THE COMPLICATIONS OF UBIQUITOUS MOBILE COMPUTING. IAPP Asia Singapore 2 April 2014 Ken Chia Huey Tan Hilary M. Wandall

Transcription

1 THE COMPLICATIONS OF UBIQUITOUS MOBILE COMPUTING IAPP Asia Singapore 2 April 2014 Ken Chia Huey Tan Hilary M. Wandall

2 Today, the number of mobile phones on earth is GREATER THAN the number of people on earth.

3 ALMOST EVERY ASPECT OF OUR LIVES IS CONNECTED Who we call, where we go, what we read, what we write, the games we play, what we buy and where we buy it...

4 OUR LIVES CAN BE TRACKED BY Our phones and tablets Our watches Our cars Our appliances Our game players Other wearable technologies Surveillance cameras and webcams Sensors The web sites we visit The mobile apps we use The and SMS messages we send and receive Our GPS coordinates

5 According to recent estimates, the online activity of an average internet user is tracked > 2,000 times per day... and likely will continue to increase

6 According to recent news articles, the majority of Internet users have taken one or more steps online to protect their privacy.

7 PRIVACY CONCERNS ARISE in our private lives and our professional lives

8 PROTECTING PRIVACY IN PRIVATE LIFE Designing Privacy Into Mobile Apps

9 SIX PRINCIPLES FOR MOBILE APP PRIVACY BY DESIGN 1. Fair and legitimate purposes 2. Transparency 3. Informed and meaningful choices 4. Outsourcing 5. Security 6. Accountability

10 mobile app Hypothetical Fact Pattern Mobile app offered by a large multinational company with significant operations in the country App developed by a small start up service provider in another country The app allows users to track their daily activities, record what they eat and the medicines they take, import fitness data, calculate how far they travel, and sleep from a wearable device, and share reports with their physicians The app allows a third party analytics provider to track app usage and deliver advertising

11 1. FAIR AND LEGITIMATE PURPOSES (PART IV, DIVISION 2 - PURPOSE) Privacy obligations flow with the data Balance the risks and benefits Data uses that create significant harm for individuals, such as medical identity theft, financial fraud, or stalking should be appropriately balanced by the benefits offered to those individuals in order to ensure that the use is perceived as fair and legitimate Data necessary for the core functionality of the app or the activities of the user and not excessive Avoid or limit the collection of sensitive data (e.g., persistent device identifiers, location data, photos, identifiable medical treatment information or symptoms) Store individual or device-identifiable data only as long as needed for the app to function, as consented to by the user or to meet legal requirements, where applicable

12 2. TRANSPARENCY (PART IV, DIVISION 2 PURPOSE AND PART V) Provide information to potential app users before the app is downloaded about how the app will collect and transmit data during download and when the app is used Design an easy-to-read privacy notice into the app and make it readily accessible to users Prompt users with contextual notices before data are imported into or exported from the app Privacy notices should be specific to the app and its data collection, generation and transmission practices Readily enable users to access the data about them collected, generated or shared by the app and to correct inaccurate data

13 3. INFORMED AND MEANINGFUL CHOICES (PART IV, DIVISION 1 - CONSENT) Individuals must be permitted to choose whether data about them will be processed as described in the privacy notices Choices should be provided in context and promptly before the proposed collection, import or transfer occurs Mobile apps should give users control over the collection, import, generation or transfer of any identifiable data about them for purposes other than the app s basic functions Mobile apps must allow users to opt-in to any data uses or sharing that may be unexpected and to any collection, import, generation or transfer of sensitive data about them If the app uses a third party data analytics provider that consolidates user data from multiple apps, adequate information must be provided to the end user for awareness and opt-out If the app allows user data sharing with third parties for purposes unrelated to the core functionality of the mobile app, such as advertising, adequate information must be provided to the end user for awareness and an ability to opt-out of such data sharing

14 4. OUTSOURCING (PART II, APPLICATION TO DATA INTERMEDIARIES, PART VI) Know your outsourcing providers undertake appropriate privacy due diligence Obtain written assurances from outsourcing agents that develop or support the operation of mobile apps that they will handle the data collected, generated or transmitted by or to the app in accordance with law, these principles and applicable app privacy notices and choices, and will only use subcontractors who provide written assurances of the same Don t import data into the app from any data providers without written assurances that they have the legal right to provide the data for the intended app purposes

15 5. SECURITY (PART VI) Use only authorized, official and reputable software for development of mobile apps Use secure coding to minimize the risk of a security vulnerability or data breach Mobile apps that use, import or generate sensitive data must require user authentication prior to allowing access to the data available through the app App passwords must be salted and hashed before sending or storing All personal information stored locally on a mobile device must be sufficiently encrypted at rest Transmission of all personal information to and from a mobile app and mobile device must be sufficiently encrypted Personal data must always be obfuscated in any URLs associated with the app Promptly respond to any potential data breaches

16 6. ACCOUNTABILITY (PART III) Organizational and management commitment to designing privacy into mobile apps Inventory of mobile apps and personal and device data used Privacy policies that apply to mobile app development and data collected, generated and transmitted in the mobile environment Mobile privacy awareness and training Management of outsourced providers Mobile app lifecycle management and risk management Mobile app privacy incident management

17 Thank You! Questions?

18 BYOD The Complications of Ubiquitous Mobile Computing Ken Chia, CIPP(IT) Baker & McKenzie is a member firm of Baker & McKenzie International, a Swiss Verein with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "partner" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm Baker & McKenzie

19 BYOD concerns for the organisation Since the App allows individual movements to be tracked, this could give rise to security implications for the organisation employee handles cash transfers regularly employee is part of secret deal team and information that he is visiting a particular offsite location (e.g. competitor s offices) can be price sensitive increased kidnapping threat to employee when travelling abroad? When should an organisation step in and control use? Can it monitor employees use of such apps? Health and lifestyle app capturing sensitive personal data 2014 Baker & McKenzie 19

20 BYOD is part of a greater trend towards workshifting moving work to the most optimal location, time and resources Source: Citrix Global Workshifting Index Baker & McKenzie 93% will enable workshifting by end Singapore s BYOD rate is already 90% (global average is 74%) 20

21 Issues Devices can be purchased by employees, employer or both Use not restricted to the workplace Conmingling between work and personal data Implications for employee monitoring practices Network monitoring vs monitoring at device level Location-based tracking Security incidents and investigations Do employees have legitimate expectation to privacy? But employers also have legitimate concerns re enterprise data which is stored / accessed on a personal device 2014 Baker & McKenzie 21

22 Data retention/ litigation Is segregation of enterprise and personal data on a personal device possible? Implications for compliance with statutory retention and e- discovery obligations Destruction/ spoilage of information by employees Need for employers to have access to and/or ability to copy data (e.g. create image or back-up) Consent in order not to fall foul of computer misuse offences 2014 Baker & McKenzie 22

23 Practical steps Establish framework for managing personal information on device Update employment contract and employee handbook SG - Establishing, managing or terminating employment relationship exception 2014 Baker & McKenzie 23