(2060,1,'2021-06-21 21:16:27','2021-06-21 21:16:27','<!-- wp:image {\"id\":2056,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a-1024x518.jpeg\" alt=\"\" class=\"wp-image-2056\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" rel=\"noreferrer noopener\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a>. Or at least, not yet..</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, The Commission published the <a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\" rel=\"noreferrer noopener\">new Standard Contractual Clauses</a> long awaited. And today, the EDPB has published its<a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\" rel=\"noreferrer noopener\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with<br>the EU level of protection of personal data - Version 2.0 - Adopted on 18 June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\" rel=\"noreferrer noopener\">Since Eduard Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data. The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by Art 82 GDPR. However, we still to see non material damage granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US Safe Harbour agreement then the Privacy Shield being invalidated by the European Court of Justice decisions (commonly known as Schrems-I and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the Charter of the Fundamental Rights of the European Union. with this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an equivalent level of protection for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a>) a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available)..</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received and adequacy decision on the basis of <a href=\"https://www.gdprinfo.info/#a45\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" rel=\"noreferrer noopener\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japon and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give its green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EEA. This requires transfer impact assessment to assess the level of protection in a third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – supplementary measures need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be technical, organisational and/or contractual measures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs models pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a data mapping that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We see the cloud leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' BCR (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) can be more appropriate, usually within different establishments of a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> apply \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on</em>\' restrictive conditions</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU COMMISSION implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations for its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</em>\' This is the case when the importer is falls within the definition of <strong>Art 3(2)</strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a Data Processing Agreement Art 28 is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND judicial redress (EU courts competence) and/or arbitration will be provided. This is what was lacking with the Privacy Shield, an independent authority and the ombudsperson to deal with EU citizens complaints. The EDBP recommendation has not specified this case scenario. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered as transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden in the back of a drawer. The new SCCs requiere adaptation, they are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> for Data controller to Processor, Controller to controller, processor ro processor and Processor back to Controller. They need to be adapted, Third party have now the \'docking option\' to join the contract. They can be adapted as long as the nature of the clauses are not modified</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>, emphasised by the Commission document will not be an easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, data subjects should be provided with a copy of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>the data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start with data mapping, minimising, and securing access. Hold the data as a hot potato. Don’t keep it longer than necessary. Keep your archives out of the network. Limit access to data. Train your staff. Be ready for data breach</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly data heaven with the risk of opening backdoors to data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touch at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\" rel=\"noreferrer noopener\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US creates risks and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\" rel=\"noreferrer noopener\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was recently reported that <a href=\"https://datenschutz-hamburg.de/pages/fragebogenaktion/\" data-type=\"URL\" data-id=\"https://datenschutz-hamburg.de/pages/fragebogenaktion/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed coordinated questionnaires, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 21:16:27','2021-06-21 21:16:27','',2054,'https://www.datarainbow.eu/?p=2060',0,'revision','',0),(2090,1,'2022-10-07 09:14:26','2021-07-06 01:24:44','','Privacy, Education and Human Dignity','','publish','closed','closed','','privacy-education-and-human-dignity-2','','','2022-10-07 09:14:26','2022-10-07 09:14:26','',0,'https://www.datarainbow.eu/?p=2090',40,'nav_menu_item','',0),(2091,1,'2022-10-07 09:14:26','2021-07-06 01:26:54','','COVID-19 Contact Tracing Apps: Effective Virus Risk Management Tools or Privacy Nightmare?','','publish','closed','closed','','covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare','','','2022-10-07 09:14:26','2022-10-07 09:14:26','',0,'https://www.datarainbow.eu/?p=2091',7,'nav_menu_item','',0),(2098,1,'2021-07-08 13:48:18','2021-07-08 13:48:18','<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"https://issuu.com/raducrahmaliucgdprready/docs/catalog_gdpr_online\" target=\"_blank\">GDPR 3 Years on</a> - in Romanian \'Publicație despre prelucrarea datelor personale și securittea informației\'</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>In January 2021, I had the honour of being <a rel=\"noreferrer noopener\" href=\"https://www.debbiereynoldsconsulting.com/podcast/e15-tara-taubman-bassirian\" target=\"_blank\">interviewed by Debbie Reynolds</a>, chatting about the GDPR, its slow enforcement by Data Protection Authorities. The position of the French <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/french-dpa-cnil-fined-carrefour-for-cookies/\" target=\"_blank\">CNIL</a>, the UK ICO, the Irish DPC, One stop Shop for US mega corporations, such as Google and Facebook. The future of international data flow since the invalidation of Privacy Shield by the <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">ECJ Schrems-II</a>, the requirement of ensuring the same level of data protection when personal data is transferred outside the EU/EEA and the case of the <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/beyond-brexit-cyber-security-and-data-protection-the-modern-cassandra-complex/\" target=\"_blank\">UK adequacy after Brexit</a>. Securing data exchange, encryption and the all time good advice : data minimisation.</li><li><a href=\"https://thedatadivatalksprivacypodcast.buzzsprout.com/1734607/8171493-the-data-diva-e15-tara-taubman-bassirian-llm-and-debbie-reynolds\"><strong>Find your Podcast Player of Choice to listen to “The Data Diva” Talks Privacy Podcast Episode Here</strong></a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.voiceamerica.com/guest/42903/tara-taubman-bassirian\" target=\"_blank\">Interview with Rebecca Herold</a>, the Privacy &amp; Security professor on Voice of America. </li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/interviews/interview-with-tara-taubman-bassirian-information-and-internet-specialist-in-the-uk/\" target=\"_blank\">Interview published by VPN Reports</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/interview-with-datagrail/\" target=\"_blank\">Interview with </a><a href=\"https://datagrail.io/author/kyle-schryver\">Kyle Schryver</a> for <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/interview-with-datagrail/\" target=\"_blank\">Data Grail</a></li><li>Interview with <a href=\"https://cybertalks.co.uk/profile/karla-reffold/\">Karla Reffold</a> in a <a href=\"https://cybertalks.co.uk/interviews/ico-slow-to-fine-organisations/\">Cybertals interview</a> about GDPR and the rights of Data Subjects.</li><li>Interview with <a href=\"https://www.geeklawblog.com/author/greglambert\">Greg Lambert</a>, Librarian-Lawyer-Knowledge Management-Competitive Analysis-Computer Programmer…. and Marlene Gebauer - <strong><a rel=\"noreferrer noopener\" href=\"https://www.geeklawblog.com/2019/07/ep-45-vlexs-lluis-faus-and-masoud-gerami-on-foreign-legal-research-frances-judicial-analytics-overreaction-aall-recap.html#more-16603\" target=\"_blank\">The Geek In Review Podcast – Episode 45</a></strong></li><li><a href=\"https://blog.doctrine.fr/je-deplore-la-remuneration-des-avocats-au-taux-horaire-tara-taubman-consultante-dans-la-protection-des-donnees-privees/\">Interview with Doctrine.fr French</a> legal analytics.</li></ul>\n<!-- /wp:list -->','Interviews','','inherit','closed','closed','','739-revision-v1','','','2021-07-08 13:48:18','2021-07-08 13:48:18','',739,'https://www.datarainbow.eu/?p=2098',0,'revision','',0),(2093,1,'2021-07-06 12:01:25','2021-07-06 12:01:25','<!-- wp:paragraph -->\n<p>We are working on building a privacy compliant website. This site does not use any analytics.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"left\",\"id\":116,\"width\":360,\"height\":230} -->\n<div class=\"wp-block-image\"><figure class=\"alignleft is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-2.png\" alt=\"\" class=\"wp-image-116\" width=\"360\" height=\"230\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>We do not use cookies unless strictly functional. We are trying our best to not allow third parties to track our visitors by cookies or by Java Script embeded code. It\'s hard job. We might lose traffic and SEO. We have used a Word Press template.  WP templates are mainly server side PHP scripts full of board cascading code built on code. We can\'t even see the actual code.&nbsp;When using the WP admin, the templates are loaded in the back. We wanted to let make you aware that this potential risk. Help us by spreading the word. If you see anything suspicious, lets us know.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We believe our visitors deserve protection and privacy. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Warning June 2021 : This site has various links to a tool called \'Pearltrees\' that allows to curate URL and other resources. It appear the Pearltrees website would not be fully encrypted for non sybscription users and drops cookies. Please make sure your web browser allows you to manage the cookies as a cookie banner is not always shown.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want your trust. In particular, we do not use Google analytics, avoiding to share data with external third parties.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1951,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-02-at-21.05.19-1024x528.png\" alt=\"\" class=\"wp-image-1951\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When links are posted, beware that they will take you to an external website that is hosted by a third-party provider not necessarily in your regional jurisdiction or that of DataRainbow. The company may collect, store and use information independent of DataRainbow including but not limited to IP address, browser details etc. DataRainbow has no control over the collection or use of this information. For more information on the linked sites Privacy Policy and the Lawful basis for this data collection, read their privacy notice/policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Most other web sites don\'t actually comply with the laws relating to data protection and privacy and as such it is impossible for us to guarantee that the sites we link to will not misuse your data. We hope regulators will enforce the law against these organisations. As such please always be mindful of clicking on links to third party web sites - we would recommend that you have various tools and plugins installed on your web browser to protect you such as:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>AdBlock Plus</li><li>NoScript</li><li>Privacy Badger</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Make sure that third party cookies and pop-ups are disabled in your web browser settings. We will produce a video showing you how to do this in the near future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Your right of access</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process.&nbsp;<a href=\"https://ico.org.uk/your-data-matters/your-right-to-get-copies-of-your-data/\">You can read more about this right here.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Your right to rectification</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.&nbsp;<a href=\"https://ico.org.uk/your-data-matters/your-right-to-get-your-data-corrected/\">You can read more about this right here.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Your right to erasure</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>You have the right to ask us to erase your personal information in certain circumstances.&nbsp;<a href=\"https://ico.org.uk/your-data-matters/your-right-to-get-your-data-deleted/\">You can read more about this right here.&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Your right to restriction of processing</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>You have the right to ask us to restrict the processing of your information in certain circumstances.&nbsp;<a href=\"https://ico.org.uk/your-data-matters/your-right-to-limit-how-organisations-use-your-data/\">You can read more about this right here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Your right to object to processing</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>You have the right to object to processing if we are able to process your information because the process forms part of our public tasks, or is in our legitimate interests.&nbsp;<a href=\"https://ico.org.uk/your-data-matters/the-right-to-object-to-the-use-of-your-data/\">You can read more about this right here.&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Your right to data portability</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.&nbsp;<a href=\"https://ico.org.uk/your-data-matters/your-right-to-data-portability/\">You can read more about this right here.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If we are processing your information for criminal law enforcement purposes, your rights are slightly different. Please see the relevant section of the notice.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You are not required to pay any charge for exercising your rights. We have one month to respond to you.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For any question you would have, please contact us at data@datarainbow.eu</p>\n<!-- /wp:paragraph -->','Privacy Notice','','inherit','closed','closed','','85-revision-v1','','','2021-07-06 12:01:25','2021-07-06 12:01:25','',85,'https://www.datarainbow.eu/?p=2093',0,'revision','',0),(2094,1,'2021-07-06 14:55:35','2021-07-06 14:55:35','<!-- wp:paragraph -->\n<p>We are working on building a privacy compliant website. This site does not use any analytics.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"left\",\"id\":116,\"width\":360,\"height\":230} -->\n<div class=\"wp-block-image\"><figure class=\"alignleft is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-2.png\" alt=\"\" class=\"wp-image-116\" width=\"360\" height=\"230\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>We do not use cookies unless strictly functional. We are trying our best to not allow third parties to track our visitors by cookies or by Java Script embeded code. It\'s hard job. We might lose traffic and SEO. We have used a Word Press template.  WP templates are mainly server side PHP scripts full of board cascading code built on code. We can\'t even see the actual code.&nbsp;When using the WP admin, the templates are loaded in the back. We wanted to let make you aware that this potential risk. Help us by spreading the word. If you see anything suspicious, lets us know.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We believe our visitors deserve protection and privacy. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Warning June 2021 : This site has various links to a tool called \'Pearltrees\' that allows to curate URL and other resources. It appears the Pearltrees website would not be fully encrypted for non subscription users and drops cookies. Please make sure your web browser allows you to manage the cookies as a cookie banner is not always shown. <a href=\"http://www.pearltrees.com/s/info/privacy\" target=\"_blank\" rel=\"noreferrer noopener\">see their privacy notice</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want your trust. In particular, we do not use Google analytics, avoiding to share data with external third parties.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1951,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-02-at-21.05.19-1024x528.png\" alt=\"\" class=\"wp-image-1951\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When links are posted, beware that they will take you to an external website that is hosted by a third-party provider not necessarily in your regional jurisdiction or that of DataRainbow. The company may collect, store and use information independent of DataRainbow including but not limited to IP address, browser details etc. DataRainbow has no control over the collection or use of this information. For more information on the linked sites Privacy Policy and the Lawful basis for this data collection, read their privacy notice/policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Most other web sites don\'t actually comply with the laws relating to data protection and privacy and as such it is impossible for us to guarantee that the sites we link to will not misuse your data. We hope regulators will enforce the law against these organisations. As such please always be mindful of clicking on links to third party web sites - we would recommend that you have various tools and plugins installed on your web browser to protect you such as:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>AdBlock Plus</li><li>NoScript</li><li>Privacy Badger</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Make sure that third party cookies and pop-ups are disabled in your web browser settings. We will produce a video showing you how to do this in the near future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Your right of access</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process.&nbsp;<a href=\"https://ico.org.uk/your-data-matters/your-right-to-get-copies-of-your-data/\">You can read more about this right here.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Your right to rectification</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.&nbsp;<a href=\"https://ico.org.uk/your-data-matters/your-right-to-get-your-data-corrected/\">You can read more about this right here.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Your right to erasure</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>You have the right to ask us to erase your personal information in certain circumstances.&nbsp;<a href=\"https://ico.org.uk/your-data-matters/your-right-to-get-your-data-deleted/\">You can read more about this right here.&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Your right to restriction of processing</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>You have the right to ask us to restrict the processing of your information in certain circumstances.&nbsp;<a href=\"https://ico.org.uk/your-data-matters/your-right-to-limit-how-organisations-use-your-data/\">You can read more about this right here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Your right to object to processing</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>You have the right to object to processing if we are able to process your information because the process forms part of our public tasks, or is in our legitimate interests.&nbsp;<a href=\"https://ico.org.uk/your-data-matters/the-right-to-object-to-the-use-of-your-data/\">You can read more about this right here.&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Your right to data portability</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.&nbsp;<a href=\"https://ico.org.uk/your-data-matters/your-right-to-data-portability/\">You can read more about this right here.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If we are processing your information for criminal law enforcement purposes, your rights are slightly different. Please see the relevant section of the notice.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You are not required to pay any charge for exercising your rights. We have one month to respond to you.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For any question you would have, please contact us at data@datarainbow.eu</p>\n<!-- /wp:paragraph -->','Privacy Notice','','inherit','closed','closed','','85-revision-v1','','','2021-07-06 14:55:35','2021-07-06 14:55:35','',85,'https://www.datarainbow.eu/?p=2094',0,'revision','',0),(2049,1,'2021-04-17 14:38:14','2021-04-17 14:38:14','<!-- wp:paragraph -->\n<p>The Data Diva </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In January 2021, I had the honour of being <a rel=\"noreferrer noopener\" href=\"https://www.debbiereynoldsconsulting.com/podcast/e15-tara-taubman-bassirian\" target=\"_blank\">interviewed by Debbie Reynolds</a>, chatting about the GDPR, its slow enforcement by Data Protection Authorities. The position of the French <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/french-dpa-cnil-fined-carrefour-for-cookies/\" target=\"_blank\">CNIL</a>, the UK ICO, the Irish DPC, One stop Shop for US mega corporations, such as Google and Facebook. The future of international data flow since the invalidation of Privacy Shield by the <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">ECJ Schrems-II</a>, the requirement of ensuring the same level of data protection when personal data is transferred outside the EU/EEA and the case of the <a href=\"https://www.datarainbow.eu/beyond-brexit-cyber-security-and-data-protection-the-modern-cassandra-complex/\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy after Brexit</a>. Securing data exchange, encryption and the all time good advice : data minimisation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://thedatadivatalksprivacypodcast.buzzsprout.com/1734607/8171493-the-data-diva-e15-tara-taubman-bassirian-llm-and-debbie-reynolds\"><strong>Find your Podcast Player of Choice to listen to “The Data Diva” Talks Privacy Podcast Episode Here</strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2022,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/04/Capture-décran-2021-04-17-à-14.21.55-1024x588.png\" alt=\"\" class=\"wp-image-2022\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Transcript of the interview :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>01:03</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hello, thank you for having me on your show. It\'s nice to see you and chat with you. We are both very active, I think, in educating and talking and discussing the subject of data protection. I\'ve been involved for more than a decade on this subject since the French corporate lawyer and I moved to Germany and the UK. And it\'s here that I specialized in privacy and data protection while I did my LLM. And originally, I was expecting to do char diamond safety until during my LLM. I actually realized that governments were sometimes using chart protection to quiet free speech. And so I get involved with the reform of the Data Protection Directive, which became then the regulation GDPR. I guess your auditor would know the difference between a directive and the GDPR regulation, which is a regulation that applies directly to all EU nations. The legislation was quite an ambitious program. It could not be perfect because, within the 28 member states, there are some civil law backgrounds, and the others are common law like the UK. So there has been tension between the different legislations. I still believe that it\'s the best or not the best. I shouldn\'t say that it still needs to be more perfect, but the big fine makes everybody wake up. Everybody started to think, well, GDPR data protection is actually important. I\'m trying to explain that we gain a lot with the digital world. I remember as a lawyer, when we used to, secretaries used to type everything your ears would dictate, and there was a secretary typing everything. And if something was wrong, they had to start all over again. When needed, Internet has made lawyers work much, much easier. Everyone\'s work is much easier automatic. We do search on Google, which brings up so many results in just one click and all for free. Well, free, maybe not. But we don\'t pay straight away. Sonia GDPR, with fines, wakes up. Charities, in my view, have been a bit too slow to enforce. But here comes the COVID and confinement, which also changed a lot of the situation working from home is different. I\'ve been looking and following the cases of cyberattacks, which I guess Debbie, you\'ve seen the same, they\'re just going high up the ceiling. What working from home is less security, obviously. So it needs this training. I\'m not sure every employer gets the training they needed. We had in the UK a very interesting case, the Morrison case, which went up to the High Court of vicarious liability of an employer here for his employee. And in the case of the supermarket, Morrison was he hadn\'t done anything wrong. Apart from having an employment fight with an employee. They sacked the employee. It happened employee was working in the accounting department. He was asked to forward the whole HR data to the outside accountant, would it? Meanwhile, he copied it on a USB stick. And when he gets sacked, one of the whole HR data was published online. That caused a major issue and a problem for all the employees who had the data exposed. There was a class action. The Court of Appeal said, basically, that the employee Morrison\'s should have had cyber insurance to cover these sorts of damages. In the High Courts, Morrison had a very good lawyer, not that the class action lawyer was not as good. But Morrison\'s lawyer did a very good job of convincing the High Court that they hadn\'t done anything wrong. And the ex-employee was a data controller, so he was only responsible. It can sound. I\'m guessing lots of employees, employers, or employers listening would think, well, why would Morrison be liable. They hadn\'t done anything wrong, then it\'s the only liability of the ex-employer. He saw how the other employee could get any damage compensation for the data. So that\'s an issue. And then there was this case that I barely mentioned. I saw it today on LinkedIn. I don\'t have much detail about it. But it\'s a German court that said not every data breach would give compensation. In the UK, we have the Lloyd case class action against Google when they had the green light to go forward. And they say the loss of control and the psychological distress was compensation, we still have to wait and see where it all goes. But the problem with a data breach is the consequences are not immediate. The data is stolen, they are sold on black markets, or they are just thrown away everywhere. And sometimes, many years later, someone whose ID is misused or financial details misused.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><a href=\"https://www.debbiereynoldsconsulting.com/podcast\" target=\"_blank\" rel=\"noreferrer noopener\">Debbie Reynolds</a>  </strong>07:32</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yeah, I think the problem, I mean, that we just can\'t get around is that a lot of times, the harm happens before the law. And if the enforcement doesn\'t happen soon enough, or the remediation or, you know, happen, you know, once the milk is spilled out of the carton, you know, it\'s almost impossible to get that back. So that\'s why it\'s really important that that data be protected the best way possible that individuals have more control over their data and that it not be spilled milk. I think it\'s really interesting that you\'re, you know, sleeping in a lawyer France you lived in Germany and now live in the UK. So you have, you know, the full experience, right, from different countries and, and different ways that they look at things. I love your thoughts, you know, at me being an American and you being in Europe, as we have so many people around the world working in Data Privacy, I hear sometimes people say there\'s like a difference between the way American privacy folks think about privacy as opposed to European people. I want to know, have you had any thoughts about that?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>08:48</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yes, privacy is very much connected to the cultural understanding of how we perceive our intimacy. I think Americans, for example, don\'t like people touching you. Why more Mediterraneans are all touchy, and it\'s different. We had a discussion on Facebook not long ago about what\'s the difference between privacy and data protection. For me, privacy is a fundamental human right. It\'s more of a philosophical concept. When data protection is more the data that is collected that needs to be protected, and the way that we are allowed to collect or not to collect right. And someone posted a picture of a toilet with glass walls. Some people think, well, previously is secrecy, and I have nothing to hide. So why would they care about privacy? And I like to tell them whenever you go to the loo you close the door. It\'s just somewhere you would like to be in peace. However, going back to you three, actually, France was well known on web site. Novelties used to do these things in public. And they will show it as a way of saying, Well, I\'m healthy, there was no barrier. So no problem going to the loo and showing everything you do in a loo to everyone. So things have changed. The understanding and the way we perceive privacy change. And it\'s also changed from one culture to another culture. I\'ve had people in Sweden telling me that we go naked in a sauna, and we don\'t care about privacy. And then I reply, what do you choose to go to the sauna, you choose who you\'re sitting with. And if you\'re not happy, it\'s not a huge sign out there. A certain number of people, you don\'t like them, you just go away, and you go to another sauna. Your privacy online is different. You have absolutely no control over what\'s being done with your data. And this is where previously, you get very close to data protection. A few years ago, I had a chat with an IT person about threats and detection. And whatever chatting, I Googled her, and I find so much private stuff about her online. And I just sent her a link. And she felt like you\'re invading my privacy. I said, I just Googled your name, put speech mark, right, and see everything that comes out about you. Yeah, and this even for someone who is in IT, it was four years ago. I\'m hoping today people understand that a bit more. But Google does the job of a puzzle, different pieces puzzle in one click put next to each other that shows a whole picture that you have no control over, right. It could be your own boss, but it could be someone else destroy your reputation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>10:56</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Absolutely. Right, exactly. I think for people who aren\'t online or don\'t have a very good presence or good full presence online, it is, unfortunately, an opportunity for people to fill it in with bad things or things that aren\'t true. So it\'s very important, I think, for people to really step out and establish their identity. So people know, you know, this, Tara, this is very, you know, so they can differentiate the truth from the facts from fiction. Basically, I would love to get your thoughts on the Schrems II decision and the invalidation of Privacy Shield between the EU and the US. What are your thoughts about it?