(1785,2,'2020-11-26 20:26:46','2020-11-26 20:26:46','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian LLM</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Much has been said and complained about data protection regulations. Lots of criticism, its cost, resources consumption, business killer,….</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What\'s been forgotten is that the&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/\" target=\"_blank\">General Data Protection Regulation (GDPR)</a>&nbsp;is not against data processing when done in respect with the data subject rights. The amount of electronically available data and curation and storage tools, justify a better protection. Privacy is a&nbsp;<a rel=\"noreferrer noopener\" href=\"https://rightsinfo.org/the-rights-in-the-european-convention/\" target=\"_blank\">Fundamental Human Right</a>, for dignity and freedom.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The equation is simple : Privacy = Transparency + Control</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A balance of rights and freedom of data subjects with respect to the interest of the business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Before the GDPR, data protection directive lacked uniformity and the necessary certainty throughout the EU. The new Regulation is based on harmonisation and the&nbsp;<a href=\"https://rightsinfo.org/the-rights-in-the-european-convention/\" target=\"_blank\" rel=\"noreferrer noopener\">European Data Protection Board (EDPB)</a>&nbsp;is the authority in charge of the&nbsp;<a href=\"https://gdpr-info.eu/art-63-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">consistency mechanism - Article 63</a>&nbsp;- to make sure the regulation and its enforcement are harmoniously applied by all national Data Protection Authorities (DPAs).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One of the more pro-active DPAs has been the French&nbsp;<a href=\"https://www.cnil.fr/en/home\" target=\"_blank\" rel=\"noreferrer noopener\">Commission Nationale de l\'Informatique et des Libertes (CNIL)</a>&nbsp;producing many guidelines in both French and English, including a very useful&nbsp;<a href=\"https://www.cnil.fr/en/pia-software-20-available-and-growth-pia-ecosystem\" target=\"_blank\" rel=\"noreferrer noopener\">Privacy Impact Assessment (PIA) tool</a>. So, I would like to think French companies have benefited from all necessary guidances to comply after two years period of preparation and 6 months after the GDPR entered into effect.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In two previous article, I wrote about the&nbsp;<a href=\"https://www.linkedin.com/pulse/cnil-published-first-review-6-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">CNIL’s report after 6 months of activities</a>&nbsp;and&nbsp;<a href=\"https://www.linkedin.com/pulse/six-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">some of their main cases.</a>&nbsp;While The UK ICO has been more focusing on fining nuisance calls and clarifying data subject\'s access after investigating Facebook Analytica case, The French CNIL focus has been :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clarifying criteria of consent in four cases of Mobile App data collection,</li><li>clarifying CCTV monitoring and biometrics in work place</li><li>clarifying cookie compliance.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>What are cookies?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Better than me,&nbsp;<a href=\"https://termly.io/resources/articles/cookies-comprehensive-guide/\" target=\"_blank\" rel=\"noreferrer noopener\">KJ Kearie has a Comprehensive Guide&nbsp;</a>on cookies, I recommend you read.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“A cookie is&nbsp;<a href=\"https://www.theguardian.com/technology/2012/apr/23/cookies-and-web-tracking-intro\" target=\"_blank\" rel=\"noreferrer noopener\">a tiny bit of plain text</a>&nbsp;that a website downloads to a computer when that user’s browser opens a new webpage. They are used to remember useful pieces of data from the users they encounter, acting as an<strong>invisible liaison between a domain’s owner and visitors</strong>.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>A cookie can identify both the user and the browser, and can be left on the user’s device indefinitely. When the user’s browser returns to that website, the cookie connects with the domain and shares with it the data it has collected or stored about that user.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>There are two main types of cookies –&nbsp;<a href=\"http://www.allaboutcookies.org/cookies/session-cookies-used-for.html\" target=\"_blank\" rel=\"noreferrer noopener\">session cookies</a>&nbsp;only collect details from a single browsing sessions, while&nbsp;<a href=\"https://www.techopedia.com/definition/4901/persistent-cookie\" target=\"_blank\" rel=\"noreferrer noopener\">persistent cookies</a>remain on the user’s device and collect information over time.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>In terms of functionality, some cookies aim to a better browsing experience such as remembering the language of their visitor, others, more pernicious, track the users habits, profiling users for targeted advertising. Data collected has fuelled a huge business of data brokage raising privacy and security concerns. In November,&nbsp;<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">Privacy International</a>, the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-and\" target=\"_blank\" rel=\"noreferrer noopener\">complaints</a>&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you think online tracking and profiling are legitimate? Watch&nbsp;<a href=\"https://www.youtube.com/watch?v=xYZtHIPktQg&amp;feature=youtu.be\" target=\"_blank\" rel=\"noreferrer noopener\">this video</a>&nbsp;it\'s eloquent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Online customers deserve the same privacy as offline.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookie law, known as the ePrivacy Directive, has long been misunderstood. It is not a useless banner asking you to confirm you agree for your personal data to be collected in order to access the website. Just in case, you have forgotten, an IP address or any identifiable information is considered a personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are website owners duties exactly ?</strong>&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To provide clear transparency to inform their visitors about the personal data they collect, how long it is kept, with whom they share the data and data subjects rights of access, right to delete, amend or the right of portability. These informations should be provided at the time of data collection, made accessible on each webpage, in clear language.&nbsp;<a href=\"https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227\" target=\"_blank\" rel=\"noreferrer noopener\">The WP art 29&nbsp;</a>requires that</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Every organisation that maintains a website should publish a privacy statement/ notice on the website. A link to this privacy statement/ notice should be clearly visible on each page of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible. “</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:list -->\n<ul><li>it must be concise, transparent, intelligible and easily accessible (Article 12.1);</li><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In short, a privacy notice is required to provide “<em>Concise, transparent, intelligible and easily accessible</em>” information about the data collected from visitors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Alined with the WP guidance, the&nbsp;<a href=\"https://www.linkedin.com/pulse/six-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">French DPA CNIL</a>&nbsp;has required clear information for visitors, and for non exclusively technical cookies, consent is required. AND - that is very important - opting out of cookie tracking should not be detrimental to the use of the service. This goes with the clear position of the Working Party Art 29, replaced by the EDPB.&nbsp;For more on Privacy by Design, you might want to follow&nbsp;<a href=\"https://www.ryerson.ca/pbdce/about/ann-cavoukian/\" target=\"_blank\" rel=\"noreferrer noopener\">Ann Cavoukian</a>, Leading the Privacy by Design Centre of Excellence at Ryerson University.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So, remember, privacy = transparency + control. that means an obligation to tell visitors what is collected, with whom is shared, users rights and clear opt out.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite all clear guidance, too many websites are non compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You’d expect lawyers would have it right, for being well aware of the regulation. The French association of lawyers, the CNB, has done a good job informing their members by producing ample&nbsp;<a href=\"https://www.cnb.avocat.fr/sites/default/files/documents/guide_rgpd_avocats-2018.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">guidance</a>&nbsp;to follow.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally law firms handle sensitive data of clients, so they should be the ones showing the good example.&nbsp;<a href=\"https://twitter.com/clarinette02/status/1071025796767236097\" target=\"_blank\" rel=\"noreferrer noopener\">Recently</a>, I have looked at&nbsp;<a href=\"http://www.cbbc-avocats.com/cbbc/lequipe\" target=\"_blank\" rel=\"noreferrer noopener\">few websites</a>&nbsp;from some of&nbsp;<a href=\"http://www.hleclerc-avocats.fr/alain-weber\" target=\"_blank\" rel=\"noreferrer noopener\">the top law firms</a>&nbsp;in Paris. It is outraging to see they are mostly ignoring their obligations. Lack of information about cookies, no privacy notice or insufficient information. Too many are even&nbsp;<a href=\"https://www.theverge.com/2018/7/24/17603126/google-chrome-unencrypted-not-secure\" target=\"_blank\" rel=\"noreferrer noopener\">tagged as ‘Not Secure’ by Google Chrome web browser&nbsp;</a>lacking encryption. [This is when the lock does not show next to the URL ‘http’ instead of https. unencrypted transmission means that data can be intercepted.] Some of the websites I visited have visitors contact forms or candidates applications online with CV upload.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I raised the issue few weeks ago, two of the law firms amended the security certification to https. One specialised DPO did not considered a cookie banner or&nbsp;<a href=\"http://www.jacobavocats.com/mentions-legales/\" target=\"_blank\" rel=\"noreferrer noopener\">more comprehensive privacy notice was needed</a>. It is painful to see members of the law society or big law firms could have so little consideration for privacy and data protection of clients and web visitors. I see too many exchange documents via un-encrypted email attachments. These big law firms have opulent clients around the world including outside the EU. How do they comply with data flow regulation to countries of non adequate data protection, not just China, that includes the USA as well. I have brought the CNIL\'s attention to this issue. Knowing that a website is the vitrine of a business, it worth the effort.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Data breach has been on everyday news. Have you heard of&nbsp;<a href=\"https://www.forbes.com/sites/davidvolodzko/2018/12/04/marriott-breach-exposes-far-more-than-just-data/\" target=\"_blank\" rel=\"noreferrer noopener\">Marriott hotels breach</a>&nbsp;gone undetected for four years?&nbsp;<a href=\"https://www.linkedin.com/pulse/after-canada-airlines-here-comes-british-airways-tara/\" target=\"_blank\" rel=\"noreferrer noopener\">Air Canada</a>, British Airways, Cathay Pacific, Yahoo, Equifax,,.... and many more. Fines will not give back data subjects\' hassle when dealing with ID theft or financial misuse.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It’s not anymore IF but WHEN.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Any data collection creates data breach risk.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I invite you to read&nbsp;<a href=\"https://www.linkedin.com/pulse/memory-forgetfulness-privacy-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">Memory, Forgetfulness and Delete</a>&nbsp;because Privacy matters to us all,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and from&nbsp;<a href=\"https://blog.usejournal.com/is-your-web-site-breaking-eu-law-7e5b7eb33d5d?fbclid=IwAR3n5duN22qnmVk_he_EHxsg2JQA2DCeCzAzoTk9AUBUWlUvV8h4k75FoBg\" target=\"_blank\" rel=\"noreferrer noopener\">Alexander Hanff&nbsp;</a>: \"<em>Your consent notice should provide a list of all of these assets (unless covered by the “strictly necessary” exception) and provide the option for the data to refuse the loading of any or all of these assets.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Connected read&nbsp;<a href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/?published=t\" target=\"_blank\" rel=\"noreferrer noopener\">Law&nbsp;</a>Firm Internet Security and Data Protection</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/?published=t\" target=\"_blank\" rel=\"noreferrer noopener\">Firms Data Security</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Follow ongoing&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736\" target=\"_blank\">Pearltrees curation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>UPDATE : Google-Style GDPR Fines for Everyone? <a href=\"https://www.jdsupra.com/legalnews/google-style-gdpr-fines-for-everyone-23609/\">Bavarian DPA </a>Conducts Website Cookie Practices Sweep, Announces Fines under Consideration.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The Bavarian DPA audited 40 “large websites”. The companies audited were from the following industries</em>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(a) Online retail ; (b) Sports; (c) Banking &amp; insurance; (d) Media; (e) Automotive &amp; electronics; (f) Home and residential; and (g) Other.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>•&nbsp;<em> The sweep revealed that&nbsp;all 40&nbsp;websites had integrated cookies or other “tracking tools”. While the Bavarian DPA leaves the term “tracking tools” largely undefined, it indicates they are provided by third parties and result in data being sent to these third party providers, such as pixels, beacons, or the like.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The Bavarian DPA found that&nbsp;none&nbsp;of the 40 websites’ cookie practices were GDPR-compliant. It found the following violations</em>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li><strong><em>Websites lacked the transparency needed for “informed” cookie consent</em></strong><em>. </em></li><li><strong><em>No “prior” consent was collected from users</em></strong><em>. </em></li><li><strong><em>The consent obtained was not sufficiently “active”</em>.</strong>&nbsp;</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>The Bavarian DPA announced it was considering GDPR fines for the website operators.\"</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In July 2019, the UK ICO published a new guidance on the use of cookies after admitting <a href=\"https://www.itpro.co.uk/general-data-protection-regulation-gdpr/33850/ico-admits-its-own-cookie-policy-is-non-compliant-with\">its own website was not compliant</a>. Read more <a href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/?utm_source=twitter&amp;utm_medium=iconews&amp;utm_term=7704459a-682b-4360-83e2-195bbba3a4c6&amp;utm_content=&amp;utm_campaign=\">here.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the French regulator, CNIL  \"<em>Online targeted advertisement: what action plan for the CNIL_en ?\"</em> <a href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL tweeted : \"<em>The legal framework relating to consent has evolved, and so does the website of the CNIL. On </em><a rel=\"noreferrer noopener\" href=\"https://t.co/R3uTY6ghS5\" target=\"_blank\"><em>http://cnil.fr&nbsp;</em></a><em>, no more tracking devices are deposited, as long as the user has not given his active consent</em>\" with the following <a href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\">link</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further read on <a href=\"https://datarainbow.eu/2019/06/16/websites-surreptitiously-tracking-and-reporting-on-visitors/\">cookies and Java Script code surreptitiously tracking and reporting on visitors</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li> This work is licensed under a&nbsp;<a rel=\"noreferrer noopener\" href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','Website transparency : Cookies and privacy notice','The General Data Protection Regulation (GDPR) is not against data processing when done in respect with the data subject rights. The amount of electronically available data and curation and storage tools, justify a better protection. Privacy is a Fundamental Human Right, for dignity and freedom.','inherit','closed','closed','','1066-revision-v1','','','2020-11-26 20:26:46','2020-11-26 20:26:46','',1066,'https://www.datarainbow.eu/1066-revision-v1/',0,'revision','',0),(1786,2,'2020-11-26 20:28:25','2020-11-26 20:28:25','','Screenshot 2020-11-26 at 20.28.05','','inherit','open','closed','','screenshot-2020-11-26-at-20-28-05','','','2020-11-26 20:28:25','2020-11-26 20:28:25','',1065,'https://www.datarainbow.eu/wp-content/uploads/2019/01/Screenshot-2020-11-26-at-20.28.05.png',0,'attachment','image/png',0),(1787,2,'2020-11-26 20:28:26','2020-11-26 20:28:26','','Screenshot 2020-11-26 at 20.27.55','','inherit','open','closed','','screenshot-2020-11-26-at-20-27-55','','','2020-11-26 20:28:26','2020-11-26 20:28:26','',1065,'https://www.datarainbow.eu/wp-content/uploads/2019/01/Screenshot-2020-11-26-at-20.27.55.png',0,'attachment','image/png',0),(2143,1,'2021-07-14 16:54:31','2021-07-14 16:54:31','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian LLM</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Early July this year the French CNIL published its&nbsp;<a href=\"https://www.cnil.fr/fr/quelles-thematiques-prioritaires-et-quelle-strategie-de-controle-pour-2018\" target=\"_blank\" rel=\"noreferrer noopener\">priorities and main targets for 2018</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Recruitment companies</li><li>Rental companies</li><li>Parking automated pay machines</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Here is a&nbsp;<a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6471344692427661312\" target=\"_blank\" rel=\"noreferrer noopener\">snapchot</a>&nbsp;of the CNIL\'s main investigations</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":19} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-20-at-23.22.15.png\" alt=\"\" class=\"wp-image-19\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Validity of consent :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL investigated mobile applications using embedded software development kit (SDK) and ad biding gathering personal data even when the application is not in use. The data collection is activated by default, which is contrary to the principal of privacy by design.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* The company <a rel=\"noreferrer noopener\" href=\"https://www.legifrance.gouv.fr/affichCnil.do?oldAction=rechExpCnil&amp;id=CNILTEXT000037594451&amp;fastReqId=974682228&amp;fastPos=2\" target=\"_blank\"><strong>VECTUARY</strong></a> had suggested the use of Consent Management Provider – the CNIL considered the CMP not offering sufficient protection, the consumer still lacking information. Consent needs to be informed, specific and affirmative. The technicality and opacity of the ad targeting justifies greater transparency requirement. The CNIL is insisting that informed consent has to be given before the data is collected. Personal data is used for profiling and targeted advertising as large scale as many have phones. The data collected representing serious risk of privacy, the geolocation tracking revealing intimate information about habits and patterns of life.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent cannot be passed to another controller through a contractual relationship. Following the Article 7, a controller has the obligation to demonstrate, for the entirety of the data they are processing under consent, the validity of the consent obtained.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>VECTUARY has an injunction to cease data collection, to provide clear information before requiring informe consent. It has been asked to delete all data collected. that is 42 millions of personal identification and geolocation data collected from 32 000 application. Vectuary has 3 months to comply to avoid further sanctions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This case challenged the IAB Europe consent framework French regulator’s decision against an adtech company confirms that IAB “Transparency &amp; Consent Framework” does not obtain valid consent. It also illustrates how even tiny adtech companies can unlawfully gather millions of people’s personal data from RTB.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* Very similar case of lack of valid consent for&nbsp;<a href=\"https://www.cnil.fr/fr/applications-mobiles-mises-en-demeure-pour-absence-de-consentement-au-traitement-de-donnees-de\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>SINGLESPOT</strong></a>&nbsp;using SDK for targeted advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* Previously in July, the CNIL&nbsp;<a href=\"https://www.cnil.fr/fr/applications-mobiles-mises-en-demeure-absence-de-consentement-geolocalisation-ciblage-publicitaire\" target=\"_blank\" rel=\"noreferrer noopener\">announced</a>&nbsp;that it served a formal notice to two advertising startups&nbsp;<a href=\"https://www.cnil.fr/fr/applications-mobiles-mises-en-demeure-absence-de-consentement-geolocalisation-ciblage-publicitaire\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>FIDZUP</strong></a>&nbsp;and&nbsp;<a href=\"https://www.cnil.fr/fr/applications-mobiles-cloture-de-la-mise-en-demeure-lencontre-de-la-societe-teemo\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>TEEMO</strong></a>. Both companies collect as well personal data from mobile phones via (“SDK” tools integrated into the code of their partners’ mobile apps—even when the apps are not in use—and process the data to conduct marketing campaigns on mobile phones.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Users were not informed when downloading mobile apps that an SDK that will collect their data is integrated into the apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, they not informed about the advertising targeting purposes of the processing or the data controller’s identity when installing the app. they were required to obtain valid consent by providing that information before collating the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL found that the retention of geolocation data for 13 months was excessive as disproportionate in relation to the purpose of the processing. The CNIL stressed that use of geolocation devices are especially intrusive as they constantly track users in real time.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL ordered TEEMO and FIDZUP to obtain users’ valid consent within three months (e.g., via a pop-up containing specific information and a tick-box to signify consent). The CNIL also ordered TEEMO to define a retention period for geolocation data that is proportionate to the purpose of the processing. Failure to do so within the prescribed time limit may result in sanctions, including a fine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* On March 2018, the CNIL had served a notice to&nbsp;<strong>Direct Energie</strong>, the company behind the smart meter Linky. for lack of transparency in the collect of consumers personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Intrusive camera surveillance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>*&nbsp;</strong><a href=\"https://www.legifrance.gouv.fr/affichCnil.do?oldAction=rechExpCnil&amp;id=CNILTEXT000037537391&amp;fastReqId=1466136022&amp;fastPos=4\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Association 42</strong></a>, is a higher education. In February 2018, the CNIL proceeded to an investigation in their premises to detect abusive permanent video camera footage everywhere without due notice. Furthermore the live video recording was accessible to everyone.