What will this presentation be about?

(1)

Presented by Matt Edmonds

on behalf of the Lawyers’ Insurance Association of Nova Scotia

May 29, 2014

PRIVACY AND DATA SECURITY:

WHAT ALL LAWYERS NEED TO KNOW

Matt Edmonds

Materials available for download at mattedmonds.ca/privacy

On the right hand side of each page, I have included links

to online resources related to the content of each slide. If

you have any follow-up questions, please don’t hesitate to

send me an email at

[email protected]

.

What will this presentation be about?

•What we will be talking about: risk and practice management, protecting your client’s private information

•What we won’t be talking about: the legal practice area of privacy law

PIPEDA and Your Practice: A Privacy Handbook for Lawyers

(2)

Approach

•To meet legislated standards, all practicing lawyers must have an understanding of safeguarding methods

•This is not a responsibility that can be entirely delegated to a specialist at your firm

•

It’s not as technical or as difficult as you might think

•Much easier to protect yourself now than deal with potential consequences

•

Leads to increased client confidences

Speech: Privacy as a Selling Point: An Ethical Framework for

Marketing in the Digital World - February 28, 2013

http://www.priv.gc.ca/media/sp-d/2013/sp-d_20130228_cb_e.asp

Agenda

•Threats

•Not just the traditional hacker types

•Privacy legislation, obligations •PIPEDA’s Fair Information Principles

•Especially “Accountability” and “Safeguarding”

•Safeguards, best practices •Passwords, encryption, etc.

•Selected topics

•Cross-border cloud computing

•Heartbleed

•End of support for Windows XP

•Spear phishing

•Canada’s Anti-Spam Law

THREATS

(3)

Threats: who are the “bad guys?”

•Criminals: exploit personal information for financial gain •Spamming, 419 scams, identity theft, other fraud

•Your and your clients’ competitors or rivals •Consequences from embarassment to significant losses •

High-level international espionage

•Orchestrated attacks against major firms •Government agencies

•Level of concern depends on your area of practice? •Alternatively: it’s a principled matter

•There doesn’t need to be a threat for privacy to be important

Top 10 Ways Your Privacy is Threatened - Privacy Day 2009

http://www.priv.gc.ca/resource/dpd/2009/top10_e.asp

Fact Sheet: Recognizing Threats to Personal Data: Four Ways That

Personal Information Gets Hijacked Online (March 2007)

http://www.priv.gc.ca/resource/fs-fi/id/phishing_e.asp

Scams and Fraud - Royal Canadian Mounted Police

http://www.rcmp-grc.gc.ca/scams-fraudes/index-eng.htm

Identity Theft: What it is and what you can do about it

http://www.priv.gc.ca/resource/fs-fi/02_05_d_10_e.asp

Canadian companies lose billions a year to spies - CBC News

http://www.cbc.ca/news/canada/ottawa/story/2011/11/29/ottawa-spy-conference.html

Online Spying | OpenMedia.ca

http://openmedia.ca/topics/online-spying

Right to privacy – Wikipedia

https://en.wikipedia.org/wiki/Right_to_privacy#A_collective_value_and_a_human_right

Threats: from the “good guys?”

•Clients upset by leaks or perceived risks thereof

•Privacy breaches are not often litigated because it’s difficult to prove damages

•However, under PIPEDA, anyone may make a complaint to the Privacy Commissioner, no need for standing

•Commissioner can investigate, publish reports, issue recommendations

•

Cannot enforce penalties, but the power of public

embarassment is an effective stick

•Can proceed to Federal Court after investigation, but this

rarely occurs

How to File a Privacy Complaint

http://www.priv.gc.ca/complaint-plainte/index_e.asp

Guide to Complaint Process

http://www.priv.gc.ca/complaint-plainte/guide_e.asp

Fact Sheet: Ten tips for avoiding complaints to the OPC

http://www.priv.gc.ca/resource/fs-fi/02_05_d_55_tips_e.asp

PIPEDA Compliance Framework - Legal Corner

http://www.priv.gc.ca/leg_c/framework_e.asp

Commissioner's Findings

http://www.priv.gc.ca/cf-dc/index_e.asp

(4)

Privacy Legislation: Public Sector

•Federal

•Privacy Act (1983)

•Access to Information Act (1985)

•Freedom of Information Act (1996)

•

Provincial (Nova Scotia)

•Freedom of Information and Protection of Privacy Act (FOIPOP)

•Personal Information International Disclosure Protection Act

(PIIDPA)

