippets of books in copyright and whole texts of out-of-copyright works. "Google Books gives access to a greater number of works and therefore contributes to marketing," lawyer du Chauffaut said.

The project has been praised for breathing new life into out-of-print works but has attracted more than one lawsuit for scanning books without permission from rights holders. Google recently reached a settlement in the United States after lengthy negotiations with authors and publishers led by the U.S. Authors Guild who had sued it. The settlement, which includes measures to track down and compensate authors, covers books published in North America, Britain and Australia, and any books registered with the U.S. Copyright Office. It has yet to be approved by a U.S. court.

PRIVACY GROUP FILES COMPLAINT ON FACEBOOK CHANGES

By BRAD STONE (THE NEW YORK TIMES)

In a complaint filed with the Federal Trade Commission on Thursday, a privacy organization is charging that Facebook’s recent changes to its privacy policies constitute “unfair and deceptive trade practices.”

The Electronic Privacy Information Center, or E.P.I.C., says that Facebook’s recent changes “violate user expectations, diminish user privacy, and contradict Facebook’s own representations.”

I wrote about those changes last week. The most controversial among them is that a Facebook user’s photo, gender, geographic region, the pages they are a fan of and their lists of friends are now open and available to the entire Web public. Facebook made these changes partly to make individual users more findable among the massive haystack of 350 million users.

Ten other privacy organizations signed the complaint, including the Privacy Rights Clearinghouse, the American Library Association and the Consumer Federation of America. The Office of the Privacy Commissioner in Canada has also been looking into Facebook’s privacy guidelines.

Among other charges, the complaint alleges that a person’s list of friends constitutes highly sensitive information. It can, for example, reveal a person’s sexual preference, or expose their loved ones to persecution by hostile governments, the complaint says.

E.P.I.C. is asking the commission to investigate the company and force it to give users more control over their privacy. It previously had success in complaining to the F.T.C. about the data broker Choicepoint, which resulted in a $15 million fine.

Facebook said in response that it was “disappointed” that E.P.I.C. had chosen to share its concerns with the commission without talking to Facebook directly. A Facebook spokesman, Barry Schnitt, sent this statement:

Facebook’s plan to provide users control over their privacy and how they share content is unprecedented in the Internet age. We have gone to great lengths to inform users about our platform changes, beginning with our July announcement; founder Mark Zuckerberg’s open letter to our 350 million users; our robust press and analyst outreach; the notice-and-comment framework for our new privacy policy; and simple customization tools for users.

We’re pleased that so many users have already gone through the process of reviewing and updating their privacy settings and are impressed that so many have chosen to customize their settings, demonstrating the effectiveness of Facebook’s user empowerment and transparency efforts. Of course, the new tools offer users the opportunity to decide on privacy with every photo, link or status update they wish to post, so the process of personalizing privacy on Facebook will continue.

We discussed the privacy program with many regulators, including the F.T.C., prior to launch and expect to continue to work with them in the future.