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>12:43</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s a case been ongoing for a few years. First, the previous adequacy decision, that was the Safe Harbor agreement, was invalidated by the European Court of Justice. Nothing was changed. So Maximillian Schrems, who is behind this case which found that none of your business NGOs continued his battle. In July this summer, the European Court of Justice again said that despite the European Commission giving the green light after the second year of reviewing the Privacy Shield, it should be invalidated. It\'s not because the US stars intelligentsia that European don\'t do. Right. Every country today has intelligence. And they try to grab information. The problem with the US as the European Court of Justice, so is that it is there is no sufficient judicial review. Right. There is a sort of discrimination against you EU citizens who don\'t have a right to redress or so until things change, which is the FISA section 702, the executive order 12 333 and other intelligence regulation Tridacna things that allow the US to intercept data the normal transfer of data from the EU to the US. In principles, standard contractual clauses are still valid. So all the binding corporate rules or a lot of people jumped up and said, oh, you\'re very let\'s continue as we did before. However, the high court saying that additional measures should be taken to make sure that the data that isn\'t exported from the EU and imported to the US is kept safe and not access is given to the US. Government and the EU citizen gotta write. Personally, I don\'t see many ways that this could be done. Right, we can go closer. We can data can be encrypted, the encryption key should remain within the EU clauses could be added to the standard contractual clauses that are being modernized by the Commission. That\'s right. It\'s still not there. Some data protection authorities, like the German when ones, have been very strict, saying the normal transfer of data from the EU to the US. French, we are thinking about it in English. Early, be careful what you\'re doing, what we can stop the trade. Basically, I know, I\'m not very exactly repeating what they said. But that\'s what comes out. But England, UK is concentrating on Brexit. Yeah. Is it suffering itself? Will they get the adequacy decision or not? But that\'s another issue. But what\'s interesting with the Schrems II decision is basically saying we Europe want strong protection to data. And someone like if this was a kind of RFID, sorry, that follows the data wherever it goes. The country of import should be the same level of protection today to this data, which is quite strong. Yes. But hopefully, it\'s a good message that we pass. We had an interesting case in France, if I may mention that. Datahub is a cloud that stores all medical, French medical data, especially since the COVID. Neil said to the highest administrative costs in France to consider that his data should not be put in the hands of Microsoft. So that is confirmation that what we call what the ECG sees, or the transfer of data, is not the physical transfer of data from the EU to the US. Because all these American US laws apply to US companies, even though if their servers are based in Europe, still, US government can intercept the data, right?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>17:46</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>17:47</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is why the German data protection authorities\' position is not pure data, check where it goes. And if you\'re using US companies, rethink it. That\'s a major step.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>18:04</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And I\'ve been watching this play out for over 20 years. So you know, when Safe Harbor was put in place, and they wills invalidated Privacy Shield, I don\'t know what a third try to see would be between the US and the EU. Obviously, there\'s a lot of trade between countries. So there\'s obviously probably more of an economic imperative than the privacy one. But I think we just have fundamental thoughts or differences about how we think about privacy. So in my view, the US is like commerce over privacy. And the EU is like, you know, we want to do commerce, but you have to respect that sort of an impasse, I feel. And then the redress issue is a very serious one because, in the Privacy Shield, they tried to have a sort of a method of redress within the Department of Commerce, I guess. But the big issue, in my view, well two issues in my view. One is that the Department of Commerce only covers certain types. So it\'s not almost all industries, as opposed to the GDPR. And then also the redress. Because the Department of Commerce, again, is limited in the companies that they oversee, means that you know, like, for example, like let\'s say, for instance, I have a problem with a US company, while I\'m here in the US, I don\'t have that level of redress that the Europeans are asking for. So there really has to be a total rethink of how that mechanism could be created in a way that will make it powerful. I think, but then I think that will cause a lot of people in the US to say, well, why can\'t I have that? Right? We don\'t have that right now in terms of the way that ways you guys are thinking about redress. I would love to ask. You had written something a while back about consent fatigue. And I think this is a big issue. So where a lot of people are, you know, you\'re signing up for these companies with different services. And you\'re constantly getting bombarded with cookie notices and different things like that. And some people just, they just click through. So give me your thoughts about consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>20:43</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>one of the cookies is ruled by the policy directive, which is under revision. It\'s been ongoing. However, the consent to be the same level and standard of the GDPR. We are now seeing more and more websites that cookie banners are asking consent before dropping the cookies. Actually, cookies are also under the Schrems II are considered the transfer of data to the US for the website that Google Analytics or Facebook content or other cookies that send the data to the US. It\'s an issue. We see the constant banners. I\'ve noticed with a few people who did research that sometimes some websites, although you did not consent on cookies, or before even you would say yes or no cookies were dropped. I saw several law firms\' websites was that one major Law Society website had cookies. And when we speak about cookies, it\'s a generic term. But it also includes any kind of tracing, some JavaScript pixels, and they all collect data. When you have sensitive clients, if I may call it a law firm, it\'s an issue. And it allows third parties to know who came to your website, what they did, and whichever website they also visited. And it could be that someone else who uses the same device could actually know where you\'ve been and what you\'ve been doing. So when Law Society encourages victims of domestic abuse to visit their website, and on which they are cookies, it\'s a serious issue, depending on the kind of visitors and customers are happy to have to be very vigilant with what is connected. People are today very much annoyed because every website you want to visit, you first have to decide if you want to go queue or not. It is a pain. But I\'m hoping eventually they will stop having any cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>23:18</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yeah, well, so a lot of tech companies because a lot of the laws about cookies have been eliminating cookies. They\'re out there collecting data and other ways. But the law hasn\'t caught up with that yet. So I think by the time that these cookie cases get settled, very few people actually use them, and they will be on to whatever the next evolution in technology may be. I would love to talk with you about the right to be forgotten. This is something that you talk about you\'ve written about a bit for companies is the most difficult thing in the GDPR for them to acquiesce to because the right to be forgotten means that they have to figure out what they have in terms of data about individuals and how they, remove it from an organization and how they communicate that to the individual data subject. What are your thoughts about that?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>24:18</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the question of knowing which data is hold and verities? I think this is something very important. And GDPR is based on the accountability principle. It\'s asking the organization to sit and think which data they hold during that mapping, know where it goes, who access it, for how long they return it. These are the seven principles of data protection on GDPR. My favorite principle is data minimization. If you don\'t hold the data, you don\'t have the burden of the data. If you don\'t need it, delete it.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>24:56</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I agree. I agree with you on that.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>24:58</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s as simple as that. It\'s actually good for you. You don\'t pay for data storage for anything. Another principle is data accuracy. What\'s the point of holding data that is out of date? Your market is all wrong, your everything is wrong because the data is obsolete. So deleted, you don\'t need it. I usually like to advise three-level storage of data. First level active data with more access, and also internet access seven-level, you have to keep the data because you might need it for refund reason, because it also, you know, tax reason, employment reason, you have to keep the data for a certain number of years, you have to sit and decide your data retention periods, depending on the level of data and what you want. But limit data to this second-level storage. Third Level storage would be archiving, no internet access, very limited access to any third parties. Because sometimes, for a historical reason, you need the data, right? I\'ve been asked, well, what happened, we had all these historical data of people who became famous or were famous and visited the hotel or a museum, we would want to keep that forever. Well, you can keep it just don\'t put it online. Keep it on the external hard drive that is not connected to the Internet. You\'re allowed to do that. It\'s not a problem. What people have to understand is an Internet connection. Globalization means easy access to data, easy misuse of data. But if the data is safe, encrypted on your hard drive, and not connected to the Internet, it\'s safe. You can keep it as long as you want. There\'s no problem with that. Right? That\'s what is good for the GDPR. It\'s caused people organization to sit and think, what they\'ve got, how much they are holding, who is accessing it, how they keep it secure. It\'s all common sense.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>27:03</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yeah. I think though, with the Internet age, because I don\'t know, like, I guess to use, for example, like Google, when Google first started, or Microsoft, or started giving people free email addresses, you know, the size of your email box was relatively small, over the years, they made the size of the email boxes bigger. So, as a result, people who just click more stuff may delete less stuff, they have more room. So in some ways, I feel like the Internet age has made people digital packrats, where they keep so much stuff, you know because you know, instead of like, let\'s say, before you have books in the library, now you can have things on a hard drive, and people are less apt to delete things. Also, you know, I\'ve worked a lot with corporations and lawyers. Sometimes, people want to keep data just because they think they may need it, even though they don\'t have a real reason to keep it. And that just piles up over a year over a year. And to me, those are some of you know, especially if they\'re connected to the Internet, a lot of times, you know, they have all data may be on all servers, maybe on something that\'s more vulnerable than maybe their actual data and hackers like that, that\'s just the gateway for them to get into your organization. And it also creates more risk for the company, because now you have people accessing or you have a breach, or someone\'s looking at some old stuff, you don\'t even know what\'s there. So now you have to go through and figure out, you know, whose data is on here. So it\'s just a mess. I think data retention is a big problem for a while where people just keep getting way too much stuff.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>28:54</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Indeed, I call it a Google hype. One school started to collect everything. And it was known that Google is saving all data, and storing and collecting became much, much cheaper. So people don\'t let\'s collect and then we will see what we do with it. But that causes issues that there are serious security issues with over-collecting data. Data breach cause harm, unfortunately. And cases like Morrison\'s will happen again. Yeah. Employees are not devoted to the employer as they used to be there is a much bigger turnover. Young people just change jobs. If they\'re not happy, they will want to take advantage, and it\'s so easy. Get the USB and put it online. Yeah. So yeah, data minimization is very important. And the right to be forgotten. Before the GDPR, there was a right to be forgotten by the jurisprudence of The European Court of Justice, and that was more delinking than actually deleting. Sometimes you do need the Internet and the whole world, forget about something silly that you did one day in your life. Because employers search online, everyone\'s searching online. Young people today are on with their baby pictures online, and even the embryo is already online before they were born. Yeah, it was a very interesting interview of ex-Google CEO. And he suggested that young people should be able to change their identity at the age of 21. Because they\'ve already got so much behind them of silly things, they\'ve done. Yeah, that\'s not feasible.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>30:56</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>That\'s true.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>30:57</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;We have to give a chance for people to redo their life. Everyone doesn\'t mistake. Yeah, the problem with the Internet is you just need someone with a camera next to you to make it memorable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>31:12</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Exactly.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>31:13</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve had lots of external debates this week on social media about France. Who wants to pass a law that forbids anyone to record police officers during work and post it on social media? In my interpretation of GDPR already today, we should not be able to post anyone\'s pictures online without their consent. And this is very important. I really ask everyone to reconsider before posting online, ask the person if they\'re okay. They are people with special circumstances. There are people who are in the middle of a divorce. They don\'t want to tell what they are and what they\'re doing. Right. They are protected witnesses. They don\'t want people to know where they are, and their faces would identify them. Facial recognition software for everyone can use it can identify and worse than identifying, it can make fake identification.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>32:13</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Absolutely.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>32:15</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So you might be identified as a criminal, or you are not at all a criminal, but go and try to prove it wasn\'t you, everyone is just attacking you see a police officer video that is posted on social media. It would be one extract of something that happened. You don\'t know what the start was, and you don\'t know how it finished? Right? They are police officers. I\'m not saying what I am not defending at all police violence. I\'m just saying that the judge has studied for that institution for judging. And it\'s not the work of social media to judge the actions of a police officer. They can post by blowing the faces. Yeah. But they should never be anything posted with identifying pictures without asking the person. That\'s very important. Yeah. People have to start to understand that it has consequences. Absolutely. And I thought it was the other way around. discussion with the police officer in my area, and giving the name of a young offender. 18 year old who is suspected of having killed someone with a knife.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>33:27</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It might be true.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>33:29</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>But I want the judge to tell me what he did. And what he did was a crime. Yeah, it\'s not the social Smith\'s at work. And once the local police put that on Facebook, it means that the whole family is ashamed. The siblings, I\'m ashamed. They go to school the next day, and they say, your brother killed someone. We don\'t want to talk to you anymore. You got the COVID they say, oh, I don\'t talk to you because you\'ve got fever.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>33:51</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And they were able to talk to any rain. Exactly, exactly.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>33:58</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is our things that change our relationship because of social media. We get so many good things from it. Yeah. You know, I\'m a great believer in social media. I promote elearning. I have a charity that promotes learning. I have nothing against the Internet and anything digital. I love technology. I\'m a gadget lover. But we have to accept that in the area of social media and Internet interconnection relationship has changed. We are not just broadcasting in our small network when we broadcast, we broadcast it for the whole world. Right, broadcast it as the highest bid ever. And we broadcast it forever.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>34:44</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Exactly.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>34:44</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So it\'s a big catalyst of the Internet. It is changing all scales.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>34:50</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Absolutely.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>34:51</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have been, on the other hand, be more careful with what we\'re doing and what we\'re saying. And it\'s so easy to just push a button. Without</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>35:00</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Absolutely, absolutely. Africa, right, I think we need to, you know, I\'m like you. I love technology. I\'m really excited, you know, when the Internet came into existence, because I grew up without the Internet, obviously. But I\'m a gadget lover as well. But I think we also have to be cognizant of the harms that can happen. So you can\'t dissolve the so, so excited about the innovation without understanding that there can be harm. So we have to really be able to educate around that. The GDPR in Britain, as we know, very influential around the world. So we see laws come out that are taking bits and pieces of the GDPR and incorporating them into their law. So I think there\'s going to be more regulation around Data Privacy and not less in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>35:51</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We know even got in China a similar to GDPR legislation that is coming up so even China.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>35:59</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yeah, even trying to Iraq. Right, exactly. Was that a pleasure to have you on so, and thank you again, thanks so much.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>36:08</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>My great pleasure. Thank you, Debbie. By e<a href=\"https://www.debbiereynoldsconsulting.com/podcast/tag/Podcast\">Podcast</a><a href=\"https://www.debbiereynoldsconsulting.com/podcast?author=5d75cb2fcb85fd7521d47f60\">Debbie Reynolds</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.debbiereynoldsconsulting.com/\">The Data Diva</a> </p>\n<!-- /wp:paragraph -->','Interview with Debbie Reynolds','','inherit','closed','closed','','2021-revision-v1','','','2021-04-17 14:38:14','2021-04-17 14:38:14','',2021,'https://www.datarainbow.eu/?p=2049',0,'revision','',0),(2043,1,'2021-04-17 14:11:50','2021-04-17 14:11:50','<div  data-id=\"initial-content-section\" data-export-id=\"initial-content-section\" data-label=\"Initial Content\" id=\"initial-content-section\" class=\"content-section content-section-spacing\">\n   <div  class=\"gridContainer\">\n     <div  class=\"row\">\n\n        <div  class=\"col-xs-12 col-sm-12\">                <p ></p>\n<h2  class=\"has-text-align-center\"><strong >DATARAINBOW </strong></h2>\n<p ></p>\n<p ></p>\n<p >After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ….</p>\n<p ></p>\n<p ></p>\n<p >We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<p ></p>\n<p ></p>\n<p >We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<p ></p>\n<p ></p>\n<p ><strong >Who created DATARAINBOW ?</strong></p>\n<p ></p>\n<p ></p>\n<h2 >Tara Taubman-Bassirian</h2>\n<p ></p>\n<p ></p>\n<p >Tara Taubman-Bassirian, LLM, was initially trained in French Law before settling in the UK. She has a Maitrise of private law from the prestigious <a data-mce-href=\"https://www.u-paris2.fr/fr\" href=\"https://www.u-paris2.fr/fr\" target=\"_self\" data-mce-selected=\"inline-boundary\" data-cp-link=\"1\" rel=\"noopener\">University of Paris 2 Panthéon Assas</a>, before her more recent specialisation in Computer and Communication Law with a Masters at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN’s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group&nbsp;<a  href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\" class=\"\" data-cp-link=\"1\">Fly A Kite</a>&nbsp;with&nbsp;<a  href=\"https://simbus360.com\" class=\"\" data-cp-link=\"1\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<p ></p>\n<p ></p>\n<p ><strong >CONTACT : Data@datarainbow.eu</strong></p>\n<p ></p>\n<p ></p>\n<figure  class=\"wp-block-table\">\n<table >\n<tbody >\n<tr >\n<td ><strong ><a  href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\" class=\"\">Privacy Hero 2018 :&nbsp;Tara Taubman-Bassirian</a></strong></td>\n</tr>\n</tbody>\n</table>\n</figure>\n<p ></p>\n<p ></p>\n<p >Privacy Hero of the Year poll, and the results are in…&nbsp;&nbsp;<a  href=\"https://www.linkedin.com/in/taubmanbassirian\" class=\"\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<p ></p>\n<p ></p>\n<p >(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<p ></p>\n<p ></p>\n<p >Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of&nbsp;<a  href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\" class=\"\">Rebecca Herold’s radio show</a>,&nbsp;<a  href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\" class=\"\">Data Security and Privacy with The Privacy Professor</a>. I’ve extended invitations to each today, so stay tuned for more details.&nbsp;</p>\n<p ></p>\n<p ></p>\n<p ><em >Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</em>.</p>\n<p ></p>\n<p ></p>\n<p >For keeping up with news on IT security, Privacy and Online Security, join our Facebook Group&nbsp;<a  href=\"https://www.facebook.com/groups/167255910003191?multi_permalinks=2203761959685899&amp;notif_id=1548347410584622&amp;notif_t=feedback_reaction_generic\" class=\"\">Fly A Kite</a>.</p>\n<p ></p>\n<p ></p>\n<div  class=\"wp-block-button aligncenter\"><a  class=\"wp-block-button__link\" href=\"https://www.datarainbow.eu/connect\">Work With Me</a></div>\n<p ></p>\n<p ></p>\n<figure  class=\"wp-block-image\"><img  src=\"/wp-content/uploads/sites/3/2019/01/Champion-Badge.png\" alt=\"\" class=\"wp-image-178\"></figure>\n<p ></p>\n<p ></p>\n<div  class=\"wp-block-group alignwide\">\n<div  class=\"wp-block-group__inner-container\">\n<figure  class=\"wp-block-image alignwide size-large\"><img  loading=\"lazy\" width=\"233\" height=\"118\" src=\"https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-26-at-07.53.32.png\" alt=\"\" class=\"wp-image-1713\"></figure>\n<p ></p></div>\n</div>\n<p ></p>\n<p ></p>\n<figure  class=\"wp-block-image alignwide size-large\"><img  loading=\"lazy\" width=\"511\" height=\"246\" src=\"https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-26-at-07.53.15.png\" alt=\"\" class=\"wp-image-1714\" srcset=\"https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-26-at-07.53.15.png 511w, https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-26-at-07.53.15-300x144.png 300w\" sizes=\"(max-width: 511px) 100vw, 511px\"></figure>\n<p ></p>\n<p ></p>\n<div  class=\"wp-block-group alignwide\">\n<div  class=\"wp-block-group__inner-container\"></div>\n</div>\n<p ></p>\n<p ></p>\n<div  class=\"wp-block-columns alignwide\">\n<div  class=\"wp-block-column\">\n<h3 >Privacy Hero of the Year</h3>\n<p ></p>\n<p ></p>\n<p >Polls, and the results are in…&nbsp;&nbsp;<a  href=\"https://www.linkedin.com/in/taubmanbassirian\" class=\"\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp; <strong >(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</strong></p>\n<p ></p></div>\n<p ></p>\n<p ></p>\n<div  class=\"wp-block-column\">\n<h3 >Social Media</h3>\n<p ></p>\n<p ></p>\n<p >Linkedin, Twitter and a little a bit of Facebook to keep informed, share and learn from others.</p>\n<p ></p></div>\n<p ></p></div>\n<p ></p>\n\n          </div>\n      </div>\n  </div>\n</div>','About','','inherit','closed','closed','','34-revision-v1','','','2021-04-17 14:11:50','2021-04-17 14:11:50','',34,'https://www.datarainbow.eu/?p=2043',0,'revision','',0),(2044,1,'2022-10-07 09:14:26','2021-04-17 14:14:35','','How To Understand the Ofqual AI Predicting A-Levels Debacle','','publish','closed','closed','','how-to-understand-the-ofqual-ai-predicting-a-levels-debacle','','','2022-10-07 09:14:26','2022-10-07 09:14:26','',0,'https://www.datarainbow.eu/?p=2044',53,'nav_menu_item','',0),(2045,1,'2022-10-07 09:14:26','2021-04-17 14:16:17','','Les Professionnels du Droit à l\'Ère du Numérique','','publish','closed','closed','','les-professionnels-du-droit-a-lere-du-numerique','','','2022-10-07 09:14:26','2022-10-07 09:14:26','',0,'https://www.datarainbow.eu/?p=2045',51,'nav_menu_item','',0),(2046,1,'2022-10-07 09:14:26','2021-04-17 14:17:07','','Lawyer Cloud Act : quel cloud pour les cabinets d\'avocats ?','','publish','closed','closed','','lawyer-cloud-act-quel-cloud-pour-les-cabinets-davocats','','','2022-10-07 09:14:26','2022-10-07 09:14:26','',0,'https://www.datarainbow.eu/?p=2046',52,'nav_menu_item','',0),(2047,1,'2022-10-07 09:14:26','2021-04-17 14:18:51','','Pearltrees Datarainbow','','publish','closed','closed','','pearltrees-datarainbow','','','2022-10-07 09:14:26','2022-10-07 09:14:26','',0,'https://www.datarainbow.eu/?p=2047',67,'nav_menu_item','',0),(1660,1,'2020-11-26 04:07:59','2020-11-26 04:07:59','<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">Latest news, unless I have missed something :</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ EU wants to ban encryption,</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ EDPB published their after SchremsII Supplementary Transfer Measures and Surveillance</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ EU Commission\'s draft Implementing Decision on SCCs</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅Datatilsynet\'s accreditation requirements for code of conduct monitoring body</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅EDPS\' opinion on the European Commission\'s proposal for temporary derogations of the ePrivacy Directive</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅EDPB\'s recommendations on Supplementary Transfer Measures and Surveillance</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅EDPB\'s first binding decision under article 65 GDPR</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ U.K. ICO fined BA in cooperation with the French CNIL</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ And the Marriott International fined.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ Meanwhile US might have voted for a new President😍.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ The older president is stock in and will be tough job getting him out.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ Cyberattack is as ever high.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">Data security and protection more crucial than ever. ENISA published its alarming report</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ Open Rights Group has signed onto a joint civil society statement expressing concerns over proposals by the UK government which would undermine encryption, including through its Online Harms Bill.</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅EDPB\'s first binding decision under article 65 GDPR</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅CJEU\'s judgment in Orange România case</a></li><li><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6732748718711283712/\">✅ENISA Guidelines on Securing the IoT Supply Chain</a></li><li>✅ <a href=\"https://ico.org.uk/media/action-weve-taken/2618609/ticketmaster-uk-limited-mpn.pdf\">UK ICO fined Ticketmaster</a></li><li><a href=\"https://www.legifrance.gouv.fr/ceta/id/CETATEXT000042499856?tab_selection=all&amp;searchField=ALL&amp;query=433311&amp;page=1&amp;init=true\"> ✅ French Conseil d\'Etat confirmed CNIL fine of 400.000€ for data breach</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Here is a digital brief from Euractiv <a href=\"https://www.euractiv.com/section/digital/news/digital-brief-powered-by-google-schrems-2-data-guidance-copyright-5g-in-the-eu/\">here&nbsp;</a></p>\n<!-- /wp:paragraph -->','A week with a 11.11.2020 and a Friday 13th was Going to be Memorable.','','inherit','closed','closed','','1076-revision-v1','','','2020-11-26 04:07:59','2020-11-26 04:07:59','',1076,'https://www.datarainbow.eu/1076-revision-v1/',0,'revision','',0),(1661,1,'2020-11-26 04:13:21','2020-11-26 04:13:21','','Screenshot 2020-10-01 at 20.31.28','','inherit','open','closed','','screenshot-2020-10-01-at-20-31-28','','','2020-11-26 04:13:21','2020-11-26 04:13:21','',0,'https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-10-01-at-20.31.28.png',0,'attachment','image/png',0),(1658,1,'2020-11-26 03:54:50','2020-11-26 03:54:50','<div  id=\"overlappable-4\" style=\"background-color: #ffffff;\" data-label=\"Overlappable\" data-id=\"overlappable-4\" data-export-id=\"overlappable-4\" data-category=\"overlappable\" class=\"overlappable-4 content-section content-section-spacing\" data-overlap=\"true\"><div  class=\"gridContainer\"> <div  data-type=\"row\" class=\"row spaced-cols text-center\"><div  class=\"col-xs-12 col-sm-4 col-padding\"> <i  class=\"fa icon fa-clone large shadow-large-black round aligncenter reverse color1\"></i> <div  data-type=\"column\" class=\"\"> <h5  class=\"\">PUBLICATIONS</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.</p></div> </div> <div  class=\"col-xs-12 col-sm-4 col-padding\"> <i  class=\"fa icon fa-cogs large shadow-large-black round aligncenter reverse color1\"></i> <div  data-type=\"column\" class=\"\"><h5  class=\"\">INTERVIEWS</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.</p></div> </div> <div  class=\"col-xs-12 col-sm-4 col-padding\"> <i  class=\"fa icon fa-magic large shadow-large-black round aligncenter reverse color1\"></i> <div  data-type=\"column\" class=\"\"><h5  class=\"\">RESSOURCES</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.</p></div> </div></div> </div></div><div  id=\"about-1\" style=\"background-color: #f5fafd;\" data-label=\"About\" data-id=\"about-1\" data-export-id=\"about-1\" data-category=\"about\" class=\"about-1 content-section\"><div  class=\"gridContainer\"> <div  class=\"row text-center\"><div  class=\"section-title-col\" data-type=\"column\"> <h5  class=\"\">LOREM IPSUM DOLOR</h5> <h2  class=\"\">Brand new WordPress theme&nbsp;<span  href=\"#\" style=\"font-weight: 700; font-family: Playfair Display,sans-serif; font-style: italic;\">with unlimited power</span>&nbsp;and customization possibilities</h2> <p  class=\"lead\">Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud.</p></div> </div> <div  class=\"row\"> <div  class=\"button-holder space-bottom space-bottom-small\" data-type=\"column\"> <a  class=\"button color1\" href=\"#\">GET STARTED NOW</a></div> <div  class=\"col-xs bottom-xs flexbox image-group-bottom-3-img space-bottom-xs center-xs\"> <img  class=\"left-img shadow-large-black\" data-size=\"500x300\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/computer-2569652.jpg\"> <img  class=\"center-img shadow-large-black\" data-size=\"500x300\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/apple-1838564.jpg\"> <img  class=\"right-img shadow-large-black\" data-size=\"500x300\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/laptop-2559795.jpg\"></div> </div></div> </div><div  id=\"features-3\" style=\"background-color: #ffffff;\" data-label=\"Features\" data-id=\"features-12-card-bordered\" data-export-id=\"features-12-card-bordered\" data-category=\"features\" class=\"features-12-card-bordered content-section content-section-spacing \"><div  class=\"gridContainer\"> <div  class=\"row text-center\"><div  class=\"section-title-col\" data-type=\"column\"> <h2  class=\"\">A few things we’re great at</h2> <p  class=\"lead\">Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.Ut enim ad minim veniam, quis nostrud exercitation.