Privacy Act

http://laws-lois.justice.gc.ca/eng/acts/P-21/

Fact Sheet: Privacy Act

http://www.priv.gc.ca/resource/fs-fi/02_05_d_11_01_e.asp

Department of Justice Access to Information and Privacy Office

http://justice.gc.ca/eng/trans/atip-aiprp/

FOIPOP: The Nova Scotia Freedom of Information and Protection of

Privacy Review Office

http://foipop.ns.ca/

Freedom of Information and Protection of Privacy Act

http://nslegislature.ca/legc/statutes/freedom.htm

Information Access & Privacy (FOIPOP) | novascotia.ca

http://novascotia.ca/just/IAP/

Personal Information International Disclosure Protection Act

http://nslegislature.ca/legc/statutes/persinfo.htm

FAQ: Personal Information International Disclosure Protection Act |

novascotia.ca

http://novascotia.ca/just/IAP/PIIDPAquest.asp

Information for Organizations: Public Sector

http://www.priv.gc.ca/resource/io_pu_e.asp

Information for Public Servants

http://www.priv.gc.ca/resource/topic-sujet/ips-if/index_e.asp

Privacy Legislation: Private Sector

•Personal Information Protection and Electronic Documents Act (PIPEDA)

•Applies to all entities in Canada that engage in commercial activity and handle personal information

•

…except in provinces that have enacted “substantially

similar legislation”

•British Columbia, Alberta, Quebec

•Health care sector only: Ontario, New Brunswick,

•Newfoundland and Labrador

Personal Information Protection and Electronic Documents Act

http://laws-lois.justice.gc.ca/eng/acts/P-8.6/

Legal information related to PIPEDA

http://www.priv.gc.ca/leg_c/leg_c_p_e.asp

Commercial Activity - Interpretations under PIPEDA

http://www.priv.gc.ca/leg_c/interpretations_03_ca_e.asp

Personal Information - Interpretations under PIPEDA

http://www.priv.gc.ca/leg_c/interpretations_02_e.asp

Substantially Similar Legislation - Legal information

http://www.priv.gc.ca/leg_c/legislation/ss_index_e.asp

Information for Organizations: Private Sector

http://www.priv.gc.ca/resource/io_pr_e.asp

Private Sector Organization Resources

(5)

PIPEDA: Background

•Technology-neutral (generic terms)

•Overseen by the Office of the Privacy Commissioner

•Must be reviewed by Parliament every five years

•Part 1 is about privacy

•Parts 2-5 address the use of electronic documents

•Core of PIPEDA: Schedule 1, Principles set out in the

National Standard Of Canada Entitled Model Code For

The Protection Of Personal Information, CAN/CSA-Q830-96

•a.k.a. the “Fair Information Principles”

PIPEDA Backgrounder

http://www.priv.gc.ca/leg_c/legislation/02_06_07_e.asp

PIPEDA Implementation Schedule

http://www.priv.gc.ca/leg_c/legislation/02_06_02a_e.asp

CSA's Model Code for the Protection of Personal Information

http://www.csa.ca/cm/ca/en/privacy-code/publications/view-privacy-code

Office of the Privacy Commissioner - Mandate and Mission

http://www.priv.gc.ca/au-ans/mm_e.asp

PIPEDA Review - Parliamentary Activities

http://www.priv.gc.ca/parl/pipeda_r_e.asp

Leading by Example: Key Developments in the First Seven Years of

PIPEDA

http://www.priv.gc.ca/information/pub/lbe_080523_e.asp

Fact Sheet: Parts 2 to 5 of PIPEDA

http://www.priv.gc.ca/resource/fs-fi/02_05_d_38_e.asp

PIPEDA: Fair Information Principles

1. Accountability

2. Identifying Purposes

3. Consent

4. Limiting Collection

5. Limiting Use,

Disclosure, and

Retention

•

6. Accuracy

•

7. Safeguards

•

8. Openness

•

9. Individual Access

•

10. Challenging

Compliance

Direct link to PIPEDA Schedule 1: Principles Set Out in the National

Standard of Canada Entitled Model Code for the Protection of Personal

Information

http://laws-lois.justice.gc.ca/eng/acts/P-8.6/page-19.html#h-25

Summary of the Privacy Principles

http://www.priv.gc.ca/leg_c/p_principle_e.asp

Principle 1: Accountability

•“An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization's compliance with the following principles.”

