Privacy lessons learned: do your homework about home work

David Elder -

A recently publicized privacy breach by a Canada Revenue Agency (CRA) employee underlines the need for all organizations to impose strict controls and safeguards respecting the ability of employees to remove sensitive data from the workplace.

In a widely reported story, it was recently discovered, through a request under the Access to Information Act, that confidential material respecting Canadian taxpayers, contained in hundreds of documents and tens of thousands of email messages sent and received by a CRA employee, were downloaded in unencrypted form to CDs taken home and retained by a CRA auditor, at least some of which were subsequently copied to a third party’s laptop.   While the CDs have been recovered, the laptop – thought to contain the tax files of at least 2,700 Canadians – is still missing. 

Continue Reading...

US considers tough legislation to cripple foreign sites that infringe US IP

Stuart McCormack and Lindsay Gwyer -

Recently, a controversial new bill was introduced in the United States House of Representatives. The new bill, entitled the Stop Online Piracy Act, aims to undercut the business model of websites who sell or distribute pirated American products or works by imposing obligations on third parties who deal with the sites. Its purpose is to indirectly target foreign websites that may be outside the direct reach of American law. 

One of the main components of the Stop Online Piracy Act is section 103, which provides IP owners with a tool to enforce their rights against sites “dedicated to theft of U.S. property.” Under this section, an IP rights-holder can notify a payment network provider (defined as an entity that directly or indirectly provides the proprietary services, infrastructure, and software to effect or facilitate a debit, credit, or other payment transaction) or company that provides internet advertising services of IP infringement by a particular site. Providing that the notification meets the requirements set out in the section, the recipient must respond with “technically feasible and reasonable measures” within 5 days to essentially cutting off the infringing site from its services. For payment network providers this would generally entail preventing the completion of transactions involving American customers and the infringing website, and for advertisers it would mean ceasing to advertise the website or provide advertisements to the website.

Continue Reading...

Lady Gaga and fansite caught in a bad romance

Stuart McCormack and Lindsay Gwyer -

A string of number one hits and worldwide notoriety weren’t enough to bring Lady Gaga success in a domain name dispute over the use of her stage name. Earlier this fall Lady Gaga, whose real name is Stefani Germanotta, failed to convince an arbitration panel that the domain name ladygaga.org was being used illegitimately by one of the singer’s fan sites.

Domain names are allocated through accredited registries that use a central registry system overseen by the Internet Corporation for Assigned Names and Numbers (ICANN). Disputes over domain names are resolved in accordance with ICANN’s Uniform Domain Name Dispute Resolution Policy (the Policy). In order for a domain name to be cancelled or ordered to be transferred under the Policy a complainant must show that: the domain name is identical or confusingly similar to a trademark or service mark in which the complainant has rights; the respondent has no rights or legitimate interests in respect of the domain name; and the domain name has been registered and is being used in bad faith.

Continue Reading...