</p></div> </div> <div  class=\"row spaced-cols\" data-type=\"row\"> <div  class=\"col-sm-6\"> <div  class=\"card row-card bordered y-move\"> <div  class=\"row\"> <div  class=\"col-sm-fit icon-column\"> <i  class=\"fa icon fa-connectdevelop round bordered color2\"></i> </div> <div  class=\"col-sm\" data-type=\"column\"> <h5  class=\"color2\">FLEXIBLE CODE</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.</p></div> </div></div> </div> <div  class=\"col-sm-6\"> <div  class=\"card row-card bordered y-move\"> <div  class=\"row\"> <div  class=\"col-sm-fit icon-column\"> <i  class=\"fa icon fa-codepen round bordered color2\"></i> </div> <div  class=\"col-sm\" data-type=\"column\"> <h5  class=\"color2\">FLEXIBLE CODE</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.</p></div> </div></div> </div> <div  class=\"col-sm-6\"> <div  class=\"card row-card bordered y-move\"> <div  class=\"row\"> <div  class=\"col-sm-fit icon-column\"> <i  class=\"fa icon fa-cube round bordered color2\"></i> </div> <div  class=\"col-sm\" data-type=\"column\"> <h5  class=\"color2\">FLEXIBLE CODE</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.</p></div> </div></div> </div> <div  class=\"col-sm-6\"> <div  class=\"card row-card bordered y-move\"> <div  class=\"row\"> <div  class=\"col-sm-fit icon-column\"> <i  class=\"fa icon fa-database round bordered color2\"></i> </div> <div  class=\"col-sm\" data-type=\"column\"> <h5  class=\"color2\">FLEXIBLE CODE</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.</p></div> </div></div> </div></div> </div></div><div  id=\"content-13\" style=\"background-color: #f5fafd;\" data-label=\"Content\" data-id=\"content-2\" data-export-id=\"content-2\" data-category=\"content\" class=\"content-2 content-section content-section-spacing\"><div > <div  class=\"row middle-xs\"><div  class=\"col-sm-5 bg-image shadow-large-black\" data-bg=\"image\"></div> <div  class=\"col-sm-7 full-col-left-padding full-col-right-padding\"> <div  class=\"row\"> <div  data-type=\"column\" class=\"space-bottom-small content-title-col\"> <h5  class=\"\">CASE STUDY</h5> <h2  class=\"\">The Secret of Success</h2> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.</p></div> </div> <div  class=\"row spaced-cols \" data-type=\"row\"> <div  class=\"col-xs-6\" data-type=\"column\"> <h5  class=\"\">CAMERA</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</p></div> <div  class=\"col-xs-6\" data-type=\"column\"><h5  class=\"\">MUSIC CENTER</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</p></div> <div  class=\"col-xs-6\" data-type=\"column\"><h5  class=\"\">MESSAGES</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</p></div> <div  class=\"col-xs-6\" data-type=\"column\"><h5  class=\"\">CHANNELS</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</p></div> </div></div> </div></div> </div><div  id=\"content-14\" style=\"background-color: #ffffff;\" data-label=\"Content\" data-id=\"content-3\" data-export-id=\"content-3\" data-category=\"content\" class=\"content-3 content-section content-section-spacing\"><div > <div  class=\"row middle-xs\"><div  class=\"col-sm-7 full-col-left-padding full-col-right-padding\"> <div  class=\"row\"><div  data-type=\"column\" class=\"space-bottom-small content-title-col\"> <h5  class=\"\">CASE STUDY</h5> <h2  class=\"\">The Secret of Success</h2> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.</p></div> </div> <div  class=\"row spaced-cols\" data-type=\"row\"> <div  class=\"col-xs-6\" data-type=\"column\"> <h5  class=\"\">CAMERA</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</p></div> <div  class=\"col-xs-6\" data-type=\"column\"><h5  class=\"\">MUSIC CENTER</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</p></div> <div  class=\"col-xs-6\" data-type=\"column\"><h5  class=\"\">MESSAGES</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</p></div> <div  class=\"col-xs-6\" data-type=\"column\"><h5  class=\"\">CHANNELS</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</p></div> </div></div> <div  class=\"col-sm-5 bg-image shadow-large-black revert-classes-holder\" data-bg=\"image\"></div></div> </div></div><div  id=\"portfolio-3\" style=\"background-color: #f5fafd;\" data-label=\"Portfolio\" data-id=\"portfolio-4\" data-export-id=\"portfolio-4\" data-category=\"portfolio\" class=\"portfolio-4 content-section content-section-spacing-top\"><div  class=\"\"> <div  class=\"row text-center\"><div  class=\"section-title-col\" data-type=\"column\"> <h2  class=\"\">Publications</h2> <p  class=\"lead\">With the Internet spreading linke wildfire and reaching every part of our daily life, more and more traffic is directed to websites in search for information.</p></div> </div> <div  data-type=\"row\" class=\"row\" data-fixed=\"true\"> <div  class=\"col-xs-12 col-sm-3 no-gutter-col\"> <div  class=\"contentswap-effect\" data-hover-fx=\"portfolio-4\"> <div  class=\"initial-image\"> <img  data-size=\"542x360\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/apple-1838564.jpg\"></div> <div  class=\"overlay bg-color1\"></div> <div  class=\"swap-inner col-xs-12\"> <div  class=\"row full-height-row middle-xs middle-sm\"> <div  class=\"col-xs-12 text-center content-holder\"> <a  href=\"#\"><i  class=\"fa fa-search icon big portfolio-icon\" aria-hidden=\"true\"></i></a></div> </div></div> </div></div> <div  class=\"col-xs-12 col-sm-3 no-gutter-col\"><div  class=\"contentswap-effect\" data-hover-fx=\"portfolio-4\"> <div  class=\"initial-image\"> <img  data-size=\"542x360\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/laptop-2559795.jpg\"></div> <div  class=\"overlay bg-color1\"></div> <div  class=\"swap-inner col-xs-12\"> <div  class=\"row full-height-row middle-xs middle-sm\"> <div  class=\"col-xs-12 text-center content-holder\"> <a  href=\"#\"><i  class=\"fa fa-search icon big portfolio-icon\" aria-hidden=\"true\"></i></a></div> </div></div> </div></div> <div  class=\"col-xs-12 col-sm-3 no-gutter-col\"><div  class=\"contentswap-effect\" data-hover-fx=\"portfolio-4\"> <div  class=\"initial-image\"> <img  data-size=\"542x360\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/computer-2569652.jpg\"></div> <div  class=\"overlay bg-color1\"></div> <div  class=\"swap-inner col-xs-12\"> <div  class=\"row full-height-row middle-xs middle-sm\"> <div  class=\"col-xs-12 text-center content-holder\"> <a  href=\"#\"><i  class=\"fa fa-search icon big portfolio-icon\" aria-hidden=\"true\"></i></a></div> </div></div> </div></div> <div  class=\"col-xs-12 col-sm-3 no-gutter-col\"><div  class=\"contentswap-effect\" data-hover-fx=\"portfolio-4\"> <div  class=\"initial-image\"> <img  data-size=\"542x360\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/laptop-2559795.jpg\"></div> <div  class=\"overlay bg-color1\"></div> <div  class=\"swap-inner col-xs-12\"> <div  class=\"row full-height-row middle-xs middle-sm\"> <div  class=\"col-xs-12 text-center content-holder\"> <a  href=\"#\"><i  class=\"fa fa-search icon big portfolio-icon\" aria-hidden=\"true\"></i></a></div> </div></div> </div></div> <div  class=\"col-xs-12 col-sm-3 no-gutter-col\"><div  class=\"contentswap-effect\" data-hover-fx=\"portfolio-4\"> <div  class=\"initial-image\"> <img  data-size=\"542x360\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/apple-1838564.jpg\"></div> <div  class=\"overlay bg-color1\"></div> <div  class=\"swap-inner col-xs-12\"> <div  class=\"row full-height-row middle-xs middle-sm\"> <div  class=\"col-xs-12 text-center content-holder\"> <a  href=\"#\"><i  class=\"fa fa-search icon big portfolio-icon\" aria-hidden=\"true\"></i></a></div> </div></div> </div></div> <div  class=\"col-xs-12 col-sm-3 no-gutter-col\"><div  class=\"contentswap-effect\" data-hover-fx=\"portfolio-4\"> <div  class=\"initial-image\"> <img  data-size=\"542x360\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/computer-2569652.jpg\"></div> <div  class=\"overlay bg-color1\"></div> <div  class=\"swap-inner col-xs-12\"> <div  class=\"row full-height-row middle-xs middle-sm\"> <div  class=\"col-xs-12 text-center content-holder\"> <a  href=\"#\"><i  class=\"fa fa-search icon big portfolio-icon\" aria-hidden=\"true\"></i></a></div> </div></div> </div></div> <div  class=\"col-xs-12 col-sm-3 no-gutter-col\"><div  class=\"contentswap-effect\" data-hover-fx=\"portfolio-4\"> <div  class=\"initial-image\"> <img  data-size=\"542x360\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/apple-1838564.jpg\"></div> <div  class=\"overlay bg-color1\"></div> <div  class=\"swap-inner col-xs-12\"> <div  class=\"row full-height-row middle-xs middle-sm\"> <div  class=\"col-xs-12 text-center content-holder\"> <a  href=\"#\"><i  class=\"fa fa-search icon big portfolio-icon\" aria-hidden=\"true\"></i></a></div> </div></div> </div></div> <div  class=\"col-xs-12 col-sm-3 no-gutter-col\"><div  class=\"contentswap-effect\" data-hover-fx=\"portfolio-4\"> <div  class=\"initial-image\"> <img  data-size=\"542x360\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/laptop-2559795.jpg\"></div> <div  class=\"overlay bg-color1\"></div> <div  class=\"swap-inner col-xs-12\"> <div  class=\"row full-height-row middle-xs middle-sm\"> <div  class=\"col-xs-12 text-center content-holder\"> <a  href=\"#\"><i  class=\"fa fa-search icon big portfolio-icon\" aria-hidden=\"true\"></i></a></div> </div></div> </div></div> </div></div> </div><div  id=\"testimonials-5\" style=\"background-color: #ffffff;\" data-label=\"Testimonials\" data-id=\"testimonials-5\" data-export-id=\"testimonials-5\" data-category=\"testimonials\" class=\"testimonials-5 content-section content-section-spacing\"><div  class=\"gridContainer\"> <div  class=\"row\"><div  data-type=\"column\" class=\"section-title-col\"> <h2  class=\"\">Client Testimonials</h2> <p  class=\"lead\">Don’t take our word for it – here’s what our clients say:</p></div> </div> <div  class=\"row spaced-cols content-center-sm\" data-type=\"row\"> <div  class=\"col-sm-4\"> <div  class=\"card y-move bordered\" data-type=\"column\"> <i  class=\"fa fa-quote-right icon color1 small quotation-icon\"></i> <p  class=\"text-center\">Do you sometimes have the feeling that you’re running into the same obstacles over and over again? Many of my conflicts have the same feel to them, like “Hey, I think I’ve been here before,</p> <img  src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/team-5.jpg\" class=\"round icon\"> <h6  class=\"\">John Doe</h6> <p  class=\"small italic\">Company name</p></div> </div> <div  class=\"col-sm-4\"> <div  class=\"card y-move bordered\" data-type=\"column\"> <i  class=\"fa fa-quote-right icon color1 small quotation-icon\"></i> <p  class=\"text-center\">Do you sometimes have the feeling that you’re running into the same obstacles over and over again? Many of my conflicts have the same feel to them, like “Hey, I think I’ve been here before,</p> <img  src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/team-5.jpg\" class=\"round icon\"> <h6  class=\"\">John Doe</h6> <p  class=\"small italic\">Company name</p></div> </div> <div  class=\"col-sm-4\"> <div  class=\"card y-move bordered\" data-type=\"column\"> <i  class=\"fa fa-quote-right icon color1 small quotation-icon\"></i> <p  class=\"text-center\">Do you sometimes have the feeling that you’re running into the same obstacles over and over again? Many of my conflicts have the same feel to them, like “Hey, I think I’ve been here before,</p> <img  src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/team-5.jpg\" class=\"round icon\"> <h6  class=\"\">John Doe</h6> <p  class=\"small italic\">Company name</p></div> </div></div> </div></div><div  id=\"cta-1\" data-label=\"Cta\" data-id=\"cta-blue-section\" data-export-id=\"cta-blue-section\" data-category=\"cta\" class=\"cta-blue-section content-section content-section-spacing-medium bg-color1 white-text\"><div  class=\"gridContainer\"> <div  class=\"row middle-xs\"><div  class=\"col-sm-8 space-bottom-xs\" data-type=\"column\"> <h2  class=\"\">Join us! <span  class=\"font-300\">It will only take a minute</span></h2> </div> <div  class=\"col-sm-4 end-sm\" data-type=\"column\"> <a  class=\"button color2\" href=\"#\">GET STARTED TODAY</a></div> </div></div> </div><div  id=\"team-2\" style=\"background-color: #ffffff;\" data-label=\"Team\" data-id=\"team-2\" data-export-id=\"team-2\" data-category=\"team\" class=\"team-2 content-section content-section-spacing\"><div  class=\"gridContainer\"> <div  class=\"row text-center\"><div  class=\"section-title-col\" data-type=\"column\"> <h2  class=\"\">Our Team</h2> <p  class=\"lead\">There are number of instructions to be followed at the time of refilling an inket cartridge. So whenever your printer ink runs dry you need to follow the below steps for inkjet cartridge refill.</p></div> </div> <div  class=\"row spaced-cols content-center-sm\" data-type=\"row\"> <div  class=\"col-sm-6 col-md-3\"> <div  class=\"card y-move no-padding bordered\"> <img  class=\"face\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/team-1.jpg\"> <div  data-type=\"column\" class=\"col-padding-small col-padding-small-xs description-container\"> <h4  class=\"font-500\">Team Member</h4> <p  class=\"small\" style=\"font-style: italic;\">Job Title</p> <div  class=\"social-icons-group\" data-type=\"group\"> <a  href=\"#\"><i  class=\"gray fa icon fa-facebook-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-twitter-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-linkedin-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-google-plus-square small\"></i></a></div> </div></div> </div> <div  class=\"col-sm-6 col-md-3\"> <div  class=\"card y-move no-padding bordered\"> <img  class=\"face\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/team-2.jpg\"> <div  data-type=\"column\" class=\"col-padding-small col-padding-small-xs description-container\"> <h4  class=\"font-500\">Team Member</h4> <p  class=\"small\" style=\"font-style: italic;\">Job Title</p> <div  class=\"social-icons-group\" data-type=\"group\"> <a  href=\"#\"><i  class=\"gray fa icon fa-facebook-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-twitter-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-linkedin-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-google-plus-square small\"></i></a></div> </div></div> </div> <div  class=\"col-sm-6 col-md-3\"> <div  class=\"card y-move no-padding bordered\"> <img  class=\"face\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/team-3.jpg\"> <div  data-type=\"column\" class=\"col-padding-small col-padding-small-xs description-container\"> <h4  class=\"font-500\">Team Member</h4> <p  class=\"small\" style=\"font-style: italic;\">Job Title</p> <div  class=\"social-icons-group\" data-type=\"group\"> <a  href=\"#\"><i  class=\"gray fa icon fa-facebook-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-twitter-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-linkedin-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-google-plus-square small\"></i></a></div> </div></div> </div> <div  class=\"col-sm-6 col-md-3\"> <div  class=\"card y-move no-padding bordered\"> <img  class=\"face\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/team-2.jpg\"> <div  data-type=\"column\" class=\"col-padding-small col-padding-small-xs description-container\"> <h4  class=\"font-500\">Team Member</h4> <p  class=\"small\" style=\"font-style: italic;\">Job Title</p> <div  class=\"social-icons-group\" data-type=\"group\"> <a  href=\"#\"><i  class=\"gray fa icon fa-facebook-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-twitter-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-linkedin-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-google-plus-square small\"></i></a></div> </div></div> </div>    </div> </div></div><div  id=\"latest-news-1\" style=\"background-color: #f5fafd;\" data-label=\"Latest-news\" data-id=\"blog-section\" data-export-id=\"blog-section\" data-category=\"latest_news\" class=\"blog-section blog-section-standard content-section content-section-spacing\"><div  class=\"gridContainer\"> <div  class=\"row\"><div  data-type=\"column\" class=\"section-title-col\"> <h2  class=\"\">Latest News</h2> <p  class=\"lead\">Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.</p></div> </div> <div  class=\"row\"> <div  data-type=\"row\" data-dynamic-columns=\"handled\" data-content-shortcode=\"mesmerize_latest_news\">[mesmerize_latest_news]</div></div> <div  class=\"row\"><div  class=\"text-center\"> <a  class=\"button color1\" data-attr-shortcode=\"href:mesmerize_blog_link\" href=\"[mesmerize_blog_link]\">SEE ALL BLOG POSTS</a></div> </div></div></div><div  id=\"contact-1\" data-label=\"Contact\" data-id=\"contact-1\" data-export-id=\"contact-1\" data-category=\"contact\" class=\"contact-1 content-section content-section-spacing white-text\" data-parallax-depth=\"20\"><div  class=\"gridContainer\"> <div  class=\"row text-center\"><div  class=\"section-title-col\" data-type=\"column\"> <h2  class=\"\">Contact us</h2> <p  class=\"lead\">With the Internet spreading linke wildfire and reaching every part of our daily life, more and more traffic is directed to websites in search for information.</p></div> </div> <div  class=\"row text-center\"> <div  class=\"col-xs-12 col-sm-8 col-sm-offset-2 contact-form-wrapper inline-info\"> <div  class=\"card large-padding\"> <div  class=\"\" data-content-shortcode=\"mesmerize_contact_form\" data-editable=\"true\">[mesmerize_contact_form]</div></div> </div></div> </div></div>','Front Page','','inherit','closed','closed','','1491-revision-v1','','','2020-11-26 03:54:50','2020-11-26 03:54:50','',1491,'https://www.datarainbow.eu/1491-revision-v1/',0,'revision','',0),(1687,2,'2020-11-26 06:36:06','2020-11-26 06:36:06','','Screenshot 2020-11-26 at 06.35.36','','inherit','open','closed','','screenshot-2020-11-26-at-06-35-36','','','2020-11-26 06:36:06','2020-11-26 06:36:06','',975,'https://www.datarainbow.eu/wp-content/uploads/2020/07/Screenshot-2020-11-26-at-06.35.36.png',0,'attachment','image/png',0),(1688,2,'2020-11-26 06:36:14','2020-11-26 06:36:14','<!-- wp:paragraph -->\n<p>A major <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=228677&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=9745404\">decision issued by the ECJ </a>on Thursday 16th of July invalidated toe Transatlantic data flow agreement between the EU and the US for the second time after the Safe Harbor invalidation by the ECJ. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>NEW IMPORTANT UPDATE 24th July 2020</strong> - <a href=\"https://noyb.eu/en/next-steps-eu-companies-faqs\">NOYB Next Steps for EU companies &amp; FAQs</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>FISA 702+EO 12333 have no territorial limitation. They also apply to servers in the EU that are operated by a US \'electronic communication service provider\' or where certain operations are outsourced to a US provider. The location for hosting is therefore irrelevant.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Any non-EU/EEA provider had the duty to inform you about laws like <a href=\"https://twitter.com/hashtag/FISA?src=hashtag_click\">FISA</a> 702 and EO 12.333. If they have not done so, they are liable for all costs that result from cancelling the SCCs and transferring data back to the EU/EEA…</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> The <a href=\"https://twitter.com/hashtag/PrivacyShield?src=hashtag_click\">#PrivacyShield</a> Decision was an incorrect executive decision by the European Commission. In theory, damages claims can be brought against the EU under Article 340 TFEU.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>providers may have sufficiently limited the factual access (\'possession, custody or control\') from US entities, so that an EU/EEA server is factually beyond the reach of the US govt.” I wonder if such controls are possible without full separation </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/next-steps-eu-companies-faqs\"></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is a complex decision based on the constatation that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> U.S. surveillance programs are not limited to what is strictly necessary and proportional as required by EU law on Fundamental Rights. Therefore EU data subjects do not have a right to effective legal remedies in the U.S. to ensure compliance with provisions of EU law when their data is used for national surveillance programs.The authorities of the EU Member States have insufficient powers and means to take effective action in relation to data subjects’ complaints based on allegedly unlawful processing in a third country.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>We will attempt a Synthetic and immediate analysis of what has been shaking the privacy community and international corporations in the world this end of the week. At first read, the Privacy Shield is invalidated with immediate effect. Data export to the US cant be replaced by two other legal instruments which have been said valid in principle by the ECJ, specifically Standard Contractual Clauses and Binding Corporate Rules $Article 49 GDPR derogations). </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In the absence of an adequacy decision, the controller or processor should t<strong>ake measures to compensate for the lack of data protection in a third country by way of appropriate safeguards for the data subject</strong>. Such appropriate safeguards may consist of making use of binding corporate rules, standard data protection clauses adopted by the Commission, <strong>standard data protection clauses adopted by a supervisory authority or contractual clauses authorised by a supervisory authority</strong>. Those safeguards should ensure compliance with d<strong>ata protection requirements and the rights of the data subjects appropriate to processing within the Union, including the availability of enforceable data subject rights and of effective legal remedies, including to obtain effective administrative or judicial redress and to claim compensation</strong>, in the Union or in a third country. They should relate in particular to compliance with the general principles relating to personal data processing, the principles of data protection by design and by default.  </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs and BCRs are subject to a strict requirement to implement a case by case analysis and assessment. A complex issue unanswered at this stage.<br>One certainty for organisations that relied on the framework of the Privacy Shield mechanism as a legitimate basis of data transfer to the US, this mechanism has been invalidated - only not for the UK ICO !!!. Thousands of companies who relied on Privacy Shield will have to find another solution.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First observation, this is a judicial position versus a political stand. In other words, the ECJ ruling is based on rule of law - application of the General Data Protection Regulation (GDPR) - versus the EU Commission\'s position. The EU Commission had reviewed the Privacy Shield the last two years not finding anything wrong with it. Max Schrems has been fighting with a small, rather powerless Irish Data Protection Commissioner (DPC) that has spent large amounts of the tax payer’s money to combat Schrems\' request.<br>The question initially to the Irish DPC was to estimate if there was sufficient protection for Facebook to transfer personal data to the US ?<br><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Paragraph 103 of the ECJ decision states :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, although that provision does not list the various factors which must be taken into consideration for the purposes of assessing the adequacy of the level of protection to be observed in such a transfer, Article 46(1) of that regulation states that data subjects must be afforded appropriate safeguards, enforceable rights and effective legal remedies.<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Further, in Paragraph 113 :  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In that regard, as the Advocate General also stated in point 148 of his Opinion, the supervisory authority is required, under Article 58(2)(f) and (j) of that regulation, to suspend or prohibit a transfer of personal data to a third country if, in its view, in the light of all the circumstances of that transfer, the standard data protection clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.<br> look at all circumstances and check if protection by other means is possible.</p><p><br>Paragraph 143 to add:</p><p>Return data, destroy data, and notify the DS and DPA “If the recipient of personal data to a third country has notified the controller, pursuant to Clause 5(b) in the annex to the SCC Decision, that the legislation of the third country concerned does not allow him or her to comply with the standard data protection clauses in that annex, it follows from Clause 12 in that annex that data that has already been transferred to that third country and the copies thereof must be returned or destroyed in their entirety. In any event, under Clause 6 in that annex, breach of those standard clauses will result in a right for the person concerned to receive compensation for the damage suffered.”<br></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A valid objection has been expressed that other countries access to data with less transparency. However, the US surveillance and data access stands out from its scale and capabilities, despite a relative transparency in the US national security laws. Furthermore, the US corporations\' position of quasi -monopoly means massive collection and curation of data. Not only data is massively collected and at risk of access by the US government, EU Data subjects suffer the lack of effective judicial review in the US where there cannot be redress unless a damage is proven. Therefore, EU citizens will not have a mean of complaint about their data transferred to the US</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I - What the ECJ based its decision on&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR</li><li>The European Charter of Human Rights (ECHR) mainly articles 7, 8, 46, 47, 48 and the Charter of Fundamental Rights</li><li>Visa of JUGEMENTS <br>- judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, paragraph 47 Jehovah, <br>- Schrems judgment of 6 October 2015, Schrems, C‐362/14, EU:C:2015:650, in particular paragraphs 51, 73 <br>- judgments of 24 September 2019, Google (Territorial scope of de-referencing) (C‐507/17, EU:C:2019:772), and of 1 October 2019, Planet49 (C‐673/17, EU:C:2019:801)<br>- judgment of 10 July 2018, Jehovan todistajat, C‐25/17, EU:C:2018:551, paragraph 37 <br>- judgments of 26 February 2013, Åkerberg Fransson, C‐617/10, EU:C:2013<br>- judgment of 20 March 2018, Menci, C‐524/15, EU:C:2018:197, paragraph 24<br> judgments of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; and of 18 October 2016, Nikiforidis, C‐135/15, EU:C:2016:774, paragraph 28 <br>- judgment of 17 December 1970, Internationale Handelsgesellschaft, 11/70, EU:C:1970:114, paragraph 3; of 13 December 1979, Hauer, 44/79, EU:C:1979:290, paragraph 14; </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Despite the Commission’s review of the Privacy Shield</li><li>in light of Edouard Snowden\'s revelations of the NSA bilk data collection , and based on FISA 702 / Prism / Cloud Act <br></li><li> the right of data subject, not sufficiently protected by Ombudsman</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ECJ decision  invalidated the Privacy Shield, however Standard Contractuel Clauses (SCCs) are in principal OK only if it documented that there will be no FISA interception and data subject rights respected. Not an easy condition. The devil is in the detail. How by a case by case analysis, these SCCs could be made compatible with the rights of data subjects as guaranteed by the GDPR ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s interesting to note that :<br> - the decision of the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=ecj&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6690567639938433025\">ECJ</a>&nbsp;was first published on the US Twitter Platform before reaching their own website.<br>- the Irish DPC Hellen Dixon opted to express her first reactions on US LinkedIn live platform as a guest of the US IAPP - the main certification organisation for privacy practitioners <br>- and the US Future of the Privacy Forum, using the US cloud videoconferencing app, Zoom.<br>What did the court said about data flow to the US and the Privacy Shield ?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>No grace period has been given</li><li>the Commission\'s reaction  has been to say \'we will modernise SCCs\' - Article 288 TFEU, a Commission adequacy decision</li><li>The Irish DPC has ‘welcomed’’ the judgement after spending tax payers money to combat Schrems!!</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>At this stage, we are left with many uncertainties. As mentioned above, thousands of companies rely on data transfer to the US. So SCCs and BCRs are the only option left, only IF they are adapted and re-evaluated with the DPAs supervision. Here is what the EDPB has said in its statement reacting to the ECJ decision :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> “While the SCCs remain valid, the CJEU underlines the need to ensure that these maintain, in practice, a level of protection that is essentially equivalent to the one guaranteed by the GDPR in light of the EU Charter. The assessment of whether the countries to which data are sent offer adequate protection is primarily the responsibility of the exporter and the importer, when considering whether to enter into SCCs. When performing such prior assessment, the exporter (if necessary, with the assistance of the importer) shall take into consideration the content of the SCCs, the specific circumstances of the transfer, as well as the legal regime applicable in the importer’s country. The examination of the latter shall be done in light of the non-exhaustive factors set  out under Art 45(2) GDPR. out under2) GDPR.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Adding carefully</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“If the result of this assessment is that the country of the importer does not provide an essentially equivalent level of protection, the exporter may have to consider putting in place additional measures to those included in the SCCs. The EDPB is looking further into what these additional measures could consist of.” Hopefully, we will soon know more about these ‘additional measures’.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>To raise EU’s credibility, EU DPAs might want to show more actively their concerns about the EU Data Subject’s rights. DPAs will have to access the security of the data transfers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This data flow restriction is not exclusif to the US, they are other countries of non adequate data protection  such as China, Russia or India or in same bucket. The French CNIL has created of <a href=\"https://www.cnil.fr/en/data-protection-around-the-world\">a map world of data protection</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What organisations are going to do to better protect Personal Data ?<br>Ask the lawyers exchanging data across the channel, will they ensure the  data flow is adequately protected since this decision ?<br>Several easy options come to mind : First of all, and this is an all winner option, data minimisation. If you dont hold un-necessary that, you reduce you liability. Check your third party processors, compare them with the market. Data processing agreements must be signed with all processors, assessing their guarantees (obviously, this can\'t be extended to the possibilities of a government access). Apart from <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32010D0087&amp;from=en#ntr2-L_2010039EN.01001001-E0002\">SCCs</a>, <a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>. and a case by case analysis reviewing the data importer\'s security measures, data encryption or tokenisation can reduce the chances of access although at some point the data will need to be unencrypted and vulnerable. Using EU companies as processor, or or data storage as much as possible will avoid the data flow outside the EU. A Franco-Germanic project called <a href=\"https://www.cnbc.com/2020/07/17/gaia-x-europes-answer-to-us-and-chinese-tech-giants-power.html\">Gaia-X </a>might be the winner in this muddle. Still remains the question of US operating systems. Check all the tracing and tracking that incidentally enable data transfers. Many might not realise using third party cookies such as Google Analytics or Facebook Modernizr are means of transfer of data to US, making the website owner co-controller and therefore liable. Same applies to some of the widely used tools such as MailChimp or videoconferencing apps.