•

PIPEDA says “designated individual(s),” I prefer “Privacy

Officer”

•Accountability rests with the Privacy Officer

•

Identity and contact info of Privacy Officer must be made

available on request

Getting Accountability Right with a Privacy Management Program -

April 2012

http://www.priv.gc.ca/information/guide/2012/gl_acc_201204_e.asp

Accountability - Interpretations under PIPEDA

(6)

Principle 1: Accountability

•Organizations shall implement policies and practices to give effect to the principles, including

•(a) implementing procedures to protect personal information;

•(b) establishing procedures to receive and respond to complaints and inquiries;

•(c) training staff and communicating to staff information about the organization’s policies and practices; and

•(d) developing information to explain the organization’s policies and procedures.

Build a Privacy Plan for Your Business

http://www.priv.gc.ca/resource/tool-outil/english/

Principle 7: Safeguards

•“Personal information shall be protected by security safeguards appropriate to the sensitivity of the

information.”

•Protect information against: •Loss or theft

•Unauthorized access, disclosure, copying, use, or modification •Protect info regardless of the format in which it is held

Safeguards - PrivacySense.net

http://www.privacysense.net/10-privacy-principles-of-pipeda-safeguards/

Speech: New Platforms, New Safeguards: Protecting Privacy in

Cyberspace - February 23, 2011

http://www.priv.gc.ca/media/sp-d/2011/sp-d_20110223_cb_e.asp

Securing Personal Information: A Self-Assessment Tool for

Organizations

http://www.priv.gc.ca/resource/tool-outil/security-securite/english/AssessRisks.asp?x=1

This is a very useful resource for identifying the specific types of

safeguarding practices that should be implemented.

Principle 7: Safeguards

•Methods of protection should include:

•(a) physical measures, for example, locked filing cabinets and restricted access to offices;

•(b) organizational measures, for example, security clearances and limiting access on a “need-to-know” basis; and

•(c) technological measures, for example, the use of passwords and encryption.

Key Steps for Organizations in Responding to Privacy Breaches

http://www.priv.gc.ca/information/guide/2007/gl_070801_02_e.asp

Privacy Breach Checklist

(7)

SAFEGUARDS

Passwords

•Create a password policy. Passwords should be: •Known only to the authorized user of the account

•No less than eight characters in length

•Changed regularly

•Unique; use a different password for each service, never repeat or reuse passwords

•Don’t save important passwords in your web browser

•Avoid careless practices •No sticky notes on your monitor

•Don’t write them in your address book (under “P” for passwords)

•Never use something guessable! No kids’ names, no birthdays, etc.

Password policy – Wikipedia

http://en.wikipedia.org/wiki/Password_policy

Best Practices for Enforcing Password Policies

http://technet.microsoft.com/en-us/magazine/ff741764.aspx

Password Management Best Practices

http://hitachi-id.com/password-manager/docs/password-management-best-practices.html

10 security mistakes that are easy to avoid | TechRepublic

http://www.techrepublic.com/blog/10things/10-security-mistakes-that-are-easy-to-avoid/2968

Passwords

•Remembering all your passwords:

•Record them securely (KeePass, 1Password, LastPass)

•Use a formula

•My method: [characters based on type of site] + [characters based on name of site] + [longer secure string]

•The XKCD method

•Four random words

•“Tr0ub4dor&3” takes 3 days to crack via brute force

•“correcthorsebatterystaple” takes 550 years to crack

Five Best Password Managers

http://lifehacker.com/5529133/five-best-password-managers

Choose (and remember) great passwords

http://lifehacker.com/184773/geek-to-live--choose-and-remember-great-passwords

936: Password Strength - explain xkcd

(8)

Two-factor authentication

•or “two-step verification”

•Login using a password plus another code

•Usually generated on your smartphone

•Other options: key fob with number readout, USB “key”

•If your password is compromised, your account remains safe

Two-factor authentication – Wikipedia

http://en.wikipedia.org/wiki/Two-step_verification

Here's Everywhere You Should Enable Two-Factor Authentication

Right Now – Lifehacker

http://lifehacker.com/5938565/heres-everywhere-you-should-enable-two-factor-authentication-right-now

Two-factor authentication: What you need to know (FAQ) – CNET

http://www.cnet.com/news/two-factor-authentication-what-you-need-to-know-faq/

Encryption

•During transmission

•Secure Socket Layer (SSL) connections: https://…

•Wi-fi: use WPA2, but not with Protected Setup feature •For local storage

•Encrypt your entire hard drives, especially on laptops

•Remember to encrypt all backup copies, too •When using cloud storage

•Create an encrypted volume (TrueCrypt, Mac OS Disk Utility) before uploading to services like Dropbox

