Data Loss, yet again

This week's data loss (I confess that loss is now so routine that I'm losing track, despite an article in this month's Privacy Law Bulletin regarding the Sony imbroglio) involves the Australian Institute of Company Directors (AICD).

Reports in the SMH suggest that loss of a desktop computer followed a scheduled power outage that "temporarily disabled the office's security systems, including swipe card access to its entrance".

What walked out the door? The AICD apparently doesn't know or is being caregful about what information's released to the media (as distinct from the computer thieves). The SMH indicates that "the personal details of tens of thousands of Australia's most important business figures may have been compromised after the brazen theft of a computer from the offices of thein Sydney."

AICD chief executive John Colvin reportedly said the device may have contained "names, residential addresses, phone numbers, dates of birth and email addresses of its 27,000 members, which include the directors of some of the country's largest listed companies, government bodies and charities".

Those lucky people presumably should not lose sleep, with a spokesperson indicating that the theft appeared opportunistic and did not appear to be a co-ordinated attempt at identity theft -

All the evidence suggests it was an opportunistic theft; we have nothing to suggest it was targeted

All ok, then.

The AICD's media release states that -

“The data on the computer was protected. We understand that the risk of its being accessed and used for fraudulent purposes is low and that its utility is minimal, as much of the information is publicly available,” Company Directors’ CEO, Mr John Colvin, said.

“We felt it was important, however, to let our members and clients know what had happened.”

“We have alerted our members and clients that the computer contained test data which may possibly include names, addresses, phone numbers, date of birth and, in some cases, the names of personal assistants and their email addresses where they have been provided.”

“The stolen computer did not contain data about credit card numbers, banking details, personal email addresses of members and clients or passwords.”

“While we are of the view that the risk is low, we take this matter and the privacy of our members very seriously,” Mr Colvin said.

“With the police and forensic experts, we are investigating the theft and reviewing our security. We have also consulted the Privacy Commissioner and are following his best practice guidelines in dealing with this.”

“This loss of data was the result of criminal activity involving the theft of computer hardware. We have assured our members and clients that we have strong data security precautions in place and that our data storage and other systems, including our website, are not compromised in any way.”

Identity, Privacy and Aviation Security

The national Parliamentary Joint Committee on Law Enforcement Committee has released the report of its Inquiry into the adequacy of aviation and maritime security measures to combat serious and organised crime.

The report questions the efficiency of the aviation and maritime secvurity card scheme and suggests that there is -

evidence of infiltration of airports and marine ports by organised crime for criminal activity such as drug and firearm imports, tariff avoidance, people trafficking and people smuggling, money laundering, and air cargo theft.

The document will presumably attract most attention over the Committee's call for aircraft passengers to show photo ID immediately prior to boarding, supposedly in "a bid to stop organised crime bosses travelling freely under false identities". Let's not ask whether crime czars will be able to charter private aircraft or - horreur - avail themselves of fake identity documents.

The report offers 22 recommendations. They are that -

R1 the scope of the Aviation Transport Security Act 2004 (Cth) and the Maritime Transport & Offshore Facilities Security Act 2003 (Cth) be widened to include serious and organised crime in addition to terrorist activity and unlawful interference.

R2 security at major airports be undertaken by a suitably trained government security force.

R3 joint maritime taskforces, mirroring the functions of the Joint Aviation Investigation Teams and Joint Aviation Intelligence Groups in the maritime sector be established in every state and the Northern Territory. These taskforces should include officers of the Australian Federal Police, state or territory police, the Australian Customs & Border Protection Service and the Australian Crime Commission.

R4 the formation of a Commonwealth maritime crime taskforce that would act as a national Australian Federal Police led 'flying squad', responding to specific intelligence and also conducting randomised audits of maritime and seaport security.

R5 the Attorney-General's Department conduct a review of current information sharing arrangements between law enforcement agencies and private organisations in the aviation and maritime sectors.

R6 the Crimes (Aviation) Act 1991 (Cth) be amended so as to create a new offence of deliberately travelling under a false identity.

R7 it be made a legal requirement to provide photo identification confirming passenger identity immediately prior to boarding an aircraft.

