Category Archives: Personal Data

Personal data tracker service allows to infer activities of other persons

From the March of this year everyone is able to check on the eesti.ee portal, which state agencies have reviewed their data from the population register. The new service is a matter of grave concern to notaries who are required to make inquiries into the population register, for example, if it is necessary to find out whether real estate may be the joint property of spouses or former spouses, or if it is necessary to organize succession proceedings based on data, including identifying potential heirs. According to Eve Strangi, Chief Executive Officer of the Chamber of Notaries, after the Data Tracker service came into being, people who did not use the notarial service themselves, but whose parents, children or spouse had done this, also came to the notice that personal data was viewed.

In most cases, people can get information that their data has been viewed, but not always. “An exception, for example, is the situation where heir data is required to make a will. However, the will until the death of the maker is secret, and the existence and content of the act can not be disclosed to the heir earlier than specified by the law.

Heiko Vainsalu, Head of the State Information System Agency X-Road, said that the Data Tracker highlighted weaknesses in information systems, which should now be addressed by the authorities themselves. “It is now up to the authorities to eliminate them – to improve the logic of data services and to find data services better suited to specific needs. Besides the ability to track the use and processing of the data in the state information system, the Data Tracker helps to highlight and correct the design mistakes of information systems.”

Some filters are needed. For example, the queries made by law enforcement institutions in investigating the crimes must not show up to the subjects in the Data Tracker service.

Links:
http://arileht.delfi.ee/news/uudised/andmejalgija-paljastas-notarite-salajased-toimingud?id=78131976

Sensitive personal data published in document registers of state agencies

Leave a reply

During a Garage48 hackathon held in Tallinn over the weekend, one participating team announced that they could not publish the results of their work as it contained too much personal data they had accidentally come across in state document registers. There are hundreds of such registers across Estonia, as each ministry, agencies, local governments and schools all have their own digital document registers.

The paper noted that while the Estonian Data Protection Inspectorate does check the security of document registers, it does so by hand, and checks are often followed by monitoring procedures and, less frequently, even fines for register administrators.

A similar problem was discovered back in April by Estonian startup Texta that created its own document registers analysis tool. Co-founder of Texta Silver Traat said they discovered a lot of highly detailed personal information in the documents register of the education ministry.

„We held a workshop as part of a language technology conference where we did what the state lacks the capacity to do itself. We downloaded 150,000 documents from the ministry’s document register and discovered that they held, among other things, people’s personal identification numbers, bank account numbers, addresses. We even came across some passport numbers,“ Traat described. He added that most of the information was from employment contracts.

This is the unfortunate side-effect of open data. For that data to be useful it actually has to contain at least some bits of personal data.

Links:
http://news.postimees.ee/4123431/stacks-of-sensitive-data-lying-unprotected
http://news.err.ee/597791/sensitive-personal-data-exposed-in-state-registers

Personal data processing by state systems wider than it should

Leave a reply

The first issue concerns state systems querying more personal data from X-Road than required:

In March a service was added to the Eesti.ee online portal that allows users to see which government institutions have accessed their personal data. According to daily Eesti Päevaleht, there are plenty of illegal queries. As the paper wrote on Tuesday, the Unemployment Insurance Fund, the E-Health System, notaries, and plenty of others regularly break the law by accessing people’s personal data without a legally valid reason.

What happens is that every time e.g. someone’s general practitioner accesses their data, the system automatically also displays their immediate relatives and their personal ID codes. This data represents a series of illegal queries by the system. “Thanks to the data tracker it has become clear that the information systems of plenty of institutions apply only the broader query also for their services that don’t require the data of connected persons. Those institutions where the problem has come up are already improving their systems,” the Data Protection Inspectorate’s press spokeswoman, Maire Iro, said. According to Iro the inspectorate does not have a complete overview of all the institutions affected, but that local government, liquidators, and notaries had already begun to check their queries.

The second issue is about recent law amendments and interest of state institutions to perform mass data processing on wide range of personal data:

Director General of the Estonian Data Protection Inspectorate (AKI) Viljar Peep sent a letter to Minister of Jutice Urmas Reinsalu this week expressing concern about extensive data processing by state agencies, first and foremost by the Estonian Tax and Customs Board (MTA). An amendment to the Taxation Act entered into force on April 1 which granted the MTA access to a large number of databases for risk assessment, i.e. tax intelligence, purposes, reported daily Eesti Päevaleht (link in Estonian). The tax authority primarily requests information from transaction databases of the Central Commercial Register, the Traffic Register and the Land Register. The Police and Border Guard (PPA) and the Estonian Road Administration have expressed interest in similar access to databases.