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was reminded that the video surveillance should be limited and access limited to authorised staff. Association 42 was given two month to comply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* The&nbsp;<a href=\"https://www.cnil.fr/fr/videosurveillance-excessive-mise-en-demeure-itic\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Institut des techniques informatiques et commerciales (l’ITIC)</strong></a>, another private school,&nbsp;had a similar practice of excessive camera surveillance, with retention of video footage over the required one month, lacking secure storage to avoid unauthorised access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data breach</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* If all these companies were served a notice,&nbsp;<a href=\"https://www.cnil.fr/fr/optical-center-sanction-de-250000eu-pour-une-atteinte-la-securite-des-donnees-des-clients-du-site\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>OPTICAL CENTRE</strong></a>&nbsp;has incurred a fine of 250,000 euros for a significant data leak that might have exposed customers’ sensitive personal information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"An on-site inspection was carried out on the premises of OPTICAL CENTER, during which [the company] acknowledged that [its] website did indeed have a security defect. In this case, the site&nbsp;&nbsp;<em>www.optical-center.fr</em>&nbsp;did not include functionality to verify that a customer is well connected to his personal space (“customer area”) before displaying his invoices. It was thus relatively simple to access documents from another client of the company.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Biometrics in workplace</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>*&nbsp;<a href=\"https://www.cnil.fr/fr/biometrie-au-travail-illegale-sanction-de-10000-euros\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Assistance Centre d\'Appels</strong></a>&nbsp;was investigated in its premises back in 2016. Several irregularities were found :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>fingerprint used to control work hours without prior authorisation,</li><li>audio recording of phone conversations without notice to employees and contacts</li><li>lack of strong passwords and automatic lock</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>After an initial notice, the CNIL did a second inspection that revealed only a partial application of the injunctions. therefore a fine of 10.000 Euros was given.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are the decisions that were deemed worthy of publication by the CNIL. Neither of them belong to the targeted sectors. the fines are minimal. the CNIL has preferred the approach of giving notice and checking if the injunctions have been followed by action.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>List of all CNIL\'s sanctions&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/tag/sanctions\" target=\"_blank\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a rel=\"noreferrer noopener\" href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>.<br></p>\n<!-- /wp:paragraph -->','French CNIL\'s six first month of GDPR','The CNIL investigated mobile applications using embedded software development kit (SDK) and ad biding gathering personal data even when the application is not in use. The data collection is activated by default, which is contrary to the principal of privacy by design.','inherit','closed','closed','','1065-autosave-v1','','','2021-07-14 16:54:31','2021-07-14 16:54:31','',1065,'https://www.datarainbow.eu/?p=2143',0,'revision','',0),(1789,2,'2020-11-26 20:29:00','2020-11-26 20:29:00','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian LLM</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Early July this year the French CNIL published its&nbsp;<a href=\"https://www.cnil.fr/fr/quelles-thematiques-prioritaires-et-quelle-strategie-de-controle-pour-2018\" target=\"_blank\" rel=\"noreferrer noopener\">priorities and main targets for 2018</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Recruitment companies</li><li>Rental companies</li><li>Parking automated pay machines</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Here is a&nbsp;<a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6471344692427661312\" target=\"_blank\" rel=\"noreferrer noopener\">snapchot</a>&nbsp;of the CNIL\'s main investigations</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":19} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-20-at-23.22.15.png\" alt=\"\" class=\"wp-image-19\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Validity of consent :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL investigated mobile applications using embedded software development kit (SDK) and ad biding gathering personal data even when the application is not in use. The data collection is activated by default, which is contrary to the principal of privacy by design.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* The company&nbsp;<a href=\"https://www.legifrance.gouv.fr/affichCnil.do?oldAction=rechExpCnil&amp;id=CNILTEXT000037594451&amp;fastReqId=974682228&amp;fastPos=2\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>VECTUARY</strong></a>&nbsp;had suggested the use of Consent Management Provider – the CNIL considered the CMP not offering suffisant protection, the consumer still lacking information. Consent needs to be informed, specific and affirmative. The technicality and opacity of the ad targeting justifies greater transparency requirement. The CNIL is insisting that informed consent has to be given before the data is collected. Personal data is used for profiling and targeted advertising as large scale as many have phones. The data collected representing serious risk of privacy, the geolocation tracking revealing intimate information about habits and patterns of life.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent cannot be passed to another controller through a contractual relationship. Following the Article 7, a controller has the obligation to demonstrate, for the entirety of the data they are processing under consent, the validity of the consent obtained.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>VECTUARY has an injunction to cease data collection, to provide clear information before requiring informe consent. It has been asked to delete all data collected. that is 42 millions of personal identification and geolocation data collected from 32 000 application. Vectuary has 3 months to comply to avoid further sanctions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This case challenged the IAB Europe consent framework French regulator’s decision against an adtech company confirms that IAB “Transparency &amp; Consent Framework” does not obtain valid consent. It also illustrates how even tiny adtech companies can unlawfully gather millions of people’s personal data from RTB.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* Very similar case of lack of valid consent for&nbsp;<a href=\"https://www.cnil.fr/fr/applications-mobiles-mises-en-demeure-pour-absence-de-consentement-au-traitement-de-donnees-de\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>SINGLESPOT</strong></a>&nbsp;using SDK for targeted advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* Previously in July, the CNIL&nbsp;<a href=\"https://www.cnil.fr/fr/applications-mobiles-mises-en-demeure-absence-de-consentement-geolocalisation-ciblage-publicitaire\" target=\"_blank\" rel=\"noreferrer noopener\">announced</a>&nbsp;that it served a formal notice to two advertising startups&nbsp;<a href=\"https://www.cnil.fr/fr/applications-mobiles-mises-en-demeure-absence-de-consentement-geolocalisation-ciblage-publicitaire\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>FIDZUP</strong></a>&nbsp;and&nbsp;<a href=\"https://www.cnil.fr/fr/applications-mobiles-cloture-de-la-mise-en-demeure-lencontre-de-la-societe-teemo\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>TEEMO</strong></a>. Both companies collect as well personal data from mobile phones via (“SDK” tools integrated into the code of their partners’ mobile apps—even when the apps are not in use—and process the data to conduct marketing campaigns on mobile phones.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Users were not informed when downloading mobile apps that an SDK that will collect their data is integrated into the apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, they not informed about the advertising targeting purposes of the processing or the data controller’s identity when installing the app. they were required to obtain valid consent by providing that information before collating the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL found that the retention of geolocation data for 13 months was excessive as disproportionate in relation to the purpose of the processing. The CNIL stressed that use of geolocation devices are especially intrusive as they constantly track users in real time.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL ordered TEEMO and FIDZUP to obtain users’ valid consent within three months (e.g., via a pop-up containing specific information and a tick-box to signify consent). The CNIL also ordered TEEMO to define a retention period for geolocation data that is proportionate to the purpose of the processing. Failure to do so within the prescribed time limit may result in sanctions, including a fine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* On March 2018, the CNIL had served a notice to&nbsp;<strong>Direct Energie</strong>, the company behind the smart meter Linky. for lack of transparency in the collect of consumers personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Intrusive camera surveillance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>*&nbsp;</strong><a href=\"https://www.legifrance.gouv.fr/affichCnil.do?oldAction=rechExpCnil&amp;id=CNILTEXT000037537391&amp;fastReqId=1466136022&amp;fastPos=4\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Association 42</strong></a>, is a higher education. In February 2018, the CNIL proceeded to an investigation in their premises to detect abusive permanent video camera footage everywhere without due notice. Furthermore the live video recording was accessible to everyone.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was reminded that the video surveillance should be limited and access limited to authorised staff. Association 42 was given two month to comply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* The&nbsp;<a href=\"https://www.cnil.fr/fr/videosurveillance-excessive-mise-en-demeure-itic\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Institut des techniques informatiques et commerciales (l’ITIC)</strong></a>, another private school,&nbsp;had a similar practice of excessive camera surveillance, with retention of video footage over the required one month, lacking secure storage to avoid unauthorised access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data breach</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* If all these companies were served a notice,&nbsp;<a href=\"https://www.cnil.fr/fr/optical-center-sanction-de-250000eu-pour-une-atteinte-la-securite-des-donnees-des-clients-du-site\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>OPTICAL CENTRE</strong></a>&nbsp;has incurred a fine of 250,000 euros for a significant data leak that might have exposed customers’ sensitive personal information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"An on-site inspection was carried out on the premises of OPTICAL CENTER, during which [the company] acknowledged that [its] website did indeed have a security defect. In this case, the site&nbsp;&nbsp;<em>www.optical-center.fr</em>&nbsp;did not include functionality to verify that a customer is well connected to his personal space (“customer area”) before displaying his invoices. It was thus relatively simple to access documents from another client of the company.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Biometrics in workplace</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>*&nbsp;<a href=\"https://www.cnil.fr/fr/biometrie-au-travail-illegale-sanction-de-10000-euros\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Assistance Centre d\'Appels</strong></a>&nbsp;was investigated in its premises back in 2016. Several irregularities were found :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>fingerprint used to control work hours without prior authorisation,</li><li>audio recording of phone conversations without notice to employees and contacts</li><li>lack of strong passwords and automatic lock</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>After an initial notice, the CNIL did a second inspection that revealed only a partial application of the injunctions. therefore a fine of 10.000 Euros was given.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are the decisions that were deemed worthy of publication by the CNIL. Neither of them belong to the targeted sectors. the fines are minimal. the CNIL has preferred the approach of giving notice and checking if the injunctions have been followed by action.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>List of all CNIL\'s sanctions&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/tag/sanctions\" target=\"_blank\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a rel=\"noreferrer noopener\" href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>.<br></p>\n<!-- /wp:paragraph -->','French CNIL\'s six first month of GDPR','The CNIL investigated mobile applications using embedded software development kit (SDK) and ad biding gathering personal data even when the application is not in use. The data collection is activated by default, which is contrary to the principal of privacy by design.','inherit','closed','closed','','1065-revision-v1','','','2020-11-26 20:29:00','2020-11-26 20:29:00','',1065,'https://www.datarainbow.eu/1065-revision-v1/',0,'revision','',0),(1790,2,'2020-11-26 20:30:16','2020-11-26 20:30:16','','Screenshot 2020-11-26 at 20.29.59','','inherit','open','closed','','screenshot-2020-11-26-at-20-29-59','','','2020-11-26 20:30:16','2020-11-26 20:30:16','',1062,'https://www.datarainbow.eu/wp-content/uploads/2019/01/Screenshot-2020-11-26-at-20.29.59.png',0,'attachment','image/png',0),(1791,2,'2020-11-26 20:30:20','2020-11-26 20:30:20','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian LLM</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There has been and still remains interrogations and uncertainties around the scope of application of the General Data Protection Regulation. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR contains rules concerning the protection of natural persons when their personal data are processed and rules on the free movement of personal data, as stressed in&nbsp;Article 1(1) GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 1 GDPR Subject-matter and objectives edicts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3. The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Related Recitals : 1 to 12</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 1(2) GDPR&nbsp;provides that the GDPR seeks to protect&nbsp;fundamental rights and freedoms of natural persons&nbsp;and, more specifically, their&nbsp;right to the protection of personal data. It means that, as such, the Regulation does not deal with the rights and freedoms of legal persons, such as companies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Rec.27, 158, 160; Art.1(1)-(2), 4(1) The law protects the personal data of natural persons, but does not apply to data of deceased persons. However, Member States may provide for rules regarding the processing of data of deceased persons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Article 8 of the EU Charter of Fundamental Rights -&nbsp;Protection of Personal data :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. Everyone has the right to the protection of personal data concerning him or her.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3. Compliance with these rules shall be subject to control by an independent authority.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 2 GDPR Material scope :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. This Regulation does not apply to the processing of personal data:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. in the course of an activity which falls outside the scope of Union law;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. by the Member States when carrying out activities which fall within the scope of&nbsp;<a href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:12012M/TXT\" target=\"_blank\" rel=\"noreferrer noopener\">Chapter 2 of Title V of the TEU</a>;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3. by a natural person in the course of a purely personal or household activity;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>4. by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3. For the processing of personal data by the Union institutions, bodies, offices and agencies,&nbsp;<a href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32001R0045\" target=\"_blank\" rel=\"noreferrer noopener\">Regulation (EC) No 45/2001</a>&nbsp;applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with&nbsp;<a href=\"https://gdpr-info.eu/art-98-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 98</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>4. This Regulation shall be without prejudice to the application of&nbsp;<a href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32000L0031\" target=\"_blank\" rel=\"noreferrer noopener\">Directive 2000/31/EC</a>, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Related Recitals : 13 to 21, 27</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Directive applies to the processing of personal data:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>• by automatic means (e.g., a computerised system or database); and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>• by other (non-automated) means that form part of a relevant filing system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The protection of individuals should be technologically neutral and should not depend on the techniques used.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 3 GDPR Territorial scope</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board, the supervisory authority that replaced the Working Party Article 29, has issued guidance on the territorial scope of the GDPR</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. the monitoring of their behaviour as far as their behaviour takes place within the Union.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Related Recitals : 22 to 25</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Recital 24:</strong>&nbsp;“Factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 3(1): “This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.” Article 3(2): “This regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: a. The offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or b. The monitoring of their behavior as far as their behavior takes place within the Union.”&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google Spain case (<a rel=\"noreferrer noopener\" href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=152065&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=703553\" target=\"_blank\">C-131/12</a>), in which the CJEU ruled that&nbsp;\"processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State, within the meaning of that provision, when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State.\"&nbsp;Thus, an EU-based entity that does not carry out data processing but performs an activity which can be considered inextricably linked to data processing will fall under the GDPR.&nbsp;&nbsp;&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>France v Google, Advocate General</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UK ICO : What is Personal data ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Personal data&nbsp;are defined as \"any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does this includes IP addresses? In a&nbsp;<a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=184668&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1034974\" target=\"_blank\" rel=\"noreferrer noopener\">groundbreaking decision on October 19th</a>,&nbsp;the Court of Justice of the European Union (CJEU) ruled that dynamic IP addresses could be considered as personal data. Under GDPR,&nbsp;clearly, the IP address, an ‘identification number’, can be personal data.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR applies to both automated personal data and to manual filing systems where personal data are accessible according to specific criteria. This could include chronologically ordered sets of manual records containing personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Personal data that has been pseudonymised can fall within the scope of the GDPR depending on how difficult it is to attribute the pseudonym to a particular individual.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Widening the scope of personal data from the Data Protection Directive, the GDPR applies to :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>EU based controllers and processors when personal data is processed “in the context of its activities”.&nbsp;</li><li>In addition, GDPR will apply to controllers and processors established in the European Economic Area (EEA) member states Iceland, Norway and Liechtenstein.</li><li>The GDPR may also apply to those established outside the European Union that target, by offering goods or services to data subjects in the EU/EEA, or that monitor the behaviour of such data subjects. The use of an EU language/currency, the ability to place orders in that other language and references to EU users or customers will be relevant.&nbsp;(Pammer v Reederei Karl Schlüter GmbH &amp; Co and Hotel Alpenhof v Heller (<a href=\"http://curia.europa.eu/juris/liste.jsf?language=en&amp;num=C-585/08\" target=\"_blank\" rel=\"noreferrer noopener\">Joined cases(C-585/08</a>) and (C-144/09))</li><li>Non-EU/EEA controllers established in a place where EU/EEA law applies by virtue of public international law.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Would the GDPR apply to non EU controllers established within the EEA but exclusively processing data of non EU/EEA residents?&nbsp;Some data processors process data of non EU citizens while based in the EU/EEA. To me, it s unclear if GDPR applies to them. The main practical issue here is the reach of jurisdiction for non EU citizen.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The long-arm of EU jurisdiction is translated by the requirement for controllers falling into these categories to appoint an EU-based representative. Falling ‘outside the scope of Union law’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR should not apply to the processing of the personal data of EU/EEA citizens, when collected outside the EU by non EU controllers based outside the EU/EEA. For instance data collected from an EU citizen when traveling abroad outside the EU.