R8 the Commonwealth Government review the technical and administrative requirements necessary to facilitate the effective sharing of information between airlines and air cargo agents and law enforcement agencies and the Australian Crime Commission Fusion Centre for the purpose of enhancing aviation security and law enforcement activities. The review should include research into technical requirements for such a scheme, the costs involved and any relevant statutory or other barrier to the sharing of such information. The findings of the review should be reported to the Australian Parliament.

R9 the Australian Government provide further resources to support an increased presence for currency and illicit drug detection canine units at Australian airports.

R10 access to port security areas prescribed under the Maritime Transport & Offshore Facilities Security Act 2003 (Cth) should require verification that the Maritime Security Identification Card (MSIC) belongs to the individual seeking access, either through human gate operators, verification by Closed Circuit Television or any other appropriate solution.

R11 the development of a system that enables the confidential movement and examination of containers that increases the likelihood that trusted insiders involved in serious or organised crime are not alerted to law enforcement agency interest in a container.

R12 the Commonwealth government further invest in CCTV at airports and ports, with consideration of a number of ongoing improvements, including:

• that CCTV cameras should be capable of producing footage of evidential quality;
• the continuing lead role of Customs in coordinating the monitoring of CCTV networks; and
• that CCTV networks should be complemented with automated number plate recognition (ANPR), and/or facial recognition technology.

R13 Customs be given the power to revoke a depot, warehouse or broker's license if it determines, on the strength of compelling criminal intelligence, that an individual or individuals are involved or strongly associated with significant criminal activity.

R14 the Attorney-General's Department, in consultation with the Australian Crime Commission, reviews the list of relevant security offences under the Aviation Security Identification Card (ASIC) and MSIC schemes to assess whether any further offences are required in order to effectively extend those schemes to protect the aviation and maritime sectors against the threat of infiltration by serious and organised criminal networks.

R15 the Attorney-General's Department arrange for a suitable law enforcement agency to be given the power to revoke an ASIC or MSIC if it is determined that a cardholder is not a fit and proper person to hold a card on the basis of compelling criminal intelligence.

R16 the MSIC eligibility criteria be harmonised with that of the ASIC scheme so as to make two or more convictions of an individual for maritime security relevant offences grounds for disqualification if one of those convictions occurred in the 12 months prior to an application, regardless of whether either conviction led to a term of imprisonment.

R17 expansion of the coverage of the ASIC and MSIC schemes to capture a greater part of the overall supply chain, including some or all of the following:

• staff at cargo unpacking and stuff-unstuff facilities;
• transport workers involved in the transmission of cargo between ports, airports and other parts of the logistical chain;
• customs brokers that do not access port facilities; and
• human resource staff and management at companies with employees that currently must hold ASICs or MSICs.

R18 Auscheck and CrimTrac work together to develop a database system that enables continual assessment of a cardholder's criminal record in order to ensure that cardholders are disqualified very soon after being convicted of a relevant security offence.

R19 use of biometric information, particularly fingerprints, to establish a unique identifier for applicants for the purpose of maintaining an accurate database of cardholders.

R20 the Australian Government consider the use of biometric information for the purpose of controlling access to security controlled areas in the aviation and maritime sectors.

R21 AusCheck establish memoranda of understanding with the Australian Federal Police and other key law enforcement and intelligence agencies in order to allow the timely provision of information held in the AusCheck database to those agencies.

R22 current ASIC and MSIC issuing bodies are replaced by a single, government-run, centralised issuing body.

Those recommendations have substantial privacy implications. They are marked by a an endearing but problematical faith in CCTV, biometrics, photo identity and bureaucratic responsibility shuffling.

Release of the report comes a day after news that Domingo Antonio Urrozsotomayor has faced a Sydney court after being charged with 62 offences relating to forging Commonwealth documents and money laundering. Urrozsotomayor is accused of using a personal computer and printer to forge up to 100 fake ASICs and with representing himself as a legitimate card issuer to cleaning contractors at Sydney, Canberra and Brisbane airports, who paid his 'fees' in cash. During a search at his Prestons (NSW) home after arrest in March the AFP found more than 100 ASIC application forms and 34 forged cards. He later provided "dozens more forged cards" to police.