“In the initial bill, data processing was in no way hindered, meaning that the MTA could have even looked at a person’s e-health data,” Peep recalled. “Thankfully this was limited somewhat during proceedings.” According to the director general, the issue is that Estonia lacks legislation that would regulate mass data requests. “Yes, it is specified in the Law Enforcement Act and the misdemeanor procedure how to conduct inquiries regarding specific violations, however mass data processing cannot be conducted by the same rules,” he stressed. “It is important that every authority not begin making up it own rules.”

Links:
http://news.err.ee/590473/state-systems-illegally-passing-around-personal-data-on-massive-scale
http://news.err.ee/591100/data-protection-inspectorate-concerned-by-state-agencies-data-collection

Broker companies have created database of forest owners

Leave a reply

According to Postimees, forest broker companies have created a super database of forest owners, part of which could have been leaked from agency under Ministry of Environment.

The database brings together people names, dates of birth, telephone numbers and information on their forest properties. Brokers are using phone numbers, which have not been allowed to be disclosed by telecommunication companies, as well as information about forests, which should remain locked in the forest registry of Environment Agency.

According to the head of portal metsaoksjon.ee Lehar Lindre, the passwords for use of registry are given also to forest consultants. “However, the Agency of Environmental Protection, administering the registry, does not know who and how much queries have made,” said Lindre.

Some private entities have personal data they should not have, but nobody knows where did the data came from.

Links:
http://pluss.postimees.ee/3980443/metsavahendajate-tegevus-viitab-massiivsele-infolekkele

Checking who has accessed your personal data is a challenge in practice

Leave a reply

digilugu_peremeditsiin-debug

Peeter Marvet dispels the myth of transparency in finding out who has accessed your data in state databases:

For the past 20 years or so Estonian e-government and the X-Road backbone has been promoted with the promise of transparency. Yes, we keep a lot of data, but it is stored securely and you can always check who has accessed it. This means transparency and trust. Or “trust”, as in this The Guardian interview with Toomas Henrik Ilves.

Problem is, there is no such transparency – no notifications, no place to log in and see who has accessed your data. There was one system with such functionality, but it was shut down like 10 years ago (added: there is one system – E-Health’s Digilugu.ee “patient portal”). And even when it worked, it displayed only trivial amount of accesses [..].

The rest of the databases? I recall a meeting (in the government residence, no less) where the topic was discussed, possibly on a roundtable arranged by the National Audit Office. After some serious googling I found a contact address where to submit a request to get information about who has accessed my data in the Population Registry. It took some months to get the answer, it supposedly had information about who had requested my data available only in the “comments field” and had to be assembled manually. Promoting the idea to requesting such transparency is a good start for denial-of-service attack on Estonian e-government.

Then there was a case when somebody from the Ministry of the Interior was to promote some new legislation mandating more data storage with the argument, that everybody is able to see who has been accessing the data, so it is not a privacy violation. Our correspondence with her ended after couple of rounds, after she was unable to find any proof of solution where I could view the access log.

And don’t get me started on the question of who can purchase the data from our Population Registry or from Business Register. Want to get contacts of unemployed pensioners? Give us your monies! Want to spam every e-resident who has created a company? Sure, all addresses in registry must be business contacts so spam away (and give us some monies)!

Interesting research to conduct would be to submit bunch of requests for personal data access reports to various state database holders and analyze the response time and the detailedness level of the answers.

Links:
https://tehnokratt.net/2016/05/meme-based-trust-lockean-contract-la-e-stonia/

Database with non-anonymized judicial decisions available online

Leave a reply

Riigi_Teataja_anonymization_failure

Estonia features a punishments register with misdemeanours and crimes listed by all people. For the benefit of potential employers, for instance. Then there is a judicial decisions database where expired crimes can often still be detected. In these two, names and other data of victims and witnesses are almost never found – the occasional typo excluded. Turns out, there is a third database with judicial decisions prior to 2006. In it, glaring problems are obvious regarding personal data protection, as it holds details of entire criminal acts as well as names of criminals, victims, witnesses and experts. At times, names of close relatives are included, and home addresses at the time.

Estonian Data Protection Inspectorate PR-adviser Maire Iro agrees and says and claims people responsible at State Gazette (Riigi Teataja) database have repeatedly been notified of the problem. The justice ministry press rep Maria-Elisa Tuulik said the data has been uploaded pursuant to old legislation and the people had the right, and still do, to apply to relevant courts for removal of their data in such instances. Ms Tuulik admits people might have difficulty doing that and have insufficient knowledge. She cites the excessive amount of manual labour required to sort out the data. They may thus take it all offline as public interest is waning anyway, with time passing.

