Offshore outsourcing - How safe is your data abroad? Overview of privacy, data protection and security

Global Jurist Topics

Volumn 6, Issue 2, 2006, Pages

  Basu, Subhajit ^a   Nikam, Amruta ^b  

^a QUEEN'S UNIVERSITY BELFAST   (United Kingdom)

^b NONE

Author keywords

Data protection; Data security; Outsoursing; Privacy; Safe harbor

Indexed keywords

EID: 33750164707     PISSN: 1535167X     EISSN: 1535167X     Source Type: Journal    
DOI: 10.2202/1535-167X.1204     Document Type: Review

References (86)

1. Government Accountability Office (GAO), "Current Government Data Provide Limited Insight into Offshoring of Services," GAO-04-932, September 2004, p. 1
2. Jacob Funk Kirkegaard (2005) Outsourcing and Off shoring: Pushing the EuropeanModel Over the Hill, Rather Than Off the Cliff ! Working Paper Series, Number WP 05 - www.iie.com, Institute for International Economics.
3. Working undercover Sun's investigative reporter was able to buy account details of 1,000 UK account holders of HSBC Holdings Pic, Barclays Pic and Lloyds TSB Group Plc from a former call centre worker for $5000. The former employee also offered to sell details of mortgages and medical bills. Among the information that was sold were details from credit and debit cards such as expiry dates and security numbers, which could be fraudulently used to make purchases.
4. Times News Network (2005), BPO staffers hack bank A/Cs http://timesofindia.indiatimes.com/articleshow/msid-1070986,curpg-1.cms The MphasiS-Citibank funds siphoning case is particularly noteworthy because of the ease with which a bunch of young BPO employees - from middle-class, criminal-free backgrounds - allegedly pulled off a financial fraud worth nearly half-a-million dollars from accounts of New York based customers($425,000 at last count on April 20, 2005). The five accused employees of MsourcE were not expert hackers. They were not breaking through firewalls or decoding encrypted software. Instead, they are said to have identified glaring loopholes in the MphasiS system, devised a modus operandi, roped in friends from outside and executed the fraud over four months...all this, without MphasiS getting a whiff of what was happening. Being the authorised e-banking service providers to Citibank, MphasiS-MsourcE employees were privy to confidential details of various account holders.
5. Louis D Brandeis and Samuel D. Warren, (1890) "The Right to Privacy", 4 Harvard Law Review 193
6. as cited in Steven A Hetcher (2004) Cyberspace Privacy Norms, Norms in a Wired World, Cambridge University Press p 262
7. Introduction to Dataveillance and Information Privacy, and Definitions of Terms Roger Clarke http://www.anu.edu.au/people/Roger.Clarke/DV/Intro.html
8. Ivy Schmerken (2004) Offshore Outsourcing: Is Your Data Safe?, Wall Street & Technology, April 27 2004
9. Michael Froomkin (2000) "The Death of Privacy" 52 Stanford Law Review 1461, 1465
10. "The End of Privacy" (1999) The Economist, May 1 at 21
11. as cited in Steven A Hetcher (2004) Cyberspace Privacy Norms, Norms in a Wired World, Cambridge University Press
12. Diane Rowland and Elizabeth Macdonald (2005) Information and Technology Law p 303
13. Benoit A. Aubert, Sylvie Dussault, Michel Patry and Suzanne Rivard (1999) Managing the Risk of IT Outsourcing, Proceedings of the 32nd Hawaii International Conference on System Sciences-1999
14. Boehm, B. W, (1991) Software Risk Management: Principles and Practices", IEEE Software January 1991 pp 32-42
15. Boehm, B. W, (1991) Software Risk Management: Principles and Practices", IEEE Software January 1991 pp 32-42 ibid.
16. Rowland, D 'Data Retention and the War against Terrorism - A Considered and Proportionate Response?' 2004 (3) The Journal of Information, Law and Technology (JILT)http://www2.warwick.ac.uk/fac/soc/law2/elj/jilt/2004_3/rowland/
17. Tom Davenport (2004) What Stays and What Goes? - Sourcing Processes and Jobs in the Global Economy, Offshore Outsourcing - Risks and Rewards, Conclusions Paper Presented by CFO at p. 3
18. Tom Davenport (2004) What Stays and What Goes? - Sourcing Processes and Jobs in the Global Economy, Offshore Outsourcing - Risks and Rewards, Conclusions Paper Presented by CFO at p. 3 ibid.
19. See Offshore Outsourcing of Data Services by Insured Institutions and Associated Consumer Privacy Risks http://www.fdic.gov/regulations/examinations/ offshore/index.html
20. Offshore Outsourcing of Data Services by Insured Institutions and Associated Consumer Privacy Risks http://www.fdic.gov/regulations/examinations/ offshore/index.html
21. Ibid. at p 14