The Office of Transport Security, responsible for ASICS and MSICs, has been criticised for poor background checks and poor record keeping, with the ANAO finding last month (noted here) identifying concerns about 'security holes' at Australia's air and sea ports due to failings in the card system. A mere 10,000 of the cards were not recorded on the system's central database and there's considerably more rigour at the passenger gate than at the goods gate.

TTransport Workers Union reporesentative Tony Sheldon is reported as commenting that -

We don't know who is doing the work. Just months ago in Canberra, a contracted cleaning company was found to be working for Qantas where only one of the seven guys working had an ASIC - and one of them was working illegally on a student visa

Aspirational Paper Tiger

'Almost Free: An Analysis of ICANN's 'Affirmation of Commitments'' [PDF] by Michael Froomkin in 9(1) Journal on Telecommunications & High Technology Law (2011) 188-233 comments that -

As a legal document, the Affirmation itself is a paper tiger. It may not be a contract; even if it is a contract, there is no practicable way for either of the parties to enforce it (and almost no promises by the U.S. Government). Although both parties have a right to cancel the Affirmation upon notice, it is difficult to imagine circumstances in which either party would have anything to gain by such an act—and is also not that easy to imagine circumstances in which the cancellation would actually make a legal difference to either party. Indeed, the most important legal aspect of the Affirmation is that it is not the JPA which it replaced, for the JPA had some teeth.

In contrast, the Affirmation likely will be much more meaningful as a political document. By announcing in the Affirmation that it would allow the JPA to lapse, the U.S. signaled that it was giving up the most visible of its claims to direct control of ICANN. In so doing, it gave up powers that it could reasonably have calculated it would be unlikely to use: there must be some non-zero risk that ICANN could be captured by an ideological faction but, unlike the risk of economic capture, ideological capture does not seem a major worry at present. By further enhancing the power of the GAC, the U.S. DOC sought, with it appears some success, to meet the most vociferous critics of the unique U.S. role in the governance of the DNS (or, if you prefer, background supervision of the governor of the DNS) more than half way, yet without completely giving up its fail-safe powers, those deriving from the IANA contract and from ICANN’s domicile in California.

If the U.S. won some breathing room from its critics, and the international community achieved a large step towards its agenda of internationalizing the control of the governance of the DNS, the biggest winner from the Affirmation undoubtedly remains ICANN itself. ICANN is now free of U.S. Government control (except perhaps at the extreme margin) and yet still substantially free of real control by other governments. World governments must channel their influence via the GAC. The GAC has real influence over ICANN, but it does not have control. This fact, and the fact that the residual U.S. influence is not totally eradicated, has caused some non-U.S. leaders to call for yet more divestment by the U.S., but so far these calls have been rare.

Newly unchained, or at least on a very long leash, ICANN enjoys unprecedented freedom to shape its own fate and to decide what sort of body it wants to be. In losing the specter of undue U.S. influence, ICANN has also lost its major excuse for failing to live up to its professed ideals of transparency and accountability to the wider Internet community. What will happen next depends in large part on the extent to which ICANN’s struggle for autonomy has shaped its DNA, and to what extent ICANN is ready to transcend its past. Developments to watch include the unfolding of the ICANN–GAC relationship, whether ICANN’s budget continues its rapid growth or stabilizes, and whether ICANN’s new freedom allows it to move forward on new gTLDs.

The DOC’s next big decision will come no later than September 30, 2011, when the DOC must decide the fate of the IANA contract.150 Until then at least, ICANN is unlikely to make any new moves to leverage its power over the legacy root in order to control the behavior, much less the speech, of end-users in any realm other than the trademark arena already occupied by the UDRP. The fear that it might attempt to expand its reach, either on its own or if captured by some outside group, remains the major argument for the U.S. to retain its hold on the IANA function. On the other hand, if the U.S. accepts that, as argued above, the DNS lacks geo-strategic value, the U.S. may be more willing to let go.