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2><a href=\"https://edpb.europa.eu/our-work-tools/public-consultations/2018/guidelines-32018-territorial-scope-gdpr-article-3_en\" target=\"_blank\" rel=\"noreferrer noopener\">EDPB Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)</a></h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->','GDPR Material and Territorial Scopes','There has been and still remains interrogations and uncertainties around the scope of application of the General Data Protection Regulation.','inherit','closed','closed','','1062-revision-v1','','','2020-11-26 20:30:20','2020-11-26 20:30:20','',1062,'https://www.datarainbow.eu/1062-revision-v1/',0,'revision','',0),(1792,2,'2020-11-26 20:36:27','2020-11-26 20:36:27','','Screenshot 2020-11-26 at 20.35.54','','inherit','open','closed','','screenshot-2020-11-26-at-20-35-54','','','2020-11-26 20:36:27','2020-11-26 20:36:27','',503,'https://www.datarainbow.eu/wp-content/uploads/2019/11/Screenshot-2020-11-26-at-20.35.54.png',0,'attachment','image/png',0),(1793,2,'2020-11-26 20:36:36','2020-11-26 20:36:36','<!-- wp:paragraph -->\n<p>Hilcenko, Christine; Taubman-Bassirian, Tara</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to knowledge for everyone in the increasingly-interconnected society has been a tool for democracy. We discuss here the dangers of a world online and the growing concerns about state surveillance, security, privacy and exploitation. We discuss our right to protect our individual freedom. We conclude that privacy is a fundamental Human Rights in order to guarantee human dignity and freedom.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://repozytorium.ur.edu.pl/handle/item/4959\">https://repozytorium.ur.edu.pl/handle/item/4959</a></p>\n<!-- /wp:paragraph -->','Privacy, Education and Human Dignity','Access to knowledge for everyone in the increasingly-interconnected society has been a tool for democracy. We discuss here the dangers of a world online and the growing concerns about state surveillance, security, privacy and exploitation. We discuss our right to protect our individual freedom. We conclude that privacy is a fundamental Human Rights in order to guarantee human dignity and freedom.','inherit','closed','closed','','503-revision-v1','','','2020-11-26 20:36:36','2020-11-26 20:36:36','',503,'https://www.datarainbow.eu/503-revision-v1/',0,'revision','',0),(1794,2,'2020-11-26 20:40:00','2020-11-26 20:40:00','','Screenshot 2020-11-26 at 20.39.16','','inherit','open','closed','','screenshot-2020-11-26-at-20-39-16','','','2020-11-26 20:40:00','2020-11-26 20:40:00','',484,'https://www.datarainbow.eu/wp-content/uploads/2019/10/Screenshot-2020-11-26-at-20.39.16.png',0,'attachment','image/png',0),(1795,2,'2020-11-26 20:40:10','2020-11-26 20:40:10','<!-- wp:paragraph -->\n<p>Cybertalks publish WOMEN IN CYBER! Here is a sneak preview of 5 amazing women that are experts in cybersecurity speaking out about the importance of women in the cyber industry! <a href=\"https://www.linkedin.com/in/ACoAAAAteKcBtFc457ep-RMibE_gH95vaVzQIMg/\">Jane Frankland</a><a href=\"https://www.linkedin.com/in/ACoAAANQufwBINTh-Zhy2lClO-PQbpRDybfy11A/\">ASLI YILDIZ, LLM</a><a href=\"https://www.linkedin.com/in/ACoAACH29hIBq7uJ5veyfswA_nDM__CxmgPfD40/\">Erica Stanford</a><a href=\"https://www.linkedin.com/in/ACoAAAEjZSMBPHCDNL0ZfbkbHBFk7NBEwjLsbi0/\"> </a>including<a href=\"https://www.linkedin.com/in/ACoAAAEjZSMBPHCDNL0ZfbkbHBFk7NBEwjLsbi0/\"> Tara TAUBMAN-BASSIRIAN LLM.&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Tara is interviewed about Brexit and the UK data Protection. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK Information commissionner has drafted a guidance <a href=\"https://ico.org.uk/for-organisations/data-protection-and-brexit/data-protection-if-theres-no-brexit-deal/\">Data protection if there\'s no Brexit deal</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From the EDPB <a href=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb-2019-02-12-infonote-nodeal-brexit_en.pdf\">Information note on data transfers under the GDPR in the<br> event of a no-deal Brexit,&nbsp;</a>Adopted on 12 February 2019</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From the French Data Protection Authority, the CNIL : <a href=\"https://www.cnil.fr/fr/cnil-direct/question/1267\">Règlement européen : Brexit (\"British Exit\"), quelles conséquences sur l\'application du règlement européen au Royaume-Uni ?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The main point is with a no deal Brexit, UK becomes a country of non adequate data protection. Data could still be exported from the UK to the EU, however, import of data from the EU to the UK will have to be protected in case by case, with Standard Contractual Clauses to be approved, a lengthy process. Binding Corporate Rules are less common. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What happens when data is being processed \"on behalf of\" the UK (or non-EU) controller Art 44 GDPR? There is no set of Clauses which deal with processor to controller transfers. Additionally, organisations regularly trading with EU will have to appoint a representative in the EU country where they have the most activity. Non EU organisations who had adopted UK as a country of their representation will have to define a new representative within the EU. This is not going to be the only complexity of dealing with the Brexit with no deal. Is your organisation ready for the jump?</p>\n<!-- /wp:paragraph -->','WOMEN IN CYBER! Brexit no Deal','Cybertalks publish WOMEN IN CYBER! Tara Taubman-Bassirian is interviewed about Brexit and the UK data Protection.','inherit','closed','closed','','484-revision-v1','','','2020-11-26 20:40:10','2020-11-26 20:40:10','',484,'https://www.datarainbow.eu/484-revision-v1/',0,'revision','',0),(1796,2,'2020-11-26 20:42:09','2020-11-26 20:42:09','','Screenshot 2020-11-26 at 20.41.19','','inherit','open','closed','','screenshot-2020-11-26-at-20-41-19','','','2020-11-26 20:42:09','2020-11-26 20:42:09','',498,'https://www.datarainbow.eu/wp-content/uploads/2019/11/Screenshot-2020-11-26-at-20.41.19.png',0,'attachment','image/png',0),(1797,2,'2020-11-26 20:42:16','2020-11-26 20:42:16','<!-- wp:core-embed/wordpress {\"url\":\"https://cybertalks.co.uk/interviews/ico-slow-to-fine-organisations/\",\"type\":\"wp-embed\",\"providerNameSlug\":\"cybertalks\"} -->\n<figure class=\"wp-block-embed-wordpress wp-block-embed is-type-wp-embed is-provider-cybertalks\"><div class=\"wp-block-embed__wrapper\">\nhttps://cybertalks.co.uk/interviews/ico-slow-to-fine-organisations/\n</div></figure>\n<!-- /wp:core-embed/wordpress -->\n\n<!-- wp:paragraph -->\n<p>Pre GDPR data privacy principles were ignored…and companies are still complacent as the ICO has been slow to fine organisations for failure to comply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://cybertalks.co.uk/profile/tara-taubman-bassirian/\">Tara Taubman-Bassirian</a>&nbsp;LLM,&nbsp;GDPR, Data Protection and IP consultant – Voted Privacy Hero of the Year, talks to&nbsp;<a href=\"https://cybertalks.co.uk/profile/karla-reffold/\">Karla Reffold</a>&nbsp;in a <a href=\"https://cybertalks.co.uk/interviews/ico-slow-to-fine-organisations/\">Cybertals interview</a> about GDPR and the rights of Data Subjects.</p>\n<!-- /wp:paragraph -->','Interview by Cybertalks','','inherit','closed','closed','','498-revision-v1','','','2020-11-26 20:42:16','2020-11-26 20:42:16','',498,'https://www.datarainbow.eu/498-revision-v1/',0,'revision','',0),(1798,2,'2020-11-26 20:44:23','2020-11-26 20:44:23','','Screenshot 2020-11-26 at 20.43.49','','inherit','open','closed','','screenshot-2020-11-26-at-20-43-49','','','2020-11-26 20:44:23','2020-11-26 20:44:23','',493,'https://www.datarainbow.eu/wp-content/uploads/2019/11/Screenshot-2020-11-26-at-20.43.49.png',0,'attachment','image/png',0),(1799,2,'2020-11-26 20:44:48','2020-11-26 20:44:48','<!-- wp:embed {\"url\":\"https://www.voiceamerica.com/episode/112620/null\"} -->\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps://www.voiceamerica.com/episode/112620/null\n</div></figure>\n<!-- /wp:embed -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><strong>GDPR, Data Privacy Day and The Need for Privacy</strong></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":5} -->\n<h5>Hosted by Rebecca Herold</h5>\n<!-- /wp:heading -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><a target=\"_blank\" href=\"https://www.voiceamerica.com/guest/42903/tara-taubman-bassirian\" rel=\"noreferrer noopener\">Tara Taubman-Bassirian</a></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">Episode Description</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, <a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">with Rebecca</a>.</p>\n<!-- /wp:paragraph -->','Interview With the Privacy Professor Rebecca Herold','2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, with Rebecca.','inherit','closed','closed','','493-revision-v1','','','2020-11-26 20:44:48','2020-11-26 20:44:48','',493,'https://www.datarainbow.eu/493-revision-v1/',0,'revision','',0),(1800,2,'2020-11-26 20:48:23','2020-11-26 20:48:23','','Screenshot 2020-11-26 at 20.47.20','','inherit','open','closed','','screenshot-2020-11-26-at-20-47-20','','','2020-11-26 20:48:23','2020-11-26 20:48:23','',476,'https://www.datarainbow.eu/wp-content/uploads/2019/07/Screenshot-2020-11-26-at-20.47.20.png',0,'attachment','image/png',0),(1801,2,'2020-11-26 20:48:44','2020-11-26 20:48:44','<!-- wp:heading {\"level\":3} -->\n<h3>Interview Series: Tara Taubman Bassirian, Data Protection and IP Consultant at Data Rainbow</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://datagrail.io/author/kyle-schryver\">Kyle Schryver</a>&nbsp;July 10, 2019&nbsp;<br><a href=\"https://datagrail.io/categories/interview-series\">Interview Series</a><a href=\"https://datagrail.io/categories/legal\">Legal</a><a href=\"https://datagrail.io/categories/privacy\">Privacy</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"width\":214,\"height\":299} -->\n<figure class=\"wp-block-image is-resized\"><img src=\"https://cdn.buttercms.com/4utxwgcTSpP31ZLDPzsI\" alt=\"undefined\" width=\"214\" height=\"299\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://medium.com/@DataGrail/interview-series-tara-taubman-bassirian-data-protection-and-ip-consultant-at-data-rainbow-c4866c9bc2e3\">DataGrail recently interviewed Tara Taubman Bassirian</a>, Data Protection and IP Consultant at&nbsp;<a rel=\"noreferrer noopener\" href=\"https://datarainbow.eu/\" target=\"_blank\">Data Rainbow</a>&nbsp;to bring you insights from a leading legal professional in the field of data privacy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>DG:</strong>&nbsp;What is your role at Data Rainbow and what inspired you to pursue a career in legal and privacy, specifically focusing on the GDPR?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TTB:</strong>&nbsp;In a previous life, I was a corporate lawyer in France, and now my main focus is Data Rainbow: my consultancy. Prior to Data Rainbow, I was involved in online safety, heavily researching and advising on how to stay safe online — whether you’re an adult or a child. This lead to completing a Masters of Communication and Internet Law at Queen Mary University. In short, I’m passionate about technology and want to help others make the most out of existing technologies while mitigating any potential risks associated with the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Over the last few decades, technological innovations have profoundly impacted the daily lives of nearly everyone in the developed world. Technologies on the market are constantly evolving, and even older generations are adapting to the many improvements in their everyday lives. Data has become the new oil, as it’s as valuable as any commodity.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Unprecedented quantities of personal data are mined and analyzed. Collecting, storing, and aggregating is the new business model for many technology companies in our digital world, as data storage is inexpensive, and its value is ever increasing. Data Protection regulations — such as the GDPR — aim to reestablish the balance between the rights of data subjects and the data industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I strongly believe that privacy matters and want to ensure that privacy is maintained alongside the surge in data capture and analysis. Privacy equals transparency plus control. Without privacy, there’s no freedom nor human dignity. In turn, legislation needs to adapt in line with technological advancements; the right to privacy is a human right that needs to be fought for. The totality of privacy risks associated with the digital age are still largely unknown by most people, and we need to be educated on the potential negative outcomes before they arise.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>DG:</strong>&nbsp;What is your favorite part of working in the legal space, specifically covering data privacy practices?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TTB:</strong>&nbsp;I would recommend any newly qualified or even established lawyer who loves innovation to enter the field of data protection, as it’s intellectually stimulating. There are continuous advancements in the technology space, which can lead to breaches of privacy or personal data. Within the technology industry, data protection lawyers are truly at the forefront of regulation. The privacy issues we’re experiencing today didn’t occur 30 years ago. With information becoming more and more accessible to us, data protection lawyers can uncover what’s going on in the technology space, how to anticipate potential negative outcomes, and how to create the best solutions for it.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No day is routine, and each one brings about new regulations, new guidance, and new challenges. As a result, there’s a need to constantly update knowledge. Not only that, but potentially everyone is affected. Most of us in the developed world use smartphones and have social media profiles, so it’s in our best interest to be fully informed on the potential effects that technology can have on our lives. Technology greatly enriches our lives but giving up our privacy for its benefits is too big of a price to pay.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>DG:</strong>&nbsp;With rising consumer privacy awareness, how can businesses best inform users that their data is secure and private?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TTB:</strong>&nbsp;An organization’s website can provide an initial view of how seriously they take maintaining the privacy of its customers. A compliant website, with the required cookie banner, privacy by design with opt-in options, clear privacy notice, and sensible web developing is the first step towards compliance. We recently looked at websites using JavaScript codes that track and fingerprint users, and this is not acceptable. When commissioning a website, it’s very important to use certified developers to ensure that they respect regulations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>DG:</strong>&nbsp;As someone voted Privacy Hero in 2018, what advice do you have for other privacy professionals in terms of gaining experience, knowledge, and being able to find and implement solutions for companies?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TTB:</strong>&nbsp;The downside of this professional field is its high barrier of entry. It’s difficult to get your foot in the door without no practical experience. There’s a reticence towards hiring a Data Privacy lawyer who has not had prior experience in that role. This is further impacted by that fact that GDPR legislation requires that Data Protection Officers have legal qualifications. This poses an issue as lawyers can lack technical knowledge, while IT specialists lack legal knowledge.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Working as a Data Privacy lawyer requires extensive knowledge of both the legal and the technical worlds. There’s a serious need for lawyers with IT knowledge, as Law universities often do not teach IT. In effect, there’s a disconnect between the skills and experience required and what already exists within the market. Therefore, as a lawyer, I recommend using every resource available for self-education.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>DG:</strong>&nbsp;Based on your knowledge and experience with the GDPR, what advice can you give to companies in N. America who will have to face similar upcoming challenges with the CCPA and&nbsp;<a href=\"https://datagrail.io/blog/nevadas-new-privacy-law-how-it-matches-up-against-the-ccpa\">Nevada Privacy Law</a>?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TTB:</strong>&nbsp;North America is quite different from the EU in the sense that there’s no blanket protection but a patchwork of sectorial regulations. Furthermore, many Americans confuse PII with Personal Data. Also, some US companies have preferred to ignore the GDPR by banning EU customers from accessing their websites. However, they will now have to comply with the CCPA and other regulations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Compliance with data protection rules creates trust amongst users. Keeping data accurate and cleaning up stored data to keep only what is necessary is a component of a good business. Data mapping is also a good start to see where data is collected and stored.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Enjoy this interview? Check out our previous&nbsp;<a href=\"https://datagrail.io/blog/interview-series-alexandra-ross\">Interview Series with Alexandra Ross</a>, Director, Global Privacy and Data Security Counsel at Autodesk!</strong></p>\n<!-- /wp:paragraph -->','Interview with DataGrail','Interview Series: Tara Taubman Bassirian, Data Protection and IP Consultant at Data Rainbow','inherit','closed','closed','','476-revision-v1','','','2020-11-26 20:48:44','2020-11-26 20:48:44','',476,'https://www.datarainbow.eu/476-revision-v1/',0,'revision','',0),(1803,2,'2020-11-26 20:52:09','2020-11-26 20:52:09','<!-- wp:paragraph -->\n<p>A <a href=\"https://www.youtube.com/watch?v=xYZtHIPktQg#action=share\">short video created by Forbrugerrådet Tænk</a> that shows precisely how a large number of apps demand access to your private information such as location, contacts and text  messages. How would you react if real people demanded the same?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"https://datarainbow.eu/373b4146-9937-4304-a6cf-83a53d3d0d82\" alt=\"\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Don\'t forget to visit our <a href=\"https://www.pearltrees.com/privacyday?paccess=16febff1f47.ec66ccb.a7c2311362a91fc7ea3760971fcb5692#item247885003\">Pearltrees</a> filled with resources on Privacy, Data Protection, Online Security or join the Fly A Kite Facebook Page. Be aware of must if not all free App that collect your personal data. Set your privacy setting  in accordance, especially your geolocation. Delete or reject un-necessary cookies. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Join our TwitterChat Monday 28th at 3pm GMT following @clarinette02 using #PrivacyAware</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you wish to join us for the networking celebration in London from 6 to 9pm, please contact data@datarainbow.eu for more detail. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We are starting our first of a series of <a href=\"https://www.linkedin.com/pulse/privacy-walks-tara-taubman-bassirian-llm/﻿\">Walks in the Park</a> to chat privacy and Data Protection Sunday 2nd February at Richmond Park. contact data@datarainbow.eu for more details and show interest.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/pulse/2019-gdpr-privacy-best-wishes-tara-taubman-bassirian-llm/\">GDPR and Best Wishes 2019</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.youtube.com/watch?feature=youtu.be&amp;v=Y1b8865GOHU&amp;fbclid=IwAR0u3CAxvU8p9clE152Dhh8PAyYiwKA4chsjC_6euOyOywpzf8S-umOiX9g&amp;app=desktop\">What would a cyber attack look like in the real world?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.weforum.org/agenda/2019/01/privacy-is-a-human-right-we-need-a-gdpr-for-the-world-microsoft-ceo/\">Privacy is a human right, we need a GDPR for the world: Microsoft CEO</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/gdpr-in-numbers-3/\">GDPR in Numbers</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Statistics collected from 11 EU countries show that 8 months into the GDPR, the new data protection law is alive and kicking. DPAs have received thousands of complaints and breach notifications, and a first large fine has already been imposed.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can contact us at Daa@DataRainbow.eu for all your queries concerning Data Protection and compliance. </p>\n<!-- /wp:paragraph -->','HAPPY PRIVACY DAY @)!( !!','apps demand access to your private information such as location, contacts and text  messages. How would you react if real people demanded the same?','inherit','closed','closed','','217-revision-v1','','','2020-11-26 20:52:09','2020-11-26 20:52:09','',217,'https://www.datarainbow.eu/217-revision-v1/',0,'revision','',0),(1804,2,'2020-11-26 20:55:13','2020-11-26 20:55:13','','Screenshot 2020-11-26 at 20.54.11','','inherit','open','closed','','screenshot-2020-11-26-at-20-54-11','','','2020-11-26 20:55:13','2020-11-26 20:55:13','',204,'https://www.datarainbow.eu/wp-content/uploads/2019/01/Screenshot-2020-11-26-at-20.54.11.png',0,'attachment','image/png',0),(1805,2,'2020-11-26 20:55:37','2020-11-26 20:55:37','<!-- wp:paragraph -->\n<p>In what is today the biggest fine under the GDPR, the French Data Protection Authority CNIL investigated Google Android transparency in Data processing. The investigation was consecutive to two class actions filed on the 25th of May 2018. One by the Austrian NGO Non Of Your Business (NOYB), another by the French La Quadrature du Net (LQDN). The complained have been partly answered as limited to the mobile Android Operating System. Still remain Youtube, Gmail and Google Search. This decision worth a close look up.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its complaint, NOYB stated in particular that users of Android mobile devices are required to accept Google\'s privacy policy and general terms and conditions of service and that, failing such acceptance, they could not use their terminal.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The association LQDN complained that, regardless of the terminal used, Google does not have valid legal bases to implement the processing of personal data for purposes of behaviour analysis and advertising targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>First  of all, the CNIL has shown high celerity to deal with the complaints.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>On 1st June 2018, the CNIL submitted the complaints to its European counterparts via the European information exchange system with a view to the designation of a possible lead authority in accordance with the provisions of Article 56 of the GDPR.</li><li>20 September 2018 : Decision to investigate the Android\'s data procession is taken; </li><li>on 21 September, an online test was carried out  to verify the compliance of any processing relating to the use of the operating system Android for mobile equipment, including the creation of a Google account.</li><li>24 and 25th September, the report was notified to GOOGLE LLC companies.&nbsp;and Google France SARL</li><li>28 September 28,  the two companies also received the aforementioned complaints by courier of the CNIL</li><li>2nd Octobre, Mr. François PELLEGRINI was appointed as rapporteur according to the article 47 French Data Protection law of January 6, 1978</li><li>22nd October, the reporter notified Google LLC&nbsp;and Google France a report detailing shortcomings relating to sections 6, 12 and 13 of the GDPR. The report suggested&nbsp;a fine of 50 million euros to be made public.&nbsp;</li><li>7 November 2018, Google requested a hearing from the rapporteur, </li><li>13 November the request was rejected .</li><li> On the same date, the company also made a request for closed doors and postponement of the meeting, </li><li>15 November the request was rejected.</li><li>22nd November, Google filed a written comments on the report.