<br> How will using Microsoft product will comply? The Department of Defence in France or the UK for instance are equipped with Microsoft. What data sovereignty ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.mediapost.com/publications/article/353780/microsoft-issues-statement-in-response-to-eu-data.html\">Microsoft published a statement</a> by Julie Brill, assuring :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p>“We want to be clear: If you are a commercial customer, you can continue to use Microsoft services in compliance with European law,” wrote Julie Brill, corporate vice president for global privacy and regulatory affairs at Microsoft. “The Court’s ruling does not change your ability to transfer data today between the EU and U.S. using the Microsoft cloud.”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>While the CNIL published on their Twitter account analysing the decision with their European colleagues, <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">three German DPAs - Berlin, </a><a href=\"https://datenschutz-hamburg.de/assets/pdf/2019-08-01_press-release-Google_Assistant.pdf\">Hamburg</a><a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\"> </a>and Rhineland-Palatinate <a href=\"http:// https://www.linkedin.com/pulse/after-schrems-ii-dpa-rhineland-palatinate-provides-christopher\">quickly published statements </a>inviting companies to suspend data transfer and even to repatriate the data back to the EU. Great proactive reaction. However, we can hope the EDPB will ensure the consistency mechanism of the application of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government statement </a>expressed their disappointment :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'It is disappointed that the EU’s adequacy decision for US Privacy Shield has been invalidated by the court in its judgment of 16th July 2020.\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractuel Clauses will have the same challenge : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>1- ensuring no access to the data by US Government using FISA and the Could Act </li><li>2- ensuring same level of protection for data subjects in the US.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Still many un-answered questions remain : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>What will happen with the Swiss Privacy Shield ? </li><li>What will the CCPA change the done ?</li><li>Will UK get adequacy decision after Brexit despite RIPA ?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Further reading :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote {\"className\":\"is-style-default\"} -->\n<blockquote class=\"wp-block-quote is-style-default\"><p><a href=\"https://www.dni.gov/files/icotr/Section702-Basics-Infographic.pdf\">Section 702</a> is a key provision of the FISA Amendments Act<br> of 2008 that permits the government to conduct targeted<br> surveillance of foreign persons located outside the United<br> States, with the compelled assistance of electronic<br> communication service providers, to acquire foreign<br> intelligence information</p><cite><a href=\"https://www.eff.org/702-spying\">Decoding 702: What is Section 702?</a><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/faqs-cjeu-case\">NOYB FAQ Questions</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/our-work-tools/our-documents/other/frequently-asked-questions-judgment-court-justice-european-union_en\">Frequently Asked Questions on the judgment of the Court of Justice of the European Union in Case C-311/18 - Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems - European Data Protection Board - European Data Protection Board</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edpb.europa.eu/news/news/2020/statement-court-justice-european-union-judgment-case-c-31118-data-protection_en\">Statement on the Court of Justice of the European Union Judgment in Case C-311/18 - Data Protection Commissioner v Facebook Ireland and Maximillian Schrems&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.commerce.gov/news/press-releases/2020/07/us-secretary-commerce-wilbur-ross-statement-schrems-ii-ruling-and\">U.S. Secretary of Commerce Wilbur Ross Statement on Schrems II Ruling and the Importance of EU-U.S. Data Flows</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gov.uk/government/news/uk-government-response-to-the-european-court-of-justice-decision-in-the-schrems-ii-case\">UK Government response to the European Court of Justice decision in the Schrems II case</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://iapp.org/news/a/using-sccs-post-schrems-ii-guidance-from-dpas/?mkt_tok=eyJpIjoiWkRsbVl6a3pZakJpTkRKaiIsInQiOiJSSVBkRGVVdFdBTXRUdDAzQzN5NktITWRaVG9QVnQ3U2hpeTQ2K09UU3BpWlJlVzZucTZjODVhSFFuV0VKcG1PdVpKQTErSTdVV09DNFJIYlwvQzl0bWxLYVVhZUxMa29QVkR4SVJcL1R6TUJpWkFlTjd2V0pFVDlpTXRXYmQ0WEdBIn0%3D&amp;utm_content=135417219&amp;utm_medium=social&amp;utm_source=linkedin&amp;hss_channel=lcp-10094295\">Using SCCs post-\'Schrems II\': Guidance from DPAs</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/07/17/the-schrems-ii-judgment-of-the-court-of-justice-and-the-future-of-data-transfer-regulation/\">The Schrems II judgment of the Court of Justice and the future of data transfer regulation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://europeanlawblog.eu/2020/01/07/international-data-transfers-standard-contractual-clauses-and-the-privacy-shield-the-ag-opinion-in-schrems-ii/\">International data transfers, standard contractual clauses, and the Privacy Shield: the AG Opinion in Schrems II</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.emeralddeleeuw.com/home/schremsii\">Schrems II (C-311/18) and the Invalidation of the Privacy Shield — Emerald de Leeuw</a><a href=\"https://gdpr-info.eu/art-47-gdpr/\">Binding Corporate Rules</a>,&nbsp;<a href=\"https://gdpr-info.eu/art-40-gdpr/\">approved code of conduct</a>, or&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">derogations for specific situations</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gillpayne.com/2020/07/european-court-of-justice-landmark-judgement-strikes-down-eu-us-privacy-shield/\">EUROPEAN COURT OF JUSTICE LANDMARK JUDGEMENT STRIKES DOWN EU-US PRIVACY SHIELD</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/07/schrems-ii-takeaways-accountability-in-privacy-shield-out-uks-adequacy-determination-at-risk.html\">Schrems II takeaways: Accountability IN: Privacy Shield OUT; UK’s adequacy determination AT RISK</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www-forbes-com.cdn.ampproject.org/c/s/www.forbes.com/sites/stewartroom/2020/07/19/has-europe-signalled-the-beginning-of-privacy-law-self-isolation-and-lockdown/amp/\">Has Europe Signalled The Beginning Of Privacy Law Self-Isolation And Lockdown?</a><a href=\"https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6\">https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://medium.com/golden-data/schrems-and-the-future-of-eu-us-cross-border-data-transfers-13970bf500b6\">Schrems and the future of EU-US data transfers (or lack thereof…)&nbsp;</a>this is a LONG article. An interesting US view. It has some good elements but still missing few important points. No mention of the lawful basis of processing and the obligation of transparency FB failed. Why should there be any doubt on Facebook’s basis of data transfer to the US while SCC or Privacy Shield should be clearly stated in their privacy notice. Also no reference to the Cambridge Analytica interference into élections and manipulation of public opinion. I think this was a wake up call to many on the sort of game FB was playing when collecting data and profiling. Facebook is one player in the game, they are other big ones, US corporations have somehow grow so big that they are nous out of control even for the US government. I suggest reading Professor Lawrence Lessig on the point of Lobbying and corruption of the US Congress. Are EU countries much better? Well, surely they don’t have the same power. Plus there is some sort of partnership between EU countries offering some sort of guarantee. The EU is based on free mouvement of people and goods. Therefore the directive 95 came to ensure the free flow of data within member states. The real terror created by the 9/11 tragedy is the rising level of state surveillance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>State surveillance is the real threat to freedom and individual human rights. All Western countries have taken oppressive measures. What US has done is again one level higher with clear segregation against the rights of foreign citizens. Yes, in the EU we do care about our fundamental rights as much as the US is focused on free speech, Unlike the free speech in the US, The right to privacy and data protection are not absolute and have to be balanced with other fundamental rights. The right to privacy and data protection are différent despite being interconnected. Europe is a patchwork of sovereign nations with various cultures and legal systems. \nI fully agree with the authors ‘there are deep cultural differences between EU and US and you definitely need someone on your side that actually speaks and thinks “European” on this one.’\nBoth EU and US need each other. Transatlantic trade is essential but not at the cost of EU citizens rights. We might have woken up a bit late. Not sure we can actually stop the GAFAM with not enough EU competitors. Better late than never? It’s time for the Commission to play it’s role and negotiate a fairer agreement. I don’t believe a code of conduct could be sufficient. It won’t be an easy game.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Schrems-II Invalidation of the Privacy Shield by the ECJ','','inherit','closed','closed','','975-revision-v1','','','2020-11-26 06:36:14','2020-11-26 06:36:14','',975,'https://www.datarainbow.eu/975-revision-v1/',0,'revision','',0),(1689,2,'2020-11-26 06:37:32','2020-11-26 06:37:32','<!-- wp:paragraph -->\n<p>Legal and Regulatory Responses to Technology Challenges</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Octobre 2020, I participated to this online event organised by the Practicing Law Institute PLI.  I participated, along with EU and US experts, on the first panel on E.U. Developments in Platform Regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pli.edu/programs/online-platforms\">The material remains available on demand until Octobre 2021.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I focused on Chapitre V, Lawful data transfer and the Schrems-II European Court of Justice decision in July 2020. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During the day, various speakers develop other aspects of online platforms:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Learn about the geopolitical and industry rivalries and debates about platforms and popular technologies</li><li>Hear about the implications of Brexit for platform regulations</li><li>Understand how the pandemic has affected, and will profoundly affect, issues relating to privacy, surveillance, AI and algorithms, and other topics</li><li>Gain insight into the politicization of social media platforms and communication technologies</li><li>Find connections among seemingly disparate topics of hate speech, copyright, and “fake news” through the lens of “content moderation”</li><li>Benefit from perspectives of seasoned in-house counsel, advisors, and litigators</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:image {\"id\":1068} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/11/Screenshot-2020-10-21-at-18.29.03-1024x489.png\" alt=\"\" class=\"wp-image-1068\"/></figure>\n<!-- /wp:image -->','Online Platforms and Popular Technologies 2020','','inherit','closed','closed','','1074-revision-v1','','','2020-11-26 06:37:32','2020-11-26 06:37:32','',1074,'https://www.datarainbow.eu/1074-revision-v1/',0,'revision','',0),(1690,2,'2020-11-26 06:39:25','2020-11-26 06:39:25','','Screenshot 2020-11-26 at 06.38.29','','inherit','open','closed','','screenshot-2020-11-26-at-06-38-29','','','2020-11-26 06:39:25','2020-11-26 06:39:25','',898,'https://www.datarainbow.eu/wp-content/uploads/2020/05/Screenshot-2020-11-26-at-06.38.29.png',0,'attachment','image/png',0),(1691,2,'2020-11-26 06:39:31','2020-11-26 06:39:31','<!-- wp:paragraph -->\n<p>In UK, like in many countries, the contact tracing app is presented as the solution to get out of lockdown. Is technology really the right solution?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Much has been written and the debate is still ongoing. We have published an article on <a href=\"https://datarainbow.eu/2020/04/29/stop-covid-combattre-la-pandemie-sans-perdre-la-democratie/\">the French government project of STOPCOVID. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK NHSX project is another centralised contact tracing App. A first tryout has started on the Isle of Wight since Tuesday May 2nd.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">I - </a>A<strong>nalysing the data protection compliance aspects of the project, from&nbsp;</strong><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\"><strong>Chris Pounder of Amber-walk has published his&nbsp;views</strong></a><strong> </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://amberhawk.typepad.com/amberhawk/2020/05/covid-19-how-the-gdpr-applies-to-trace-and-track.html\">COVID-19: how the GDPR applies to trace and track.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- Emphasis is put in the voluntary adoption of the measure as requested by most EU Data Protection Authorties.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Chris Pounder develops, ‘<em>NHSX claim that every operation related to the APP is voluntary (e.g. to download, to communicate to a central database if need be). Users can choose to delete the APP at any time; this would also delete the data on the phone but not any data previously uploaded to NHSX’s central database.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data is pseudonymised more than anonymised as it can be re-identifiable, therefore it will be the GDPR and not the ePrivacy Directive that will apply</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the absence of a published DPIA, Chris reminds the government promise that ‘T<em>he APP does not use any identifier already on the phone (e.g. phone number, SIM card identifier) or location details.’ The APP generates a random ID number exchanged with other phones that have also downloaded the APP. This record will remain on both phones for 14 days. When someone is COVID+ this record will trace back the contacts with a warning message for the user</em> .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- The APP should not keep any personal information and no location data. Only the first half of the postcode is collected from APP users to alert local hospitals.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, for <a href=\"https://tech.newstatesman.com/coronavirus/uncertainty-over-who-could-access-nhsx-contact-tracing-app-data-as-pilot-goes-live\">Laurie Clarke reporter</a>, remains :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>‘<em>Uncertainty over who could access NHSX contact tracing app data as Isle of White pilot goes live’. ‘The NHSX coronavirus contact tracing app is being rolled out on the Isle of Wight this week, but major question marks still hang over the app. Matthew Gould, CEO of NHSX, told parliament today that the data collected by the app would be accessible to unspecified organisations as long as it was used for public health purposes. ‘</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>3- For Chris Pounder, ‘</strong><em><strong>there are three definitional issues:</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>(<em>a) is personal data processed? </em></li><li><em>b) if so, who is the controller processing personal data? and </em></li><li><em>(c) if there is a controller, does the voluntary nature of the APP equate to “data subject consent”?</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject is identifiable and the data related to medical health. He is therefore ‘<em>pretty sure the APP is processing personal data and special category of personal data</em>’, subject to the Article 6  lawful basis and a condition that overcomes the prohibition in Article 9(1) from processing health personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Controller, there would be joint controllers as he points to the NHSX website stating that “<em>NHS England and NHS Improvement and the Department of Health and Social Care are delivering NHSX together” This bring to the Article 26 that requires any processing of personal data “shall in a transparent manner determine their respective responsibilities</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the emphasis is on the voluntary adoption of the App, the next question  is on ”<em>data subject consent</em>”. Chris points out that <em>‘the NHS text on the website is very careful to avoid the use of the “C word” and it is easy to see why</em>’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 43 states that with respect to consent: “<em>consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller</em>” This will be the case where the controller is a public authority or an employer. It will be unlikely for that consent to be considered as ‘<em>freely given</em>’. Therefore voluntary adoption does not refer the character of legitimate basis on consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The limit of the ‘<em>voluntary</em>’ adoption he sees is that it could lead to a denial of a service as previously for the ‘<em>ID Card holders refused to “volunteer” making it a requirement to interact with any public service.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The first comment is that any interference by a public authority (NHSX) is unlikely to infringe Article 8(1) [_<a href=\"https://awallon.com:15001/oo/r/546619490369058645\">GDPR08</a>_]&nbsp;of the European Convention on Human Rights; This is because Article 8(2) permits legislation to be enacted by a Parliament process (e.g. in the Coronavirus 2 which sets aside the A.8(1) right in limited circumstances (e.g. any interference deemed&nbsp;<strong><em>necessary</em></strong>&nbsp; “<em>for the protection of health</em>”).&nbsp; It all hangs on the word “<em>necessary</em>”; it is either necessary or it isn’t. If there is reliance on data subject consent (which we think is unreliable), then there is also no A.8 breach (so long consent is properly formed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the GDPR/DPA2018,  <em>‘if the processing is “necessary” it will have Article 6 lawful basis (e.g. candidates are A.6(1)(c) or A.6(1)(e); A.6(1)(d) could be used in a case-by-case emergency). If there is need for an A.9 condition that lifts the prohibition on processing of health personal data the candidates are A.9(2)(c), A.9(2)(g), A.9(1)(i), Schedule 1, paragraphs2, 3 or 6 of the DPA2018</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>‘<em>If there is reliance on consent or necessary or public task (or even necessary legitimate interests of controller/Third Party), the controller has to specify publicly (A.13; A.14) what happens to the personal data if there withdrawal of consent or exercise of the exercise of the right to object to the processing.’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, in he concludes ‘<em>the ICO should take up Article 8 ECHR cases on the grounds that necessary as used in the GDPR has the same meaning as in Article 8.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><strong>II - The UK like France has opted for the centralised model </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The App is encountering technical issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://www.iacr.org/misc/statement-May2014.html\">UK ICO</a> like the <a href=\"https://www.cnil.fr/fr/publication-de-lavis-de-la-cnil-sur-le-projet-dapplication-mobile-stopcovid\">French CNIL</a> have expressed their preference for the decentralised model for a decentralised model. Chris Pounder sees further vulnerability of the centralised approach  with a ‘<em>future legislative mood of Government</em>’. He believes ‘<em>It could be tempting (e.g. to reduce the pressures on the public purse) for Government to enact legislation that makes certain processing of personal data compulsory. For instance, to prove entitlement to a COVID related benefit</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p> <em>\'Considering to revert to a decentralised model to resolve their Bluetooth issues. ‘Covidsafe app is not working properly on iPhones, authorities admit’ ‘Australians running the Covidsafe contact tracing app on iPhones may not be recording all the data required if they don’t have the app running in the foreground or they are using an older model phone, the government has admitted.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://uk.reuters.com/article/us-health-coronavirus-france-tech/france-accuses-apple-of-refusing-help-with-stopcovid-app-idUKKBN22H0LX\">France is struggling to find an agreement with Apple and Google</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theguardian.com/world/2020/may/06/covidsafe-app-is-not-working-properly-on-iphones-authorities-admit\">Australia who has already deployed the App has been struggling technically </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.theregister.co.uk/2020/05/05/uk_coronavirus_app/\">The Register</a> wrote: ‘<em>UK finds itself almost alone with centralized virus contact-tracing app that probably won\'t work well, asks for your location, may be illegal’. ‘On Monday, the UK government explained in depth and in clearly written language how its iOS and Android smartphone application – undergoing trials in the Isle of Wight – will work, and why it is a better solution to the one by Apple and Google that other nations have decided to adopt. It has also released a more technical explanation</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Running the Bluetooth connection in the back has several inconvenience such as draining the battery and opening security vulnerabilities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Furthermore, the Bluetooth distance measurement is unreliable <a href=\"https://www.nu.nl/tech/6046965/bluetoothuitvinder-gebruik-bluetooth-voor-corona-app-niet-erg-nauwkeurig.html\">according to its own inventor</a>. Bluetooth signals can pierce obstacles the virus hopefully cannot such as a wall or vehicle bodies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The margin of error has caused a return to lock down in Singapore, one of the first nations after China to deploy TraceTogether App. Less than 20% of the population actually downloaded the App It is suspected that Bluetooth works through glass and even some walls and may even be triggered by reflection in windows in buildings. Jason Bay Senior Director (Government Digital Services) at the Government Technology Agency, Singapore&nbsp;<a href=\"https://blog.gds-gov.tech/automated-contact-tracing-is-not-a-coronavirus-panacea-57fb3ce61d98\">wrote</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>If you ask me whether any Bluetooth contact tracing system deployed or under development, anywhere in the world, is ready to replace manual contact tracing, I will say without qualification that the answer is, No. Not now and, even with the benefit of AI/ML and — God forbid — blockchain ? (throw whatever buzzword you want), not for the foreseeabl</em>e future.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The amount of <strong>false alerts</strong> will cause major distress and reduce trust on the App. When someone receives the warning SMS that they have been in contact with someone COVID+, that doesn\'t mean the NHS can test them immediately. They might be asked to self isolate themselves which is not always technically possibly. It has been suggested in France that they would be hotels dedicated to quarantine. That means 14 days of accommodation, food and entertainment. During which time the person and his family or network will be under distress, maybe unnecessarily isolated causing loss of revenues. Should the government be liable for all that ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- These Apps are source of security issues</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The well known and security expert Bruce Schneier has expressed his concerns about the issues of using Bluetooth Technology <a href=\"https://www.schneier.com/blog/archives/2020/05/me_on_covad-19_.html\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"My problem with contact tracing apps is that they have absolutely no value,\" Bruce Schneier, a privacy expert and fellow at the Berkman Klein Center for Internet &amp; Society at Harvard University, told BuzzFeed News. \"I\'m not even talking about the privacy concerns, I mean the efficacy. Does anybody think this will do something useful? ... This is just something governments want to do for the hell of it. To me, it\'s just techies doing techie things because they don\'t know what else to do.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">SecurityWeek reporter Kevin Townsend wrote</a> ‘<em>These apps could easily become subject to a high number of false positives – and false positives always lead to a rejection by users. ‘ que faire du stresse, isolation et perte de revenus consécutives au faux positives alertes? Le BT transverse les murs et un automobiliste à proximité pourrait être décelé conne en ‘contact’</em> .  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cyberscoop.com/bluetooth-exploit-jan-ruge-contact-tracing/\">As contact tracing gains attention, a researcher pokes a hole in Bluetooth technology</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>If someone is reluctant to self quarantine, will they ignore the warning messages ?</li><li>The most at risk populations are the over 60x, will they be willing to download the app ?</li><li>What are going the security issues of opening the Bluetooth connection be?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Any data base creates security issues. New NHS contact-tracing app vulnerable to ‘<em>malicious false alerts</em>’, warn experts.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Additionaly, ‘<em>The new NHS contact-tracing app could be used to send malicious alerts causing people to isolate unnecessarily, it has been warned.</em></p><p><em>The app, which is being trialled in the Isle of Wight, tells users if someone they have been in proximity with may be suffering from coronavirus, meaning they could be exposed.</em></p><p><em>But because users can set off the warnings themselves by reporting symptoms – rather than positive Covid-19 test results – it could be used to send out false alerts.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\'Dr Michael Veale, a lecturer in digital rights and regulation at University College London who this week gave evidence to MPs on the technology, told The Independent that Britain’s tracing app had nothing to stop individuals “maliciously triggering notifications” using its normal functionality.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>“People can deliberately put others into quarantine or report large areas,” he said. “A child could try to get a day off school by reporting symptoms from a parent’s phone to trigger a quarantine.’</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Constant Bluetooth signals in the back will drain the phone battery eventually causing over heating. Will be see a new epidemic of ‘pockets in fire’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ICAR, the Association of  experts in Cryptologic research has issued a statement against mass surveillance <a href=\"https://www.iacr.org/misc/statement-May2014.html\">\'The Copenhagen Resolution\'</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>The membership of the IACR repudiates mass surveillance and the undermining of cryptographic solutions and standards. Population-wide surveillance threatens democracy and human dignity. We call for expediting research and deployment of effective techniques to protect personal privacy against governmental and corporate overreach.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> <a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">A technical deep-dive into the NHS COVID-19 contact tracing app</a> : Since \'<em>the contact tracing beta is now open source for both&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-iOS-BETA\" target=\"_blank\"><em>iOS</em></a><em>&nbsp;and&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-Android-BETA\" target=\"_blank\"><em>Android</em></a><em>, along with some&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://github.com/nhsx/COVID-19-app-Documentation-BETA\" target=\"_blank\"><em>documentation</em></a><em>. As a follow-up to our “</em><a href=\"https://reincubate.com/blog/staying-alive-covid-19-background-tracing/\"><em>Staying alive</em></a><em>” post, we’ve taken a deep-dive into the source code. It’s pleasantly surprising to find it licensed under MIT, indicating an NHSX commitment to transparency and quality... There have been claims that the Android app accesses location data, as the prompt for Bluetooth API access on Android devices appears to ask for location permissions. However, we debunked this yesterday: this is a consequence of how Android&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://developer.android.com/guide/topics/connectivity/bluetooth#Permissions\" target=\"_blank\"><em>manages requests for Bluetooth permissions</em></a><em>.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Reincubate’s CEO, Aidan Fitzpatrick, says:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yes, it is the case that the coming Apple&nbsp;<code>ExposureNotification</code>&nbsp;framework in iOS 13.5 obviates the need for these keepalives. However, it’s worth noting that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>iOS 13.5 has not been released, and may not be for some weeks</li><li>Prior to yesterday, the last iOS 13.5 beta had a&nbsp;<a href=\"https://siguza.github.io/psychicpaper/\" rel=\"noreferrer noopener\" target=\"_blank\">major security flaw</a>, suggesting heavy lifting is going on in Apple’s engineering teams</li><li>Once it is released, it will&nbsp;<a href=\"https://venturebeat.com/2020/01/29/as-ios-and-ipados-13-near-80-adoption-is-the-race-with-android-over/\" rel=\"noreferrer noopener\" target=\"_blank\">likely take months</a>&nbsp;for a majority of iOS users to install it (unusually, the equivalent Android adoption may be&nbsp;<a href=\"https://www.theverge.com/2020/4/13/21220033/android-covid-19-tracking-updates-google-play-contact-tracing\" rel=\"noreferrer noopener\" target=\"_blank\">more rapid</a>)</li><li>Older iOS devices — such as the iPhone 6 — cannot run iOS 13, and will not be able to use the Apple technique</li><li><em>There’s no reason why the NHS COVID-19 app won’t be able to automatically transition in future to using Apple’s framework — or even dual-running both mechanisms</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The app will become increasingly effective as more people use it, and the benefit of mass adoption will create a flywheel effect in this sense. The Australian COVIDSafe app struggled as it didn’t support detecting backgrounded iOS devices from an Android device, and it didn’t have this clever iOS-to-iOS keepalive mechanism.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to reflect on which circumstances make use of technology like this appropriate. If contact tracing is successful in saving lives, which criteria should be assessed as to whether it’s applied for future diseases? Once the precedent is set, is there an argument that this technology might be used to combat&nbsp;<em>pre-existing</em>&nbsp;infectious diseases? It’s foreseeable that different societies will evaluate the trade-offs differently.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>III - The balance of Proportionality requires a three party test :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Fundamental rights, enshrined in the Charter of Fundamental Rights of the European Union constitute the core values of the European Union . These rights must be respected whenever the EU institutions and bodies design and implement new policies or adopt any new legislative measure and in the ECHR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EU law which requires that \"<em>the content and form of Union action shall not exceed what is necessary to achieve the objectives of the treaties\"</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>the principle of proportionality requires that acts of the EU institutions be appropriate for attaining the legitimate objectives pursued by the legislation at issue and do not exceed the limits of what is appropriate and necessary in order to achieve those objectives\" . It therefore \"restricts the authorities in the exercise of their powers by requiring a balance to be struck between the means used and the intended aim (or Under Article 52(1) of the Charter, \"subject to the principle of proportionality, limitations </em><a href=\"#\"><em>onresult reached)\" the exercise of fundamental rights</em></a><em> may be made only if they are necessary (...</em>)\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>1- The necessity</strong>, Something needs to be done to end this national confinement killing the country’s economy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the Data Protection Impact Assessment published by <a href=\"https://www.fiff.de/dsfa-corona-file-en/at_download/file\">the Forum InformatikerInnen für Frieden und gesellschaftliche Verantwortung (FIfF) e. V. .