In time, geo-strategy may not be the only arena in which the DNS’s centrality diminishes. If it is true that “[e]ighty percent of all online sessions begin with search,” then the DNS’s importance to the World Wide Web is well into its decline. Of course, the Web is not the Internet; many other services from e-mail to video transport rely on the DNS also. But the example of search, combined with the growth of “walled garden” discursive communities such as MySpace and Facebook, plus virtual worlds such as Second Life and World of Warcraft, all suggest that the long-predicted moment when the human-readable names for Internet addresses that the DNS enables begins to lose its importance really is just around the corner.

Meanwhile, however, until something contactless like phone-to-phone Bluetooth takes off, we will still need a human-friendly address to give to new potential correspondents in one-to-one relationships. Internet broadcasters, or their fine-tuned heavily personalized successors, will need some way to advertise their presence and make it easy for users to find them. At present, a nice memorable Web address works well on a business card, the side of a bus, or in a short radio or TV commercial. Thus, ICANN remains important because even if control of the DNS has limited political relevance, that control still has substantial economic importance—so long as the DNS’s hegemony of convenience continues.

Privacy Tort

'The Limits of Tort Privacy' by Neil Richards in (2011) Journal of Telecommunications and High Technology Law genuflects to the US First Amendment in arguing that -

The conception of tort privacy developed by Warren, Brandeis and Prosser sits at the heart of American understandings of privacy law. Rooted in protection of private information against unwanted collection, use, and disclosure, tort privacy protects against emotional injury, and was directed by design against disclosures of true, embarrassing facts by the media. In this essay, I argue that as conceived by Warren and Brandeis and interpreted by Prosser, tort privacy is a poor vehicle for grappling with problems of privacy and reputation in the digital age. Tort privacy, especially the disclosure tort, has from its inception been in conflict with First Amendment values. And when First Amendment values and tort privacy conflict, First Amendment values should prevail virtually all of the time. The disclosure tort will retain limited utility in the electronic environment, but privacy in the age of information and social media requires new strategies and new legal tools. Some of these strategies might include tort privacy as presently understood, but others require new approaches. These approaches can take either a broader look at tort privacy, including new torts and new theories of injury beyond emotional harm, or they can include new conceptions of privacy altogether, such as confidentiality law.

He concludes that

The intrusion tort shares more with the disclosure tort than a common origin in the Warren, Brandeis, and Prosser traditions. It shares both the element of private information and the element of high offensiveness to a reasonable person, making it another illustration of Post‘s argument that the privacy torts are best understood as remedies for gross breaches of social etiquette. But disclosure and intrusion are different breaches of good manners – whereas disclosure protects against emotionally harmful gossip, intrusion often protects against emotionally harmful collection of the gossip, by a secret recorder, secret listener, or other intruder. Because the elements of the tort do not create civil liability for speech, thereby directly affecting the scope of public debate, the intrusion tort does not implicate heightened First Amendment concerns.

Moreover, if we are interested in protecting against what we colloquially call ―invasions of privacy ― the intrusion model is a better fit with our intuitive linguistic understandings of that metaphor. Secret cameras would seem to intrude on our privacy more directly than publications about us that hurt our feelings. Thus, as we structure legal protections to protect private information from disclosure, the law should focus on preventing unwanted collections or accumulations of information, rather than preventing the dissemination of already-collected information.

Going beyond intrusion, there are other ways to remedy privacy harms that create fewer constitutional problems than the disclosure tort. We have become accustomed to thinking about privacy in terms of Prosser‘s four torts, but there are other torts sharing elements with some or all of the privacy torts that can also be used to regulate information. For example, there is a close analogy between intrusion and trespass, with the primary difference being that intrusion protects emotional harm from invasions into private areas or relationships, while trespass protects property rights from similar invasions. But trespass is in reality a kind of privacy tort as well – protecting the privacy of the home from invasion, and another tort that creates fewer First Amendment problems than disclosure.

