<!-- wp:paragraph -->
<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>During summer 2015, Slimpay launched a research program using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database, stored on an unsecured system accessible online.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p> Breach of at least two processing principles: data minimisation and storage limitation. Possibly data accuracy as part of the data stored would have become inaccurate. Purpose limitation could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients about the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Its only October the 21<sup>st</sup>, 8 months after the initial notification that the CNIL enquired about their notifications data subjects.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>More than a year later, in 21<sup>st</sup> of September 2021 the case was instructed by the ‘commission restreinte’ (restricted commission) for the infringement of articles 28-3 and 28-4, 32 and 34 GDPR.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection was formulated) from concerned DPAs was formulated.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>It was considered that in the specific context of this internal research, company Slimpay was the data controller.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The CNIL made a series of observations retaining liability of Slimpay for the lack of compliant data processing agreements (art 28-3 GDPR), the obligation of securing the data (Art 32 GDPR) and absence of data subject notification.</p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true,"type":"1"} -->
<ol type="1"><li><strong>Lack of data processing agreement art 28-3 GDPR</strong><strong></strong></li></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>Every and each sub processing has to be comply with the requirements of article 28 GDPR in order to ensure a compliant processing of the data.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Art 28-4 <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>When the sub-processor does comply with its obligations the initial processor’s liability is engaged.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of art 28 para 3 and 4. These contracts have include specific clauses</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href="https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant">DPA clauses 30 June 2021</a>, modifying the document <a href="https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses">published in 2017</a>)</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>In response to Slimpay argument, the CNIL logically responded that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li><strong>On the obligation to ensure the security of the data</strong><strong></strong></li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>The CNIL, based on article 32 GDPR, taking account of the risks involved,</p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true,"type":"a"} -->
<ol type="a"><li><strong>First on the lack of appropriate security measures</strong></li></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Access to the server were not restricted.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Slimpay argue a human error more than a weakness of his security system.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was sufficient.</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Slimplay argued the security whole was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Not wistanding an actual damaged caused to data subjects, the lack of security is in itself a breach of article 32. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This is a very important point to underline as article 82 GDPR allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be itself a breach of data as rarely data subjects can prove immediate harm after a data is compromised.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The argument of an employee’s negligent was not retained as in any case the company was liable to ensure the security of the data.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Last week, <a href="https://eugd.org/2500-euros-damages-eugd-scalable-capital-data-leak/" target="_blank" rel="noreferrer noopener">a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Also the Danish DPA announced it found that a public entity sent personal data, including sensitive personal data and children's personal data, via unencrypted email. The DPA ruled that the public entity did not implement the necessary security measures, taking into account the amount and type of information being<br><a href="https://lnkd.in/ePBCrYyY" target="_blank" rel="noreferrer noopener">Here's the decision</a></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li><strong>On the password weakness</strong></li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accept Slimplay’s evidences.</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>The CNIL considers that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of article 34 GDPR</strong>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong><u>On the amount of the fine</u></strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Based on the article 83 GDPR, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance in securing such data.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they have omitted the notifications article 34 to data subjects.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Considering the financial situation of the company and its net benefits I 2019 and 2020 (not mentioned), 180.000 € was justified.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Considering the number of victims concerned by the breach, the decision was made public.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This is for the administrative sanction.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Remains Civil damages for data subjects whose data have been negligently handled. Recital 45 allows data subjects to sue indistinctively the data controller or his processors.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Ultimately, there is the criminal offense of not complying with the obligations of article 32 GDPR.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm's inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel="noreferrer noopener" href="https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/" target="_blank">Ikea</a> and <a rel="noreferrer noopener" href="https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/" target="_blank">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p></p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":2313,"width":840,"height":878,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large is-resized"><img src="https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png" alt="" class="wp-image-2313" width="840" height="878"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement article 28 to his professional accounts, with a lack of transparency to third parties. Additionally, <a href="https://aws.amazon.com/solutions/case-studies/wetransfer/">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the invalidation of the Privacy Shield. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Client had warned about the particular sensitivity of the personal and financial data included in the documents. Tey had refused encryption despite all recommendations by the CNIL and any IT security in breach of article 32 GDPR. They took long time and several contacts before they notify the breach to the CNIL, so far never notified data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO has mentioned secured means of document exchange. The other law firm plays with Wetransfer links to avoid the respect of fair communications. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Here is one example of how things can go wrong following a data breach of personal data mentioned in the newly adopted version of the&nbsp;<a href="https://www.linkedin.com/company/eu-edpb/">European Data Protection Board</a>'s Guidelines 01/2021 on Examples regarding Personal Data&nbsp;<a href="https://www.linkedin.com/feed/hashtag/?keywords=breach&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792">Breach</a>&nbsp;Notification under the&nbsp;<a href="https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792">GDPR</a> :</p>
<!-- /wp:paragraph -->