•Or try a service that handles encryption for you (Viivo, Boxcryptor)

What is SSL? - Yahoo! Small Business Help

http://help.yahoo.com/l/us/yahoo/smallbusiness/webhosting/ssl/ssl-01.html

Virtual private network – Wikipedia

http://en.wikipedia.org/wiki/Virtual_private_network

Taking steps to secure your Wifi network

http://www.priv.gc.ca/resource/sbw/2011/cs_01_e.asp

How to Secure Your Wireless Network | PCWorld

http://www.pcworld.com/article/130330/article.html

Security Watch: A guide to Wireless Security

http://technet.microsoft.com/en-us/magazine/2005.11.securitywatch.aspx

How to Use TrueCrypt to Encrypt Your Sensitive Documents | PCWorld

http://www.pcworld.com/article/242612/how_to_use_truecrypt_to_encrypt_your_sensitive _documents.html

Getting Started with TrueCrypt (to Secure Your Data)

http://www.howtogeek.com/howto/6169/use-truecrypt-to-secure-your-data/

A Guide to Windows 7 Security | PCWorld

http://www.pcworld.com/article/171979/windows_7_security.html

Encryption for Macs

http://irtsecurity.stanford.edu/protecting/EncryptionforMacs.html

Viivo - Cloud File Encryption

http://www.viivo.com/

Boxcryptor | Encryption for cloud storage

(9)

Email

•Avoid sending sensitive information via email

•Maybe your email account is secure, but what about the recipient?

•Talk to your clients about this

•Alternative: use a “client portal” service

•

When sending to more than one recipient, use the BCC

field (hides the recipients’ addresses from each other)

•Use two-factor authentication: your primary email account

is your most important account!

Cloud Computing: Client Portals

http://www.attorneyatwork.com/cloudcomputing/

Benefits of BCC | US-CERT

https://www.us-cert.gov/ncas/tips/ST04-008

Safeguards

•Workstations

•Require password to boot

•Set to auto-lock if left unattended (for ~5 mins?) •Mobile devices

•Use a passcode lock

•Set up remote wipe functionality •Software

•Keep your operating systems and other software up-to-date

•Run anti-virus software with up-to-date virus definitions

Fact Sheet: Privacy on the Go: 10 Workplace Tips for Protecting

Personal Information on Mobile Devices (January 2011)

http://www.priv.gc.ca/resource/fs-fi/02_05_d_46_dpd_e.asp

Making regular password and software updates

Safeguards

•Employee access

•Limit the access privileges of each user to what is necessary

•Enforce policies on copying info, use network settings, check logs •Physical security

•Locked cabinets, doors, motion detectors, intrusion alarms

•Angle computer monitors so they’re not visible through a window

•Wipe/remove/destroy storage drives in all devices before disposal

Establishing and implementing an IT security policy

Ten things HR professionals need to know about privacy

http://www.priv.gc.ca/resource/fs-fi/02_05_d_53_hr_e.asp

10 things you should do to securely dispose of computers

http://www.techrepublic.com/blog/10things/10-things-you-should-do-to-securely-dispose-of- computers/

(10)

SELECTED TOPICS

Cloud Computing

•PIPEDA: “An organization is responsible for personal information in its possession or custody, including

information that has been transferred to a third party for

processing. The organization shall use contractual or other

means to provide a comparable level of protection while the

information is being processed by a third party.” •Using US-based providers is okay

•(Justice Minister’s consent req’d for public organizations in NS)

•Ensuring “comparative level of protection” is key •Understand your terms of service agreement •Choose an established, reputable provider •Encrypt your data as much as possible

Fact Sheet: Introduction to Cloud Computing

http://www.priv.gc.ca/resource/fs-fi/02_05_d_51_cc_e.asp

Cloud Computing for Small and Medium-sized Enterprises: Privacy

Responsibilities and Considerations

http://www.priv.gc.ca/information/pub/gd_cc_201206_e.asp

Guidelines for Processing Personal Data Across Borders

http://www.priv.gc.ca/information/guide/2009/gl_dab_090127_e.asp

Personal Information Transferred Across Borders

http://www.priv.gc.ca/resource/topic-sujet/pitab-ctrp/index_e.asp

Canadian Cloud Law Blog: Cloud Computing and Privacy FAQ

http://www.cloudlawyer.ca/2011/04/cloud-computing-and-privacy-faq.html

Heartbleed

•Vulnerability in OpenSSL (encryption software used on the Internet)