22. Steven A Hetcher (2004) Cyberspace Privacy Norms, Norms in a Wired World, Cambridge University Press at p 251
23. Graham Greenleaf, 'IT Outsourcing Privacy Guidelines', Privacy Law & Policy Reporter, Volume 1, No 7, September 1994, pp 131-132
24. Graham Greenleaf, 'IT Outsourcing Privacy Guidelines', Privacy Law & Policy Reporter, Volume 1, No 7, 1994, pp 131-132 Ibid.
25. The purpose of informal game theory is "to model the strategic structure of social situations. The most famous and perhaps pervasive strategic structure of interest to social scientists and policymakers has been the structure variously known as the Prisoner's Dilemma, collective action problem, public good problem or Tragedy of the Commons" Steven A Hetcher (2004) Cyberspace Privacy Norms, Norms in a Wired World, Cambridge University Press, pp250-304
26. Steven A Hetcher (2004) Cyberspace Privacy Norms, Norms in a Wired World, Cambridge University Press, pp250-304
27. Kelly, Hugh C. and Nolle, Daniel E. (2003) 'Cross-border outsourcing and risk management for banks', Journal of Financial Transformation pp 63-72
28. For a detail discussion on contact see Pai, A., & Basu, S. (2006) "Offshore technology outsourcing: overview of management and legal issues", International Journal of Business Process Management (in press)
29. Pamela Samuelson (2000) Privacy as Intellectual Property? 52 Stanford Law Review at p 1125
30. Christopher Millard( 2005) Communications Privacy, in Ian Walden and John Angel (eds) Telecommunications Law and Regulation, at p 381
31. Global Internet Policy Initiative (2004) The International Legal Framework For Data Protection and Its Transposition to Developing and Transitional Countries, www.internetpolicy.net/privacy/20041228privacy.pdf
32. Tenth Annual Report of the Data Protection Registrar, 1994, London: HMSO
33. Diane Rowland and Elizabeth Macdonald (2005) Information and Technology Law p 303
34. Gellman R (1998) 'Does Privacy Law?' in Agre, PE and Rotenberg, M Technology and Privacy: the New Landscape, 1998 Cambridge, Mass: MIT
35. Diane Rowland and Elizabeth Macdonald (2005) Information and Technology Law p 307
36. Stephen Deadman (2005) Circles of Trust: The Implications of EU Data Protection and Privacy Law for Establishing a Legal Framework for Identity Federation, Liberty Alliance Project https://www.projectliberty.org/specs/ Circles_of_Trust_Legal_Framework_White_Paper_322200522576.pdf
37. OECD Document C 58 final (October 1st 1981)
38. EU Directive on the Protection of Individuals with regard to the Processing of Personal Data and the Free Movement of such data (95/46/EC)
39. Peter Carey (2004) Data Protection: A Practical Guide to UK and EU Laws, Oxford University Press, at p 99
40. January 28, 1981 Europe TS No 108
41. Only 10 countries ratified the convention and 8 countries signed the convention but have not ratified it. See Fred H. Cate: EU Data Protection Directive, Information Privacy and Public Interest
42. Managing Compliance in Global Space - Trans Border Data Flow by Katherine Sainty, Partner and Andrew Ailwood presented at Sydney on 30 November 2004 at the Workplace and Information Privacy Conference at http://www.aar.com.au/pubs/ pdf/priv/pap30nov04.pdf
43. Article 25 EU Data Protection Directive 95/46/EC
44. ibid.
45. The Politics of Trans border Data Flows: Competing Values, Interests, and Institutions at http://www.oii.ox.ac.uk/research/cybersafety/extensions/pdfs/ papers/andreas_busch.pdf
46. Lucas Bergkamp, The Privacy Fallacy: Adverse Effects Of Europe's Data Protection Policy In An Information-Driven Economy, Computer Law & Security Report Vol. 18 no. 1 2002 ISSN 0267 3649/02/$20.00
47. https://www.privacyassociation.org/
48. Binding Corporate Rules are based on Article 29 Working Party working document on transfers of personal data to third countries, applying Article 26(2) of the EU Data Protection Directive (WP 74) seehttp://europa.eu.int/comm/ justice_home/fsj/privacy/docs/wpdocs/2003/wp74_en.pdf
49. http://www.iccwbo.org/home/ebitt/FINAL_ICC_BCRs_report.pdf
50. Trade B Loring (2002) 'An Analysis of the Informational Privacy Protection afforded by the European Union and United States' 37 Texas International Law Journal 421
51. Tracie B Loring (2002) 'An Analysis of the Informational Privacy Protection afforded by the European Union and United States' 37 Texas International Law Journal 421
52. Whalen v. Roe, 429 U.S. Reports (February 22, 1977), 589-604
53. Whalen v. Roe, 599-600 as citied in Jean Slemmons Stratford and Juri Stratford (1998) Data Protection and Privacy in the United States and Europe, IASSIST Quarterly