&nbsp;</li><li>7th December, the rapporteur replied to these observations.</li><li>11th December, Google, which had fifteen days from receipt of the rapporteur\'s to reply, requested to postpone the meeting and extend the deadline to produce new observations.&nbsp; </li><li>13th December , the request was accepted to postpone for two weeks - until January 7 - the deadline for filing these observations and to postpone the meeting to January 15, 2019.</li><li>4th January, Google filed new observations in response to those of the rapporteur.</li><li>All observations were reiterated orally during the meeting of 15 January 2019.</li><li>21st January the decision was made public.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>On the decision itself, Google argued the French CNIL should not be the competent Data Protection Authority.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on Article 55 (1) of the GDPR states: Each supervisory authority shall be competent to exercise the tasks and powers vested in it in accordance with this Regulation in the territory of the Member State to which it belongs.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 56 (1) of the GDPR provides: Without prejudice to Article 55, the supervisory authority of the principal place of business or of the sole place of business of the controller or processor shall have jurisdiction to act as lead supervisory authority for cross-border processing by that controller or processor, in accordance with the procedure laid down in Article 60.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google argued that the CNIL could not be competent to conduct this procedure and that it should have transmitted the complaints received to the Irish Data Protection Commission (DPC) the lead authority to deal with these cross-border complaints in accordance with Art 60 GDPR.&nbsp;Google Ireland Limited being its main establishment in the EU for some of the its cross-border processing, including those objects of the complaints.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, initial discussions turned around the competent authority as defined by the main establishment of the company. Google arguing Ireland to be its main establishment, the CNIL responding the main Administrative establishment is not the criteria. Based on Article 4 (16) of the RGPD&nbsp;and Recital 36 GDPR, the main establishment to consider should be based on objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes and means of processing trough stable arrangements. The CNIL added that the determination should be analysed in concreto, according to objective criteria. The main establishment could therefore not necessarily correspond to the main designated administrative establishment.  The CNIL based its position on the WP article 29 guidance WP244 of 5th April 2017 \"<em>the central administration is the place where the decisions are made on the purposes and means of processing.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciding otherwise would result on forum shopping, says the CNIL. Google Ireland had no decisional power. Google Ireland Limited is not mentioned in the Company\'s Privacy Policy dated May 25, 2018 as the entity where the main decisions about the purposes and means of the processing are made. covered by the privacy policy presented to the user when creating his account, during the configuration of his mobile phone on Android. In fact Google had not either named any DPO in Ireland who would be in charge of the processing of personal data that it could implement in the European Union.&nbsp;It further notes that the Android operating system is developed solely by Google LLC.. Additionally, the company itself had indicated, by mail dated December 3, 2018 addressed to the DPC, that the transfer of responsibility of Google LLC.&nbsp;to Google Ireland Limited on certain processing of personal data concerning European citizens would be finalized on 31 January 2019. It later specified to update its confidentiality rules which will come into effect on 22 January 2019. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google\'s argument that a reorganisation both operational and organizational was underway to make the company Google Ireland Limited the controller for certain processing of personal data concerning European nationals, was in my view a mistake only proving that at the time of the compliant Google Ireland had no decisional power.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It also considers that the definition of principal place of business should be distinguished from that of controller. Arguing that if the European legislator had intended that the concept of principal place of business should be interpreted as the place where decisions concerning \'would have expressly indicated simply ignored the text of the Recital 36.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the absence of a principal establishment allowing the identification of a lead authority, the one stop shop did not apply, and the CNIL was competent to initiate this procedure and to exercise all of its powers under Article 58 of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very interesting analysis to determine the main establishment and the lead authority based on objective criteria and not a subjective decision favouring forum shopping. The decision dismisses the application of the GDPR’s one-stop-shop by holding that Google Ireland Limited is not Google’s main establishment in the EU. A rather strict interpretation of the concept of “main establishment”. With no main establishment in the EU, Google LLC could potentially be subject to enforcement by any supervisory authority in the EU where Google has an establishment, including France.&nbsp; </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Once the CNIL confirmed its competence, it goes into a detailed analysis of the transparency requirement and legitimate basis of processing. here after, a free translation is offered:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- On the Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google argued on the validity of the complaints. &nbsp;The CNIL responded that the question of the admissibility of the complaints could not affect the legality of the proceedings, as it could self-refer itself based on the findings made by its services.&nbsp;The CNIL had therefore a mission to supervise the application of the regulation and to ensure compliance with it and that it has, for this purpose, the power to carry out investigations, in accordance with Arti 57 1. a) and h) of the RGPD. In fact, the two associations had been mandated to represent the complaints under article 80 of the RGPD.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The second argument claiming that the proceedings breached its right to a fair trial according to Art 6 of the Convention for the Protection of Human Rights and Fundamental Freedoms that the rapport to his observations were addressed in French, sounded rather difficult to succeed. The CNIL responded to that any notification of a penalty report had to be in French based on a legal obligation laid down in Article 111-1 of the Code of relations between the public and the administration which provides that use of the French language is prescribed in the exchanges between the public and the administration, in accordance with the provisions of the law n ° 94-665 of August 4, 1994 relating to the use of the French language. Google has an establishment on the French territory with several hundred employees. Google had in any event sufficient material and human resources enabling it to ensure a translation of the documents in English in sufficient time to become acquainted with it and to make observations within the deadline.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of these elements, the Restricted Training considers that the company had in any event sufficient material and human resources enabling it to ensure a translation of the documents in English in sufficient time to become acquainted with it and to make observations in the the deadline fixed for it.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This point explains why it is important that the Organisations\' representative speak the language of the DPA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also the refusal to extend the time limit he was opposed to produce his first observations and limited the time available to prepare his defence.&nbsp;It also considers that the adjournment of the meeting as well as the additional time it was finally granted to produce its second observations were still not sufficient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>3.Over the scope of investigations</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google argued first of all that the rapporteur has confused the Android operating system and the Google account when they are separate services that implement different treatment activities. Then argued that the scope of control chosen by the CNIL - namely the creation of a Google account when setting up a new device using the Android operating system - is limited in that it only represents a case figure affecting 7% of users. Finally, it indicated that the findings were made on an older version of the Android operating system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL did not disputed the existence of separate services, respectively related to the Android operating system and the Google Account, implementing different processing activities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It observed, however, that the facts covered by the investigations corresponded to the scenario chosen to carry out the on-line check, namely the journey of a user and the documents to which he could have accessed during the initial configuration of his mobile equipment using the Android operating system.&nbsp;This path included the creation of an account.&nbsp;These facts therefore related to the treatments covered by the privacy policy presented to the user when creating an account during the setting up of their mobile phone on Android.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Then, adding that if it was true that the user actually had the choice to create an account and has the opportunity to use some of the services without having to create an account, however, when setting up an Android device, the ability to create a Google account or connect to an existing account naturally appeared at the beginning of the setting process, without specific action of the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In any case, under Article 11.I.2 of the Data Protection Act, the CNIL has a broad discretion as to the scope of the controls it may undertake.&nbsp;A specific control scenario, such as that used in this case, may make it possible to make findings reflecting a more comprehensive privacy policy. The scope of the processing of personal data that is performed&nbsp;is therefore is irrelevant so is the version of the Android operating system since it appears from the documents provided by Google that the user\'s journey is similar in the newer version .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>4.On breach of transparency and information obligations</strong><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google infringed the GDPR for three main reasons: (1)&nbsp;<strong>lack of transparency&nbsp;</strong>(art. 5 GDPR); (2)&nbsp;<strong>insufficient information&nbsp;</strong>(art. 12 and 13 GDPR); and (3)&nbsp;<strong>invalid consent collection or lawfulness basis&nbsp;</strong>(art. 7 GDPR). The CNIL found the information Google provides when creating an account is not clearly accessible and therefore consent is not \'informed\' and explicitly obtained. Criticising pre-ticked boxes explicitly prohibited by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <strong>obligations of transparency</strong> resulted on Article 12 (1) GDPR that provides: \"<em>1.The controller shall take appropriate measures to provide any information referred to in&nbsp;</em><a href=\"http://www.privacy-regulation.eu/en/article-13-information-to-be-provided-where-personal-data-are-collected-from-the-data-subject-GDPR.htm\"><em>Articles 13</em></a><em>&nbsp;and 14 and any communication under&nbsp;</em><a href=\"http://www.privacy-regulation.eu/en/article-15-right-of-access-by-the-data-subject-GDPR.htm\"><em>Articles 15</em></a><em>&nbsp;to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 13 (1) provides that:  <em>\"1.&nbsp;Where personal data relating to a data subject are collected from the data subject, the&nbsp;controller&nbsp;shall, at the time when personal data are obtained, provide the data subject with all of the following information:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(a)&nbsp;&nbsp;&nbsp; the identity and the contact details of the&nbsp;controller&nbsp;and, where applicable, of the&nbsp;controller\'s&nbsp;representative;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(b)&nbsp;&nbsp;&nbsp; the contact details of the data protection officer, where applicable;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(c)&nbsp;&nbsp;&nbsp; the purposes of the&nbsp;processing&nbsp;for which the personal data are intended as well as the legal basis for the&nbsp;processing;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(d)&nbsp;&nbsp;&nbsp; where the&nbsp;processing&nbsp;is based on point (f) of Article 6(1), the legitimate interests pursued by the&nbsp;controller&nbsp;or by a&nbsp;third party;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(e)&nbsp;&nbsp;&nbsp; the&nbsp;recipients or categories of&nbsp;recipients of the personal data, if any;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(f)&nbsp;&nbsp;&nbsp; where applicable, the fact that the&nbsp;controller&nbsp;intends to transfer personal data to a third country or&nbsp;international organisation&nbsp;and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article&nbsp;46 or 47, or the second subparagraph of Article&nbsp;49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google firstly considered that the Confidentiality rules and conditions of use, accessible when creating an account, constitutes first-level information in accordance with the EDPS Guidelines on Transparency within the meaning of the EU Regulation 2016 / 679 (WP260) of 25 May 2018. It states that the document provides a good overview of the treatments implemented and that the mention of the legal basis of these treatments does not have to be included in this first level information.&nbsp;Information about how long the data is kept is in the section Exporting and Deleting the Information in the Privacy Policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google goes on to argue that the information of individuals must, in the light of sections 12 and 13 of the Regulations, be assessed on a global basis.&nbsp;In this regard, it states that the information it issues is also used, in addition to the documents entitled Confidentiality Rules and Conditions of Use, Privacy Policy and Terms of Use, through several other terms and conditions.&nbsp;Additional information messages may appear when creating an account under each of the privacy settings.&nbsp;In addition, an e-mail is sent to the user when an account is created, stating that: it can change the privacy and security settings of the Google account at any time,&nbsp;create reminders to check the privacy or security settings.&nbsp;This e-mail  contains clickable links to various setting tools.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These other control tools, which are made available to the user after the creation of his account from the management interface of his account include for example a tool called check-up confidentiality that allows users to choose privacy settings that suit them, including custom ads, location history, web-based activity, and apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google also puts forward a Dashboard tool that allows users to have an overview of the use they make of the services offered by Google such as Gmail or Youtube.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Finally, Google reminds that when a user clicks Create Account without having disabled custom ad settings, an account creation confirmation pop-up appears to remind that the account is set to include customisation features.&nbsp;The company indicates that the user journey is thus configured to slow down the progression of users who would not have spontaneously made the choice of more privacy-friendly settings.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL takes note of the progress made in recent years by the company in its policy of informing users, in the sense of greater transparency and greater control over their data expected by them.&nbsp;For the reasons that follow, however, it considers that the requirements of the GDPR, the implementation of which must be assessed in the light of the concrete scope of the processing of personal data in question, are not respected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Firstly, the CNIL recalls that pursuant to the provisions of Art 12 of the Regulation, information must be provided in an <strong>easily accessible way</strong>.&nbsp;This accessibility requirement is informed by the <strong>transparency guidelines</strong>, in which the EDPS considered that a key aspect of the transparency principle highlighted in these provisions is that the data subject should be able to advance what the scope and consequences of the processing encompass so as not to be caught off guard at a later stage as to how its personal data were used.&nbsp;[...] In particular, with regard to complex, technical or non-planned data processing,&nbsp;G29\'s position is that [...] controllers should <strong>separately and clearly define the main consequences of treatment</strong>: in other words, what will actually be the effect of the specific treatment described in a statement or opinion on the protection of the privacy for the data subject.&nbsp;The CNIL also recalls that the <strong>accessibility requirement </strong>of Article 12 is based in part on the ergonomic choices made by the controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In this case, the CNIL found that the general architecture of the information chosen by the Corporation does not meet the requirements of the Regulations.&nbsp;The information that must be disclosed to individuals pursuant to section 13 is <strong>excessively scattered in several documents</strong>: Privacy Policy and Terms of Use, displayed during the creation of the account, then Terms of Use and Rules of confidentiality which are accessible in a second time by means of clickable links appearing on the first document.&nbsp;These different documents include buttons and links that must be activated to learn additional information.&nbsp;Such an ergonomic choice leads to a fragmentation of information thus forcing the user to multiply the clicks necessary to access the different documents.&nbsp;The user must then carefully consult a large amount of information before he or she can identify the relevant paragraph (s).&nbsp;However, the work provided by the user does not stop there since it will still have to cross-check and compare the collected information in order to understand which data are collected according to the various settings that he may have chosen.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL noted that, given this architecture, some information is difficult to find. For example, with regard to targeted advertising, to know the information that is collected, a user must perform many actions and combine several documentary resources.&nbsp;As a first step, you should read the General Privacy Policy and Terms of Service, then click the More Options button and then the Read more link to display the Customise Ads page.&nbsp;He will thus have access to a first description of the treatment relating to the personalisation of the advertisement which proves to be incomplete.&nbsp;To complete the information relating to the data processed for this purpose,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Similarly, in terms of <strong>geolocation data processing</strong>, the CNIL noted that the same course devoid of any intuitive character is required from the user with regard to information relating to geolocation data.&nbsp;The user will have to complete the following steps: Review the Privacy Policy and Terms of Service, click More Options, and then click the Learn more link to view the Location History page and view the displayed text. However, as this text is only a short description of the processing, the user will need to go to the Privacy Policy document and access the Information about your location to access the rest of the information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the two cases described, <strong>five actions are necessary for the user to access the information</strong> relating to the targeted advertisements and s<strong>ix for the geolocation</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL stated that if the user wished to have <strong>information on the retention periods</strong> of his personal data, he must first consult the Privacy Policy found in the main document and then go to the section titled Export and delete the information and finally click on the hyperlink click here contained in a general paragraph on storage times.&nbsp;It is therefore only after four clicks that the user accesses this information.&nbsp;The Restricted Training further notes that the title chosen by the company for Exporting and Deleting Your Information does not easily allow the user to understand that this is a topic to access information about retention periods .&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As a result of all these factors, there is an <strong>overall lack of accessibility</strong> of the information provided by the company in the context of the processing in question.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, the CNIL considered that the<strong> clear and comprehensible nature of the information provided</strong>, as required by Article 12 of the GDPR, <strong>must be assessed taking into account the nature of each treatment</strong> in question and its <strong>concrete impact on the persons concerned</strong>. concerned.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Beforehand, the CNIL considered it was essential to emphasise that the <strong>data processing</strong> implemented by the controller was <strong>particularly massive and intrusive</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data Google collects <strong>comes from a wide variety of sources</strong>.&nbsp;This data is collected both from the use of the phone, the use of the company services, such as the Gmail email service or the Youtube video platform, but also from the data generated by the user activity when they visit third-party sites that use <strong>Google services, including Google Analytics cookies placed on these sites.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As such, the Privacy Policy reveals that <strong>at least twenty services</strong> offered by the company are likely to be involved in the processing, which may concern data such as web browsing history, history from applications, data stored locally on the equipment (such as address books), geolocation of equipment, etc.&nbsp;Therefore, <strong>a lot of data is processed as part of these services via or in connection with the Android operating system</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The record shows that, in addition to data from external sources, the company treats <strong>at least three categories of data</strong>: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>data produced by the user</strong> (for example, their name, password, phone number, email address, payment method, content created, imported or received, such as writings, photos or videos );  </li><li><strong>data generated by its activities</strong> (for example, IP address, unique user credentials, mobile network data, data related to wireless networks and Bluetooth devices, timestamp of actions performed, data geolocation, the technical data of the devices used including data relating to the sensors (accelerometer, etc.), the videos viewed, the searches made, the browsing history, the purchases, the applications used, etc .;</li><li><strong>Derived or inferred data from data provided by the user or his activities</strong>.