Breach of confidence is another privacy tort that has been underappreciated as a tool to regulate disclosures of embarrassing or harmful information. Recall that in the press privacy cases, a less restrictive means than punishing disclosure was to prevent the press from collecting the information in the first place, rather than allowing the state to directly censor the speech under a disclosure theory. The press (or others) can obtain information by trespassing or intruding into private areas, or it can obtain it through a leak. Both the breach of confidence tort or confidentiality rules more generally allow the regulation of disclosure in a way that is less troubling from a First Amendment perspective than the disclosure tort, because confidentiality remedies not the emotional injury of published words, but instead the breach of an assumed duty. Confidentiality has limits, too; most notably, it typically applies only to duties that are voluntarily assumed. But unlike the limits of disclosure, the limits of confidentiality enhance its consisistency with our First Amendment commitments to robust public debate.

The issues of press and privacy raised by the rise of social networks, incidents like the Clementi suicide and WikiLeaks are likely to become some of the most important and difficult facing our society in the Information Age. Of course, law will not provide all the answers, but it must provide some answers, if only to regulate the competing demands of publicity and non-disclosure that these cases raise. Law will be necessary to determine whether a case is more like Ravi's tweeting in the Clementi suicide, or more like the tweets of the democracy protesters in Cairo's Taksim Square. At the same time, it is important to realize that the harms from privacy are real. Just because the disclosure tort is largely unconstitutional, it does not mean that many of the psychological injuries it seeks to remedy are not substantial. A broader and more imaginative conception of tort privacy can hopefully help us to protect against some of those harms, either through tort law or other forms of law modeled on tort, and also to avoid the conflict with First Amendment values that the disclosure model produces.

Statutory Interpretation

The Commonwealth Attorney-General Robert McClelland has announced passage through Parliament of the Acts Interpretation Amendment Bill 2011 (Cth), promoted as making it "easier for people to understand and interpret Commonwealth legislation" and as "the first comprehensive update ... in more than a hundred years".

The legislation will amend the Acts Interpretation Act 1901 (Cth) by "improving language and structure". It reflects recommendations in the 1993 Clearer Commonwealth Law report by the House of Representatives Standing Committee on Legal & Constitutional Affairs and the consequent, 1998 Attorney-General’s Department and the Office of Parliamentary Counsel joint discussion paper Review of the Commonwealth Acts Interpretation Act 1901.

Specifically, it restructures the Act by -

• co-locating and listing alphabetically definitions
• ensuring powers in relation to instruments apply to all types of instruments
• enabling section 19B and 19BA Orders to apply retrospectively
• providing that an action by a minister other than a minister authorised to perform that action is not invalid merely on that basis
• clarifying actions done by a person purporting to act under an appointment;
• providing that everything in an Act should be considered part of the Act and
• modernising concepts (eg by adjusting the definition of ‘document’ to include things like maps, plans, drawings and photographs and by allowing meeting participants to be in different locations and to participate using technology such as video-conferencing).

It also amends theLegislative Instruments Act 2003 (Cth) in relation to the construction of legislative instruments and is reflected in consequential amendments to 248 Commonwealth statutes.

Among new definitions -

Australian citizen is specified to have the same meaning as in the Australian Citizenship Act 2007, which can currently be found in section 4 of that Act (the new definition is intended to pick up both s 4(1) and (2) of the current definition in the Australian Citizenship Act 2007 ). The term Australian citizen is used in numerous Commonwealth Acts without being defined. For example, the Bankruptcy Act 1966 and Telecommunications (Interception and Access) Act 1979 . This amendment ensures that the term is given a consistent and contemporary meaning across Commonwealth law.

Business day is defined as ‘a day that is not a Saturday, a Sunday or a public holiday in the place concerned’. There are over 200 references to ‘business day’ in Commonwealth legislation, many with differing definitions. The Acts Interpretation Act is a logical repository for this definition and will ensure that it can be applied consistently across the statute book.