<!-- wp:image {"id":2325,"sizeSlug":"large","linkDestination":"none"} -->
<figure class="wp-block-image size-large"><img src="https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2022-01-04-at-11.00.34-971x1024.png" alt="" class="wp-image-2325"/></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>Lawyers or other legal professionals bound by attorney client privilege or confidentiality should be more careful when handling documents containing personal or financial data. This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a rel="noreferrer noopener" href="https://www.pearltrees.com/t/data-in-law-firms/id37123024" target="_blank">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a rel="noreferrer noopener" href="https://www.pearltrees.com/dataleak" target="_blank">Here are curated some of the major cyberattacks. </a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Following closely, as it seems like the French CNIL is starting the year 2022 with vigour, a sanction against the French mobile company Free. Here resumed by the great Jimmy Orucevic :</p>
<!-- /wp:paragraph -->

<!-- wp:group -->
<div class="wp-block-group"><!-- wp:quote -->
<blockquote class="wp-block-quote"><p><em><a href="https://www.linkedin.com/feed/hashtag/?keywords=cnil&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896">CNIL</a>&nbsp;fines FREE MOBILE for failure to respond to inquiries from data subjects, false invoices, e-mailing of passwords in plain text --&gt; € 300'000</em></p><p><em>The french&nbsp;<a href="https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896">DataProtection</a>&nbsp;authority has received many complaints concerning the difficulties encountered by individuals in having responses to their requests for&nbsp;<a href="https://www.linkedin.com/feed/hashtag/?keywords=access&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896">access</a>&nbsp;and to object to receiving&nbsp;<a href="https://www.linkedin.com/feed/hashtag/?keywords=commercial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896">commercial</a>&nbsp;prospecting messages from the French mobile telephone operator FREE MOBILE.</em></p><p><em>The CNIL retained 4 breaches of the&nbsp;<a href="https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896">#GDPR</a>&nbsp;against the company:</em></p><p><em>- a failure to respect the right of access of individuals regarding their&nbsp;<a href="https://www.linkedin.com/feed/hashtag/?keywords=personal&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896">personal</a>&nbsp;data (Art. 12 and 15 of the GDPR), since the company did not respond to the requests made by the complainants within the time limits;</em></p><p><em>- a&nbsp;<a href="https://www.linkedin.com/feed/hashtag/?keywords=failure&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896">failure</a>&nbsp;to respect the right to&nbsp;<a href="https://www.linkedin.com/feed/hashtag/?keywords=object&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896">object</a>&nbsp;of the persons concerned (Art. 12 and 21 of the GDPR), since the company did not take into account the requests of the complainants that no more commercial prospecting messages be sent to them;</em></p><p><em>-a breach of the obligation to protect data by&nbsp;<a href="https://www.linkedin.com/feed/hashtag/?keywords=design&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896">design</a>&nbsp;(Art. 25 of the GDPR), as the company continued to send invoices to complainants for telephone lines whose&nbsp;<a href="https://www.linkedin.com/feed/hashtag/?keywords=subscription&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896">subscription</a>&nbsp;had been cancelled;</em></p><p><em>- a breach of the obligation to ensure the&nbsp;<a href="https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896">security</a>&nbsp;of personal data (Art. 32 of the GDPR), since the company transmitted by&nbsp;<a href="https://www.linkedin.com/feed/hashtag/?keywords=email&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896">email</a>&nbsp;- in clear text - the passwords of users when they subscribed to an offer with FREE MOBILE, without these passwords being temporary and the company requiring them to be changed.</em></p><p><em>This fine takes into account the size and the&nbsp;<a href="https://www.linkedin.com/feed/hashtag/?keywords=financial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896">financial</a>&nbsp;situation of the company. Its publicity is justified by the need to reiterate the importance of responding to requests for exercising the data subject's rights and ensuring the security of users' data.</em></p><p><em>decision accessible <a rel="noreferrer noopener" href="https://lnkd.in/dAC5mf9K" target="_blank">here</a></em></p><cite>[Hashtags removed]</cite></blockquote>
<!-- /wp:quote -->

<!-- wp:paragraph -->
<p>Again the question of security of data questioned. A password in clear in an email is a no no, as much as personal or confidential documents exchange by unencrypted emails or transfer of documents in the hands of thord party apps without assessment and a Data Protection Agreement article 28 GDPR.</p>
<!-- /wp:paragraph -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p><em>Renforcer la sécurité de toute transmission de données à caractère personnel.&nbsp;</em></p><p><em><strong>La messagerie électronique ne constitue pas un moyen de communication sûr&nbsp;</strong>pour transmettre des données personnelles, sans mesure complémentaire. Une simple erreur de manipulation peut conduire à divulguer à des destinataires non habilités des données personnelles et à porter ainsi atteinte au droit&nbsp;&nbsp;&nbsp; à la vie privée des personnes. En outre, toute entité ayant accès aux serveurs de messagerie concernés (notamment ceux des émetteurs et destinataires) peut avoir accès à leur</em></p><cite><a rel="noreferrer noopener" href="https://www.pearltrees.com/t/data-in-law-firms/id37123024#item410340589" target="_blank">CNIL's guidance</a><br><br>"reinforcing the security of any transmission of personal data.<strong> E-mail is not a secure means of communication for transmitting personal data without further action.</strong> A simple error in handling may lead to the disclosure of personal data to unauthorised recipients and thus infringe on the right to privacy of individuals. In addition, any entity with access to the relevant mail servers (including those of the senders and recipients) may have access to their content."</cite></blockquote>
<!-- /wp:quote --></div>
<!-- /wp:group -->

<!-- wp:paragraph -->
<p></p>
<!-- /wp:paragraph -->