&nbsp;In this category, the Privacy Policy lists a number of purposes that can only be accomplished by generating data from the other two categories of data.&nbsp;Thus, the customisation of the ads that the company realises requires to infer the interests of users from their activity in order to offer them to advertisers.&nbsp;In the same way, the purposes of providing content, research and personalised recommendations require inferring new information from those declared, produced or generated by the activity of the user.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Moreover, if the very large number of processed data can characterise alone the massive and intrusive nature of the treatments performed, the very nature of some of the data described, such as geolocation data or content consulted, reinforces this finding.&nbsp;Considered in isolation, the <strong>collection of each of these data is likely to reveal with a high degree of precision many of the most intimate aspects of people\'s lives, including their lifestyle, their tastes, their contacts, their opinions or their trips</strong>.&nbsp;The result of the combination of these data greatly reinforces the <strong>massive and intrusive nature of the processing</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consequently, it is in the light of the particular characteristics of these processing of personal data which have just been recalled that the characters are clear and understandable, within the meaning of Art 12 of the GDPR, of the information provided for in Art 13 of the Regulations, must be appreciated.&nbsp;The CNIL considered that these requirements were not respected in this case.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Specifically, the CNIL noted that the information provided by Google did not allow the users to understand sufficiently the particular consequences of the processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the purposes announced in the various documents are described as follows: offer personalised services in terms of content and advertisements, ensure the safety of products and services, provide and develop services, etc.&nbsp;.&nbsp;They are too generic in terms of the scope of the treatments implemented and their consequences.&nbsp;This is also the case when users are told too loosely: <em>The information we collect is used to improve the services offered to all our users.&nbsp;[...] The information we collect and how we use it depends on how you use our services and how you manage your privacy settings.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL noted that the description of the aims pursued did not allow users to measure the extent of the treatments and the degree of intrusion into their private lives that they are likely to take away.&nbsp;It considered, in particular, that such information is not provided in a clear manner, nor at the first level of information provided to users through, in this case, the document entitled Confidentiality rules and conditions of use nor in the other levels of information proposed by the company.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL further noted that the description of the data collected, which could be of such a nature as to clarify the scope of these purposes and to prevent the user from being subsequently caught off guard as to the way in which his data were used and combined, is particularly imprecise and incomplete, both in the analysis of the first level of information and that of the other documents provided.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example, the Privacy Policy and Terms of Use document and the Privacy Policy document specify: <em>This may be more complex (...) information, such as the ads you find most useful, the people you care about. interest most on the web or YouTube videos that are likely to interest you.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of the foregoing, the CNIL believed that the user is not able, especially by being aware of the first level of information presented to him in the Privacy Policy and Terms of Use, to measure the scope of the main treatments on his private life.&nbsp;While it noted that exhaustive information, from the first level, would be counterproductive and does not respect the requirement of transparency, it considers that it should contain terms that would objectify the number and scope of implemented.&nbsp;It further considered that it would be possible, by other types of presentation methods adapted to data combining services,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The finding of lack of clarity and comprehensibility must also be made with regard to the mention of the legal basis of targeted advertising .&nbsp;In fact, the company first states in the Privacy Policy: <em>We ask you for permission to process your information for specific purposes, and you are free to revoke your consent at any time.&nbsp;For example, we ask you for permission to provide personalised services, such as ads.&nbsp;The legal basis chosen here therefore appears to be consent.&nbsp;</em>However, the company further adds it relies on the legitimate interest,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL stressed that if Google had indicated before that the only legal basis for the processing of the targeted advertisement was consent, the investigation shows that this clarification is not brought to the attention of the users.&nbsp;The formulations recalled above did not allow the latter to clearly measure the distinction between properly targeted advertising, based on the combination of multiple user data, which is based on the company\'s consent statement , other forms of targeting using for example the context of navigation, based on the legitimate interest.&nbsp;The CNIL stressed the particular importance of the need for clarity in these processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With respect to information on the retention period, the CNIL noted that the How are Google\'s collected information page is maintained has four categories: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Information retained until the user deleted it;</li><li>Information with a timeout;</li><li>Information retained until user\'s Google Account is deleted;</li><li>Information kept for long periods of time for specific reasons.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>It noted, however, that as regards to the latter category, only very general explanations of the purpose of this retention are provided and no precise duration or the criteria used to determine that duration are indicated.&nbsp;This information is among those that must be issued to users pursuant to Article 13 (2) (a) of the Regulations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Finally, if the company claims that multiple information tools are made available to users concomitantly and after the creation of their account, the restricted training notes that these methods do not make it possible to reach the requirements of transparency and transparency. information from articles 12 and 13 of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First, the CNIL noted that the tools to which the company refers do contribute, to a certain extent, to the goal of transparency throughout the life of the account and the use of Google\'s services.&nbsp;However, it considered that they do not participate sufficiently in the information provided for in Article 13, which must be provided at the time data are obtained.&nbsp;As mentioned in the EDPS Transparency Guidelines, Article 13 specifies the information to be provided to data subjects from the start of the processing cycle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If any data other than those strictly necessary to create the account, are collected throughout the life of the account, such as browsing history or purchases, the time of its creation marks the entry of the user in the ecosystem of Google services, whose particularly massive and intrusive nature of processing has been recalled previously.&nbsp;This step marks the beginning of a multitude of treatment operations: collection, combination, analysis, etc.&nbsp;Therefore, since the process of creating the account is essential in the understanding of treatments and their impact and where the proposed user journey itself invites the person concerned to focus his attention at this stage, the information provided for in Rule 13 of the Rules of Procedure at that time must.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Moreover, both the pop-up window appearing at the time of the creation of the account and the electronic message sent as soon as the account is created contain only a summary or very specific information on the processing implemented and can not allow to consier the prior information as sufficient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the text of the pop-up window indicates <em>This Google Account is configured to include customisation features (such as recommendations and custom ads) that are based on the information stored in your account.&nbsp;The e-mail indicates the main features of the Google Account and the existence of control tools.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With regard to the confidentiality check-up tool, this essentially allows the user to set up the collected information such as browsing history or visited places.&nbsp;Finally, the Dashboard consists of an information panel for each Google service overview of the use of the account holder.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Nevertheless, these confidentiality check-up and Dashboard tools can only be used, just like the e-mail mentioned above, after the account creation step, which is nevertheless essential for informing users as well as it has been said.&nbsp;In addition, although their existence and interest are brought to the attention of users, they imply an active and initiative of these.&nbsp;For these reasons, these tools do not allow to consider that sufficient information is provided for the application of Article 13 of the Regulations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the light of all these elements, the CNIL committee considers that a breach of the transparency and information obligations as provided for in Articles 12 and 13 of the Regulation is characterised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>5. Failure to provide a legal basis for the processing implemented</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6 of the RGPD states that: 1.&nbsp;&nbsp;&nbsp;Processing&nbsp;shall be lawful only if and to the extent that at least one of the following applies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(a)&nbsp;&nbsp;&nbsp; the data subject has given consent to the&nbsp;processing&nbsp;of his or her personal data for one or more specific purposes;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(b)&nbsp;&nbsp;&nbsp;&nbsp;processing&nbsp;is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(c)&nbsp;&nbsp;&nbsp;&nbsp;processing&nbsp;is necessary for compliance with a legal obligation to which the&nbsp;controller&nbsp;is subject;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(d)&nbsp;&nbsp;&nbsp;&nbsp;processing&nbsp;is necessary in order to protect the vital interests of the data subject or of another natural person;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(e)&nbsp;&nbsp;&nbsp;&nbsp;processing&nbsp;is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the&nbsp;controller;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(f)&nbsp;&nbsp;&nbsp;&nbsp;processing&nbsp;is necessary for the purposes of the legitimate interests pursued by the&nbsp;controller&nbsp;or by a&nbsp;third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>the processing is necessary to safeguard the vital interests of the data subject or of another natural person;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google was criticised for failing to validly collect the consent of individuals for targeted advertising.&nbsp;It was also considered that the company could not claim a legitimate interest for these processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In defence, Google specified that it relied solely on the consent for the targeted advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 4 (11) of the above-mentioned Regulations specifies what consent means: <em>any freely given, specific, informed and unambiguous indication of the data subject\'s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 7 of the same Regulation provides the conditions that apply to it:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>1.&nbsp;&nbsp;&nbsp;Where&nbsp;processing&nbsp;is based on consent, the&nbsp;controller&nbsp;shall be able to demonstrate that the data subject has consented to&nbsp;processing&nbsp;of his or her personal data.</em></li><li><em>2.&nbsp;&nbsp;&nbsp;If the data subject\'s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.</em></li><li><em>3.&nbsp;&nbsp;&nbsp;The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of&nbsp;processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.</em></li><li><em>4.&nbsp;&nbsp;&nbsp;When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia , the performance of a contract, including the provision of a service, is conditional on consent to the&nbsp;processing&nbsp;of personal data that is not necessary for the performance of that contract.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Firstly, Google said that the users\' consent is informed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It believes that simple and clear information is presented to the user when creating an account and allow him to know how the company uses the data for customisation purposes.&nbsp;In particular, the Company refers to the summary entitled Privacy Policy and Terms of Use, the sections dedicated to the targeted advertisements contained in the Privacy Policy and the additional information message entitled Targeted Advertising in the Menu Options account creation setting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, Google claimed that the user\'s consent is specific and unambiguous.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In particular, it stated that when setting up the account, the user has the option of making a choice regarding the display of targeted advertising .&nbsp;It considers that this possibility enables to express its consent to the use of its data independently of the other choices it may express with regard to the other purposes relating to the processing associated with the Google Account (eg YouTube search history).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It also considered that the procedures for obtaining consent for the purposes of targeted advertisements it sets up are in line with the recommendations of the CNIL of December 5, 2013 regarding cookies.&nbsp;In particular, it specifies that short information is available on the targeted ads followed by an \"I accept\" button (the Privacy Policy and the Terms of Use), preceded by a \"more options\" button that gives users the ability to disable multiple processing operations, including for targeted ad purposes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It also argued that the solution presented in the public notice of the president of the CNIL No. MED-2018-023 of November 29, 2018 allows the user to consent to all ends via a button accept all.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lastly, it considered that explicit consent for the processing of data for the purposes of targeted advertising, within the meaning of Art 9 (2) (a) of the GDPR, could not be required in the absence of sensitive data.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Regarding the informed consent&nbsp;and&nbsp;the&nbsp;spread&nbsp;of&nbsp;information</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the first place, the CNIL specified that this informed character must be examined in the light of the preceding developments concerning the lack of transparency and information of the users during the setting up of their account.&nbsp;It considered that the deficiencies previously identified necessarily have an impact on the information delivered to the users to ensure the informed nature of the consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL indicated that the EDPS Guideline of 10 April 2018 on Consent within the meaning of Regulation 2016/679 (WP250) states that the controller must ensure that consent is provided on the basis of information that enables the people concerned to easily identify who is responsible for the data and to understand what they are agreeing to.&nbsp;[It] must clearly describe the purpose of the data processing for which consent is sought.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These guidelines also state that: In order for consent to be informed, it is necessary to inform the person concerned of certain crucial elements in making a choice.&nbsp;[..] At least the following information is required in order to obtain valid consent: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>the identity of the controller,</em></li><li><em>the purpose of each processing operation for which consent is sought,</em></li><li><em>the (types of) data collected and used,</em></li><li><em>the existence of the right to withdraw consent,</em></li><li><em>information on the use of data for automated decision-making [..] and</em></li><li><em>information on the possible risks associated with the transmission of data due to the lack of a decision on adequacy and appropriate safeguards [...].</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>As it was able to identify under the breach of the transparency and information requirements, the CNIL considered that the information on targeted advertising is excessively disseminated in separate documents and is not, as such, easily accessible.&nbsp;In this respect, the CNIL refered to the preceding developments on the multiple actions that must be performed by a user who wishes to be made aware of available on the processing related to the targeted advertisement.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In addition, the CNIL also noted under the breach of transparency obligations, the information provided was not sufficiently clear and understandable in that it was difficult for a user to have a global understanding of the can do the object and their scope.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As an illustration, the information in the targeted Ad section, accessible from the Privacy Policy and Terms and Conditions document through the More Options button, contains the following: Google can show you ads based on your activity in Google services (for example, in the search or on YouTube, as well as on Google\'s websites and partner applications).&nbsp;The CNIL noted that it is not possible to read, for example through clickable links, the services, sites and Google application to which the company refers.&nbsp;Therefore, the user was not able to understand the targeted advertising they are subject to, as well as their scope,&nbsp;even though these treatments nevertheless imply a plurality of services (for example: Google search, YouTube, Google home, Google maps, Playstore, Google photo, Google play, Google analytics, Google translation, Play books) and the processing of a large amount of data personal character.&nbsp;Users are not able to have a proper perception of the nature and volume of data that is collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of these elements, the CNIL committee considered that the users\' consent for targeted advertising was not sufficiently informed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>With regard to the specific and unequivocal nature of the consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 32 of the Regulation provides that: <em>Consent must be given by a clear positive act by which the data subject expresses in a free, specific, informed and unambiguous manner his agreement to the processing of his personal data [...].&nbsp;There can therefore be no consent in the event of silence, boxes checked by default or inactivity.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 43 of the GDPR states that: <em>Consent is presumed not to have been freely given if separate consent can not be given to different personal data processing operations, although this is appropriate in the present case.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The above EDPS guidance on consent states that: <em>In order to comply with the specific nature of consent, the controller must ensure: [...] (ii) the detailed nature of consent requests [...] This means that data controller who seeks consent for various specific purposes should provide separate consent for each purpose so that users can give specific consent for specific purposes.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In this case, the CNIL noted that when the user creates an account, he has the possibility to modify some of the parameters associated with the account.&nbsp;To access these settings, the user must click the more options button, present before the Create Account button.&nbsp;the CNIL also noted that the personalisation settings of the account, which contain the choice for the display of personalised ads, are pre-checked by default, which means, unless otherwise indicated, the agreement of the user to processing of its data for the purposes mentioned (eg YouTube search history, display of personalised ads etc.).&nbsp;The user has the option to uncheck these parameters if he does not want these treatments to be implemented.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL observed that, at the time of the creation of the account, if the user does not click on the button more options to set his account, he must check the boxes <em>I accept the terms of use of Google and I agree that my information will be used as described above and detailed in the Privacy Policy</em>.&nbsp;Subsequently, he must press the <em>Create Account</em> button.&nbsp;A pop-up window appears, titled Simple confirmation that contains the following text This Google Account is set up to include customisation features (such as recommendations and custom ads), which are based on information stored in your account.&nbsp;To change your personalisation settings and the information stored in your account,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If it does not click <em>More Options</em>, the user must select the <em>Confirm</em> button to complete the account creation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of the foregoing, the CNIL noted that if the user has the possibility to modify the configuration of the parameters of his account prior to its creation, a positive action on his part is necessary to access the possibilities of setting up the account.&nbsp;Thus, the user can completely create his account, and accept the related processing, including targeted advertising, without clicking <em>More options</em>.&nbsp;Therefore, the user\'s consent is not, in this case, validly collected to the extent that it is not given through a positive act by which the person consents specifically and distinctly to the processing of its data for purposes of targeted advertising compared to other purposes of treatment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL also considered that the actions by which the user proceeds to the creation of his account - by ticking the boxes I accept the conditions of use of Google and I accept that my information is used as described below above and detailed in the privacy rules, and then selecting Create Account - can not be considered as the expression of a valid consent.