confidential info on old harddrives.

From: Philip.Belben_at_powertech.co.uk <(Philip.Belben_at_powertech.co.uk)>
Date: Wed Jun 2 12:28:25 1999

>> As far as publication is concerned, if you publish sensitive information
about a
>> person, there may be an action for defamation or some similar offence even if
it
>> is true.
>
> Unless that person is in the 'public's eye', like the president? Please
correct me
> if i'm wrong.


I have no idea what the legal situation is for a public figure, but I had always
assumed that in such cases things are published simply because the (financial)
benefits of doing so outweigh the (also financial) punishments imposed by the
law. I didn't think that the law actually made an exception.


>> > I wasn't talking about morals. I'd probably find the previous owner and
give
>> it to
>> > them, if they wanted it. otherwise I'd trash it. I have no use for old
>> letters and
>> > bank statements....
>>
>> So you weren't talking about morals. Maybe you should have been thinking
about
>> them, though. If someone makes a mistake and you discover it, what should
you
>> (morally) do? Exploit it for financial gain? Or help them put it right?
>>
>> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
> If you read past my first sentence you would have seen my answer.


I read several of your sentences. You said something about what you would
probably do and something about what you considered you had a right to do, but
little about what you _ought_ to do.

That said, this is a mailing list, not a private letter. Such questions are
often inserted for rhetorical reasons, not merely to extract a particular
correspondent's answers. Should I have written "IAMTA" against it or something?
IAMTA.


>> There have indeed. Generally after copyright has expired, which in most
>> countries now happens 50 or 70 years after the death of the writer. In the
case
>> of war diaries and the like, these are usually published with the permission,
if
>> not the active co-operation, of the author. This is a useful guide for when
>> personal data ceases to be sensitive - 50 to 70 years after the death of the
>> person concerned.
>
> How long is the copyright for software?


If the law doesn't specifically fix a different period, and I would be surprised
if it did, it will be just as long as for anything else.

A legal grey area looms here. What is software? The text of a personal letter
as typed in a word processor isn't; the source of a program is; but things in
between like spreadsheets, databases, even text formatter source code could have
problems in defining software. (In this context. In the context of the
Hardware vs Software debate, for example, all the above are soft)


> Regardless, I still _believe_ that it is the seller who is responsible for the
data,
> if not morally or legally, than just for personal safety and/or fear of
> embarrassment, or just paranoia. This of course is my opinion. I've never
sold a
> computer without first wiping everything off of it, and i don't have any info
i
> would consider sensitive or very private stored on there.


I agree that the seller has a duty to keep sensitive data safe, and off the
machine if he can. But I claim that the buyer also has such a duty. This may
be a cultural difference - in the UK it is still exceedingly impolite to read
someone else's mail without first being offered it by the person concerned, no
matter how close your relationship (genetic or social) with them (I think
husbands and wives may be an exception - still impolite but not exceedingly so)


> On the hypothetical about the drug dealer and his buyers, sellers and account
info:
> As a (insert your country) citizen, isn't it your duty to inform the
authorities of
> such crimes? Obstruction of justice comes to mind, for one (U.S.A).


That is a very nasty moral grey area. A similar question has been asked by
people repairing video cassette machines: if I find evidence that someone has
gone to great, even destructive, trouble to remove a jammed cassette from a
machine, should I report a suspicion about (e.g.) obscene videos?

I don't have a solution to this moral problem. I don't know whether I have a
stronger duty to my country (or the laws thereof) or to the person I'm dealing
with. But I don't think I have a duty to pry where I'm not wanted in order to
incriminate people. Police detectives are employed for that purpose.


> And that situation about the 'shrink' failing to wipe his drive of very
private and
> sensitive info before selling it was just plain irresponsible. Would he throw
out
> letters or whole files without first shredding them? It is _*HIS*_
responsibility
> for those papers, as is it his ethical duty to guard those papers and files he
> stores in his office. Heck, the police needs a search order to gain access to
those
> files, why should one have access to those files, paper and other types,
simply
> because he/she failed to delete or shred them before a sell? <( or he/she
moves to
> another office and leaves her filing cabinet at old office?) If my
information
> were in that drive and i found out about it, I would demand he lost his
license for
> incompetence.


You seem to be pointing to a view almost opposite to that you expressed earlier,
here. If the police need a warrant to examine these files, someone who
accidentally stumbles on them (say on the hard disk of an old machine) surely
cannot have a right to do very much with them...

There is certainly a lot of incompetence there. And for some of it the cure is
education. People should know if there is sensitive stuff on the drive. But
they should be able to trust us to delete it if they can't do so. I wouldn't
expect the psychiatrist to know how to wipe the drive in a computer that no
longer boots, for example. But they should know enough to ask us to delete it
when they give us the machine.


> I would think that computer files are considered the same as paper files under
the
> law, again US law. Correct me if I'm wrong.


Under UK law, specifically the Data Protection Act, controls on computer files
are stricter than those on paper files. I don't know all the details of the act
- I suppose now is the time to find out...


> Anyways, if we really wanted to find the legal thing to do, one of us should
contact
> a lawyer friend that specializes in this. What category does this fall under
anyway
> (the personal information bit, not the software licenses)?


The American approach. Whatever you do, ask a lawyer :-)

I'd err more on the side of Least said, soonest mended. But I really don't
think this problem will go away. People who use computers need to be educated
in such matters. And - I claim - better not by frightening them too hard.

Philip.





**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote also confirms that this email message has been swept
for the presence of computer viruses.

Power Technology Centre, Ratcliffe-on-Soar,
Nottingham, NG11 0EE, UK
Tel: +44 (0)115 936 2000
http://www.powertech.co.uk
**********************************************************************
Received on Wed Jun 02 1999 - 12:28:25 BST

This archive was generated by hypermail 2.3.0 : Fri Oct 10 2014 - 23:32:15 BST