For some of the decisions State Gazette has tried to anonymize personal data, but using ineffective technical means (see picture above).

Links:
http://news.postimees.ee/3762007/the-national-victims-register
https://www.riigiteataja.ee/kohtuteave/kohtulahendite_otsing/kriminaalasjad.html
https://www.riigiteataja.ee/docs//public/dokument_279468.pdf

Privacy concerns over fingerprint collecting from e-residents

Leave a reply

Biometric data of all individuals who have applied for or own Estonian identity cards, irrespective of whether they are national identity documents or digital identity documents meant exclusively for e-identification, are stored in digital database, archived and retained for 50 years (in case of e-residency, this is done to avoid conferring duplicate identities to one person).

From the perspective of e-residents, this is immaterial — the digital identity documents issued do not serve as travel documents, as has been established above. Nevertheless, due to the fact that under the Estonian Identity Documents Act the term “digital identity card” denotes both the e-IDs of nationals as well as e-residents’ e-ID cards, the requirement of biometric identifiers also applies to both.

Drawing on the aforementioned, the authors of the given chapter claim that the failure to differentiate between the two types of documents leads to unnecessary collection of biometric data that is in contradiction with the Data Protection Directive Article 6 principles of purpose and proportionality.

Biometrics as security technology cannot be “thrown in” for good measure, as Estonia seems to have done, without proper analysis of risks for the protection of fundamental rights and freedoms, not considering whether the purpose to be achieved could not be achieved by less intrusive means.

The practice is indeed questionable, since in case EU citizen applies for Estonian residency, the objective of “avoiding conferring duplicate identities to one person” is achieved by less intrusive means without fingerprints being collected.

Links:
http://link.springer.com/chapter/10.1007%2F978-3-319-26896-5_4

Banks twisting client arms to draw out personal data

Leave a reply

danske_data_form

Nordea and Danske clients complained to Postimees that said banks withheld services related to transfers and purchase of shares as the individuals failed to fill fresh personal data declaration.

The banks told Postimees that they are not collecting the detailed data on their own initiative but are under obligation to fulfil diligence measures arising from laws and other regulations.

Danske Bank explained that the information collected about customers has become very detailed. «In addition to an individual’s personal and document data, a bank must identify the customer’s activity profile, field of activity, volume of activity (bank account turnover), main partners,» explained the bank’s communication chief Tõnu Talinurm. «Pursuant to Tax Information Exchange Act, Danske Bank A/S Estonian branch needs to provide Tax and Customs Board information regarding US tax residents known to it or presumed by it. Because of that, we need to ask all clients whether they are US tax residents.»

Data Protection Inspectorate’s main stand is that the bank presenting the questions must also ensure that the clients know why they need to declare the extra data.

Financial Supervision Authority said the laws do lay on banks the obligation to know their customers, but do not prescribe specific questions.

Links:
http://news.postimees.ee/3396503/banks-twist-client-arms-to-draw-personal-data
http://news.postimees.ee/3396619/editorial-need-to-know-or-nice-to-know

Talk by IT law and data protection specialist professor Lee Bygrave

Leave a reply

Lee A. Bygrave

The IT law programme invites you to a discussion with a distinguished IT law and data protection specialist professor Lee Bygrave from Oslo University. He will give his talk on Friday, October 9, 2015, from 14.15 to 17.30 at the University of Tartu, Faculty of Law, Näituse 20 room 103. The talk will cover the following topics:

the US-EU cleavage on data protection regulatory policy;

the extent to which data protection rules can and ought to apply to use of human biological material;

regulatory policy on privacy-enhancing technology and privacy/data protection by design.

Lee Bygrave’s visit to Estonia is organized by the IT Law Programme. Additional information: Helen Eenmaa-Dimitrieva, Director of the IT Law.

Links:
http://www.ut.ee/itlaw
http://www.jus.uio.no/ifp/english/people/aca/lee/

Four PBGB officials fired in 2014 for misusing police database

1 Reply

Estonian_Police_and_Border_Guard_Board_PPA

Sixteen officials faced disciplinary proceedings for Police and Border Guard Board’s (PPA) KAIRI information system. Four lost to their jobs for unauthorized access. For example, one police officer from Jõhvi made 170 queries on 70 individuals, 52 vehicles and 11 phone numbers, none related to his official duties. “PPA takes data handling very seriously and exercises ever stronger control over the use of its information systems,” said Anne Abel from PPA’s internal audit office.

Good work by PPA’s internal audit office. What about other institutions which hold state information systems?

Links:
http://news.err.ee/v/politics/e7b05226-bb75-4207-a96f-71de32b4d5a5/four-officials-fired-in-2014-for-misusing-police-database