&nbsp;The specific nature of the consent is not respected because the user, by these actions, accepts all the processing of personal data implemented by the company, including those of targeted advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In addition, the CNIL noted that multiple technology processes are used by the company to combine and analyse data from different external services, applications or sources.&nbsp;They undeniably have a multiplying effect on the precise knowledge society has of its users.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As a result, the restricted formation believes that the company has operations of combinations with almost unlimited potential allowing a massive and intrusive treatment of the data of the users.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Given the scope of the data processing - in particular that of targeted advertising - and the number of people concerned, the CNIL underlined that the deficiencies previously retained are of a particular gravity.&nbsp;A lack of transparency regarding these wide-scope processing, as well as a lack of valid user consent to targeted advertising, constitute substantial infringements of the protection of their privacy and are contrary to legitimate aspirations of people who want to keep control of their data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In this respect, strengthening the rights of individuals is one of the main thrusts of the Regulation.&nbsp;The European legislator recalls that The rapid evolution of technologies and globalization have created new challenges for the protection of personal data.&nbsp;The extent of collection and sharing of personal data has increased significantly.&nbsp;Technologies allow both private and public authorities to use personal data as never before in their business (...) Technologies have transformed both the economy and social relations (recital 6) .&nbsp;It stresses that these developments require a strong data protection framework (...) with rigorous enforcement of the rules, it is important to create the confidence that will enable the digital economy to develop in the internal market as a whole.&nbsp;Individuals should have control over their personal data.&nbsp;(recital 7).&nbsp;The European legislator regrets, finally, that Directive 95/46 / EC has not made it possible to avoid the widespread public perception that significant risks to the protection of individuals still exist, in particular as regards the online environment.&nbsp;(recital 9).&nbsp;whereas Directive 95/46 / EC has not prevented the widespread public perception that significant risks to the protection of individuals still exist, in particular with regard to the online environment.&nbsp;(recital 9).&nbsp;whereas Directive 95/46 / EC has not prevented the widespread public perception that significant risks to the protection of individuals still exist, in particular with regard to the online environment.&nbsp;(recital 9).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL thus considered, in view of the scale of the processing carried out and the compelling need for the users to keep control of their data, that they must be put in a position to be sufficiently informed of the scope of the data implemented and to validly consent to it, unless to deprive of basic confidence in the digital ecosystem.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Finally, the CNIL emphasised that shortcomings need to be put into perspective with regard to the company\'s business model, in particular the place of the users\' data processing for advertising purposes via the Android operating system.&nbsp;In view of the benefits it takes from these processing, Google must pay particular attention to its responsibility under the GDPR in their implementation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It follows from all the foregoing and the criteria which have been duly taken into account by the Committee, in view of the maximum amount incurred on the basis of 4% of the turnover indicated in point 2 of this Decision, that a financial penalty is justified up to 50 million euros, as well as a supplementary publicising sanction for the same reasons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Account is also taken of the company\'s prominent place in the market for operating systems, the seriousness of the deficiencies and the interest this decision represents in informing the public in determining the duration of its publication.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>FOR THESE REASONS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The restricted formation of the CNIL, after having deliberated, decides:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>to award Google LLC a monetary penalty in the amount of 50 (fifty) million euros;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>to send this decision to Google France Sarl for the execution of this decision;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google has already publicly announced it has appealed the case. It\'s of course important as this decision creates a precedent and establish the rules.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is only  start.<a href=\"https://www.laquadrature.net/en/2019/01/21/first-sanction-against-google-following-our-collective-complaints/\"> La Quadrature du Net publishe</a>d : \"<em>Today, the CNIL&nbsp;</em><a href=\"https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc\"><em>sanctioned</em></a><em>&nbsp;</em><strong><em>Google to a 50 million Euros fine</em></strong><em>, stating that the targeted advertising it engages in with its operating system Android is in breach of the GDPR, the new European regulation that came into effect on May 25. However, this sanction is really only the beginning of an answer to our complaint against Google, which denounced especially the targeted advertising imposed on Youtube, Gmail and Google Search in violation of our consent.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>In this respect, the CNIL explains the low amount of its sanction, considering Google’s nearly&nbsp;</em><a href=\"https://www.statista.com/statistics/266206/googles-annual-global-revenue/\"><em>110 billion US dollars</em></a><em>&nbsp;revenue, by the fact it limited the scope of its examination to “the data processing covered by the privacy policy presented to a user when creating their account on their Android mobile phone” (our translation).&nbsp;</em><sup><em>1</em></sup><em>&nbsp;We therefore expect the CNIL to quickly answer the rest of our complaint, which concerns Youtube, Gmail and Google Search, by issuing a fine commensurate with this company and the extent and the duration of the violation of ours rights (the maximum amount possible is 4 billion euros – 4% of global revenue –, which we hope for).</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This publication is licensed under a Creative Commons Attribution 4.0 International<br>More information on the licence can be found <a href=\"http://creativecommons.org/licenses/by/4.0/\">here</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Google Subject to the Biggest Fine Under GDPR','In what is today the biggest fine under the GDPR, the French Data Protection Authority CNIL investigated Google Android transparency in Data procession. The investigation was consecutive to two class actions filed on the 25th of May 2018. One by the Austrian NGO Non Of Your Business (NOYB), another by the French La Quadrature du Net (LQDN). This decision worth a close look.','inherit','closed','closed','','204-revision-v1','','','2020-11-26 20:55:37','2020-11-26 20:55:37','',204,'https://www.datarainbow.eu/204-revision-v1/',0,'revision','',0),(1806,2,'2020-11-26 20:59:11','2020-11-26 20:59:11','','Screenshot 2020-11-26 at 20.57.47','','inherit','open','closed','','screenshot-2020-11-26-at-20-57-47','','','2020-11-26 20:59:11','2020-11-26 20:59:11','',134,'https://www.datarainbow.eu/wp-content/uploads/2019/01/Screenshot-2020-11-26-at-20.57.47.png',0,'attachment','image/png',0),(1807,2,'2020-11-26 20:59:19','2020-11-26 20:59:19','<!-- wp:paragraph -->\n<p>The General Data Protection Regulation applies to Personal Data. But do we know what exactly defines Personal Data? The <a href=\"https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/what-is-personal-data/what-is-personal-data/\">UK ICO </a>recently published a clarification document. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":135} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.01.53.png\" alt=\"\" class=\"wp-image-135\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>First limitation, it does not include legal personalities. Natural person, are living people in contrast with legal entities or organisation. They are technically labelled \"Data Subject\'. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'That individual must be identified or identifiable either directly or indirectly from one or more identifiers or from factors specific to the individual.\' this is where it gets more complicated and contextual.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR only applies to information which relates to an identifiable living individual. Consequently, information relating to a deceased person does not constitute personal data and therefore is not subject to the GDPR unless the EU country has opted to include them.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The processing of Personal Data covers a large variety of acts from collect, to copy to store the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The processing don\'t need to be electronically, there are two majors ways of processing:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>personal data processed wholly or partly by automated means (that is, information in electronic form); and</li><li>personal data processed in a non-automated manner which forms part of, or is intended to form part of, a ‘filing system’ (that is, manual information in a filing system).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ICO further adds : \"The GDPR does not cover information which is not, or is not intended to be, part of a ‘filing system’. However, under the Data Protection Act 2018 (DPA 2018) unstructured manual information processed only by public authorities constitutes personal data. This includes<strong> paper records </strong>that are not held as part of a filing system. While such information is personal data under the DPA 2018, it is exempted from most of the principles and obligations in the GDPR and is aimed at ensuring that it is appropriately protected for requests under the Freedom of Information Act 2000.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further guidance on the provisions of the DPA 2018 is awaited.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is more clarification from the <a href=\"https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en\">EU Commission</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2 id=\"examples-of-personal-data\">Examples of personal data</h2>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>a name and surname;</li><li>a home address;</li><li>an email address such as&nbsp;<a href=\"mailto:name.surname@company.com\">name.surname@company.com</a>;</li><li>an identification card number;</li><li>location data (for example the location data function on a mobile phone)*;</li><li>an Internet Protocol (IP) address;</li><li>a cookie ID*;</li><li>the advertising identifier of your phone;</li><li>data held by a hospital or doctor, which could be a symbol that uniquely identifies a person.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Within identifiable data qualified as Personal Data, they are the special categories, previously called \'Sensitive Data\' tat requires further cautious and a higher level of protection. these will be data with regard to :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>race;</li><li>ethnic origin;</li><li>political opinions;</li><li>religious or philosophical beliefs;</li><li>trade union membership;</li><li>genetic data;</li><li>biometric data (where this is used for identification purposes);</li><li>health data;</li><li>sex life; or</li><li>sexual orientation.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>What about pseudonymised or anonymised Personal Data ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR defines pseudonymisation as:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":136} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.32.10.png\" alt=\"\" class=\"wp-image-136\"/><figcaption><br></figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":137} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.59.20.png\" alt=\"\" class=\"wp-image-137\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The EU Commission explains :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Personal data that has been de-identified, encrypted or&nbsp;pseudonymised&nbsp;but can be used to re-identify a person remains personal data and falls within the scope of the law.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Personal data that has been rendered&nbsp;anonymous&nbsp;in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example provided by the UK ICO </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":138} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-14.04.35.png\" alt=\"\" class=\"wp-image-138\"/></figure>\n<!-- /wp:image -->','What is Protected by the GDPR ?','The General Data Protection Regulation applies to Personal Data. But do we know what exactly defines Personal Data? The UK ICO recently published a clarification document. ','inherit','closed','closed','','134-revision-v1','','','2020-11-26 20:59:19','2020-11-26 20:59:19','',134,'https://www.datarainbow.eu/134-revision-v1/',0,'revision','',0),(1808,2,'2020-11-26 21:03:40','2020-11-26 21:03:40','<!-- wp:heading {\"level\":3} -->\n<h3>Proportionality and Data Minimisation are Key to GDPR</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Personal data is the hot potato.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One of the six principals of Data Protection is Data minimisation. It goes against the recent tide of mass collection of data. Nevertheless, it is a life saver. By collecting less, keeping accurate, safe and confidential, in an accountable manner in appropriate registers, ideally keeping data and assets mapping, most of the hassle of compliance is resolved.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Little reminder of the six principals :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Lawfulness, fairness and transparency. ...</li><li>Purpose limitation. ...</li><li>Data minimisation. ...</li><li>Accuracy. ...</li><li>Storage limitation. ...</li><li>Integrity and confidentiality.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Proportionality comes as a mortar that blends it all together. We recently commented a decision by the <a href=\"https://datarainbow.eu/2020/03/02/court-said-no-to-facial-recognition-technology/\">French Administratif Court, Conseil d\'Etat, on the illegality of Live Facial Recognition technologies in schools.</a> Based on the imbalance of power and the loss of control caused by biometrics data collection disproportionate to the result, the court ordered the cease of the test. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wherever the same result can be achieved in a less intrusive manner, it has to prevail.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to the Charter of Fundamental Rights of the European Union, Article&nbsp;8,  data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by the law. Seen in a wider context, the concept of consent allows the data subject concerned to decide for him or herself on the legitimacy of restrictions to on his or her right to the protection of personal data.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On this 4th of March, the Advocate General M.&nbsp;MACIEJ SZPUNAR presented its conclusions in request for a preliminary ruling from the Tribunalul Bucureşti (Regional Court, Bucharest, Romania) stems from a dispute between a provider of telecommunication services and a national data protection authority as to the obligations of the former in the context of contractual negotiations with a customer when it comes to copying and storing the copy of ID cards.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further clarifying the concept of ‘consent’ given by a data subject, while addressing the question of the burden of proof as to whether or not the data subject has given consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>What does the EU Regulation 2016/679</em> says :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pursuant to Article&nbsp;4(11) of Regulation (EU) 2016/679,&nbsp;for the purpose of that regulation, ‘“<em>consent” of the data subject means </em><strong><em>any freely given, specific, informed and unambiguous</em></strong><em> indication of the data subject\'s wishes by which he or she, by a </em><strong><em>statement or by a clear affirmative action</em></strong><em>, signifies agreement to the processing of personal data relating to him or her</em>’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;&nbsp;The Article&nbsp;6(1)(a) and (b) of that regulation is worded as follows:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>‘<em>Processing shall be lawful only if and to the extent that at least one of the following applies:</em></p><p>(a)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<em>the data subject has given consent to the processing of his or her personal data for one or more specific purposes;</em></p><p>(b)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<em>processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’</em>.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Article&nbsp;7(1) of the same regulation states that ‘<em>where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data</em>’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The facts of the case were as follows :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Romanian National Authority for the Supervision of the Processing of Personal Data, ‘the ANSPDCP’ had issued a report which included the imposition of an administrative penalty on Orange România on the ground that copies of the identity documents of its customers had been taken and kept without their express consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Orange România had concluded contracts for the provision of mobile telecommunication services with customers requiring copies of their identity documents. In order to do so, customers were required to sign a document declaring they had been informed of and had consented to the collection and storage of a copy of their ID card.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The existence of the customers’ consent had been established by the insertion of crosses in boxes in the written documentation evidencing the contract.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Court is called upon to specify the conditions under which consent to the processing of personal data may be considered valid.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The decision of the national DPA imposing a fine on Orange Româniawas was adopted prior to the GDPR. However, it required as well to destroy the copies of the identity documents previously collected. This injunction having effect for the future, the regulation appeared to be applicable in so far&nbsp;<em>ratione temporis</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In order to demonstrate consent on an informed choice on the collection and storage of IDs, customers were asked to tick a box. Is this sufficient to constitute a ‘specific and informed’ and ‘freely expressed’ consent within the meaning of Article&nbsp;2(h) of Directive 95/46 and Article 4(11) of Regulation 2016/679, to that undertaking when he or she needs to state, in handwriting, on an otherwise standardised contract, that he or she refuses to consent to the photocopying and conservation of his or her ID documents ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article&nbsp;6(1)(a) of the directive provides that personal data must be processed <strong>fairly and lawfully</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Under the Directive 95/46, Article&nbsp;2(h), consent is defined as any <strong>freely given specific and informed</strong> indication of his or her wishes by which the data subject signifies his or her agreement to personal data relating to him or her being processed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Under the Regulation 2016/679, Article&nbsp;4(11), a higher standard of consent is required : consent needs to be f<strong>reely given, specific, informed and unambiguous</strong> indication of the data subject’s wishes by which he or she, by a statement or <strong>by a clear affirmative action</strong>, signifies agreement to the processing of personal data relating to him or her.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent is freely given when the data subject expresses its wishes <strong>actively</strong>, rather than by passive behaviour. It should be demonstrated that the data subject had enjoyed a high degree of autonomy when choosing whether or not to give consent which for instance as previously ruled, excludes a preselected tick of a checkbox.<a>4</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;<em><strong>Informed consent</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was the data subject informed of all circumstances surrounding the data processing and its consequences? The customer needed to know :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>which data are to be processed, </li><li>the duration of such processing, </li><li>in what way and for which specific purpose,</li><li>who is processing the data and whether the data are intended to be transferred to third parties,</li><li>be informed of the consequences of refusing consent: is consenting to the data processing a condition for concluding the contract or not?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><em>&nbsp;Who does <strong>the burden of proof&nbsp;lie&nbsp;with&nbsp;?</strong></em>&nbsp;&nbsp;&nbsp;&nbsp;</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a>Looking at the </a>Article&nbsp;7(1) of Regulation 2016/679, the Advocate General confirms that it is for the controller to demonstrate that the data subject has consented to processing of his or her data, not only to prove that the data subject has given his or her consent, but must also prove that all the conditions for effectiveness have been met.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although the burden of proof rule is not expressly laid down in the Directive 95/46 the controller has to proof ‘the data subject has&nbsp;<em>unambiguously</em>&nbsp;given his consent’.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><em>Application of the principles on this case</em></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Asking customers to provide some personal data and in particular to prove their identity for the purposes of the conclusion of a contract. To require a customer to consent to the copying and storing of identity documents, however, appears to go beyond what is necessary for the performance of the contract. On the basis of the information available, it appears that the customers of Orange România do not give their free, specific and informed consent under the circumstances described by the referring court.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>There is <strong>no freely given consent</strong>. Obliging a customer to state in handwritten form that he or she does not consent to the copying and storing of his or her ID card does not permit freely given consent in the sense that the customer is put into a situation in which he or she perceptibly deviates from a regular procedure which leads to the conclusion of a contract. Following the judgment in&nbsp;<em>Planet49</em>,&nbsp;consent is to be expressed by positive opt in act.