Ongoing removal of imperial archaisms is reflected in the Explanatory Memorandum comment that -

Section 17 of the Acts Interpretation Act currently provides a definition of Minister or Minister of State as meaning ‘one of the King’s Ministers of State for the Commonwealth’. The reference to the Sovereign in this definition is unnecessary. It is clear that ‘Ministers of State for the Commonwealth’ are Ministers appointed by the Governor-General to administer departments of State of the Commonwealth under section 64 of the Constitution. While that section states that such officers ‘shall be the Kings/Queens Ministers of State for the Commonwealth’ they are referred to elsewhere in the Constitution as simply ‘Ministers of State’ (see for example sections 65 and 66)

The Attorney-General commented that the Bill is

a major step towards reducing the complexity of Commonwealth legislation. The measures contained in this Bill will assist in making the law more accessible and easier to understand.

The Bill updates the language and concepts in the Acts Interpretation Act to bring it into the 21st century so that it continues to be a clear and useful point of reference for interpreting the law.

The measures passed today will ensure that the important rules and definitions contained within the Act are easier to find and understand.

This will have a significant impact on the overall clarity of Commonwealth laws and, in turn, make the law more accessible for all Australians.

It also reduces the size of the Commonwealth statute book by including a number of new general rules and definitions, which avoids the need to repeat these in other Commonwealth Acts

The Republic of Stupid

After a day reading Radin and Rorty and checking citations I am unimpressed, to say the least, by Alexandra Petri's fatuous 'Like it or not, we're in the grip of a digital Stockholm syndrome' in today's SMH.

Petri frets that -

I am a citizen of the world's third most populous country - closing in on 700 million, to be exact. We have our own language (English/Pirate English), our own currency (Likes), and our own flag.

Every few years we threaten to leave. "I don't like the way things are going", we say. "Stop rearranging everything without telling or asking me."

But they stop us at the border, every time, holding all our loved ones hostage. "You want this memory, don't you?" they ask. "And this picture! And how will you 'Like' things when you leave?"

We shudder. And we stay. The country's name is Facebook. Its nationals? Friends. Citizenship in this country allows us to be at home anywhere in the world.

Get back to me, Alexandra, when the Republic of Stupid provides income support, raises taxes, has armed guards and attack dogs, and kills people who are trying to slip across the border. Facebook isn't Burma and it's lazy, tired journalism to use the online 'community' of the day is another country.

Petri explains that -

It's the one country where people actively try to keep their parents from immigrating after them. "Nonsense, mother", we insist. "You have everything you need where you are."

Once you are in, you are everyone's Friend. Since immigrating in high school, I've had no desire to leave. Why would I? Everything I need is here. My Friends. People I hardly know - also Friends.

This is not the way the country has always looked. The topography changes, swiftly, when you least expect it. Midway through the night, your rights are rearranged. Suddenly everyone and his internet-equipped dog can see everything you post - unless you dash off to change your settings. Facebook privacy? It's the new oxymoron, like jumbo shrimp.

Are the readers of the SMH a republic? The NYRB is a perpetual Scandinavia of the mind?

The Republic of Stupid? It's the old meme ... just like vaudeville it's dead and smells that way.

Little Angels and Angry Mummies

As a fan of Richard Hughes' 1929 A High Wind In Jamaica and Robert Musil's 1906 Die Verwirrungen des Zöglings Törleß (with a rather bleak view of childhood innocence and by extension the construction of 'childhood') and current Australian debate about content regulation - in particular the current ALRC review - I'm fascinated by Letting Children be Children - Report of an Independent Review of the Commercialisation and Sexualisation of Childhood (aka Bailey Report) under the auspices of the UK Department of Education.

The report deals with several 'themes' in a nice example of angsty mummies, wishlists and avoidance of parental responsibility. (Heaven forbid that some people actually turn off the television occasionally or influence marketers by voting with their credit card.)

Under The 'Wallpaper' of Children's Lives it comments that -

We are all living in an increasingly sexual and sexualised culture, although it is far from clear how we arrived at this point.

Many parents feel that this culture is often inappropriate for their children and they want more power to say 'no'.

Some parts of the business world and sections of the media seem to have lost their connection to parents and this is compounded in some new media where there is limited regulation.

Where regulation does exist, regulators need to connect better with parents and encourage businesses to comply with the 'spirit of the regulation'. Where regulation does not exist, businesses need to behave more responsibly.