</a> They recommend that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li> An appropriate legal basis must be established and in this respect responsibilities have to be defined. </li><li>Reinforcing the measures of pseudonymisation \'when creating the TempIDs in the app, it must be ensured that there is no connection between TempIDs and it must never be possible to make one. ...The server(s)’ operator must employ an effective separation method...\'</li><li>Accompanying the publication of the app it must be ensured in law and in fact that users have to disclose neither the status of the app nor the mere existence on a device to third parties. </li><li>Before the app gets published, a comprehensive investigation of the software and the overall system must be conducted and published by an independent body. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>2- Could the same result be achieved in a less intrusive way?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I would argue providing tests,, masks, ventilators and resources to over loaded NHS staff will bring a serious improvement with any inconvenient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The cost of the deployment of the NHSX App is unknown. The Australian Government would have allegedly spend 700.000 AUD just to host the data in Amazon AWS clouds. This is how much less resource the NHS will receive.<a href=\"https://www.securityweek.com/covid-19-contact-tracing-apps-effective-virus-risk-management-tools-or-privacy-nightmare\">h</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://martinralbrecht.wordpress.com/2020/05/03/open-letters-v-surveillance/﻿\">A letter, signed by 177 scientists and researchers working in the UK in the fields of information security and privacy, reads: </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<em>Echoing the letter signed by 300 international leading researchers, we note that it is vital that, when we come out of the current crisis, we have not created a tool that enables data collection on the population, or on targeted sections of society, for surveillance. Thus, solutions which allow reconstructing invasive information about individuals must be fully justified.1 Such invasive information can include the ‘social graph’ of who someone has physically met over a period of time. With access to the social graph, a bad actor (state, private sector, or hacker) could spy on citizens’ real-world activities.</em>”</p><p></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Actually, early testing can give far better results as epidemiologists are saying it is during the first 24 hours that the COVID+ are most contagious. <em><a href=\"https://news.sky.com/story/coronavirus-send-virus-alerts-within-24-hours-or-risk-second-wave-scientist-warns-11984908\">\'Coronavirus: Send virus alerts within 24 hours or risk second wave, scientist warns</a></em>\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.wired.co.uk/article/contact-tracing-apps-coronavirus\"><strong>IV - Coronavirus contact tracing apps were meant to save us</strong></a><strong>. They won’t. ‘With little evidence to show how effective such apps are and growing privacy concerns, there’s a risk they could do more harm than good‘ </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>From Iceland to Israel,&nbsp;</em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\"><em>more than 30 systems</em></a><em>&nbsp;are being developed by governments and health authorities. They promise to automate the laborious process of tracking down the contacts of infected individuals, helping to slow the spread of coronavirus through the population and save lives.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>False alerts might loose users trust. An Oxford research said that the probability of seeing any result from the tracing Apps requires that at least 60% of the population use the App. Will the most vulnerable population of over 60% be willing to download and use it ? Will the government be liable for the false alters causing distress, unnecessary isolation and loss of revenues? France is talking of self isolating in hotels, where and how feed and entertain these people? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Elsewhere projects using personal data to combat SARS-CoV-2 </a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://tracetogether.zendesk.com/hc/en-sg/articles/360046475654-20-April-2020-One-Month-On\"><em>Singapour’s TraceTogether App</em></a><em> moved to the The Apple and Google collaboration on digital contact tracing solutions, is a game-changer, as we said previously. It will significantly improve the contact tracing capability available to governments and public health authorities over what is available through public APIs on either Android or iOS platforms. We are glad that Apple and Google are engaging governments and public health authorities around the world, including us, to incorporate feedback as the specifications for their contract tracing protocol and private APIs.  </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.lexology.com/library/detail.aspx?g=e6e61ca3-45ae-49a0-b6f1-5fd4adf11291\">In Poland</a>, Although initially voluntary in nature, it has become mandatory for all those under obligatory quarantine or epidemiological surveillance, as a tool to confirm compliance with quarantine obligations (e.g. whether the ban on leaving the quarantine location is observed).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Contact tracing apps in Austria: a Red Cross initiative |Has been launched In March 2020 in co-operation with Accenture. </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The first published version of the Stopp Corona app required users to log their contacts via a \'manual\' handshake. In the current version, however, the app already allows contacts to be traced automatically, depending on the device and its configuration.&nbsp;</em></p><p><em>The automatic handshake functionality is based on the discovery and messaging functionality of the p2pkit developed by the Swiss company Uepaa, which uses Bluetooth and Wifi-direct techniques to determine the distance between the users.&nbsp;</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Switzerland: \"WeTrace\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>This project is ready to be deployed. It is open source. All data remains locally on the devices. Packaged information encrypted asymmetrically. The sole information a potential malfeasor on the central server would see is the fact _that_ an infected person has actually pushed a status update, but on the core server it is not visible \"what\" the person has broadcasted. The broadcasting user can determine the details of what should be broadcasted aside from status (location of contact, time of contact, etc.). Packages will be sent not to everyone but only to those that need to know.</em></p><cite><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Spain: \"Open Coronavirus\" app (Private)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The Spanish medical investigator Aurelia Bustos has released Open Coronavirus, an open-source app with the aim to copy the advantages of the South-Korean app: in the end, serving as an individual-validation-method in order to allow free movement of the citizens. This tool can be used by any public institution as a basis for its own apps on tracking citizens due to the coronavirus emergency, and it offers a modular design: three levels of management (mobile phone, central management of data by the competent authority and checking of the control points by the competent authority too) with different options of geolocation (GPS, bluetooth, positioning by mobile operators cells) that could be implemented or not by the corresponding institution. Its use would be voluntary for the citizen (although, in words of the medical investigator, \"it would be probably very advantageous for the user, as it would allow him/her to have the possibility to finish an eventually longer quarantine\"), and it would necessarily depend on the realization of any kind of coronavirus detection tests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>As this is an open-source app, that it will not be officially published in its current status, and any use of the same by any institutons must be always in line with GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sadly, it can be said of the NHSX Tracing App, similar to the French STOPCOVID, that <a href=\"https://www.lemonde.fr/idees/article/2020/04/25/stopcovid-est-un-projet-desastreux-pilote-par-des-apprentis-sorciers_6037721_3232.html\">«&nbsp;StopCovid est un projet désastreux piloté par des apprentis sorciers&nbsp;»</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE 8th May</strong>, The Financial Times reveals \'<a href=\"https://www.ft.com/content/446df516-4ec5-4c06-b39f-dd89ea5f6f0b\">UK starts to build second contact tracing app</a>\' going for a decentralised model in collaboration with Apple and Google.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The different existing systems&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.huffingtonpost.fr/entry/la-chine-lance-une-appli-pour-tracer-les-malades-du-coronavirus_fr_5e42b411c5b6bb0ffc18acfe\">The Chinese System based on geolocation</a></li><li><a href=\"https://github.com/DP-3T/documents\">The DP3T</a> Protocol&nbsp;(sous diverses variantes), sa déclinaison par l’alliance&nbsp;</li><li><a href=\"https://www.apple.com/covid19/contacttracing\">Apple/Google</a>&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/dp3t-pact-et-consorts-les-protocoles-de-contact-tracing-se-multiplient-39902703.htm\"> PACT- Est</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://pact.mit.edu/\">PACT-Ouest</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://github.com/TCNCoalition/TCN\">TCN</a> Protocol&nbsp;,&nbsp;</li><li><a href=\"https://www.zdnet.fr/actualites/l-inria-degaine-robert-son-protocole-pour-le-contact-tracing-39902499.htm\">ROBERT</a> Protocol&nbsp;.&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:image {\"id\":719} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/04/COVID_PEPP.png\" alt=\"\" class=\"wp-image-719\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Liste of <a href=\"https://gdprhub.eu/index.php?title=Projects_using_personal_data_to_combat_SARS-CoV-2\">Projects using personal data to combat SARS-CoV-2</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.technologyreview.com/2020/05/07/1000961/launching-mittr-covid-tracing-tracker/﻿\">MIT - A flood of coronavirus apps are tracking us. Now it’s time to keep track of them.</a>&nbsp;MIT have documented 25 individual, significant automated contact tracing efforts globally, including details on what they are, how they work, and what policies and processes have been put in place around them.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDRI <a href=\"https://edri.org/covid-19-digital-rights-document-pool/\">COVID-19 &amp; Digital Rights: Document Pool</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/sites/edp/files/publication/20-05-08_techdispatch-tracing_en.pdf\">Techdispatch&nbsp;\'</a>Contact Tracing with Mobile Applications\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:gallery {\"ids\":[930,931,932]} -->\n<figure class=\"wp-block-gallery columns-3 is-cropped\"><ul class=\"blocks-gallery-grid\"><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQe2X0AE1.png\" alt=\"\" data-id=\"930\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqe2x0ae1/\" class=\"wp-image-930\"/></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQexXQAYJ2.png\" alt=\"\" data-id=\"931\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqexxqayj2/\" class=\"wp-image-931\"/></figure></li><li class=\"blocks-gallery-item\"><figure><img src=\"/wp-content/uploads/sites/3/2020/05/EXezQfQX0AEk3.png\" alt=\"\" data-id=\"932\" data-link=\"https://datarainbow.eu/2020/05/06/nhsx-contacts-tracing-app/exezqfqx0aek3/\" class=\"wp-image-932\"/></figure></li></ul></figure>\n<!-- /wp:gallery -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://reincubate.com/blog/nhs-covid-19-background-tracing-details/\">Privacy International : A technical deep-dive into the NHS COVID-19 contact tracing app</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":933} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/EXethgcXgAAF4.jpeg\" alt=\"\" class=\"wp-image-933\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.privacyinternational.org/long-read/3752/coronavirus-tracking-uk-what-we-know-so-far\">UK government Covid tracking app: what you need to know!</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://insights.doughtystreet.co.uk/post/102g6tz/guide-to-coronavirus-offences-help-for-the-public-police-and-lawyers\">Guide to Coronavirus Offences. Help for the public, police and lawyers</a></em>&nbsp;by&nbsp;the&nbsp;Doughty&nbsp;Street&nbsp;Chambers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://axisofeasy.com/aoe/computer-model-that-locked-down-the-world-turns-out-to-be-shtcode/\">Computer model that locked down the world turns out to be sh*tcode.</a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A SPECIAL THANK YOU TO GRAEME McGOWAN for allowing me to use his beautiful photography.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://creativecommons.org/licenses/by/4.0/&amp;usg=ALkJrhhlCHDdIskVLuBz-aYeLh0JgcYicA\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>&nbsp;.</p>\n<!-- /wp:paragraph -->','NHSX Contacts Tracing App','Is NHSX UK centralised Tracing APP capable of best combat the COVID19 propagation? the Balance of proportionality looks rather weak. ','inherit','closed','closed','','898-revision-v1','','','2020-11-26 06:39:31','2020-11-26 06:39:31','',898,'https://www.datarainbow.eu/898-revision-v1/',0,'revision','',0),(1692,2,'2020-11-26 06:40:06','2020-11-26 06:40:06','','Screenshot 2020-11-26 at 06.38.39','','inherit','open','closed','','screenshot-2020-11-26-at-06-38-39','','','2020-11-26 06:40:06','2020-11-26 06:40:06','',0,'https://www.datarainbow.eu/wp-content/uploads/2020/05/Screenshot-2020-11-26-at-06.38.39.png',0,'attachment','image/png',0),(2066,1,'2021-06-21 21:53:12','2021-06-21 21:53:12','<!-- wp:image {\"id\":2056,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a-1024x518.jpeg\" alt=\"\" class=\"wp-image-2056\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, The Commission published the <a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\" rel=\"noreferrer noopener\">new Standard Contractual Clauses</a> long awaited. And today, the EDPB has published its<a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\" rel=\"noreferrer noopener\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with<br>the EU level of protection of personal data - Version 2.0 - Adopted on 18 June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Since Ed</a><a href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\" rel=\"noreferrer noopener\">w</a><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">ard Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data. The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by Art 82 GDPR. However, we still to see non material damage granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US Safe Harbour agreement then the Privacy Shield being invalidated by the European Court of Justice decisions (commonly known as Schrems-I and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the Charter of the Fundamental Rights of the European Union. with this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an equivalent level of protection for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a>) a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available)..</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japon and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give its green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EEA. This requires transfer impact assessment to assess the level of protection in a third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – supplementary measures need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be technical, organisational and/or contractual measures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs models pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a data mapping that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We see the cloud leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' BCR (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) can be more appropriate, usually within different establishments of a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> apply \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on</em>\' restrictive conditions</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU COMMISSION implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations for its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</em>\' This is the case when the importer is falls within the definition of <strong>Art 3(2)</strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a Data Processing Agreement Art 28 is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND judicial redress (EU courts competence) and/or arbitration will be provided. This is what was lacking with the Privacy Shield, an independent authority and the ombudsperson to deal with EU citizens complaints. The EDBP recommendation has not specified this case scenario. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered as transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden in the back of a drawer. The new SCCs requiere adaptation, they are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> for Data controller to Processor, Controller to controller, processor ro processor and Processor back to Controller. They need to be adapted, Third party have now the \'docking option\' to join the contract. They can be adapted as long as the nature of the clauses are not modified</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>, emphasised by the Commission document will not be an easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, data subjects should be provided with a copy of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>the data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start with data mapping, minimising, and securing access. Hold the data as a hot potato. Don’t keep it longer than necessary. Keep your archives out of the network. Limit access to data. Train your staff. Be ready for data breach</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly data heaven with the risk of opening backdoors to data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touch at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\" rel=\"noreferrer noopener\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 21:53:12','2021-06-21 21:53:12','',2054,'https://www.datarainbow.eu/?p=2066',0,'revision','',0),(2067,1,'2021-06-21 21:55:30','2021-06-21 21:55:30','<!-- wp:image {\"id\":2056,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a-1024x518.jpeg\" alt=\"\" class=\"wp-image-2056\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, The Commission published the <a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\" rel=\"noreferrer noopener\">new Standard Contractual Clauses</a> long awaited. And today, the EDPB has published its<a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\" rel=\"noreferrer noopener\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with<br>the EU level of protection of personal data - Version 2.0 - Adopted on 18 June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Since Ed</a><a href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\" rel=\"noreferrer noopener\">w</a><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">ard Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data. The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by Art 82 GDPR. However, we still to see non material damage granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US Safe Harbour agreement then the Privacy Shield being invalidated by the European Court of Justice decisions (commonly known as Schrems-I and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the Charter of the Fundamental Rights of the European Union. with this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an <strong>equivalent level of protection</strong> for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a>) a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available)..</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japon and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give its green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EEA. This requires transfer impact assessment to assess the level of protection in a third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – supplementary measures need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be technical, organisational and/or contractual measures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs models pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a data mapping that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We see the cloud leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' BCR (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) can be more appropriate, usually within different establishments of a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> apply \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on</em>\' restrictive conditions</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU Commission implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations for its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</em>\' This is the case when the importer is falls within the definition of <strong>Art 3(2)</strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a Data Processing Agreement Art 28 is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND judicial redress (EU courts competence) and/or arbitration will be provided. This is what was lacking with the Privacy Shield, an independent authority and the ombudsperson to deal with EU citizens complaints. The EDBP recommendation has not specified this case scenario. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered as transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden in the back of a drawer. The new SCCs requiere adaptation, they are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> for Data controller to Processor, Controller to controller, processor ro processor and Processor back to Controller. They need to be adapted, Third party have now the \'docking option\' to join the contract. They can be adapted as long as the nature of the clauses are not modified</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>, emphasised by the Commission document will not be an easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, data subjects should be provided with a copy of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>the data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start with data mapping, minimising, and securing access. Hold the data as a hot potato. Don’t keep it longer than necessary. Keep your archives out of the network. Limit access to data. Train your staff. Be ready for data breach</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly data heaven with the risk of opening backdoors to data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touch at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\" rel=\"noreferrer noopener\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 21:55:30','2021-06-21 21:55:30','',2054,'https://www.datarainbow.eu/?p=2067',0,'revision','',0),(2068,1,'2021-06-21 22:10:13','2021-06-21 22:10:13','<!-- wp:image {\"id\":2056,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a-1024x518.jpeg\" alt=\"\" class=\"wp-image-2056\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, The Commission published the <a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\" rel=\"noreferrer noopener\">new Standard Contractual Clauses</a> long awaited. And today, the EDPB has published its<a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\" rel=\"noreferrer noopener\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with<br>the EU level of protection of personal data - Version 2.0 - Adopted on 18 June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Since Ed</a><a href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\" rel=\"noreferrer noopener\">w</a><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">ard Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data. The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by Art 82 GDPR. However, we still to see non material damage granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US Safe Harbour agreement then the Privacy Shield being invalidated by the European Court of Justice decisions (commonly known as Schrems-I and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the Charter of the Fundamental Rights of the European Union. with this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an <strong>equivalent level of protection</strong> for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a>) a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available)..</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japon and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give its green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EEA. This requires transfer impact assessment to assess the level of protection in a third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – supplementary measures need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be technical, organisational and/or contractual measures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs models adopted by the Commission pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a data mapping that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We see the cloud leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' BCR (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) can be more appropriate, usually within different establishments of a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> apply \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on</em>\' restrictive conditions</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU Commission implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations for its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</em>\' This is the case when the importer is falls within the definition of <strong>Art 3(2)</strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a Data Processing Agreement Art 28 is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND judicial redress (EU courts competence) and/or arbitration will be provided. This is what was lacking with the Privacy Shield, an independent authority and the ombudsperson to deal with EU citizens complaints. The EDBP recommendation has not specified this case scenario. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered as transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden in the back of a drawer. The new SCCs requiere adaptation, they are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> for Data controller to Processor, Controller to controller, processor ro processor and Processor back to Controller. They need to be adapted, Third party have now the \'docking option\' to join the contract. They can be adapted as long as the nature of the clauses are not modified</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>, emphasised by the Commission document will not be an easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, data subjects should be provided with a copy of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>the data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start with data mapping, minimising, and securing access. Hold the data as a hot potato. Don’t keep it longer than necessary. Keep your archives out of the network. Limit access to data. Train your staff. Be ready for data breach</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly data heaven with the risk of opening backdoors to data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touch at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\" rel=\"noreferrer noopener\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 22:10:13','2021-06-21 22:10:13','',2054,'https://www.datarainbow.eu/?p=2068',0,'revision','',0),(1694,2,'2020-11-26 06:41:20','2020-11-26 06:41:20','<!-- wp:paragraph -->\n<p>Thursday, 19th January 2017, the French ‘Office parlementaire d\'évaluation des choix scientifiques et technologiques (OPECST)’ hold a public hearing on Artificial Intelligence in the Senate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Five ‘table ronde’ or round table were organised mostly with academics on the different aspects of the societal moves due to Artificial Intelligence (AI or IA in French) :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The technologies related to the AI ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Strategic dimensions in AI research ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Political, societal and economical questions raised by the development of AI ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ethical issues raised by AI ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Legal challenges due to the application of AI.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was pointed that some milestone progress on deep learning has been achieved. Machines have surpassed human champions in most intellectually challenging games, including Chess, Scrabble, Othello, even Jeopardy. On March 2016, the Google AlphaGo DeepMind’s Artificial Intelligence program beat Lee Sedol, the strongest Go player in the world. Go—a 2,500-year-old game is far more complex than Chess. An exceptional powerful computer had to process more than 30 million moves. In 2011, IBM Watson won against two of Jeopardy\'s greatest champions creating a big buzz in the tech community. It was early 1996 when Deep Blue won its first game against a world chess champion, when it defeated Garry Kasparov. Gerard Sabah, Research Directeur at CNRS points that IBM Watson used 3000 processors, far more than any publicly available computer, disposing over 3 million pages of encyclopaedia. Benoit Le Blanc, Lecturer in Computer Science at the Polytechnic Institute of Bordeaux (IPB) , Deputy Director of the Ecole Nationale Supérieure de Cognitique in Bordeaux (ENSC), Researcher in the Cognition and Human Engineering (CIH) team of the Laboratory of Materials Integration (IMS), Ecole Nationale Supérieure de Cognitique de Bordeaux (ENSC), insists on the importance of interdisciplinary and human-machine collaboration. He reminded that these results were only possible thanks to the feed of experienced human expert players.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Machines can process large amount of data much faster than any human. They still can’t take initiative. They can’t make sense of what they do. They would not be able to explain why they did it. Furthermore, as Francois TADDEI mentioned, machines can perform in one area, can win a specific game, remaining unable to play any other game Machines lack the capacity to question themselves, still a human exclusivity. For Jean-Daniel Kant, Professor at University Pierre et Marie Curie, the future of machine learning is in the multidisciplinary study to understand and recreate human behaviour. Collective Artificial Intelligence system can achieve multi-agents, autonomous machines. The objectif being to create intelligent machines to replace human.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>David Sadek, Directeur of research at Institut des Mines, Institut des Telecoms, points that machines are not yet capable of emotional intelligence. They lack reasoning, unable of producing language or any introspection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Jean-Gabriel Ganascia, Professor at Paris University of Science Pierre et Marie Curie, LIPSIS, President of the Ethics Committee, mentions the technical progress made in Facial recognition. Google\'s Facenet accuracy is said to be of 99,63 %, higher than any human performance. The result is achieved thanks to the study of 200 million images. Another area of progress concerns Conversational agents such as Amazon\'s Echo or Apple\'s Siri.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Gerard Sabah explains how Google Deep Dream can recognise a cat within millions of images, however still would not know how to explain what a cat is. He sees the future of the AI in hybridation of AI and human.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Artificial Intelligence raises several ethical challenges. In case of imminence of a collision, who should the autonomous car, protect at first? The car, the driver, a pedestrian, or…? Human and machine’s logical thinking do not have same considerations. On the question of appropriate human decision making, David Sadek mentioned the a Battleship game used by US marines for training. The software always won the battle as it would its own ships drain if touched to maximise the progress.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Laurent Alexandre, Founder of Doctrissimo website and specialist of Transhumanisme, reminded there was no equivalent of Facebook or Google in Europe raising the issue of digital sovereignty.