54. John Nicholson, Data Privacy in the US, Legal Issues in Offshore Outsourcing 4, in CLE Program - Legal Risks of Outsourcing Abroad (2004 A.B.A. Sec. Int'l L. & Prac. Annual Meeting)
55. Joel R. Reidenberg, Privacy in the Information Economy: A Fortress or Frontier for Individual Rights? 44 Fed. Comm. L.J. 195, 209 (1992)
56. Joel R. Reidenberg, Privacy in the Information Economy: A Fortress or Frontier for Individual Rights? 44 Fed. Comm. L.J. 195, 214 (1992)
57. section 5(a) of the Federal Trade Commission Act
58. The FTC in 2005: Standing Up for Consumers and Competition, April 2005
59. John Nicholson, Data Privacy in the US, Legal Issues in Offshore Outsourcing 4, in CLE Program - Legal Risks of Outsourcing Abroad (2004 A.B.A. Sec. International Law and Practice. Annual Meeting
60. Justin Kent at 557
61. U.S. Dep't of Health & Human Services, Summary of the HIPAA Privacy Rule 14, at http://www.hhs.gov/ocr/privacysummary.rtf
62. John Nicholson, Data Privacy in the US, Legal Issues in Offshore Outsourcing 4, in CLE Program - Legal Risks of Outsourcing Abroad (2004 A.B.A. Sec. Intentional Law and Practice Annual Meeting at 5
63. Kent 557
64. Randall E. Colson, HIPAA and Outsourcing: The Impact of Business Associate Rules under the Final Privacy and Security Standards 12 (Negotiating Tech. Outsourcing Agreements - Law Seminars Int'l, Sept. 30, 2003), at http://www.haynesboone.com/FILES/tbl_s12PublicationsHotTopics/PublicationPDF60/ 1103/09_30_2003_Colson.pdf.
65. Kenneth N. Rashbaum (2004) Offshore Outsourcing of Health Data Services, The Health Lawyer
66. John A. Funk and J. Patrick Toher (2004) Big Brother Is Watching, A Survey of the Regulatory Landscape Impacting Outsourcing Transactions, LJN's Corporate Compliance & Regulatory, Volume 2, Number 3
67. Neal R. Pandozzi, Beware of Banks Bearing Gifts: Gramm-Leach-Bliley and the Constitutionality of Federal Financial Privacy Legislation, 55 University of Miami Law. Review 163, 194-97 (2001)
68. Justin Kent Holcombe, Solutions For Regulating Offshore Outsourcing In The Service Sector: Using The Law, Market, International Mechanisms, And Collective Organization As Building Blocks, University of Pennsylvania Journal of Labour and Employment Law, Spring 2005 at 555
69. California Bill No. SB 1492 "An Act to add Chapter 6.5 to Part 2.6 of Division 1 of the Civil Code, relating to confidential information" Passed by Senate August 27, 2004, Vetoed by Governor September 29, 2004
70. California Bill No. SB 1492 "An Act to add Chapter 6.5 to Part 2.6 of Division 1 of the Civil Code, relating to confidential information" Passed by Senate August 27, 2004, Vetoed by Governor September 29, 2004
71. 6 SAFE-ID Act, S. 2312, 108th Cong. § 3 (2004)
72. S.2312
73. Peter Carey (2004) Data Protection: A Practical Guide to UK and EU Laws, Oxford University Press, at p 99
74. Privacy Regulation Spring 2003 at http://www.ftc.gov/speeches/thompson/ thompsonsafeharbor.pdf
75. Privacy Regulation Spring 2003 at http://www.ftc.gov/speeches/thompson/ thompsonsafeharbor.pdf Ibid.
76. Microsoft Corp., C-4069 (Final Order Aug. 8, 2002)
77. Eli Lilly and Co.,C. 4047, (Final Order May 8, 2002) http://www.ftc.gov/ speeches/swindle/perspectivesonprivacy.htm
78. Privacy Regulation Spring 2003 at http://www.ftc.gov/speeches/thompson/ thompsonsafeharbor.pdf
79. Ibid.
80. Jae-Nam Lee, Minh Q. Huynh, Ron Chi-Wai Kwook and Shih-Ming Pi (2003),"IT Outsourcing Evolution, Past, Present and Future," Communications of the ACM,Vol.46, No.5, May 2003 Also see Information Technology Law 3rd Edn. by Ian Lloyd at pg 196-199
81. Bierce & Kenerson, P.C, (2004),"Insights on Effective Outsourcing,"http://www.outsourcing-law.com/economics.htm, site visited on November 5 2004
82. Managing Director of Aulich & Co, the Hon Terry Aulich
83. Fred H. Cate, The Privacy Problem: A Broader View of Information Privacy and the Costs and Consequences of Protecting It, First Rep., Mar. 2003, at 1, 5, available at http://www.firstamendmentcenter.org/FirstReport.privacyproblem.PDF
84. Implementation of Whole-of-Government Information Technology Infrastructure Consolidation and Outsourcing Initiative, The Auditor-General Audit Report No. 9, 6 September 2000, p 231.
85. Outsourcing and privacy - Advice for Commonwealth agencies considering contracting out (outsourcing) information technology and other functions, August 1994, http://www.privacy.gov.au/news/p6_4_19.doc (28 September 2000), clause 3.4
86. Jacqueline Klosek, Data Privacy and Security Are A Significant Part of The Outsourcing Equation, Intellectual Property & Technology Law Journal June, 2005