Incident: Security breach hits TradeFreedom

Canadian brokerage TradeFreedom has been hit with a security breach and is notifying some of its customers that their information may have been compromised:

reportonbusiness.com: Security breach hits online brokerage

Online broker TradeFreedom Securities Inc. has quietly notified an unidentified number of its customers that a computer security breach has compromised some of their personal information, potentially exposing them to fraud.

In what it described as a follow-up to an Aug. 17 notice to clients, it said in a Friday e-mail that it had finished its investigation into the "recent unauthorized intrusion" of one of its computer systems.

"We have subsequently determined that, despite our security systems in place at the time, this unauthorized intrusion has also resulted in the compromise of some of your personal information," TradeFreedom said. "This information is your name, social insurance number, city, province and postal code."

Citing a continuing police investigation by the Sûreté du Québec, TradeFreedom president Bruce Seago said he could not release any details about the nature or timing of the computer security breach....

Privacy awareness week

Yesterday was the first day of Privacy Awareness Week in Canada. I haven't seen the commissioners making a visible fuss out of it, but CAPAPA has issued a release:

CAPAPA supports Canadian’s Right to Know
“Privacy IS Your Business”(Calgary, Alberta)

August 26, 2007 – CAPAPA (Canadian Association of Professional Access and Privacy Administrators) is pleased to support international Privacy Awareness Week, August 26th to September 1st, 2007. Privacy Awareness Week, a campaign first initiated by Privacy Victoria (Australia) in 2001, has for the first time gone international.

As Canada’s leading association serving privacy and access professionals, CAPAPA is spearheading the campaign to promote privacy awareness in Canada. “Identity theft and information security breaches are happening more often than ever,” says CAPAPA National Chair Sharon Polsky. “To reverse that trend, Canadians must recognize the importance of protecting their personal information — at home, in the workplace, and in the consumer marketplace.”

Privacy Awareness Week provides an opportunity for individuals to raise questions about privacy legislation and its impact on how individuals conduct their business and personal lives. Privacy Awareness Week spotlights the need for Canadians to recognize their rights and obligations to maintain the privacy of their personal information. The theme for Privacy Awareness Week 2007 is ‘Privacy is your business'.

Know your Rights and Obligations


Canadian organizations, governments, and government agencies are bound by a variety of wide-reaching privacy laws. Ms. Polsky notes that, “As consumers, each of us is responsible to understand what our rights and responsibilities are under those laws.”

CAPAPA is a key source for helping Canadians recognize their privacy rights and responsibilities, and is the privacy advocate’s source for issues such as the passenger name record exchange, emerging RFID CHIP technology, and CAPAPA's Submission to the Senate on proposed changes to Canada’s Election Act.

More information on these and other Canadian privacy issues is at http://www.capapa.org./ For more information on how you can promote Privacy Awareness Week 2007, visit http://www.capapa.org/ or contact CAPAPA at: info@capapa.org.

USA: adoption of IFRS - roadmap to be published

The SEC has announced that it will shortly publish for consultation a proposed roadmap for the adoption of International Financial Reporting Standards (IFRS) by US issuers beginning in 2014. The SEC notes in its press release:

Currently, U.S. issuers use U.S. Generally Accepted Accounting Principles (U.S. GAAP). The Commission would make a decision in 2011 on whether adoption of IFRS is in the public interest and would benefit investors. The proposed multi-year plan sets out several milestones that, if achieved, could lead to the use of IFRS by U.S. issuers in their filings with the Commission. The increasing integration of the world's capital markets, which has resulted in two-thirds of U.S. investors owning securities issued by foreign companies that report their financial information using IFRS, has made the establishment of a single set of high quality accounting standards a matter of growing importance. A common accounting language around the world could give investors greater comparability and greater confidence in the transparency of financial reporting worldwide".

To watch a statement by SEC Chairman Cox, outlining the above, click here (for QuickTime) or here (for Windows Media Player). The roadmap has not yet been published on the SEC website but further information is available in this report in the Wall Street Journal. 

Note:

[a] A useful map, indicating those countries where IFRSs have been adopted, is available on the IASB website here. 