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several speakers mentioned the challenges of sovereignty, in Political, Financial, Judicial and even personal identities in a context where social media can know more on individuals ID than the government. What is France\'s position with regard to the major US companies who have considerably invested in AI- the GAFA, Google, Apple, Facebook and Amazon - financially and in human resources. on the other side, there is the BATX, Baidu, Alibaba, Tencent. Xiaomi. How could France retain its scientific forces and maybe offer more long term research budgets?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In France, academic research remains too isolated from the industry as mentioned by Yves Demazeau, Directeur de recherche au CNRS a Grenoble, Directeur de l’Association Française pour la recherche en Intelligence Artificielle (AFIA).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Gilles Dowek, Research directeur at l’INRIA and adjunct professor at l’ENS Paris-Saclay, suggested we spoke of Artificial intelligences, in plural as they are a variety of AI each with different ethical challenges.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Will machine ever be able to replace human? The impact of AI in the workplace remains uncertain. Would the least skilled jobs disappear or the intermediary level ones as consider Jean-Daniel KANT (professor a l\'university des Sciences, Pierre et Marie Curie) ? How many jobs will be created by the AI ? There is no clear answer. For Marie-Claire Carrere-Gee, Présidente du Conseil d’orientation pour l’emploi, only 10% of jobs would be threatened by the AI if the market adapts itself fast enough.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Should machine have a legal personality? Alain Bensoussan is an attorney specialised in advanced technologies defining himself as “the advocate for the rights of robots and their sovereignty”. According to him, the right must adapt to the growing role that Artificial Intelligence plays in our lives. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“Human freedom is framed by the legal entity and the freedom of other holders of rights and obligations is framed by a legal person. In the same way, because robots are automatons, intelligent maR chines capable of making decisions autonomously, I think that it is necessary to create the notion of a robot person. With everything that it implies: the robot’s identification so that we know who we addressing, responsibility, a governance equivalent to that of legal persons, a capital, an insurance and full traceability, like constant monitoring of their actions to use as proof of their eventual responsibility”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Alain Bensoussan is the author of a charter on the rights of robots. See Report for EU Parliament by Mady Delvaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Finally, another major challenge of AI is privacy compliance. Isabelle Falque-Perrotin, Data Protection Authority at the CNIL, reminded that AI had been identified by the privacy community during the International Conference of Data Protection and Privacy Commissioners in Marakech. She pointed the four factors making AI and data protection appear antinomic : 1- AI has a massive need of data, where data protection suppose data minimisation. 2- The principle of limitation of data storage, where AI needs to store data to memorise. 3- Data security, how to secure data that is invisible? 4- data subject rights suppose an informed consent, while the AI is a machine in constant transformation. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Still many challenges to overcome for a harmonious development of artificial intelligence in accordance with human rights.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was announced that the CNIL is launching a debate with all parties involved in AI. Following the Law for a Digital Republic, the CNIL has been tasked by Axelle Lemaire, French Deputy Minister for Innovation and Digital Affairs, to launch a wide reflection on the place of algorithms, organising a round of debate around this topic, which should be completed in September with a report on the subject.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ‘Conseil national du numérique (CNNum)’ will have to come up with a tool to collect public’s chalenges with algorithms, while INRIA will coordinate the launch of a platform called TransAlgo, for the development of the transparency and accountability of algorithmic systems. You can watch the video of the launch of Agoranov, the new French Artificial Intelligence strategy here.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have left out the questions of bioethics. What AI and robotics can bring to medical sciences? How will they disrupt genetics or radiology or skin cancer research for instance? Will robots replace doctors and should they become decision maker? I will post on this specific subject treated at a recent European Forum on Bioethics in Strasbourg.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Update : Google’s AlphaGo AI beats world’s best human Go player. This is a major step as Go is an even more complex game than chess responding to a more intuitive logic than the mathematical logic of the chess.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>AlphaGo retires from competitive Go after defeating world number one 3-0.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further read on Pearltrees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a Creative Commons Attribution 4.0 International License.</p>\n<!-- /wp:paragraph -->','France Initiatives to Tackle the Challenges of Artificial Intelligence','','inherit','closed','closed','','821-revision-v1','','','2020-11-26 06:41:20','2020-11-26 06:41:20','',821,'https://www.datarainbow.eu/821-revision-v1/',0,'revision','',0),(2005,2,'2020-12-11 21:42:42','2020-12-11 21:42:42','<!-- wp:paragraph -->\n<p>Pourquoi il est important que les visages des policiers en action doivent être floutés?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>S\'il est vrai que la liberté d\'expression et la liberté d\'information sont garantie par la Constitution francaise et la Convention Europeenne des Droits de l\'homme, la Protection de la vie privee est tout autant digne d\'interet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Quels sont les legislations applicables :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Ainsi, toute personne, même celle qui exerce des activités publiques, politiques, économiques ou professionnelles peut se prévaloir du principe du droit au respect de la vie privée.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;(<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=CELEX%3A32016R0679#d1e1559-1-1\" target=\"_blank\">voir l’article 4 paragraphe 2 du RGPD</a>), devrait donc normalement faire l’objet d’une autorisation par la personne concernée, par exemple le policier.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le traitement de données personnelles à des fins journalistiques, sauf cas exceptionnels, n’a pas à faire l’objet d’une autorisation<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Liberté d\'expression des citoyens, article 10 de la Convention, aux termes duquel</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"1. Toute personne a droit à la liberté d\'expression. Ce droit comprend la liberté d\'opinion et la liberté de recevoir ou de communiquer des informations ou des idées sans qu\'il puisse y avoir ingérence d\'autorités publiques et sans considération de frontière. Le présent article (art. 10) n\'empêche pas les États de soumettre les entreprises de radiodiffusion, de cinéma ou de télévision à un régime d\'autorisations.</p><p>2. L\'exercice de ces libertés comportant des devoirs et des responsabilités peut être soumis à certaines formalités, conditions, restrictions ou sanctions, prévues par la loi, qui constituent des mesures nécessaires, dans une société démocratique, à la sécurité nationale, à l\'intégrité territoriale ou à la sûreté publique, à la défense de l\'ordre et à la prévention du crime, à la protection de la santé ou de la morale, à la protection de la réputation ou des droits d\'autrui, pour empêcher la divulgation d\'informations confidentielles ou pour garantir l\'autorité et l\'impartialité du pouvoir judiciaire.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://hudoc.echr.coe.int/eng#{%22itemid%22:[%22001-62057%22]}\">https://hudoc.echr.coe.int/eng#{%22itemid%22:[%22001-62057%22]}</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Arrêt de 2011 sur la minimisation des données et anonymisation des fonctionnaires de police <a rel=\"noreferrer noopener\" href=\"https://t.co/a8caDVgFNh?amp=1\" target=\"_blank\">https://legifrance.gouv.fr/jorf/id/JORFTEXT000023865789/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 12.</strong> La garantie des droits de l\'Homme et du Citoyen nécessite une force publique : cette force est donc instituée pour l\'avantage de tous, et non pour l\'utilité particulière de ceux auxquels elle est confiée.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Code civil un&nbsp;<strong>article 9&nbsp;</strong> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><strong><em>\"chacun a droit au respect de sa vie privée\".</em></strong></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En Chypre \'A newspaper was fined €10,000 for publishing the names and photographs of police officers alongside allegations of unnecessary and unlawful detention. The Commissioner found that the aim of the news article could have been achieved without the officers being identified\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'A TV station and online newspaper operator was fined €5,000 for publishing, without consent, the photograph of a police informant who had expressed the wish to remain anonymous.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Principe de minimisation des données personnelles Art 5 du RGDP</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ne doivent traiter (diffuser sur internet, divulguer dans un article…) que les données personnelles nécessaires à la démonstration. L’impact sur la vie privée des personnes doit être le plus réduit possible, comme le prévoit là encore le RGPD</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Inutile donc de montrer les visages de manifestants mais aussi de policier, si ce n’est pas nécessaire. Chacun a droit au respect de sa vie privée et les conséquences d’une diffusion massive de données personnelles peuvent être particulièrement désagréables, voire dramatiques pour certains, en particulier pour les agents des forces de l’ordre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Conclusion :</strong> lors d’une manifestation, toute personne peut prendre des images et les diffuser, à condition qu’elle agisse dans un but journalistique, qu’elle ne traite que le minimum utile de données personnelles (visages, voix de passants, etc.). Par ailleurs, les visages des agents de certains services d’intervention et de renseignement listés dans <a rel=\"noreferrer noopener\" href=\"https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000023865789&amp;categorieLien=id\" target=\"_blank\">un arrêté de 2011</a> doivent impérativement être floutées.</p>\n<!-- /wp:paragraph -->','Liberté d\'Expression, Liberté. d\'Information et la Protection de la Vie Privée','Pourquoi il est important que les visages des policiers en action doivent être floutés?','inherit','closed','closed','','1070-revision-v1','','','2020-12-11 21:42:42','2020-12-11 21:42:42','',1070,'https://www.datarainbow.eu/1070-revision-v1/',0,'revision','',0),(1695,2,'2020-11-26 06:42:34','2020-11-26 06:42:34','<!-- wp:paragraph -->\n<p>Pourquoi les visages des policiers en action doivent etre floutés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>S\'il est vrai que la liberté d\'expression et la liberté d\'information sont garantie par la Constitution francaise et la Convention Europeenne des Droits de l\'homme, la Protection de la vie privee est tout autant digne d\'interet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Quels sont les textes :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Ainsi, toute personne, même celle qui exerce des activités publiques, politiques, économiques ou professionnelles peut se prévaloir du principe du droit au respect de la vie privée.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;(<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/FR/TXT/?uri=CELEX%3A32016R0679#d1e1559-1-1\" target=\"_blank\">voir l’article 4 paragraphe 2 du RGPD</a>), devrait donc normalement faire l’objet d’une autorisation par la personne concernée, par exemple le policier.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>le traitement de données personnelles à des fins journalistiques, sauf cas exceptionnels, n’a pas à faire l’objet d’une autorisation<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Liberté d\'expression des citoyens, article 10 de la Convention, aux termes duquel</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"1. Toute personne a droit à la liberté d\'expression. Ce droit comprend la liberté d\'opinion et la liberté de recevoir ou de communiquer des informations ou des idées sans qu\'il puisse y avoir ingérence d\'autorités publiques et sans considération de frontière. Le présent article (art. 10) n\'empêche pas les États de soumettre les entreprises de radiodiffusion, de cinéma ou de télévision à un régime d\'autorisations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. L\'exercice de ces libertés comportant des devoirs et des responsabilités peut être soumis à certaines formalités, conditions, restrictions ou sanctions, prévues par la loi, qui constituent des mesures nécessaires, dans une société démocratique, à la sécurité nationale, à l\'intégrité territoriale ou à la sûreté publique, à la défense de l\'ordre et à la prévention du crime, à la protection de la santé ou de la morale, à la protection de la réputation ou des droits d\'autrui, pour empêcher la divulgation d\'informations confidentielles ou pour garantir l\'autorité et l\'impartialité du pouvoir judiciaire.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:embed {\"url\":\"https://hudoc.echr.coe.int/eng#{%22itemid%22:[%22001-62057%22]}\",\"type\":\"rich\",\"providerNameSlug\":\"embed-handler\"} -->\n<figure class=\"wp-block-embed is-type-rich is-provider-embed-handler\"><div class=\"wp-block-embed__wrapper\">\nhttps://hudoc.echr.coe.int/eng#{%22itemid%22:[%22001-62057%22]}\n</div></figure>\n<!-- /wp:embed -->\n\n<!-- wp:paragraph -->\n<p>Arrêt de 2011 sur la minimisation des données et anonymisation des fonctionnaires de police <a rel=\"noreferrer noopener\" href=\"https://t.co/a8caDVgFNh?amp=1\" target=\"_blank\">https://legifrance.gouv.fr/jorf/id/JORFTEXT000023865789/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art. 12. La garantie des droits de l\'Homme et du Citoyen nécessite une force publique : cette force est donc instituée pour l\'avantage de tous, et non pour l\'utilité particulière de ceux auxquels elle est confiée.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Code civil un&nbsp;<strong>article 9&nbsp;</strong> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><strong><em>\"chacun a droit au respect de sa vie privée\".</em></strong></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En Chypre A newspaper was fined €10,000 for publishing the names and photographs of police officers alongside allegations of unnecessary and unlawful detention. The Commissioner found that the aim of the news article could have been achieved without the officers being identified</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A TV station and online newspaper operator was fined €5,000 for publishing, without consent, the photograph of a police informant who had expressed the wish to remain anonymous.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Principe de&nbsp;minimisation des données personnelles Art 5 du RGDP</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ne doivent traiter (diffuser sur internet, divulguer dans un article…) que les données personnelles nécessaires à la démonstration. L’impact sur la vie privée des personnes doit être le plus réduit possible, comme le prévoit là encore le RGPD</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;Inutile donc de montrer les visages de manifestants mais aussi de policier, si ce n’est pas nécessaire. Chacun a droit au respect de sa vie privée et les conséquences d’une diffusion massive de données personnelles peuvent être particulièrement désagréables, voire dramatiques pour certains, en particulier pour les agents des forces de l’ordre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Conclusion&nbsp;: lors d’une manifestation, toute personne peut prendre des images et les diffuser, à condition qu’elle agisse dans un but journalistique, qu’elle ne traite que le minimum utile de données personnelles (visages, voix de passants, etc.). Par ailleurs, les visages des agents de certains services d’intervention et de renseignement listés dans&nbsp;<a href=\"https://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000023865789&amp;categorieLien=id\" target=\"_blank\" rel=\"noreferrer noopener\">un arrêté de 2011</a>&nbsp;doivent impérativement être floutées.</p>\n<!-- /wp:paragraph -->','Liberté d\'Expression, Liberté. d\'Information et la Protection de la Vie Privée','','inherit','closed','closed','','1070-revision-v1','','','2020-11-26 06:42:34','2020-11-26 06:42:34','',1070,'https://www.datarainbow.eu/1070-revision-v1/',0,'revision','',0),(1696,2,'2020-11-26 06:43:38','2020-11-26 06:43:38','<!-- wp:paragraph -->\n<p>\"<a href=\"http://themetapicture.com/woman-leaves-bad-online-review/\" target=\"_blank\" rel=\"noreferrer noopener\"><em>Woman Leaves Bad Online Review, The Owner Finds Out And Responds</em></a>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An angry customer, \'Sonal B.\' leaves a negative comment about a restaurant on Yelp. The offended manager replies publicly, and it all goes heatedly viral online. It\'s Sunday and with my Mediator\'s hat on and as a student learner of the online course on negotiation skills (Coursera Successful Negotiation Skills by University of Michigan), I thought I could dig the story a bit more.First, looking at the Yelp website, under Voltaire restaurant in KC, I don\'t seem to find the review. I searched for \'<em>Sonal B</em>\' KC, they are few, all blank profiles with no review!!Intrigued, I see the restaurant is at 1617 Genessee Street in KC, I searched for law firms nearby and they are few at the 1600, from employment law to dispute resolution ! I supposed Voltaire to be a French restaurant, in which case, I could easily imagine how they would be playing arrogance, if you know what I mean. Customer service and French don\'t really rhyme. Let\'s play Sonal B\'s advocate. First cultural clarification needed: Is this usual in the states that a restaurant would refuse to let customers take out their meal? I understand the manager\'s argument that the meal would not look nice out of the plate, however, is this not a client\'s decision? Nothing really goes against a risotto in box, does it?! Why on earth the waiter would not want to tell them which kind of stock they used for the risotto? Is this not a legitimate request? So, the customer could have few grants of complaint. I can accept that they were a bit lazy not just walking away to find another restaurant. After all, why should the restaurant serve them if they don\'t want to. Do they have an obligation to serve every customer? So, anyway, there is always two sides in each conflict. I bet the restaurant people could have been arrogant, they must not have liked the customer\'s arrogance, and no, no one likes you telling you have rights because you are a lawyer. However, not many online comments have taken the side of the customer.I wonder why the review is not on Yelp\'s website anymore.By the way, I am amazed on the way restaurants in the US can be \'diverse\', the name is French, but they serve, Italian, Vietnamese, even Persian kebab,.... !Digging up further, this time with my eCommerce and libel law expert hat. I noticed that the comment was made on the 1st of October responded in short time and gone viral since for being picked up by two sites Eater and Uproxx. It seems like the posts have been taken down despite Yelp saying they wouldn\'t (\'<em><strong>Your trust is our top concern,</strong>&nbsp;so businesses can\'t pay to alter or remove their reviews.</em>\'). You can still find&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.kansascity.com/living/liv-columns-blogs/chow-town/article2557634.html\" target=\"_blank\">reference to it</a>&nbsp;on the&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.yelp.com/topic/kansas-city-the-most-epic-yelp-response-ever?category=7\" target=\"_blank\">Yelp Shout-Outs</a>&nbsp;discussion page. So, from a marketing standpoint, the question is, should or should not a restaurant respond to negative reviews? If it does so, should it be in private or public? Think of the advertisement this case has created for the restaurant.<a rel=\"noreferrer noopener\" href=\"http://www.kansascity.com/living/liv-columns-blogs/chow-town/article2557634.html\" target=\"_blank\">This article</a>&nbsp;mentions another review left by this same Sonal B. Unfortunately, I don\'t seem to find it. Might be that....<a rel=\"noreferrer noopener\" target=\"_blank\">she has left Yelp</a>? From a quick look at the&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.facebook.com/UPROXX/posts/10152771736876337\" target=\"_blank\">comments</a>&nbsp;on Uproxx Facebook page, it appears that Sonal B has eventually closed her account, hope no one will guess the name of her lawyer husband.Thanks to an online connection in KC, I have been passed&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\">additional facts from the local press</a>. I am told that the review was taken down by the writer who had deactivated her accounts. \'She got slammed by the social media world for being an ass.\' I was told. This case is a great demonstration of why it worth monitoring your brand online. Just what big companies such as Nestle did not and paid the price (I am referring to the Palm oil attack against Nestlé by Greenpeace). I have to say that I often disagree with online marketers for only looking at the number of followers, the many clicks and not enough at the actual interest of readers for the subject. I can only say my message was broadcasted when I publish online. What tells me the actual impact of my message is if I had readers who \'liked\' or \'commented\' my piece. This is why I feel frustrated when my stats numbers tells me how many visitors I had on my blog if no one clicked \'like\' or posted a \'comment\'. By the way, please do comment or disagree with me if it\'s the case, I\'d love you to share your views. Coming back to this case, a simple response has not only stopped a customer from tarnishing a restaurant\'s reputation (because it could happen that more people would have taken the other party\'s side as I mentioned initially, there is always to sides on each story) even more, it has made the restaurant famous around the world and all that for the cost of......0 $. So, as a result,&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\">many potential clients</a>&nbsp;are now curious to know where this Voltaire is and would want to travel to KC just to try it. Eventually, with a little deeper digging, I was able to find<a rel=\"noreferrer noopener\" href=\"http://www.meetup.com/KCRoundtable/members/64292342/\" target=\"_blank\">&nbsp;the author of the comment</a>. She wrote in another site : \"<em>Hi! My name is Sonal Keenan Bhatia. My husband E.E. and I own a law firm which largely represents labor unions and plaintiffs. We are interested in legal technology solution-building and have some ideas we\'d like to create with the right partner..</em>.\" And this is where I take my Privacy hat to point out how what is supposedly \'anonymous\' and parse is curated by Google for all the pieces of the puzzle to be assembled to reveal the full picture. Finding the real identity of the author of the comment was a simple matter of a quick Google search. On this aspect, I can only refer you to the expert knowledge of Daniel Solove and invite you to watch his videos on YouTube to see examples of how a reputation and a persona can be destroyed online. See also&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.facebook.com/viktorms\" target=\"_blank\">Viktor Mayer-Schönberger</a>, author of \'<a rel=\"noreferrer noopener\" href=\"http://www.google.co.uk/url?url=http://www.amazon.co.uk/Delete-The-Virtue-Forgetting-Digital/dp/0691150362&amp;rct=j&amp;q=&amp;esrc=s&amp;sa=U&amp;ei=_OlDVMXHDOOE7gaj8YD4Cw&amp;ved=0CBsQFjAB&amp;sig2=7F6STfWV1YN93HbaqCTTaA&amp;usg=AFQjCNFtK5g7846CcXD6mpdNEoIpLMVBHA\" target=\"_blank\"><strong>Delete</strong>: The Virtue of Forgetting in the Digital Age</a>\' who has also great Youtube videos to watch if you don\'t want to read his book. This last point is connected to the current debate on the right to be forgotten, the ECJ decision ordering Google to delete link to website of defamation. One tricky balance to find between privacy, the right to be forgotten and the newsworthy right to be remembered as recently proclaimed by the BBC. A latent tension between privacy and freedom of speech. A very interesting Sunday, with this rapid analysis I wanted to share.I so love what I do.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.tripadvisor.co.uk/Hotel_Review-g1453682-d622439-Reviews-La_Chancellerie-Huismes_Loire_Valley_Centre_Val_de_Loire.html\" target=\"_blank\" rel=\"noreferrer noopener\">in contrast: How a manger\'s agressivity can worsen the negative review.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Update December 2016 :&nbsp;<a rel=\"noreferrer noopener\" href=\"http://thenextweb.com/insider/2016/12/15/can-no-longer-sued-leaving-negative-reviews-online/?utm_source=feedburner&amp;utm_medium=feed&amp;utm_campaign=Feed%3A+TheNextWeb+%28The+Next+Web+All+Stories%29\" target=\"_blank\">You can no longer be sued for leaving negative reviews online.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Thanks to Mark Lemley fro painting us to this other battle <a href=\"http://www.boston.com/food-dining/restaurants/2014/12/09/harvard-business-school-professor-goes-war-over-worth-chinese-food/KfMaEhab6uUY1COCnTbrXP/story.html﻿\">case between a Harvard Business professor and a Chinese restaurant. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is very interesting. Thanks for Fabrice Epelboin for sharing the<a href=\"http://www.leblogducommunicant2-0.com/2014/11/09/clash-du-president-de-huawei-contre-elise-lucet-ce-que-tout-dirigeant-devrait-retenir/﻿\"> link</a>. I recently wrote a piece on LinkedIn Pulse concerning the positive reaction of a manager in Atlanta to turn a customers negative online review to the advantage of his restaurant.  Here is what Huawei missed. A French TV reporter tried to interview him about the use of young children in a Chinese factory where they make Huawei\'s Smartphone screens. Not only he refused to respond and ignored the notorious journalist, he then went claiming he\'ll ask all his business network CEOs to refuse to give her any interview. Oh dear Sir, you had it all wrong and will have to face the anger of social media. His Twitter excuse won\'t do much I am afraid. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\'Le Tronc d\'Arbre\', Photo by Tara Taubman-Bassirian - Licence CC</em></p>\n<!-- /wp:paragraph -->','How an Online Negative Review Can Be Positively Exploited','An angry customer leaves a negative comment about a restaurant on Yelp. The offended manager replies publicly, and it all goes heatedly viral online','inherit','closed','closed','','844-revision-v1','','','2020-11-26 06:43:38','2020-11-26 06:43:38','',844,'https://www.datarainbow.eu/844-revision-v1/',0,'revision','',0),(2075,1,'2021-06-21 23:06:10','2021-06-21 23:06:10','<!-- wp:image {\"id\":2056,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a-1024x518.jpeg\" alt=\"\" class=\"wp-image-2056\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet. The <a href=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" data-type=\"URL\" data-id=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO is to publish a new set of Standard Contractual Clauses</a>. The Commission\'s SCCs will not apply to the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, The Commission published the <a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\" rel=\"noreferrer noopener\">new Standard Contractual Clauses</a> long awaited. And today, the <a href=\"https://edpb.europa.eu/edpb_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/edpb_en\" target=\"_blank\" rel=\"noreferrer noopener\">EDPB</a> has published its<a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\" rel=\"noreferrer noopener\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with<br>the EU level of protection of personal data - Version 2.0 - Adopted on 18 June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Since Edward Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data (FISA section 702, EO 12333, US Cloud Act). The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a82\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a82\" target=\"_blank\">Art 82 GDPR</a>. However, we are still to see <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" target=\"_blank\">non-material damages</a> granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Safe Harbour agreement</a> then the <a rel=\"noreferrer noopener\" href=\"http://datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/(opens in a new tab)\" target=\"_blank\">Privacy Shield</a> being invalidated by the European Court of Justice decisions (commonly known as <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Schrems-I</a> and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the <a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" target=\"_blank\">Charter of the Fundamental Rights of the European Union</a>. With this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an <strong>equivalent level of protection</strong> for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a> a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japan and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate level of protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give it a green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EU/EEA. To allow data transfer, data exporters are required to process a <strong>transfer impact assessment</strong> to assess the level of protection in the third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus the implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – <strong>supplementary measures</strong> need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be <strong>technical, organisational and/or contractual measures</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractual Clauses models adopted by the Commission pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a<strong> data mapping</strong> that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We witness the clouds leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' Binding Corporate Rules (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) that can be more appropriate, usually established within a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> applies \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only</em>\' under restrictive conditions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU Commission\'s implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations around its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers <strong>only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</strong></em>\' This is the case when the importer falls within the definition of <strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a3\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a3\" target=\"_blank\">Art 3(2)</a></strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a <strong>Data Processing Agreement </strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a28\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a28\" target=\"_blank\"><strong>Article 28</strong> </a>is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND <strong>judicial redress</strong> (EU courts competence) AND/OR <strong>arbitration</strong> will have to be provided. This is what was lacking with the Privacy Shield, an independent authority and the <strong>ombudsperson</strong> to deal with EU citizens complaints. The EDBP recommendation has not specified the exclusion of importers subject to the GDPR. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data encryption</strong> can help, when the encryption key remain in Europe. That does not solve the problem when data needs to be accessed/processed in the country of import.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden at the bottom of a drawer. The new SCCs require adaptation, and regular assessments. These assessments have to be filed as the DPAs could request to access the logs. They are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Third parties have now the \'<strong>docking option</strong>\' to join the contract. They can be adapted as long as the nature of the clauses are not modified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Emphasised by the Commission\'s document, this will not be easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy. Data subjects have the right to be informed. Is this systematic or at request?