Travelers Face Greater Use of Personal Data

Travelerswashingtonpost.com: By Paul Lewis and Spencer S. Hsu

The United States and the European Union have agreed to expand a security program that shares personal data about millions of U.S.-bound airline passengers a year, potentially including information about a person's race, ethnicity, religion and health.

Under the agreement, airlines flying from Europe to the United States are required to provide data related to these matters to U.S. authorities if it exists in their reservation systems. The deal allows Washington to retain and use it only 'where the life of a data subject or of others could be imperiled or seriously impaired,' such as in a counterterrorism investigation.

According to the deal, the information that can be used in such exceptional circumstances includes "racial or ethnic origin, political opinions, religious orphilosophical beliefs, trade union membership" and data about an individual's health, traveling partners and sexual orientation.

Airlines do not usually gather such data, but officials say it could wind up in passenger files as a result of requests for special services such as wheelchairs, or through routine questioning by airline personnel and travel agents about contacts, lodging, next of kin and traveling companions. Even a request for a king-size bed at a hotel could be noted in the database. ...

Although Homeland Security has said it will move passenger information to "dormant" status after seven years and "expects" to erase it after 15 years, it notified the E.U. that expiration of data will be subject to "further discussions."

Dutch lawmaker Sophia Veld, the European Parliament's standing rapporteur on Passenger Name Records, said the agreement gives a green light to U.S. authorities to use confidential information for unstated purposes. Stavros Lambrinidis of Greece, vice chairman of the parliament's civil liberties, justice and home affairs committee, warned that it allows extra data collection not just in counterterrorism cases but for "a vast and in some cases unidentified number of crimes. So we have function creep."

And make the king suite non-smoking, please. Got that down?

Defining Privacy -- and Its Limits

From Inside Higher Ed:

"A student in a public university dormitory room had a “reasonable expectation of privacy” for his personal computer and its hard drive, a federal appeals court ruled on Thursday. The decision also found that despite that right to privacy, an administrator in the case under review had the right to conduct a remote search of the computer — without a warrant — because of the circumstances involved.

The decision — by the U.S. Court of Appeals for the Ninth Circuit — is among the highest level court rulings to date on a set of legal questions pitting privacy vs. security that are increasingly present in academe. While experts cautioned that the decision involved a specific set of facts, several also said it provided guidance for students on their privacy rights and for administrators at public colleges and universities on setting computer policies that give them the flexibility they feel they need to prevent security breaches.

The ruling dates back to an incident in 1999, and the actions of administrators at the University of Wisconsin at Madison, when they were notified ...that someone on Madison’s network was hacking into the company’s network. Ultimately, a then-student at Madison whose computer was found to be used in the hacking entered into an agreement with prosecutors in which he agreed to admit guilt, received a sentence of time served on federal charges arising from the hacking, and was released after eight months in prison. But ...the then-student, also won the right to appeal the case in the hope of clearing his name, and his appeal focused on information gathered by Madison officials.

There has been a good deal of recent discussion and concern about "reasonable expectations of privacy" hereabouts. This decision may be of some interest. Further comment to follow.