UK: DBERR consultation on the creation of a UK wide companies registry

DBERR has published a consultation paper concerning its proposal to integrate the Northern Ireland Registry of Companies with Companies House to create a single UK Registry of Companies. According to the consultation paper:

In practical terms the merger would mean that customers would be able to refer to one Register only for registration and information relating to UK companies. It would also mean that all UK customers had access to the same products and services at the same price. The system would operate in much the same way as Companies House currently works with Scotland. The Registrar for Northern Ireland would be retained, and would be an appointee of the Secretary of State for BERR, as is the case for England and Wales and for Scotland; in practice the Northern Ireland Registrar would report to the Chief Executive of Companies House. The office in Belfast would remain, but would use systems, hardware, processes and have corporate standards in common with Companies House. Registry operations in Northern Ireland would be maintained with no detrimental impact upon customers, but the existing company data would be migrated to give customers full UK information on companies. There would be a common fee structure, and customers would have the benefit of common filing and search services covering the whole of the UK. There would be an exercise to value and transfer (if applicable) relevant assets and liabilities".

Developments in UK data protection law

DP Thinker has posted a few developments in UK data protection law:

DP thinker: A few developments

Just a few developments to note on data protection in the UK:

1) The draft Data Retention (EC Directive) Regulations 2007 will take effect on 1st October 2007. These regulations implement the Data Retentions Directive 2006/24/EC and will apply to public electronic communications providers. Data will be retained for a period of 12 months from the date of communication (Regulation 4(2)). The types of data to be retained are telephone numbers and mobile numbers (Regulation 5(1) and 5(2)). The regulations do not apply to data from internet access, e-mail and internet telephony (VoIP). The Information Commissioner will monitor the application of these regulations (Regulation 8). A comparison of the other European Member States' Laws implementing the Data Retentions Directive 2006/24/EC can be found here.

2) On 24 October 2007, the transitional exemptions under the UK Data Protection Act 1998 will end. This means that structured manual filing systems containing personal records will be covered under the Data Protection Act, but would apply to data that was held before October 1998. The Durant case will be relevant, which took the view that most manual file files are not relevant filing systems.

3) Draft Freedom of Information and Data Protection (Appropriate Limit and Fees) Regulations 2007 - The Government has drafted amended freedom of information (FOI) fees regulations which will allow public authorities to take into account more comprehensively the work involved in dealing with an FOI request. The consultation was completed in June, but further details can be found here.

UK: England and Wales: relieving directors from liability in respect of unlawfully paid dividends

In HMRC Commissioners v Holland (Ch.D., Deputy Judge Cawson QC, 24 June 2008) the judge had before him applications under Section 212 of the Insolvency Act (1986) relating to 42 separate companies. One of the questions considered was whether a director could be relieved from liability under Section 727 of the Companies Act (1985) in respect of the payment of unlawful dividends. In this regard, Deputy Judge Cawson QC observed:

"The headnote to Re Loquitur [Ltd., IRC v Richmond [2005] 2 BCLC 442] suggests that the case decides that there is no jurisdiction to grant relief under Section 727 CA 1985 where, as a result of directors failing to exercise proper skill and care a dividend is paid that renders the company insolvent or potentially insolvent. However, I consider  that this reads too much into Etherton J's judgment ... Whilst the Court will, necessarily, be most reluctant to grant relief under Section 727 when an officer/shareholder has benefited at the expense of the creditors by reason of the payment of the dividend, I consider that the Court does retain a discretion to relieve at least when, as in the present case, the director has not directly benefited from the payment of the dividend" (para. [224])

Notes: 

[1] The decision is not yet available on BAILII but a copy of the transcript is available on the Lawtel subscription service (the Lawtel staff have not yet prepared a summary). Update (29 Sept 2008): the decision is now on BAILII - click here. 

[2] The provision in Section 727 of the Companies Act (1985) permitting the court to grant relief is found in Section 1157 of the Companies Act (2006), which comes into force on 1 October 2008.

Denmark: corporate social responsibility reporting

Several months ago the Danish Government published its Action Plan for Corporate Social Responsibility. In the Plan the Government explained that it would make it mandatory for large businesses, institutional investors and unit trusts to report on corporate social responsibility matters (further information, in English, is available here).  The UK's Financial Times newspaper has recently reported that legislation introducing these provisions will be voted on in October.