Under the label What we would like to see the report wishes that "sexualised images used in public places and on television, the internet, music videos, magazines, newspapers and other places are more in line with what parents find acceptable, and that public space becomes more family-friendly.

Consequent recommendations are -

1. Ensuring that magazines and newspapers with sexualised images on their covers are not in easy sight of children. Retail associations in the news industry should do more to encourage observance of the voluntary code of practice on the display of magazines and newspapers with sexualised images on their covers. Publishers and distributors should provide such magazines in modesty sleeves, or make modesty boards available, to all outlets they supply and strongly encourage the appropriate display of their publications. Retailers should be open and transparent to show that they welcome and will act on customer feedback regarding magazine displays.

2. Reducing the amount of on-street advertising containing sexualised imagery in locations where children are likely to see it. The advertising industry should take into account the social responsibility clause of the Committee of Advertising Practice (CAP) code when considering placement of advertisements with sexualised imagery near schools, in the same way as they already do for alcohol advertisements. The Advertising Standards Authority (ASA) should place stronger emphasis on the location of an advertisement, and the number of children likely to be exposed to it, when considering whether an on-street advertisement is compliant with the CAP code. The testing of standards that the ASA undertakes with parents (see R7) should also cover parental views on location of advertising in public spaces.

3. Ensuring the content of pre-watershed television programming better meets parents’ expectations. There are concerns among parents about the content of certain programmes shown before the watershed. The watershed was introduced to protect children, and pre-watershed programming should therefore be developed and regulated with a greater weight towards the attitudes and views of parents, rather than ‘viewers’ as a whole. In addition, broadcasters should involve parents on an ongoing basis in testing the standards by which family viewing on television is assessed and the Office of Communications (Ofcom) should extend its existing research into the views of parents on the watershed. Broadcasters and Ofcom should report annually on how they have specifically engaged parents over the previous year, what they have learnt and what they are doing differently as a result.

4. Introducing Age Rating for Music Videos. Government should consult as a matter of priority on whether music videos should continue to be treated differently from other genres, and whether the exemption from the Video Recordings Act 1984 and 2010, which allows them to be sold without a rating or certificate, should be removed. As well as ensuring hard copy sales are only made on an age-appropriate basis, removal of the exemption would assist broadcasters and internet companies in ensuring that the content is made available responsibly.

5. Making it easier for parents to block adult and age-restricted material from the internet: To provide a consistent level of protection across all media, as a matter of urgency, the internet industry should ensure that customers must make an active choice over what sort of content they want to allow their children to access. To facilitate this, the internet industry must act decisively to develop and introduce effective parental controls, with Government regulation if voluntary action is not forthcoming within a reasonable timescale. In addition, those providing content which is age-restricted, whether by law or company policy, should seek robust means of age verification as well as making it easy for parents to block underage access.

The second theme is Clothing, Products and Services for Children, with the authors commenting -

Sexualised and gender-stereotyped clothing, products and services for children are the biggest areas of concern for parents and many non-commercial organisations contributing to the Review, with interest fanned by a sometimes prurient press. The issues are rarely clear-cut, with a fine balance on a number of points – taste, preference, choice, affordability, fashion and gender preferences.

Retailers are aware of the issues and sensitivities and are responding. They need to be explicitly and systematically family friendly, from design and buying through to display and marketing.

After indicating "What we would like to see" is that retailers do not sell or market inappropriate clothing, products or services for children, the report offers one recommendation -

6. Developing a retail code of good practice on retailing to children. Retailers, alongside their trade associations, should develop and comply with a voluntary code of good practice for all aspects of retailing to children. The British Retail Consortium (BRC) should continue its work in this area as a matter of urgency and encourage non-BRC members to sign up to its code.

Theme 3 concerns Children as Consumers -

We all live in a commercial world and children are under pressure from a range of sources to act as consumers.

We do not want to cut children off from the commercial world completely as we believe that it brings benefits and parents tell us that they want to manage the issue themselves, supported by proportionate regulation and responsible businesses.