•Allowed hackers to read the memory (i.e. RAM) of a server; this doesn’t mean servers were cracked wide

open

•Patched very quickly after discovery

•What to do:

•Change all your passwords from before Heartbleed was discovered

•Use different passwords for each site

Heartbleed Bug “official” site

http://heartbleed.com/

Heartbleed – Wikipedia

http://en.wikipedia.org/wiki/Heartbleed

Heartbleed bug: What you need to know (FAQ) – CNET

(11)

End of support for Windows XP

•Result:

•No more tech support from Microsoft, obviously

•More important: no more software updates or security patches •Hackers and developers fight back and forth: hackers find

a hole, developers fix it

•With end of support, new vulnerabilities remain undetected, are not repaired

•

There are stopgap measures (anti-virus software,

firewalls, etc.), but don’t count on them

•What to do? Upgrade! For more reasons than just the

security vulnerability.

Windows XP support has ended - Microsoft Windows

http://windows.microsoft.com/en-CA/windows/end-support-help

When Windows XP support ends, this is how you secure your PC and

save all updates

http://www.expertreviews.co.uk/software/1304965/when-windows-xp-support-ends-this-is-how-you-secure-your-pc-and-save-all-updates

Spear phishing

•“Phishing” is the attempt to trick someone into revealing sensitive information (e.g. usernames, passwords) by masquerading as a trustworthy entity in an electronic communication.

•

“Spear phishing” is when the attempt is directed at

specific individuals or companies, usually using

information about the target to increase the probability of success.

•Lawyers may be at particular risk of spear phising by unscrupulous adverse parties.

91% of cyberattacks begin with spear phishing email

http://news.techworld.com/security/3413574/91-of-cyberattacks-begin-with-spear-phishing-email/

Spear Phishing 101 - Who Is Sending You Those Scam Emails And

Why?

http://www.forbes.com/sites/ericbasu/2013/10/07/spear-phishing-101-who-is-sending-you-those-scam-emails-and-why/

Spear Phishing: Scam, Not Sport

http://ca.norton.com/spear-phishing-scam-not-sport/article

Spear Phishing: Identity Theft’s New Black

http://idtheft.about.com/od/theftmethods/a/Spear_Phishing.htm

Spear phishing

•Key tips:

•Most companies (banks, agencies, etc.) never request personal information via email. If in doubt, call them, but look up the number separately, as a phone number included in the email may be part of the scam.

•Don’t follow links in the email; enter the address manually in your web browser.

•Usually the sender’s “reply to” address will display at the top of the email, but that doesn’t mean that’s where the email came from. Anyone can set any “reply to” address they like.

•

Consider investing in doing some spear phishing

“penetration testing,” i.e. “white hat” phising attempts within your own firm to test whether individuals can spot

Threat Number One: Spear Phishing

(12)

Canada’s Anti-Spam Legislation

•No official short title. Commonly, “CASL”

• An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act, S.C. 2010, c. 23

•Precedence over privacy provisions of PIPEDA

•

Comes into force on July 1, 2014

•Part re: installation of apps comes into force on January 15, 2015 •Deals with “commercial electronic messages” or “CEMs”

•Not just bulk communications, could be just one message. •Lots of information at fightspam.gc.ca

Canada's Anti-Spam Legislation – Government Site

http://fightspam.gc.ca/

Canada's Anti-Spam Legislation – CRTC

http://www.crtc.gc.ca/eng/casl-lcap.htm

Canadian Chamber of Commerce page on CASL

http://www.chamber.ca/resources/casl/

What's it all about? How anti-spam legislation can affect your firm –

CBA

http://www.cba.org/CBA/PracticeLink/03-12-SS/05.aspx

Get ready for Canada’s Anti-Spam Law – Blakes

http://www.blakes.com/english/resources/pages/blakes-anti-spam.aspx

PRIVACY AND DATA SECURITY:

WHAT ALL LAWYERS NEED TO KNOW

Matt Edmonds

Materials available for download at mattedmonds.ca/privacy

PIPEDA Self-Assessment Tool

http://www.priv.gc.ca/resource/tool-outil/security-securite/english/AssessRisks.asp?x=1

Other Sources of Privacy Information

http://www.priv.gc.ca/resource/links-liens/02_03_07_e.asp