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, <strong>data subjects should be provided with a copy </strong>of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>The data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start as soon as possible with <strong>data mapping</strong>, <strong>data minimising</strong>, and <strong>securing access</strong>. <strong>Hold the data as a hot potato.</strong> Don’t keep it longer than necessary. Keep your <strong>archives</strong> out of the network. Limit access to data. Train your staff. Be ready for data breach that is not anymore IF but WHEN it happens.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never have reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly <strong>data heaven</strong> with the risk of opening backdoors to data transfers to the US. Adequacy decision are to be reviewed after 4 years. Meanwhile, a DPA can challenge the decision based on an individual\'s complaint.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touched at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a rel=\"noreferrer noopener\" href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" data-type=\"URL\" data-id=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" target=\"_blank\" rel=\"noreferrer noopener\">Case Law Digest 2021: Transfers of personal data to third countries</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This document is not a legal advice. Simply a fresh analyse of the recent publications.</p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 23:06:10','2021-06-21 23:06:10','',2054,'https://www.datarainbow.eu/?p=2075',0,'revision','',0),(1698,2,'2020-11-26 06:51:26','2020-11-26 06:51:26','<div  id=\"overlappable-4\" style=\"background-color: #ffffff;\" data-label=\"Overlappable\" data-id=\"overlappable-4\" data-export-id=\"overlappable-4\" data-category=\"overlappable\" class=\"overlappable-4 content-section content-section-spacing\" data-overlap=\"true\"><div  class=\"gridContainer\"> <div  data-type=\"row\" class=\"row spaced-cols text-center\"><div  class=\"col-xs-12 col-sm-4 col-padding\"> <i  class=\"fa icon fa-clone large shadow-large-black round aligncenter reverse color1\"></i> <div  data-type=\"column\" class=\"\"> <h5  class=\"\">PUBLICATIONS</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.</p></div> </div> <div  class=\"col-xs-12 col-sm-4 col-padding\"> <i  class=\"fa icon fa-cogs large shadow-large-black round aligncenter reverse color1\"></i> <div  data-type=\"column\" class=\"\"><h5  class=\"\">DATA COMPLIANCE</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.</p></div> </div> <div  class=\"col-xs-12 col-sm-4 col-padding\"> <i  class=\"fa icon fa-magic large shadow-large-black round aligncenter reverse color1\"></i> <div  data-type=\"column\" class=\"\"><h5  class=\"\">RESSOURCES</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.</p></div> </div></div> </div></div><div  id=\"about-1\" style=\"background-color: #f5fafd;\" data-label=\"About\" data-id=\"about-1\" data-export-id=\"about-1\" data-category=\"about\" class=\"about-1 content-section\"><div  class=\"gridContainer\"> <div  class=\"row text-center\"><div  class=\"section-title-col\" data-type=\"column\"> <h5  class=\"\">LOREM IPSUM DOLOR</h5> <h2  class=\"\">Brand new WordPress theme&nbsp;<span  href=\"#\" style=\"font-weight: 700; font-family: Playfair Display,sans-serif; font-style: italic;\">with unlimited power</span>&nbsp;and customization possibilities</h2> <p  class=\"lead\">Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud.</p></div> </div> <div  class=\"row\"> <div  class=\"button-holder space-bottom space-bottom-small\" data-type=\"column\"> <a  class=\"button color1\" href=\"#\">GET STARTED NOW</a></div> <div  class=\"col-xs bottom-xs flexbox image-group-bottom-3-img space-bottom-xs center-xs\"> <img  class=\"left-img shadow-large-black\" data-size=\"500x300\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/computer-2569652.jpg\"> <img  class=\"center-img shadow-large-black\" data-size=\"500x300\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/apple-1838564.jpg\"> <img  class=\"right-img shadow-large-black\" data-size=\"500x300\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/laptop-2559795.jpg\"></div> </div></div> </div><div  id=\"features-3\" style=\"background-color: #ffffff;\" data-label=\"Features\" data-id=\"features-12-card-bordered\" data-export-id=\"features-12-card-bordered\" data-category=\"features\" class=\"features-12-card-bordered content-section content-section-spacing \"><div  class=\"gridContainer\"> <div  class=\"row text-center\"><div  class=\"section-title-col\" data-type=\"column\"> <h2  class=\"\">A few things we’re great at</h2> <p  class=\"lead\">Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.Ut enim ad minim veniam, quis nostrud exercitation.</p></div> </div> <div  class=\"row spaced-cols\" data-type=\"row\"> <div  class=\"col-sm-6\"> <div  class=\"card row-card bordered y-move\"> <div  class=\"row\"> <div  class=\"col-sm-fit icon-column\"> <i  class=\"fa icon fa-connectdevelop round bordered color2\"></i> </div> <div  class=\"col-sm\" data-type=\"column\"> <h5  class=\"color2\">FLEXIBLE CODE</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.</p></div> </div></div> </div> <div  class=\"col-sm-6\"> <div  class=\"card row-card bordered y-move\"> <div  class=\"row\"> <div  class=\"col-sm-fit icon-column\"> <i  class=\"fa icon fa-codepen round bordered color2\"></i> </div> <div  class=\"col-sm\" data-type=\"column\"> <h5  class=\"color2\">FLEXIBLE CODE</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.</p></div> </div></div> </div> <div  class=\"col-sm-6\"> <div  class=\"card row-card bordered y-move\"> <div  class=\"row\"> <div  class=\"col-sm-fit icon-column\"> <i  class=\"fa icon fa-cube round bordered color2\"></i> </div> <div  class=\"col-sm\" data-type=\"column\"> <h5  class=\"color2\">FLEXIBLE CODE</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.</p></div> </div></div> </div> <div  class=\"col-sm-6\"> <div  class=\"card row-card bordered y-move\"> <div  class=\"row\"> <div  class=\"col-sm-fit icon-column\"> <i  class=\"fa icon fa-database round bordered color2\"></i> </div> <div  class=\"col-sm\" data-type=\"column\"> <h5  class=\"color2\">FLEXIBLE CODE</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation.</p></div> </div></div> </div></div> </div></div><div  id=\"content-13\" style=\"background-color: #f5fafd;\" data-label=\"Content\" data-id=\"content-2\" data-export-id=\"content-2\" data-category=\"content\" class=\"content-2 content-section content-section-spacing\"><div > <div  class=\"row middle-xs\"><div  class=\"col-sm-5 bg-image shadow-large-black\" data-bg=\"image\"></div> <div  class=\"col-sm-7 full-col-left-padding full-col-right-padding\"> <div  class=\"row\"> <div  data-type=\"column\" class=\"space-bottom-small content-title-col\"> <h5  class=\"\">CASE STUDY</h5> <h2  class=\"\">The Secret of Success</h2> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.</p></div> </div> <div  class=\"row spaced-cols \" data-type=\"row\"> <div  class=\"col-xs-6\" data-type=\"column\"> <h5  class=\"\">CAMERA</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</p></div> <div  class=\"col-xs-6\" data-type=\"column\"><h5  class=\"\">MUSIC CENTER</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</p></div> <div  class=\"col-xs-6\" data-type=\"column\"><h5  class=\"\">MESSAGES</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</p></div> <div  class=\"col-xs-6\" data-type=\"column\"><h5  class=\"\">CHANNELS</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</p></div> </div></div> </div></div> </div><div  id=\"content-14\" style=\"background-color: #ffffff;\" data-label=\"Content\" data-id=\"content-3\" data-export-id=\"content-3\" data-category=\"content\" class=\"content-3 content-section content-section-spacing\"><div > <div  class=\"row middle-xs\"><div  class=\"col-sm-7 full-col-left-padding full-col-right-padding\"> <div  class=\"row\"><div  data-type=\"column\" class=\"space-bottom-small content-title-col\"> <h5  class=\"\">CASE STUDY</h5> <h2  class=\"\">The Secret of Success</h2> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.</p></div> </div> <div  class=\"row spaced-cols\" data-type=\"row\"> <div  class=\"col-xs-6\" data-type=\"column\"> <h5  class=\"\">CAMERA</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</p></div> <div  class=\"col-xs-6\" data-type=\"column\"><h5  class=\"\">MUSIC CENTER</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</p></div> <div  class=\"col-xs-6\" data-type=\"column\"><h5  class=\"\">MESSAGES</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</p></div> <div  class=\"col-xs-6\" data-type=\"column\"><h5  class=\"\">CHANNELS</h5> <p  class=\"\">Lorem ipsum dolor sit amet, consectetur adipisicing elit.</p></div> </div></div> <div  class=\"col-sm-5 bg-image shadow-large-black revert-classes-holder\" data-bg=\"image\"></div></div> </div></div><div  id=\"portfolio-3\" style=\"background-color: #f5fafd;\" data-label=\"Portfolio\" data-id=\"portfolio-4\" data-export-id=\"portfolio-4\" data-category=\"portfolio\" class=\"portfolio-4 content-section content-section-spacing-top\"><div  class=\"\"> <div  class=\"row text-center\"><div  class=\"section-title-col\" data-type=\"column\"> <h2  class=\"\">Publications</h2> <p  class=\"lead\">With the Internet spreading linke wildfire and reaching every part of our daily life, more and more traffic is directed to websites in search for information.</p></div> </div> <div  data-type=\"row\" class=\"row\" data-fixed=\"true\"> <div  class=\"col-xs-12 col-sm-3 no-gutter-col\"> <div  class=\"contentswap-effect\" data-hover-fx=\"portfolio-4\"> <div  class=\"initial-image\"> <img  data-size=\"542x360\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/apple-1838564.jpg\"></div> <div  class=\"overlay bg-color1\"></div> <div  class=\"swap-inner col-xs-12\"> <div  class=\"row full-height-row middle-xs middle-sm\"> <div  class=\"col-xs-12 text-center content-holder\"> <a  href=\"#\"><i  class=\"fa fa-search icon big portfolio-icon\" aria-hidden=\"true\"></i></a></div> </div></div> </div></div> <div  class=\"col-xs-12 col-sm-3 no-gutter-col\"><div  class=\"contentswap-effect\" data-hover-fx=\"portfolio-4\"> <div  class=\"initial-image\"> <img  data-size=\"542x360\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/laptop-2559795.jpg\"></div> <div  class=\"overlay bg-color1\"></div> <div  class=\"swap-inner col-xs-12\"> <div  class=\"row full-height-row middle-xs middle-sm\"> <div  class=\"col-xs-12 text-center content-holder\"> <a  href=\"#\"><i  class=\"fa fa-search icon big portfolio-icon\" aria-hidden=\"true\"></i></a></div> </div></div> </div></div> <div  class=\"col-xs-12 col-sm-3 no-gutter-col\"><div  class=\"contentswap-effect\" data-hover-fx=\"portfolio-4\"> <div  class=\"initial-image\"> <img  data-size=\"542x360\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/computer-2569652.jpg\"></div> <div  class=\"overlay bg-color1\"></div> <div  class=\"swap-inner col-xs-12\"> <div  class=\"row full-height-row middle-xs middle-sm\"> <div  class=\"col-xs-12 text-center content-holder\"> <a  href=\"#\"><i  class=\"fa fa-search icon big portfolio-icon\" aria-hidden=\"true\"></i></a></div> </div></div> </div></div> <div  class=\"col-xs-12 col-sm-3 no-gutter-col\"><div  class=\"contentswap-effect\" data-hover-fx=\"portfolio-4\"> <div  class=\"initial-image\"> <img  data-size=\"542x360\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/laptop-2559795.jpg\"></div> <div  class=\"overlay bg-color1\"></div> <div  class=\"swap-inner col-xs-12\"> <div  class=\"row full-height-row middle-xs middle-sm\"> <div  class=\"col-xs-12 text-center content-holder\"> <a  href=\"#\"><i  class=\"fa fa-search icon big portfolio-icon\" aria-hidden=\"true\"></i></a></div> </div></div> </div></div> <div  class=\"col-xs-12 col-sm-3 no-gutter-col\"><div  class=\"contentswap-effect\" data-hover-fx=\"portfolio-4\"> <div  class=\"initial-image\"> <img  data-size=\"542x360\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/apple-1838564.jpg\"></div> <div  class=\"overlay bg-color1\"></div> <div  class=\"swap-inner col-xs-12\"> <div  class=\"row full-height-row middle-xs middle-sm\"> <div  class=\"col-xs-12 text-center content-holder\"> <a  href=\"#\"><i  class=\"fa fa-search icon big portfolio-icon\" aria-hidden=\"true\"></i></a></div> </div></div> </div></div> <div  class=\"col-xs-12 col-sm-3 no-gutter-col\"><div  class=\"contentswap-effect\" data-hover-fx=\"portfolio-4\"> <div  class=\"initial-image\"> <img  data-size=\"542x360\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/computer-2569652.jpg\"></div> <div  class=\"overlay bg-color1\"></div> <div  class=\"swap-inner col-xs-12\"> <div  class=\"row full-height-row middle-xs middle-sm\"> <div  class=\"col-xs-12 text-center content-holder\"> <a  href=\"#\"><i  class=\"fa fa-search icon big portfolio-icon\" aria-hidden=\"true\"></i></a></div> </div></div> </div></div> <div  class=\"col-xs-12 col-sm-3 no-gutter-col\"><div  class=\"contentswap-effect\" data-hover-fx=\"portfolio-4\"> <div  class=\"initial-image\"> <img  data-size=\"542x360\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/apple-1838564.jpg\"></div> <div  class=\"overlay bg-color1\"></div> <div  class=\"swap-inner col-xs-12\"> <div  class=\"row full-height-row middle-xs middle-sm\"> <div  class=\"col-xs-12 text-center content-holder\"> <a  href=\"#\"><i  class=\"fa fa-search icon big portfolio-icon\" aria-hidden=\"true\"></i></a></div> </div></div> </div></div> <div  class=\"col-xs-12 col-sm-3 no-gutter-col\"><div  class=\"contentswap-effect\" data-hover-fx=\"portfolio-4\"> <div  class=\"initial-image\"> <img  data-size=\"542x360\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/laptop-2559795.jpg\"></div> <div  class=\"overlay bg-color1\"></div> <div  class=\"swap-inner col-xs-12\"> <div  class=\"row full-height-row middle-xs middle-sm\"> <div  class=\"col-xs-12 text-center content-holder\"> <a  href=\"#\"><i  class=\"fa fa-search icon big portfolio-icon\" aria-hidden=\"true\"></i></a></div> </div></div> </div></div> </div></div> </div><div  id=\"testimonials-5\" style=\"background-color: #ffffff;\" data-label=\"Testimonials\" data-id=\"testimonials-5\" data-export-id=\"testimonials-5\" data-category=\"testimonials\" class=\"testimonials-5 content-section content-section-spacing\"><div  class=\"gridContainer\"> <div  class=\"row\"><div  data-type=\"column\" class=\"section-title-col\"> <h2  class=\"\">Client Testimonials</h2> <p  class=\"lead\">Don’t take our word for it – here’s what our clients say:</p></div> </div> <div  class=\"row spaced-cols content-center-sm\" data-type=\"row\"> <div  class=\"col-sm-4\"> <div  class=\"card y-move bordered\" data-type=\"column\"> <i  class=\"fa fa-quote-right icon color1 small quotation-icon\"></i> <p  class=\"text-center\">Do you sometimes have the feeling that you’re running into the same obstacles over and over again? Many of my conflicts have the same feel to them, like “Hey, I think I’ve been here before,</p> <img  src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/team-5.jpg\" class=\"round icon\"> <h6  class=\"\">John Doe</h6> <p  class=\"small italic\">Company name</p></div> </div> <div  class=\"col-sm-4\"> <div  class=\"card y-move bordered\" data-type=\"column\"> <i  class=\"fa fa-quote-right icon color1 small quotation-icon\"></i> <p  class=\"text-center\">Do you sometimes have the feeling that you’re running into the same obstacles over and over again? Many of my conflicts have the same feel to them, like “Hey, I think I’ve been here before,</p> <img  src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/team-5.jpg\" class=\"round icon\"> <h6  class=\"\">John Doe</h6> <p  class=\"small italic\">Company name</p></div> </div> <div  class=\"col-sm-4\"> <div  class=\"card y-move bordered\" data-type=\"column\"> <i  class=\"fa fa-quote-right icon color1 small quotation-icon\"></i> <p  class=\"text-center\">Do you sometimes have the feeling that you’re running into the same obstacles over and over again? Many of my conflicts have the same feel to them, like “Hey, I think I’ve been here before,</p> <img  src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/team-5.jpg\" class=\"round icon\"> <h6  class=\"\">John Doe</h6> <p  class=\"small italic\">Company name</p></div> </div></div> </div></div><div  id=\"cta-1\" data-label=\"Cta\" data-id=\"cta-blue-section\" data-export-id=\"cta-blue-section\" data-category=\"cta\" class=\"cta-blue-section content-section content-section-spacing-medium bg-color1 white-text\"><div  class=\"gridContainer\"> <div  class=\"row middle-xs\"><div  class=\"col-sm-8 space-bottom-xs\" data-type=\"column\"> <h2  class=\"\">Join us! <span  class=\"font-300\">It will only take a minute</span></h2> </div> <div  class=\"col-sm-4 end-sm\" data-type=\"column\"> <a  class=\"button color2\" href=\"#\">GET STARTED TODAY</a></div> </div></div> </div><div  id=\"team-2\" style=\"background-color: #ffffff;\" data-label=\"Team\" data-id=\"team-2\" data-export-id=\"team-2\" data-category=\"team\" class=\"team-2 content-section content-section-spacing\"><div  class=\"gridContainer\"> <div  class=\"row text-center\"><div  class=\"section-title-col\" data-type=\"column\"> <h2  class=\"\">Our Team</h2> <p  class=\"lead\">There are number of instructions to be followed at the time of refilling an inket cartridge. So whenever your printer ink runs dry you need to follow the below steps for inkjet cartridge refill.</p></div> </div> <div  class=\"row spaced-cols content-center-sm\" data-type=\"row\"> <div  class=\"col-sm-6 col-md-3\"> <div  class=\"card y-move no-padding bordered\"> <img  class=\"face\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/team-1.jpg\"> <div  data-type=\"column\" class=\"col-padding-small col-padding-small-xs description-container\"> <h4  class=\"font-500\">Team Member</h4> <p  class=\"small\" style=\"font-style: italic;\">Job Title</p> <div  class=\"social-icons-group\" data-type=\"group\"> <a  href=\"#\"><i  class=\"gray fa icon fa-facebook-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-twitter-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-linkedin-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-google-plus-square small\"></i></a></div> </div></div> </div> <div  class=\"col-sm-6 col-md-3\"> <div  class=\"card y-move no-padding bordered\"> <img  class=\"face\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/team-2.jpg\"> <div  data-type=\"column\" class=\"col-padding-small col-padding-small-xs description-container\"> <h4  class=\"font-500\">Team Member</h4> <p  class=\"small\" style=\"font-style: italic;\">Job Title</p> <div  class=\"social-icons-group\" data-type=\"group\"> <a  href=\"#\"><i  class=\"gray fa icon fa-facebook-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-twitter-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-linkedin-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-google-plus-square small\"></i></a></div> </div></div> </div> <div  class=\"col-sm-6 col-md-3\"> <div  class=\"card y-move no-padding bordered\"> <img  class=\"face\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/team-3.jpg\"> <div  data-type=\"column\" class=\"col-padding-small col-padding-small-xs description-container\"> <h4  class=\"font-500\">Team Member</h4> <p  class=\"small\" style=\"font-style: italic;\">Job Title</p> <div  class=\"social-icons-group\" data-type=\"group\"> <a  href=\"#\"><i  class=\"gray fa icon fa-facebook-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-twitter-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-linkedin-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-google-plus-square small\"></i></a></div> </div></div> </div> <div  class=\"col-sm-6 col-md-3\"> <div  class=\"card y-move no-padding bordered\"> <img  class=\"face\" src=\"https://www.datarainbow.eu/wp-content/plugins/mesmerize-companion/theme-data/mesmerize/sections/images/team-2.jpg\"> <div  data-type=\"column\" class=\"col-padding-small col-padding-small-xs description-container\"> <h4  class=\"font-500\">Team Member</h4> <p  class=\"small\" style=\"font-style: italic;\">Job Title</p> <div  class=\"social-icons-group\" data-type=\"group\"> <a  href=\"#\"><i  class=\"gray fa icon fa-facebook-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-twitter-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-linkedin-square small\"></i></a> <a  href=\"#\"><i  class=\"gray fa icon fa-google-plus-square small\"></i></a></div> </div></div> </div>    </div> </div></div><div  id=\"latest-news-1\" style=\"background-color: #f5fafd;\" data-label=\"Latest-news\" data-id=\"blog-section\" data-export-id=\"blog-section\" data-category=\"latest_news\" class=\"blog-section blog-section-standard content-section content-section-spacing\"><div  class=\"gridContainer\"> <div  class=\"row\"><div  data-type=\"column\" class=\"section-title-col\"> <h2  class=\"\">Latest News</h2> <p  class=\"lead\">Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.</p></div> </div> <div  class=\"row\"> <div  data-type=\"row\" data-dynamic-columns=\"handled\" data-content-shortcode=\"mesmerize_latest_news\">[mesmerize_latest_news]</div></div> <div  class=\"row\"><div  class=\"text-center\"> <a  class=\"button color1\" data-attr-shortcode=\"href:mesmerize_blog_link\" href=\"[mesmerize_blog_link]\">SEE ALL BLOG POSTS</a></div> </div></div></div><div  id=\"contact-1\" data-label=\"Contact\" data-id=\"contact-1\" data-export-id=\"contact-1\" data-category=\"contact\" class=\"contact-1 content-section content-section-spacing white-text\" data-parallax-depth=\"20\"><div  class=\"gridContainer\"> <div  class=\"row text-center\"><div  class=\"section-title-col\" data-type=\"column\"> <h2  class=\"\">Contact us</h2> <p  class=\"lead\">With the Internet spreading linke wildfire and reaching every part of our daily life, more and more traffic is directed to websites in search for information.</p></div> </div> <div  class=\"row text-center\"> <div  class=\"col-xs-12 col-sm-8 col-sm-offset-2 contact-form-wrapper inline-info\"> <div  class=\"card large-padding\"> <div  class=\"\" data-content-shortcode=\"mesmerize_contact_form\" data-editable=\"true\">[mesmerize_contact_form]</div></div> </div></div> </div></div>','Front Page','','inherit','closed','closed','','1491-revision-v1','','','2020-11-26 06:51:26','2020-11-26 06:51:26','',1491,'https://www.datarainbow.eu/1491-revision-v1/',0,'revision','',0),(2076,1,'2021-06-21 23:11:56','2021-06-21 23:11:56','<!-- wp:image {\"id\":2056,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a-1024x518.jpeg\" alt=\"\" class=\"wp-image-2056\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet. The <a href=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" data-type=\"URL\" data-id=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO is to publish a new set of Standard Contractual Clauses</a>. The Commission\'s SCCs will not apply to the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, on 18 June 2021 the Commission adopted the <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">new Standard Contractual Clauses</a> long awaited, for transfers of personal data to third countries as the GDPR prohibits the transfer of personal data to a country outside the EU unless the third country has been deemed adequate by the European Commission or one of the prescribed transfer mechanisms are in place. The role of the standard contractual clauses is limited to ensuring appropriate data protection safeguards for international data transfers. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Today, the <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/edpb_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/edpb_en\" target=\"_blank\">EDPB</a> adopted its<a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data - Version 2.0.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Since Edward Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data (FISA section 702, EO 12333, US Cloud Act). The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a82\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a82\" target=\"_blank\">Art 82 GDPR</a>. However, we are still to see <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" target=\"_blank\">non-material damages</a> granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Safe Harbour agreement</a> then the <a rel=\"noreferrer noopener\" href=\"http://datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/(opens in a new tab)\" target=\"_blank\">Privacy Shield</a> being invalidated by the European Court of Justice decisions (commonly known as <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Schrems-I</a> and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the <a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" target=\"_blank\">Charter of the Fundamental Rights of the European Union</a>. With this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an <strong>equivalent level of protection</strong> for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a> a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japan and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate level of protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give it a green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EU/EEA. To allow data transfer, data exporters are required to process a <strong>transfer impact assessment</strong> to assess the level of protection in the third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus the implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – <strong>supplementary measures</strong> need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be <strong>technical, organisational and/or contractual measures</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractual Clauses models adopted by the Commission pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a<strong> data mapping</strong> that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We witness the clouds leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' Binding Corporate Rules (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) that can be more appropriate, usually established within a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> applies \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only</em>\' under restrictive conditions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU Commission\'s implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations around its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers <strong>only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</strong></em>\' This is the case when the importer falls within the definition of <strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a3\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a3\" target=\"_blank\">Art 3(2)</a></strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a <strong>Data Processing Agreement </strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a28\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a28\" target=\"_blank\"><strong>Article 28</strong> </a>is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND <strong>judicial redress</strong> (EU courts competence) AND/OR <strong>arbitration</strong> will have to be provided. This is what was lacking with the Privacy Shield, an independent authority and the <strong>ombudsperson</strong> to deal with EU citizens complaints. The EDBP recommendation has not specified the exclusion of importers subject to the GDPR. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data encryption</strong> can help, when the encryption key remain in Europe. That does not solve the problem when data needs to be accessed/processed in the country of import.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden at the bottom of a drawer. The new SCCs require adaptation, and regular assessments. These assessments have to be filed as the DPAs could request to access the logs. They are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Third parties have now the \'<strong>docking option</strong>\' to join the contract. They can be adapted as long as the nature of the clauses are not modified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Emphasised by the Commission\'s document, this will not be easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy. Data subjects have the right to be informed. Is this systematic or at request?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, <strong>data subjects should be provided with a copy </strong>of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://gdprinfo.info/#a13.1.f\">Article 13(1)(f)</a> and <a href=\"https://gdprinfo.info/#a14.1.f\">Article 14(1)(f)</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Obligation of the controller to provide data subjects with information about the fact that it intends to transfer their personal data to a third country or in accordance with pursuant to</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>The data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start as soon as possible with <strong>data mapping</strong>, <strong>data minimising</strong>, and <strong>securing access</strong>. <strong>Hold the data as a hot potato.</strong> Don’t keep it longer than necessary. Keep your <strong>archives</strong> out of the network. Limit access to data. Train your staff. Be ready for data breach that is not anymore IF but WHEN it happens.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never have reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly <strong>data heaven</strong> with the risk of opening backdoors to data transfers to the US. Adequacy decision are to be reviewed after 4 years. Meanwhile, a DPA can challenge the decision based on an individual\'s complaint.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touched at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a rel=\"noreferrer noopener\" href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" data-type=\"URL\" data-id=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" target=\"_blank\" rel=\"noreferrer noopener\">Case Law Digest 2021: Transfers of personal data to third countries</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This document is not a legal advice. Simply a fresh analyse of the recent publications.</p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 23:11:56','2021-06-21 23:11:56','',2054,'https://www.datarainbow.eu/?p=2076',0,'revision','',0),(1958,2,'2020-12-10 13:11:41','2020-12-10 13:11:41','<!-- wp:paragraph -->\n<p>We are working on building a privacy compliant website. This site does not use any analytics.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"left\",\"id\":116,\"width\":360,\"height\":230} -->\n<div class=\"wp-block-image\"><figure class=\"alignleft is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-2.png\" alt=\"\" class=\"wp-image-116\" width=\"360\" height=\"230\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>We do not use cookies unless strictly functional. We are trying our best to not allow third parties to track our visitors by cookies or by Java Script embeded code. It\'s hard job. We might lose traffic and SEO. We have used a Word Press template.  WP templates are mainly server side PHP scripts full of board cascading code built on code. We can\'t even see the actual code.&nbsp;When using the WP admin, the templates are loaded in the back. We wanted to let make you aware that this potential risk. Help us by spreading the word. If you see anything suspicious, lets us know.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We believe our visitors deserve protection and privacy. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want your trust. In particular, we do not use Google analytics, avoiding to share data with external third parties.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1951,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-02-at-21.05.19-1024x528.png\" alt=\"\" class=\"wp-image-1951\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>To opt-out of tracking by adding the shortcode <code>[matomo_opt_out]</code> to your privacy page. You can <a href=\"https://www.datarainbow.eu/wp-admin/admin.php?page=matomo-settings&amp;tab=privacy\">tweak the opt-out to your liking - see the Privacy Settings</a>. We use Matomo Analytics on our website. By <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/wp-admin/admin.php?page=matomo-settings&amp;tab=tracking\" target=\"_blank\">disabling cookies in the tracking settings</a>, you might not need to ask for any cookie or tracking consent if the GDPR or ePrivacy applies to you <a rel=\"noreferrer noopener\" href=\"https://matomo.org/faq/new-to-piwik/how-do-i-use-matomo-analytics-without-consent-or-cookie-banner/\" target=\"_blank\">(learn more)</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><code>[matomo_opt_out]</code></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When links are posted, beware that they will take you to an external website that is hosted by a third-party provider not necessarily in your regional jurisdiction or that of DataRainbow. The company may collect, store and use information independent of DataRainbow including but not limited to IP address, browser details etc. DataRainbow has no control over the collection or use of this information. For more information on the linked sites Privacy Policy and the Lawful basis for this data collection, read their privacy notice/policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Most other web sites don\'t actually comply with the laws relating to data protection and privacy and as such it is impossible for us to guarantee that the sites we link to will not misuse your data. We hope regulators will enforce the law against these organisations. As such please always be mindful of clicking on links to third party web sites - we would recommend that you have various tools and plugins installed on your web browser to protect you such as:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>AdBlock Plus</li><li>NoScript</li><li>Privacy Badger</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Make sure that third party cookies and pop-ups are disabled in your web browser settings. We will produce a video showing you how to do this in the near future.