While adults may understand that companies might look to ‘push the boundaries’ when
advertising to them, children are especially vulnerable and need to be given special
consideration.

Special measures already exist in advertising and marketing regulations to protect children but some gaps exist.

Regulators cannot realistically be expected to anticipate detailed developments in the new media. However, an absence of regulation does not absolve businesses from acting responsibly by themselves.

The report's parents would accordingly "like to see" that -

the regulations protecting children from excessive commercial pressures are comprehensive and effective across all media and in line with parental expectations. That marketers do not exploit any gaps in advertising regulation in order to unduly influence the choices children make as consumers. That parents and children have a sound awareness and understanding of marketing techniques and regulation.

The associated recommendations are -

7. Ensuring that the regulation of advertising reflects more closely parents’ and children’s views. The Advertising Standards Authority (ASA) should conduct research with parents and children on a regular basis in order to gauge their views on the ASA’s approach to regulation and on the ASA’s decisions, publishing the results and subsequent action taken in their annual report.

8. Prohibiting employment of children as brand ambassadors and in peer-to-peer marketing. The Committee of Advertising Practice and other advertising and marketing bodies should urgently explore whether, as many parents believe, the advertising selfregulatory codes should prohibit the employment of children under the age of 16 as brand ambassadors or in peer-to-peer marketing – where people are paid, or paid in kind, to promote products, brands or services.

9. Defining a child as under the age of 16 in all types of advertising regulation. The ASA should conduct research with parents, children and young people to determine whether the ASA should always define a child as a person under the age of 16, in line with the Committee of Advertising Practice and Broadcast Committee of Advertising Practice codes.

10. Raising parental awareness of marketing and advertising techniques. Industry and regulators should work together to improve parental awareness of marketing and advertising techniques and of advertising regulation and complaints processes and to promote industry best practice.

11. Quality assurance for media and commercial literacy resources and education for children. These resources should always include education to help children develop their emotional resilience to the commercial and sexual pressures that today’s world places on them. Providers should commission independent evaluation of their provision, not solely measuring take-up but, crucially, to assess its effectiveness. Those bodies with responsibilities for promoting media literacy, including Ofcom and the BBC, should encourage the development of minimum standards guidance for the content of media and commercial literacy education and resources to children.

Under Theme 4 – Making Parents’ Voices Heard - the report notes that -

Parents have told us that they feel they cannot make their voices heard, and that they often lack the confidence to speak out on sexualisation and commercialisation issues for fear of being labelled a prude or out of touch.

Business and industry sectors and their regulators need to make clear that they welcome, and take seriously, feedback on these subjects.

Given the technology available, regulators and businesses should be able to find more effective ways to encourage parents to tell them what they think, quickly and easily, and to be transparent in telling parents how they are responding to that feedback.

Once parents know that their views are being taken seriously, we would expect them to respond positively towards companies that listen to their concerns.

What we would like to see is "that parents find it easier to voice their concerns, are listened to more readily when they do, and have their concerns visibly acted on by businesses and regulators".

The recommendations are -

12. Ensuring greater transparency in the regulatory framework by creating a single website for regulators. There is a variety of co-, self- and statutory regulators across the media, communications and retail industries. Regulators should work together to create a single website to act as an interface between themselves and parents. This will set out simply and clearly what parents can do if they feel a programme, advertisement, product or service is inappropriate for their children; explain the legislation in simple terms; and provide links to quick and easy complaints forms on regulators’ own individual websites. This single website could also provide a way for parents to provide informal feedback and comments, with an option to do so anonymously, which regulators can use as an extra gauge of parental views. Results of regulators’ decisions, and their reactions to any informal feedback, should be published regularly on the single site.

13. Making it easier for parents to express their views to businesses about goods and services. All businesses that market goods or services to children should have a one-click link to their complaints service from their home page, clearly labelled ‘complaints’. Information provided as part of the complaints and feedback process should state explicitly that the business welcomes comments and complaints from parents about issues affecting children. Businesses should also provide timely feedback to customers in reaction to customer comment. For retail businesses this should form part of their code of good practice (see Theme 2, Recommendation 6), and should also cover how to make it