</p>\n<!-- /wp:paragraph -->','Privacy Notice','','inherit','closed','closed','','85-revision-v1','','','2020-12-10 13:11:41','2020-12-10 13:11:41','',85,'https://www.datarainbow.eu/85-revision-v1/',0,'revision','',0),(2096,1,'2021-07-07 23:15:01','2021-07-07 23:15:01','<!-- wp:paragraph -->\n<p><strong>POURQUOI LE RESPECT DE LA VIE PRIVEE EST UNE IMPERATIVE</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Dans son ouvrage « Delete: The Virtue of Forgetting in the Digital Age », Viktor Mayer-Schonberger du Berkman Klein Center of Internet and Society, expose l’ombre permanente qui nous suit en ligne pour toujours. Les problèmes de dignité humaine et de liberté qui en découlent et sa solution suggérée : suppression automatique des fichiers par date d’expiration.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Rétablir le paramètre par défaut, du souvenir à l’oubli.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les parcelles d’informations éparses se regroupent et construisent une image, parfois déformée, qui nous poursuit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Selon la théorie de la conservation de l’énergie, les données ont une durée de vie trompeusement longue.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Rien n’est effacé.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Comme le souligne Viktor Mayer-Schonberger, le projet de génocide de la Stasi allemande aurait pris une toute autre dimension, et bien apocalyptique, si les capacités de recherches sur Google et l’indexation des données avaient existé à l’époque.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Il mentionne le cas du registre des citoyens néerlandais mis en place dans les années 1930. Pour assurer l’administration des titres sociaux, il comprenait les donnes de religion et d’ethnicité. Une fois que les nazis ont occupé les Pays-Bas, ils ont exploité le registre pour identifier les juifs à déporter et à envoyer dans des camps de concentration.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Un autre grand spécialiste de la vie privée, le professeur Daniel Solove, oeuvre activement à sensibiliser sur les questions de protection des données et les conséquences de la réputation en ligne.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Son article, «Je n’ai rien à cacher» et autres malentendus sur la confidentialité, explique pourquoi le respect de la vie privée est important. Il a plus amplement développé ses idées dans un essai : Rien à cacher: le faux compromis entre la vie privée et la sécurité.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Si vous continuez à penser que les seules personnes qui devraient s’inquiéter sont celles qui font quelque chose d’immorale ou d’illégale, vous devriez lire les essais et livres du Professeur Solove. Avec la masse de données et l’omni-surveillance ambiante (constante surveillance), la situation n’est pas seulement Orwellienne, mais kafkaïenne.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Dans une série de vidéos et de conférences YouTube, le Professeur Daniel Solove attire l’attention du public sur les cas de harcèlement en ligne.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La fille ‘Dog Pooh’ est l’histoire d’une pauvre fille. Elle est avec son chien dans le métro de la banlieue Sud-Coréenne. Le chien fait ses besoins dans le train, elle est pressée, elle quitte le train en refusant de nettoyer derrière. Autrefois, cela aurait été la fin de l’incident. Aujourd’hui, lorsque la persuasion en face à face échoue, il existe un plan B : l’humiliation anonyme sur Internet. Le témoin qui l’a enregistrée avec son smartphone, a mis en ligne la vidéo honteuse. En quelques jours, son identité et son passé ont été révélés. La vidéo devient alors virale à travers le monde. Des affiches et toutes sortes de plaisanteries s’ensuivent. Les médias ont relaté l’incident. Même le Washington Post américain a publié son histoire.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Elle a finalement atteint une renommée mondiale qu’elle aurait souhaité n’avoir jamais atteinte. Pour toujours, cette image la suivra. Cette fille sera reconnue comme la ‘<em>Dog Pooh Girl’</em> ‘la fille à la crotte de chien’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Une autre illustration, la triste histoire du ‘<em>Star Wars Kid’</em>. Un jeune garçon, un peu enrobé, au Canada. Il publie une vidéo de lui-même en ligne le montrant dans sa tentative, plutôt infructueuse, d’imiter George Lucas, célèbre star du cinéma. Sa vidéo a été regardée par des dizaines de millions d’internautes qui ont commenté et largement moqué son geste. Il a été moqué par le monde entier.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Un incident d’enfance qui le suivra pour toujours.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Daniel Solove s’interroge alors sur l’avenir de la réputation à l’ère numérique et comment les données peuvent nous poursuivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Il écrit : « <em>Si l’Empire de Star Wars avait le Big Data, l’Empire aurait gagné. Une recherche de documents aurait révélé où Luke Skywalker vivait sur Tatooine. Une collecte et une agrégation plus efficaces des enregistrements Jawa auraient permis de localiser immédiatement les droïdes. Une simple analyse des données aurait révélé que Ben Kenobi était vraiment Obi Wan Kenobi. Une recherche dans les registres de naissance aurait révélé que la princesse Leia était la sœur de Luke. Si l’Empire avait eu quelque chose comme la NSA, il aurait eu toutes les données dont il avait besoin, et il aurait pu balayer les droïdes et tout le monde, et ça aurait été ça.</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ainsi, plus d’informations sont-elles mieux stockées ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Qu’est-ce qu’une information sortie de son contexte.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Quelle liberté et quelle autonomie lorsque nous ne pouvons plus échapper à notre passé ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lors d’une interview avec le Wall Street Journal, le PDG de Google, Eric Schmidt, a suggéré que les jeunes devraient avoir le droit de changer leur identité une fois atteint l’âge de 21 ans pour échapper à leurs erreurs de jeunesse.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Il ajoute : « <em>Je ne crois pas que la société comprenne ce qui se passe lorsque tout est disponible, connaissable et enregistré par tout le monde à tout moment.</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Alors, prendre une nouvelle identité est-ce vraiment réaliste ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Regardons d’abord Facebook, une plateforme où les utilisateurs sont encouragés à partager leurs aventures au quotidien, leurs sentiments et leurs opinions. Facebook a permis l’analyse des profils d’abonnés exploités par l’entreprise Cambridge Analytica afin de manipuler leurs opinions à dessin électoraux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Plus inquiétant, Facebook ne respecte pas les multiples couches de notre personnalité en les stockant sous un compte unique. Plus de liberté d’expression ni de langage modulaire selon les niveaux relationnels.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Dans le passé, on maintenait des journaux intimes. Aujourd’hui, ils ont été remplacés par des blogs en ligne ou des plateformes de médias sociaux où l’on révèle les détails les plus intimes de la vie.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Et accessoirement la vie d’autres membres de la famille, amis, collègues, tout mis en ligne pour l’éternité.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Aujoutd’hui, 50% des blogs sont tenus par des jeunes de moins de 18 ans.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La génération Google, comme l’appelle Daniel Solove, a ses souvenirs gravés pour toujours. Une enfance qui les suivra à jamais, à la portée de Google pour rassembler chaque pièce éparse ou remonter les vieux souvenirs en surface.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Oublier n’est pas pardonner. Oublier est une purge salutaire de notre cerveau. C’est surtout une purge aléatoire.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Peut-être avez-vous entendu parler de Neuralink, un projet révolutionnaire financé par Elon Musk.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Elon Musk est le PDG américain et multimilliardaire connu pour ses voitures électriques Tesla, mais aussi l’inventeur des fabuleuses tuiles solaires. Il projette même de coloniser la planète Mars.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>L’homme le plus riche du monde selon le magazine Forbes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Son projet Neuralink vise à réduire les inégalités sociales en renforçant les capacités cognitives. Un projet d’implantation d’interfaces électroniques dans le cerveau des populations défavorisées, car il estime qu’elles seraient en souffrance cognitive. Une théorie soutenue par le Dr Laurent Alexandre français qui estime qu’un QI élevé est la clé du succès. Toute une utopie soutenue par les adeptes du trans-humanisme.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Offrez-leur un traitement cérébral supplémentaire et vous résoudrez les problèmes de pauvreté !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ajout de mémoire :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maintenant, penchons-nous sur cette petite histoire racontée par le Professeur Jean-Gabriel Ganascia :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Une petite fille, Adèle, demande à sa grand-mère Juliette : Grand-mère, que signifie une «<em>récitation</em>» ? La grand-mère se souvient vaguement qu’au début du XXIe siècle, les gens devaient lire et relire pour mémoriser des poémes ou autres textes littéraires. Adèle vit en 2075. Elle n’en a aucune idée.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Neuralink a résolu le problème de mémorisation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En fait, Elon Musk a emprunté son idée à NEURALIFE dans « <em>Tomorrow and Beyond</em> », ouvrage de science-fiction de Ian Bronx.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La petite fille est curieuse de savoir si cet apprentissage par cœur aurait été douloureux. La grand-mère la rassure : « <em>non, il fallait juste lire et relire pour mémoriser, pour ne pas oublier. </em>“</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La petite fille n’a aucune idée de ce que signifie oublier.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Jean-Gabriel Ganascia, qui raconte cette histoire de science-fiction, est professeur d’informatique et philosophe français. Il est président du comité d’éthique au CNRS. Ses recherches sont particulièrement axées sur l’éthique et l’intelligence artificielle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En France, les patients sont déjà traités par des simulations électroniques profondes du cerveau pour traiter les symptômes de la maladie de Parkinson.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maintenant, imaginez avoir une mémoire étonnante pour enregistrer et vous souvenir de tout, y compris chaque rêve, chaque détail de votre vie.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eh bien, près de 80 personnes dans le monde aujourd’hui ont naturellement cette capacité biologique.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En réalité, ils en souffrent. Ils souffrent de troubles d’hypermnésie. Ils gardent en permanence un souvenir intact de leur vie. Ils se souviennent pratiquement de chaque événement mineur dont la plupart des gens oublieraient en quelques jours. La mémoire pour eux est si vivante qu’ils peuvent ressentir la douleur pour toujours une fois enregistrée. Chaque image douloureuse qu’ils voient reste gravée dans leur cerveau.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Imaginez le cauchemar qu’ils vivent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sans oublier que nous pourrions être hantés par le passé sans la possibilité de pardonner ou de décider dans le présent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Si le projet Neuralink devait aller de l’avant, il lui faudrait un boutonàd’effacement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Et c’est la la grande question : qui peut décider de sélectionner et supprimer nos souvenirs ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Avant même Neuralink, nous sommes déjà la première génération à avoir une grande partie de notre vie en permanence, enregistrée numériquement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google agrège et remonte en un clic toutes les miettes d’informations qui composent le puzzle de notre vie.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Que peut offrir le droit à l’oubli ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le soi-disant ‘<em>droit à l’oubli</em>’ créé par la Cour Européenne de Justice ne supprime pas les informations, mais dissocie uniquement le contenu des résultats du moteur de recherche Google.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Dans des circonstances spécifiques, un droit de suppression a été introduit par le récent règlement européen sur la protection des données personnelles. Mais il ne concerne qu’une infime parcelle de nos informations disponibles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Depuis sa création il y a plus de 20 ans, Google recueille et accumule une masse de données.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google en sait plus sur chacun de nous que nous-mêmes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La nouvelle société Panopticienne de surveillance invisible menace la liberté et la dignité humaine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Se souvenir a longtemps été le rêve de l’homme. Cependant, l’oubli est une capacité biologique. Aujourd’hui, un changement s’opère. De l’oubli biologique, nous sommes passés à la mémoire numérique.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Normalement, la mémoire est l’exception, l’oubli la valeur par défaut.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Numériquement, la mémorisation est devenue la valeur par défaut, l’oubli l’exception.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La santé et le bien-être humains sont basés sur l’équilibre entre la mémoire et l’oubli.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les feuilles des arbres prennent les couleurs de l’automne pour tomber. Progressivement, ils rejoignent le sol pour enrichir ses nutriments. Cet cycle de putréfaction est ce qui permet la naissance de nouvelles vies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Une transmutation que l’épigénétique commence à entrevoir dans l’ADN humain.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Nous devons oublier pour mieux nous souvenir.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La conscience donne la possibilité de peser les avantages et les inconvénients. Être conscient, ce n’est pas avoir peur.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Comment protéger au mieux notre vie privée ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Faut-il prendre le risque de tout mettre en ligne pour l’éternité ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Comment apporter transparence et contrôle pour une meilleure confidentialité ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ce sont les questions de notre avenir, l’avenir de nos enfants.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Quel genre de société voulons- nous pour nos enfants ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pour se protéger contre un avenir incertain, il vaut mieux stocker moins que plus.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Alors, souvenons-nous d’oublier, pour emprunter les mots de Viktor Mayer-Schonberger.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lectures complémentaires :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La vie sous les chiffres</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Garder un œil</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Drones, éthique et réglementation des voitures autonomes</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initiatives de la France pour relever les défis de l’intelligence artificielle</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Caméras portables</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ce travail est publié sous une licence internationale Creative Commons Attribution 4.0 .</p>\n<!-- /wp:paragraph -->','POURQUOI LE RESPECT DE LA VIE PRIVEE EST UNE IMPERATIVE','Rétablir le paramètre par défaut, du souvenir à l\'oubli.','inherit','closed','closed','','810-revision-v1','','','2021-07-07 23:15:01','2021-07-07 23:15:01','',810,'https://www.datarainbow.eu/?p=2096',0,'revision','',0),(2072,1,'2021-06-21 22:29:34','2021-06-21 22:29:34','<!-- wp:image {\"id\":2056,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a-1024x518.jpeg\" alt=\"\" class=\"wp-image-2056\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet. The <a href=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" data-type=\"URL\" data-id=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO is to publish a new set of Standard Contractual Clauses</a>. The Commission\'s SCCs will not apply to the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, The Commission published the <a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\" rel=\"noreferrer noopener\">new Standard Contractual Clauses</a> long awaited. And today, the <a href=\"https://edpb.europa.eu/edpb_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/edpb_en\" target=\"_blank\" rel=\"noreferrer noopener\">EDPB</a> has published its<a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\" rel=\"noreferrer noopener\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with<br>the EU level of protection of personal data - Version 2.0 - Adopted on 18 June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Since Edward Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data (FISA section 702, EO 12333, US Cloud Act). The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a82\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a82\" target=\"_blank\">Art 82 GDPR</a>. However, we are still to see <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" target=\"_blank\">non-material damages</a> granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Safe Harbour agreement</a> then the <a rel=\"noreferrer noopener\" href=\"http://datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/(opens in a new tab)\" target=\"_blank\">Privacy Shield</a> being invalidated by the European Court of Justice decisions (commonly known as <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Schrems-I</a> and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the <a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" target=\"_blank\">Charter of the Fundamental Rights of the European Union</a>. With this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an <strong>equivalent level of protection</strong> for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a> a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japon and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give its green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EEA. This requires <strong>transfer impact assessment</strong> to assess the level of protection in a third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – <strong>supplementary measures</strong> need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be technical, organisational and/or contractual measures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs models adopted by the Commission pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a data mapping that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We see the cloud leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' BCR (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) can be more appropriate, usually within different establishments of a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> apply \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on</em>\' restrictive conditions</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU Commission implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations for its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</em>\' This is the case when the importer is falls within the definition of <strong>Art 3(2)</strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a Data Processing Agreement Art 28 is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND judicial redress (EU courts competence) and/or arbitration will be provided. This is what was lacking with the Privacy Shield, an independent authority and the ombudsperson to deal with EU citizens complaints. The EDBP recommendation has not specified this case scenario. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered as transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden in the back of a drawer. The new SCCs requiere adaptation, they are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> for Data controller to Processor, Controller to controller, processor ro processor and Processor back to Controller. They need to be adapted, Third party have now the \'docking option\' to join the contract. They can be adapted as long as the nature of the clauses are not modified</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>, emphasised by the Commission document will not be an easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, data subjects should be provided with a copy of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>the data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start with data mapping, minimising, and securing access. Hold the data as a hot potato. Don’t keep it longer than necessary. Keep your archives out of the network. Limit access to data. Train your staff. Be ready for data breach</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly data heaven with the risk of opening backdoors to data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touch at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\" rel=\"noreferrer noopener\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 22:29:34','2021-06-21 22:29:34','',2054,'https://www.datarainbow.eu/?p=2072',0,'revision','',0),(2073,1,'2021-06-21 22:49:05','2021-06-21 22:49:05','<!-- wp:image {\"id\":2056,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a-1024x518.jpeg\" alt=\"\" class=\"wp-image-2056\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet. The <a href=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" data-type=\"URL\" data-id=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO is to publish a new set of Standard Contractual Clauses</a>. The Commission\'s SCCs will not apply to the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, The Commission published the <a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\" rel=\"noreferrer noopener\">new Standard Contractual Clauses</a> long awaited. And today, the <a href=\"https://edpb.europa.eu/edpb_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/edpb_en\" target=\"_blank\" rel=\"noreferrer noopener\">EDPB</a> has published its<a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\" rel=\"noreferrer noopener\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with<br>the EU level of protection of personal data - Version 2.0 - Adopted on 18 June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Since Edward Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data (FISA section 702, EO 12333, US Cloud Act). The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a82\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a82\" target=\"_blank\">Art 82 GDPR</a>. However, we are still to see <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" target=\"_blank\">non-material damages</a> granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Safe Harbour agreement</a> then the <a rel=\"noreferrer noopener\" href=\"http://datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/(opens in a new tab)\" target=\"_blank\">Privacy Shield</a> being invalidated by the European Court of Justice decisions (commonly known as <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Schrems-I</a> and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the <a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" target=\"_blank\">Charter of the Fundamental Rights of the European Union</a>. With this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an <strong>equivalent level of protection</strong> for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a> a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japan and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate level of protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give it a green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EU/EEA. To allow data transfer, data exporters are required to process a <strong>transfer impact assessment</strong> to assess the level of protection in the third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus the implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – <strong>supplementary measures</strong> need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be <strong>technical, organisational and/or contractual measures</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractual Clauses models adopted by the Commission pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a<strong> data mapping</strong> that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We witness the clouds leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' Binding Corporate Rules (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) that can be more appropriate, usually established within a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> applies \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only</em>\' under restrictive conditions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU Commission\'s implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations around its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers <strong>only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</strong></em>\' This is the case when the importer falls within the definition of <strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a3\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a3\" target=\"_blank\">Art 3(2)</a></strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a <strong>Data Processing Agreement </strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a28\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a28\" target=\"_blank\"><strong>Article 28</strong> </a>is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND <strong>judicial redress</strong> (EU courts competence) AND/OR <strong>arbitration</strong> will have to be provided. This is what was lacking with the Privacy Shield, an independent authority and the <strong>ombudsperson</strong> to deal with EU citizens complaints. The EDBP recommendation has not specified the exclusion of importers subject to the GDPR. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden at the bottom of a drawer. The new SCCs require adaptation, and regular assessments. These assessments have to be filed as the DPAs could request to access the logs. They are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Third parties have now the \'<strong>docking option</strong>\' to join the contract. They can be adapted as long as the nature of the clauses are not modified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Emphasised by the Commission\'s document, this will not be easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy. Data subjects have the right to be informed. Is this systematic or at request?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, <strong>data subjects should be provided with a copy </strong>of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>The data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start with data mapping, minimising, and securing access. Hold the data as a hot potato. Don’t keep it longer than necessary. Keep your archives out of the network. Limit access to data. Train your staff. Be ready for data breach</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly data heaven with the risk of opening backdoors to data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touch at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\" rel=\"noreferrer noopener\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 22:49:05','2021-06-21 22:49:05','',2054,'https://www.datarainbow.eu/?p=2073',0,'revision','',0),(1711,2,'2020-11-26 07:55:48','2020-11-26 07:55:48','<!-- wp:heading {\"align\":\"center\"} -->\n<h2 class=\"has-text-align-center\"><strong>DATARAINBOW </strong></h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ….</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Who created DATARAINBOW ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, is a French Lawyer based in the UK who has studied private law at the prestigious Paris University Pantheon Assas, before specialising on Computer and Communication Law at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN’s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group&nbsp;<a href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a>&nbsp;with&nbsp;<a href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTACT : Data@datarainbow.eu</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018 :&nbsp;Tara Taubman-Bassirian</a></strong></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>Privacy Hero of the Year poll, and the results are in…&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of&nbsp;<a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">Rebecca Herold’s radio show</a>,&nbsp;<a href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\">Data Security and Privacy with The Privacy Professor</a>. I’ve extended invitations to each today, so stay tuned for more details.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For keeping up with news on IT security, Privacy and Online Security, join our Facebook Group&nbsp;<a href=\"https://www.facebook.com/groups/167255910003191/?multi_permalinks=2203761959685899&amp;notif_id=1548347410584622&amp;notif_t=feedback_reaction_generic\">Fly A Kite</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:button {\"align\":\"center\"} -->\n<div class=\"wp-block-button aligncenter\"><a class=\"wp-block-button__link\" href=\"http://www.datarainbow.eu/connect/\">Work With Me</a></div>\n<!-- /wp:button -->\n\n<!-- wp:image {\"align\":\"wide\",\"id\":4} -->\n<figure class=\"wp-block-image alignwide\"><img src=\"http://www.datarainbow.eu/wp-content/uploads/2020/11/about-image-1.jpg\" alt=\"Image description\" class=\"wp-image-4\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"align\":\"wide\",\"id\":5} -->\n<figure class=\"wp-block-image alignwide\"><img src=\"http://www.datarainbow.eu/wp-content/uploads/2020/11/about-image-2.jpg\" alt=\"Image description\" class=\"wp-image-5\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"align\":\"wide\",\"id\":6} -->\n<figure class=\"wp-block-image alignwide\"><img src=\"http://www.datarainbow.eu/wp-content/uploads/2020/11/about-image-3.jpg\" alt=\"Image description\" class=\"wp-image-6\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:columns {\"align\":\"wide\"} -->\n<div class=\"wp-block-columns alignwide\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:heading {\"level\":3} -->\n<h3>Early on</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I am so fascinated by photography and it’s capability to bring your imagination to amazing places. Early on, I fell in love with the idea of filming my own productions, so I set out to learn everything I could about storytelling through photos.</p>\n<!-- /wp:paragraph --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:heading {\"level\":3} -->\n<h3>Current</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>I have been teaching myself filmmaking for the past four and a half years and I’m still learning every day. I am building my business as a freelance filmmaker, as well as working on my own photo shoots.</p>\n<!-- /wp:paragraph --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->','About','','inherit','closed','closed','','34-revision-v1','','','2020-11-26 07:55:48','2020-11-26 07:55:48','',34,'https://www.datarainbow.eu/34-revision-v1/',0,'revision','',0);