</li><li>There is <strong>no informed consent</strong>. It is not made crystal-clear to the customer that a refusal to the copying and storing of his or her ID card does&nbsp;<em>not</em>&nbsp;make the conclusion of a contract impossible. A customer does not choose in an informed manner if he or she is not aware of the consequences.</li><li>There is no indication whatsoever that Orange România has managed to demonstrate that customers consented to processing of their personal data. In this respect, an evident lack of clarity in internal procedures is surely not conducive to furnishing the proof that consent has been given by the customer. Such <strong>lack of clarity and conflicting instructions </strong>to sales personnel obviously cannot be to the detriment of the customer,&nbsp;<em>in casu</em>&nbsp;the data subject.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In conclusion, the Advocate General opinion is that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There is no ‘consent’ where the customer does not indicate his or her ‘spe<strong>cific and informed’ and ‘freely given’ wishes</strong>, within the meaning of Article&nbsp;2(h) of Directive 95/46/EC of the European Parliament and of the Council of 24&nbsp;October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and of Article&nbsp;4(11) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27&nbsp;April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), to that undertaking </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>==&gt; No free consent when the customer is required to state, in handwriting, on an otherwise standardised contract, that he or she refuses to consent to the photocopying and storage of his or her ID documents.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The court was asked to answer on the validity of the consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECJ ruling is soon to be followed. Although the DG opinions are not binding the court tends to rely on them. What are the implications of this analysis on the absence of free, explicite and unambiguous consent when the customer actively produce copy of his or her ID ? Should this view be extended to any case where copy of ID card is requested while not strictly necessary, based on the principle of data minimisation?  Additionally, free and explicite consent requires that consent not be detrimental to the access to the service especially where data minimisation calls for minimal data collection. Could there not be  better, more appropriate, more proportionate means of ID verification? Could the customer\'s ID be verified by other means and was it necessary to retain copy of the ID card and ultimately how identifications are stored, kept secured and for how long?</p>\n<!-- /wp:paragraph -->','Consumer contracts and the validity of consent','Personal data is the hot potato. If you do\'t need it, don\'\'t collect it, don\'t keep it. Data minimisation will save you many troubles.','inherit','closed','closed','','583-autosave-v1','','','2020-11-26 21:03:40','2020-11-26 21:03:40','',583,'https://www.datarainbow.eu/583-autosave-v1/',0,'revision','',0),(1809,2,'2020-11-26 21:03:43','2020-11-26 21:03:43','<!-- wp:heading {\"level\":3} -->\n<h3>Proportionality and Data Minimisation are Key to GDPR</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Personal data is the hot potato.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One of the six principals of Data Protection is Data minimisation. It goes against the recent tide of mass collection of data. Nevertheless, it is a life saver. By collecting less, keeping accurate, safe and confidential, in an accountable manner in appropriate registers, ideally keeping data and assets mapping, most of the hassle of compliance is resolved.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Little reminder of the six principals :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Lawfulness, fairness and transparency. ...</li><li>Purpose limitation. ...</li><li>Data minimisation. ...</li><li>Accuracy. ...</li><li>Storage limitation. ...</li><li>Integrity and confidentiality.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Proportionality comes as a mortar that blends it all together. We recently commented a decision by the <a href=\"https://datarainbow.eu/2020/03/02/court-said-no-to-facial-recognition-technology/\">French Administratif Court, Conseil d\'Etat, on the illegality of Live Facial Recognition technologies in schools.</a> Based on the imbalance of power and the loss of control caused by biometrics data collection disproportionate to the result, the court ordered the cease of the test. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wherever the same result can be achieved in a less intrusive manner, it has to prevail.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to the Charter of Fundamental Rights of the European Union, Article&nbsp;8,  data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by the law. Seen in a wider context, the concept of consent allows the data subject concerned to decide for him or herself on the legitimacy of restrictions to on his or her right to the protection of personal data.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On this 4th of March, the Advocate General M.&nbsp;MACIEJ SZPUNAR presented its conclusions in request for a preliminary ruling from the Tribunalul Bucureşti (Regional Court, Bucharest, Romania) stems from a dispute between a provider of telecommunication services and a national data protection authority as to the obligations of the former in the context of contractual negotiations with a customer when it comes to copying and storing the copy of ID cards.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further clarifying the concept of ‘consent’ given by a data subject, while addressing the question of the burden of proof as to whether or not the data subject has given consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>What does the EU Regulation 2016/679</em> says :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Pursuant to Article&nbsp;4(11) of Regulation (EU) 2016/679,&nbsp;for the purpose of that regulation, ‘“<em>consent” of the data subject means </em><strong><em>any freely given, specific, informed and unambiguous</em></strong><em> indication of the data subject\'s wishes by which he or she, by a </em><strong><em>statement or by a clear affirmative action</em></strong><em>, signifies agreement to the processing of personal data relating to him or her</em>’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;&nbsp;The Article&nbsp;6(1)(a) and (b) of that regulation is worded as follows:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>‘<em>Processing shall be lawful only if and to the extent that at least one of the following applies:</em></p><p>(a)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<em>the data subject has given consent to the processing of his or her personal data for one or more specific purposes;</em></p><p>(b)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<em>processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’</em>.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Article&nbsp;7(1) of the same regulation states that ‘<em>where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data</em>’.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The facts of the case were as follows :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Romanian National Authority for the Supervision of the Processing of Personal Data, ‘the ANSPDCP’ had issued a report which included the imposition of an administrative penalty on Orange România on the ground that copies of the identity documents of its customers had been taken and kept without their express consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Orange România had concluded contracts for the provision of mobile telecommunication services with customers requiring copies of their identity documents. In order to do so, customers were required to sign a document declaring they had been informed of and had consented to the collection and storage of a copy of their ID card.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The existence of the customers’ consent had been established by the insertion of crosses in boxes in the written documentation evidencing the contract.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Court is called upon to specify the conditions under which consent to the processing of personal data may be considered valid.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The decision of the national DPA imposing a fine on Orange Româniawas was adopted prior to the GDPR. However, it required as well to destroy the copies of the identity documents previously collected. This injunction having effect for the future, the regulation appeared to be applicable in so far&nbsp;<em>ratione temporis</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In order to demonstrate consent on an informed choice on the collection and storage of IDs, customers were asked to tick a box. Is this sufficient to constitute a ‘specific and informed’ and ‘freely expressed’ consent within the meaning of Article&nbsp;2(h) of Directive 95/46 and Article 4(11) of Regulation 2016/679, to that undertaking when he or she needs to state, in handwriting, on an otherwise standardised contract, that he or she refuses to consent to the photocopying and conservation of his or her ID documents ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article&nbsp;6(1)(a) of the directive provides that personal data must be processed <strong>fairly and lawfully</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Under the Directive 95/46, Article&nbsp;2(h), consent is defined as any <strong>freely given specific and informed</strong> indication of his or her wishes by which the data subject signifies his or her agreement to personal data relating to him or her being processed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Under the Regulation 2016/679, Article&nbsp;4(11), a higher standard of consent is required : consent needs to be f<strong>reely given, specific, informed and unambiguous</strong> indication of the data subject’s wishes by which he or she, by a statement or <strong>by a clear affirmative action</strong>, signifies agreement to the processing of personal data relating to him or her.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent is freely given when the data subject expresses its wishes <strong>actively</strong>, rather than by passive behaviour. It should be demonstrated that the data subject had enjoyed a high degree of autonomy when choosing whether or not to give consent which for instance as previously ruled, excludes a preselected tick of a checkbox.<a>4</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;<em><strong>Informed consent</strong></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was the data subject informed of all circumstances surrounding the data processing and its consequences? The customer needed to know :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>which data are to be processed, </li><li>the duration of such processing, </li><li>in what way and for which specific purpose,</li><li>who is processing the data and whether the data are intended to be transferred to third parties,</li><li>be informed of the consequences of refusing consent: is consenting to the data processing a condition for concluding the contract or not?</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><em>&nbsp;Who does <strong>the burden of proof&nbsp;lie&nbsp;with&nbsp;?</strong></em>&nbsp;&nbsp;&nbsp;&nbsp;</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a>Looking at the </a>Article&nbsp;7(1) of Regulation 2016/679, the Advocate General confirms that it is for the controller to demonstrate that the data subject has consented to processing of his or her data, not only to prove that the data subject has given his or her consent, but must also prove that all the conditions for effectiveness have been met.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although the burden of proof rule is not expressly laid down in the Directive 95/46 the controller has to proof ‘the data subject has&nbsp;<em>unambiguously</em>&nbsp;given his consent’.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><em>Application of the principles on this case</em></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Asking customers to provide some personal data and in particular to prove their identity for the purposes of the conclusion of a contract. To require a customer to consent to the copying and storing of identity documents, however, appears to go beyond what is necessary for the performance of the contract. On the basis of the information available, it appears that the customers of Orange România do not give their free, specific and informed consent under the circumstances described by the referring court.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>There is <strong>no freely given consent</strong>. Obliging a customer to state in handwritten form that he or she does not consent to the copying and storing of his or her ID card does not permit freely given consent in the sense that the customer is put into a situation in which he or she perceptibly deviates from a regular procedure which leads to the conclusion of a contract. Following the judgment in&nbsp;<em>Planet49</em>,&nbsp;consent is to be expressed by positive opt in act.</li><li>There is <strong>no informed consent</strong>. It is not made crystal-clear to the customer that a refusal to the copying and storing of his or her ID card does&nbsp;<em>not</em>&nbsp;make the conclusion of a contract impossible. A customer does not choose in an informed manner if he or she is not aware of the consequences.</li><li>There is no indication whatsoever that Orange România has managed to demonstrate that customers consented to processing of their personal data. In this respect, an evident lack of clarity in internal procedures is surely not conducive to furnishing the proof that consent has been given by the customer. Such <strong>lack of clarity and conflicting instructions </strong>to sales personnel obviously cannot be to the detriment of the customer,&nbsp;<em>in casu</em>&nbsp;the data subject.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In conclusion, the Advocate General opinion is that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There is no ‘consent’ where the customer does not indicate his or her ‘spe<strong>cific and informed’ and ‘freely given’ wishes</strong>, within the meaning of Article&nbsp;2(h) of Directive 95/46/EC of the European Parliament and of the Council of 24&nbsp;October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and of Article&nbsp;4(11) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27&nbsp;April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), to that undertaking </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>==&gt; No free consent when the customer is required to state, in handwriting, on an otherwise standardised contract, that he or she refuses to consent to the photocopying and storage of his or her ID documents.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The court was asked to answer on the validity of the consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECJ ruling is soon to be followed. Although the DG opinions are not binding the court tends to rely on them. What are the implications of this analysis on the absence of free, explicite and unambiguous consent when the customer actively produce copy of his or her ID ? Should this view be extended to any case where copy of ID card is requested while not strictly necessary, based on the principle of data minimisation?  Additionally, free and explicite consent requires that consent not be detrimental to the access to the service especially where data minimisation calls for minimal data collection. Could there not be  better, more appropriate, more proportionate means of ID verification? Could the customer\'s ID be verified by other means and was it necessary to retain copy of the ID card and ultimately how identifications are stored, kept secured and for how long?</p>\n<!-- /wp:paragraph -->','Consumer contracts and the validity of consent','Personal data is the hot potato. If you do\'t need it, don\'\'t collect it, don\'t keep it. Data minimisation will save you many troubles.','inherit','closed','closed','','583-revision-v1','','','2020-11-26 21:03:43','2020-11-26 21:03:43','',583,'https://www.datarainbow.eu/583-revision-v1/',0,'revision','',0),(1810,2,'2020-11-26 21:07:29','2020-11-26 21:07:29','','Screenshot 2020-11-26 at 21.06.22','','inherit','open','closed','','screenshot-2020-11-26-at-21-06-22','','','2020-11-26 21:07:29','2020-11-26 21:07:29','',458,'https://www.datarainbow.eu/wp-content/uploads/2019/07/Screenshot-2020-11-26-at-21.06.22.png',0,'attachment','image/png',0),(1811,2,'2020-11-26 21:07:37','2020-11-26 21:07:37','<!-- wp:paragraph -->\n<p>Sharing Stewart Room\'s Privacy insights with his authorisation. Stewart Room is Partner at PwC UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Top reasons to cherish concepts of </strong><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=%23privacy\"><strong>privacy</strong></a>: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Discovery and development</em>: we need a private place to develop and grow, to experiment and to find out who we are. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Happiness</em>: our relationships with one another require a private place to kindle, to sustain, for love. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Sanctuary</em>: a private place is a refuge from persecution, intolerance, abuse and harm. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Disagreement, dissent</em>: sometimes people need to resist or fight back against dictators, demagogues and dystopian potentials, for which privacy is essential. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Trust in tech</em>: amazing tech innovations have the capacity to change the world for the good, but not without privacy trust and confidence. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Consumer protection</em>: personal data fuels business and public services, but its our data, not theirs, so privacy rules protect us from abusive practices. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Reputation</em>: respecting privacy enhances reputations, from policing, to the workplace, to online activities and everything in between. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Business purpose</em>: creating and sustaining economic value for the long term can’t be divorced from the need to respect privacy.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Our values</em>: privacy is a fundamental right in a democratic society, upon which everything stands or falls, so it’s a differentiator between what we value and what we would dread to become.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Top reasons why </strong><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=%23Data_Protection\"><strong>Data_Protection</strong></a><strong> programmes fail to deliver: </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Purpose</em>: if an organisation doesn’t understand why a good approach to DP is integral to its purpose, how can we expect good outcomes? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Tone from the top</em>: leadership is everything, but if the Board won’t lead on DP, what’s there to follow? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Skills</em>: DP needs a multi-disciplinary team to deliver, so if key skills are lacking, problems will embed. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Silos</em>: silos mean behavioural, virtual and physical barriers standing in the way of DP success. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Vision</em>: yes, DP is a legal topic, but in the real world it needs more than a legalistic vision.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Narrow and shallow transformation</em>: DP needs to be delivered in all layers of the organisation, covering paper, people, tech and data, so change needs to be broad and deep. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Technology Reference Architecture</em>: a comprehensive approach needs a TRA, so if you haven’t got one, don’t be surprised by DP failure. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Special Characteristics</em>: buying off the peg is ok at times, but DP needs ‘made to measure’ solutions, knowing the factors that make your organisation unique. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>Adverse Scrutiny</em>: DP needs to survive adversity, so ignoring your risks is a recipe for disaster.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>? <em>People</em>: the main concern of DP is people and if you forget that, you’ve got nothing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Top things that make </strong><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=%23privacy\"><strong>#privacy</strong></a><strong> professionals sigh</strong>: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♂️ <em>New oil</em>: sorry, personal data isn’t oil, or some other kind of commodity that can be owned then exploited and until you understand that, you just won’t understand anything about privacy, period. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>GDPR is done</em>: GDPR has barely started, so get real and stick with the programme, because there’s a 50 year history here and its not going away. ?‍♂️ Privacy activists are a pain: if they are, then power to them, because they do a good job and we need them. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>X owns privacy</em>: no, everyone owns privacy. ?‍♂️ Decades of experience: really, tell us about it.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>Security or privacy</em>: a false dichotomy, a mantra for a surveillance society or police state. ?‍♂️ Security is privacy: nope, still wrong, keep trying. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>They’re jumping on the bandwagon</em>: hey, this is a community and everyone is welcome, so lend them a hand. ?‍♂️ Consent is best: yes, consent is important, but it’s not the only route to lawfulness and certainly not the best or appropriate route in all circumstances. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>Leading privacy expert:</em> it’s not yours to claim, but for others to think. ?‍♂️ Privacy stymies innovation and competitiveness: ok, prove it. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>?‍♀️ <em>We need fines</em>: we don’t, we need a change of mindset.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>BECAUSE <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">PRIVACY MATTERS</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','Privacy Insights by Stewart Room','','inherit','closed','closed','','458-revision-v1','','','2020-11-26 21:07:37','2020-11-26 21:07:37','',458,'https://www.datarainbow.eu/458-revision-v1/',0,'revision','',0),(1812,2,'2020-11-26 21:10:24','2020-11-26 21:10:24','<!-- wp:paragraph -->\n<p>As a privacy and data protection advocate, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent request where applicable. The French Data Protection Authority, CNIL, has played a lead role in <a href=\"https://datarainbow.eu/2019/01/27/french-cnils-six-first-month-of-gdpr/\">clarifying the regulation</a>. The expectation would be that French websites would have benefited from the guidances produced, using the two years of preparation and the first year of GDPR application to comply. Sadly, this has not always been the case. Even pointing the issues to some web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular recognised expert, Allen Woods, retired today, kindly accepted to have a look to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analysis threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting, data sharing with third parties not only via cookies but Java Script codes used by the web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Woods then proceed to further scrutiny to add into his report : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers advising Data Protection compliance, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen the hidden JavaScript codes on the website \'represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered.\' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address. IP address, identification number entering the definition of \'personal data\' as in the Article 4 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a Wordpress template, and uses Google\'s Gutenberg\'s font but no analytics, we are looking to change this.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Knowing how much users\' behaviour is tracked gives a tough burden and liability to website owners as data controller unless there is a certification assuring web developers real competences and not simply a \'lego block\' assembler expert. Increasingly web developer use templates such as Wordpress that comes out of users control tracking behaviour and location. Based on the GDPR, they are two level of liability. One for the data controller, basically whoever decides the means and purposes of the data processing, and the data processor, acting under the guidance and on behalf of the data controller. The European Court of Justice Advocate General opinion in the FashionID case where embedded Facebook \'like\' button capable of gathering data such as IP addresses and browser identification where Facebook is considered data controller, held that the hosting websites should be considered as joint data controller sharing proportional liability. The Facebook Fanpage decision had already created co-controllership between Facebook and the admin of the Facebook page. The website owner which receives anonymous statistics is deemed to be data controller by permitting third party scripts as the data they allow to be collected is not anonymous from the perspective of the analytics providers. A detailed picture of users is build to target advertising to users. ECJ in the&nbsp;Jehovan todistajat held that in order to have joint control and joint responsibility, it is not required that each of the controllers must have access to (all of) the personal data concerned. Many web owners are in total ignorance of such a shared liability.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’ has become an anti-trust issue of over grown corporations. GAFAM\'s seems to have become too big to any regulator to combat.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://facebook%20users%20cannot%20avoid%20location-based%20ads%2C%20investigation%20finds/\">Facebook users cannot avoid location-based ads, investigation finds. Facebook&nbsp;</a> \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”. In reality, users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing on all kind of websites.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, in <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can imagine the gathering of information on each individual internet user to profile their personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wish</a> is to predict your needs before you realise. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until an illness is detected. Women won\'t anymore need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">why all that matters</a>, think of the past, not that long ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, a demonstration of what happened <a href=\"https://youtu.be/xYZtHIPktQg\">if your shop assistant was an App.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Further read</em> : <a href=\"https://www.businessinsider.com/facebook-google-amazon-dominate-digital-economy-chart-2019-6?r=US&amp;IR=T\">“More than two of out every three dollars spent on digital ads in the US goes to one of the three companies.”</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://geomarketing.com/beacon-marketing-platform-inmarket-introduces-predictive-targeting-program\">Beacon Marketing Platform inMarket Introduces Predictive Targeting Program</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>in 2009 <a href=\"https://www.telegraph.co.uk/technology/facebook/6214370/Facebook-shuts-down-Beacon.html\">Facebook shuts down Beacon</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://policyreview.info/articles/news/data-subjects-data-controllers-fashionable-concept/1400\">On the expanding notion of data controller </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors. What liability for web owners?\n','inherit','closed','closed','','428-revision-v1','','','2020-11-26 21:10:24','2020-11-26 21:10:24','',428,'https://www.datarainbow.eu/428-revision-v1/',0,'revision','',0),(1813,2,'2020-11-26 21:15:46','2020-11-26 21:15:46','','VERSAILLES','','inherit','open','closed','','versailles','','','2020-11-26 21:15:46','2020-11-26 21:15:46','',402,'https://www.datarainbow.eu/wp-content/uploads/2019/05/VERSAILLES.jpg',0,'attachment','image/jpeg',0),(1814,2,'2020-11-26 21:15:51','2020-11-26 21:15:51','','Tara_Taubman_Bassirian','','inherit','open','closed','','tara_taubman_bassirian','','','2020-11-26 21:15:51','2020-11-26 21:15:51','',402,'https://www.datarainbow.eu/wp-content/uploads/2019/05/Tara_Taubman_Bassirian.png',0,'attachment','image/png',0),(1817,2,'2020-11-26 21:17:03','2020-11-26 21:17:03','','CAMERAS','','inherit','open','closed','','cameras','','','2020-11-26 21:17:03','2020-11-26 21:17:03','',402,'https://www.datarainbow.eu/wp-content/uploads/2019/05/CAMERAS.jpg',0,'attachment','image/jpeg',0),(1818,2,'2020-11-26 21:17:21','2020-11-26 21:17:21','<!-- wp:heading {\"level\":4} -->\n<h4>The omni-presence of CCTV cameras. A subject I have been writing about for many years, including <a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\">here</a> and <a href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\">here</a>.</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Two new guidances, one by the <a href=\"https://t.co/iLfWe3PxTR\">Irish Data Protection commissionner</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and one by the <a href=\"https://ico.org.uk/for-organisations/in-your-sector/business/general-data-protection-regulation-gdpr-faqs-for-small-retailers?utm_source=twitter&amp;utm_medium=iconews&amp;utm_term=11692803-24bf-4164-9af2-1bd530eea6b7&amp;utm_content&amp;utm_campaign&amp;fbclid=IwAR03GMYAKvSjh92H8VC5mHW69dv7Ldll_GYaJ5KcVaz4RGlwwDvMEhL8sD8\">UK ICO.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What private CCTV camera surveillance can cause ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Because <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">privacy matters</a>, CCTVs  have to obey to strict rules : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You need :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>To inform the public by clear warning, </li><li>Register your cameras with the Information Commissionner, </li><li>Assess the privacy impact of the surveillance recording in a <a href=\"https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras\">DPIA</a>,</li><li>Secure the data collected,</li><li>Limit access to data collected,</li><li>Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces, </li><li>Ensure that the CCTV images are clear and of a high quality,</li><li>Comply with the comprehensive ICO CCTV <a href=\"https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/?fbclid=IwAR0biT_007rE2cbDeMXL4aaRpvXmJcxGCieiV6tbgBGxxdaAqXxt96mQzok\">check list</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/282774/SurveillanceCameraCodePractice.pdf?fbclid=IwAR1jQCpXzQh1BnkXrWTdB6SBZ6ScEqHsBaS2HHICoraZHUsYB818lRal5Ac\">Surveillance Code of Practice</a> has not yet been updated to comply with the GDPR. It states \"<em>Principle 7 - Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.</em>\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What is the nature of the pictures recorded by the CCTV cameras?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>GDPR require higher protection for \'<em>special category data\'</em>. Recital 51 clarifies when pictures can be considered of \'<em>special category</em>\' or as previously called \'<em>sensitive data</em>\' : “<em>Those personal data should include personal data revealing <strong>racial or ethnic origin</strong>, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.</em>\"  <a href=\"https://iapp.org/news/a/ask-the-privacy-expert/)\">IAPP comments</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore when a CCTV footage reveal an image identifying an individual with its racial or ethic origin, by the colour of the skin or any external religious sign, these should be considered special category data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A management company intend to use CCTV images to name and shame fly tippers.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not seeing any result with their CCTV cameras to stop fly tipping, the management company of a private residence decide to pass at a higher speed by naming and shaming perpetrators.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ico.org.uk/your-data-matters/cctv/?fbclid=IwAR2ukAzVv4yVY9KEv5zFUkSRb6g7Va1q07Xti8AdyqX3rQv_lzdyOmEq4qE\">UK ICO specifically request</a> that \"<em>CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.</em>\"&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://l.facebook.com/l.php?u=https%3A%2F%2Fico.org.uk%2Fyour-data-matters%2Fcctv%2F%3Ffbclid%3DIwAR2mHJ3YdgIEo95OlkNPQEJIhtq8sddhUeFGLLwdLxP41EHuZhNcZi9AThs&amp;h=AT0KGO2z-vp79YdW98JcL8ySgXe0Yz8BlIB9Aw4UjOdZPWLZjN23jXvoxryzS0d4tVZboM1vwGJSvrO7OjOPiFXd2Ed1703uY3cA3Xvs0OgiZeUxQCoj7zy7FOtKZ-I6PeHcGQAnxg\">&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not noticing much improvement with the cameras, the management has now decided to name and shame the perpetrators. When public naming and shaming, they should be ready for this sort of out of control incidents&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061?fbclid=IwAR3JwAi7npCRmC_pkVcHyAM-D0LaEPt4xz62wYpX7uqsZj5TA9EBukD0TuQ\">https://www.bbc.co.uk/.../uk-england-coventry...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of securing the data collected</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV cameras are easily hackable as shown in <a href=\"https://www.zerohedge.com/news/2019-05-02/chinas-mass-surveillance-app-hacked-code-reveals-specific-criterea-illegal?fbclid=IwAR3Vl1RuX8GW2fSYdixxxrKb9rE038S7MZ5rLO0srl3mJ2zAZwL3po1BCMg\">this case</a>&nbsp;and&nbsp;therefore&nbsp;a&nbsp;burden&nbsp;to&nbsp;keep&nbsp;safe. Cameras footage can be interecepted to <a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\">broadcast live online</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://securityboulevard.com/2019/05/smart-cities-and-smarter-hackers/amp/\">Smart cities and smarter hackers</a>. \'<em>Japan is planning a mass hackathon after passing legislation to prepare their citizens in advance of their 2020 Olympics. The company’s government plans to test the security of 200 Million IoT devices to create awareness of IoT security and its importance in the run up to the big event next year.</em>\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do you want to give access to your data footage to any hacker? <a href=\"https://paulbernal.wordpress.com/2012/02/07/do-you-want-a-camera-in-your-kids-bedroom/\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of over-reliance on technology</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wrong identification cans easily ruine someone\'s reputation as internet never forget. White Europeans are usually not good at identifying black or Asian. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy, necessity and the balance of proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. \'<em>Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.&nbsp; In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.&nbsp; A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.</em>\' The EDPB has published an <a href=\"https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf\">Assessment and Necessity Toolkit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Balancing fairness and proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6(1)f  lawful ground of processing personal data balancing exercises require it to be ‘<em>necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>’. In other words, the legitimate interests of the controller&nbsp;<em>and</em>&nbsp;those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered <a href=\"https://www.independent.co.uk/.../facial-recognition...\">excessive and out of proportion</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When publicly naming and shaming,  this sort of <a href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061\">out of control incidents </a>should be expected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I understand dumping is bad but it doesn\'t justify destroying someone\'s life and reputation. <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Internet memory is indelible</a>. In a more legal term, it doesn\'t stand the balance of proportionality to publish the footage. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>When the same result could be achieved in a less intrusive way </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV Code of Conduct suggests other measures such as more lighting for a bette security. In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>As example of issues created by pictures posted online to identify criminals:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.independent.co.uk/news/uk/home-news/facial-recognition-london-inaccurate-met-police-trials-a8898946.html\">Facial recognition wrongly identifies public as potential criminals 96% of time, figures reveal </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.digitaltrends.com/home-theater/dont-be-a-sucker-the-white-van-speaker-scam-explained/\">The white van speaker scam explained, and how it moved to Craigslist and Facebook</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thejournal.ie/paris-white-van-4566347-Mar2019/\">How an internet hoax about a \'white van kidnapper\' sparked violence in Paris</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">that way</a>? <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">The sad reputation of the woman who dumped her cat in a bin.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'<em>In an attempt to crack down on shoplifters, a UK storeowner has begun posting CCTV images of suspected thieves on the company\'s website, along with the incentive of a 500 pound (€580) reward for those who successfully identify thieves. On Saturday, the scheme claimed its first victim. But is it legal?</em>\' <a href=\"https://observers.france24.com/en/20090819-naming-shaming-shoplifters-cctv-legal-home-bargains?fbclid=IwAR26I88C13Nya4Wu3B21FBS9HN-5M61oGrrT5wzXY0y1_ETRqUypijE8JVI\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CCTV cameras and captured images','Big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.','inherit','closed','closed','','402-revision-v1','','','2020-11-26 21:17:21','2020-11-26 21:17:21','',402,'https://www.datarainbow.eu/402-revision-v1/',0,'revision','',0),(1816,2,'2020-11-26 21:16:27','2020-11-26 21:16:27','<!-- wp:heading {\"level\":4} -->\n<h4>The omni-presence of CCTV cameras. A subject I have been writing about for many years, including <a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\">here</a> and <a href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\">here</a>.</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Two new guidances, one by the <a href=\"https://t.co/iLfWe3PxTR\">Irish Data Protection commissionner</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and one by the <a href=\"https://ico.org.uk/for-organisations/in-your-sector/business/general-data-protection-regulation-gdpr-faqs-for-small-retailers?utm_source=twitter&amp;utm_medium=iconews&amp;utm_term=11692803-24bf-4164-9af2-1bd530eea6b7&amp;utm_content&amp;utm_campaign&amp;fbclid=IwAR03GMYAKvSjh92H8VC5mHW69dv7Ldll_GYaJ5KcVaz4RGlwwDvMEhL8sD8\">UK ICO.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I know, big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What private CCTV camera surveillance can cause ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Record any movement. They are usually not allowed to record voices. They record indistinctly, regardless of criminals or purely innocent walking by.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Because <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">privacy matters</a>, CCTVs  have to obey to strict rules : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You need :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>To inform the public by clear warning, </li><li>Register your cameras with the Information Commissionner, </li><li>Assess the privacy impact of the surveillance recording in a <a href=\"https://www.gov.uk/government/publications/data-protection-impact-assessments-for-surveillance-cameras\">DPIA</a>,</li><li>Secure the data collected,</li><li>Limit access to data collected,</li><li>Be ready for anyone to send a Subject Access Request to access the video footage at no cost with obligation to blur third parties faces, </li><li>Ensure that the CCTV images are clear and of a high quality,</li><li>Comply with the comprehensive ICO CCTV <a href=\"https://ico.org.uk/for-organisations/data-protection-self-assessment/cctv-checklist/?fbclid=IwAR0biT_007rE2cbDeMXL4aaRpvXmJcxGCieiV6tbgBGxxdaAqXxt96mQzok\">check list</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/282774/SurveillanceCameraCodePractice.pdf?fbclid=IwAR1jQCpXzQh1BnkXrWTdB6SBZ6ScEqHsBaS2HHICoraZHUsYB818lRal5Ac\">Surveillance Code of Practice</a> has not yet been updated to comply with the GDPR. It states \"<em>Principle 7 - Access to retained images and information should be restricted and there must be clearly defined rules on who can gain access and for what purpose such access is granted; the disclosure of images and information should only take place when it is necessary for such a purpose or for law enforcement purposes.</em>\"&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What is the nature of the pictures recorded by the CCTV cameras?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>GDPR require higher protection for \'<em>special category data\'</em>. Recital 51 clarifies when pictures can be considered of \'<em>special category</em>\' or as previously called \'<em>sensitive data</em>\' : “<em>Those personal data should include personal data revealing <strong>racial or ethnic origin</strong>, whereby the use of the term ‘racial origin’”: photographs should not systematically be considered to be processing of SC of PD as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The processing of photographs should not systematically be considered to be processing of special categories of personal data as they are covered by the definition of biometric data only when processed through a specific technical means allowing the unique identification or authentication of a natural person.</em>\"  <a href=\"https://iapp.org/news/a/ask-the-privacy-expert/)\">IAPP comments</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore when a CCTV footage reveal an image identifying an individual with its racial or ethic origin, by the colour of the skin or any external religious sign, these should be considered special category data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A management company intend to use CCTV images to name and shame fly tippers.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not seeing any result with their CCTV cameras to stop fly tipping, the management company of a private residence decide to pass at a higher speed by naming and shaming perpetrators.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ico.org.uk/your-data-matters/cctv/?fbclid=IwAR2ukAzVv4yVY9KEv5zFUkSRb6g7Va1q07Xti8AdyqX3rQv_lzdyOmEq4qE\">UK ICO specifically request</a> that \"<em>CCTV operators are not allowed to disclose images of identifiable people to the media - or to put them on the internet - for entertainment. Images released to the media to help identify a person are usually disclosed by the police.</em>\"&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://l.facebook.com/l.php?u=https%3A%2F%2Fico.org.uk%2Fyour-data-matters%2Fcctv%2F%3Ffbclid%3DIwAR2mHJ3YdgIEo95OlkNPQEJIhtq8sddhUeFGLLwdLxP41EHuZhNcZi9AThs&amp;h=AT0KGO2z-vp79YdW98JcL8ySgXe0Yz8BlIB9Aw4UjOdZPWLZjN23jXvoxryzS0d4tVZboM1vwGJSvrO7OjOPiFXd2Ed1703uY3cA3Xvs0OgiZeUxQCoj7zy7FOtKZ-I6PeHcGQAnxg\">&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Naming and shaming will result in identifying, revealing racial, ethnic, religious origins and eventually capture minors.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not noticing much improvement with the cameras, the management has now decided to name and shame the perpetrators. When public naming and shaming, they should be ready for this sort of out of control incidents&nbsp;<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061?fbclid=IwAR3JwAi7npCRmC_pkVcHyAM-D0LaEPt4xz62wYpX7uqsZj5TA9EBukD0TuQ\">https://www.bbc.co.uk/.../uk-england-coventry...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of securing the data collected</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV cameras are easily hackable as shown in <a href=\"https://www.zerohedge.com/news/2019-05-02/chinas-mass-surveillance-app-hacked-code-reveals-specific-criterea-illegal?fbclid=IwAR3Vl1RuX8GW2fSYdixxxrKb9rE038S7MZ5rLO0srl3mJ2zAZwL3po1BCMg\">this case</a>&nbsp;and&nbsp;therefore&nbsp;a&nbsp;burden&nbsp;to&nbsp;keep&nbsp;safe. Cameras footage can be interecepted to <a href=\"https://clarinettesblog.wordpress.com/2012/02/07/would-you-like-a-webcam-in-your-bedrooms-and-bathrooms-broadcating-live/\">broadcast live online</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://securityboulevard.com/2019/05/smart-cities-and-smarter-hackers/amp/\">Smart cities and smarter hackers</a>. \'<em>Japan is planning a mass hackathon after passing legislation to prepare their citizens in advance of their 2020 Olympics. The company’s government plans to test the security of 200 Million IoT devices to create awareness of IoT security and its importance in the run up to the big event next year.</em>\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Do you want to give access to your data footage to any hacker? <a href=\"https://paulbernal.wordpress.com/2012/02/07/do-you-want-a-camera-in-your-kids-bedroom/\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of over-reliance on technology</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wrong identification cans easily ruine someone\'s reputation as internet never forget. White Europeans are usually not good at identifying black or Asian. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Privacy, necessity and the balance of proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Privacy is a fundamental human rights resulting of the Article 8 ECHR. In the context of fundamental rights, such as the right to the protection of personal data, proportionality is key for any limitation on these rights. It is a requirement before deploying any process to consider the balance between the means used and the intended aim. \'<em>Proportionality requires that advantages due to limiting the right are not outweighed by the disadvantages to exercise the right.&nbsp; In other words, the limitation on the right must be justified. Safeguards accompanying a measure can support the justification of a measure.&nbsp; A pre-condition is that the measure is adequate to achieve the envisaged objective. In addition, when assessing the processing of personal data, proportionality requires that only that personal data which is adequate and relevant for the purposes of the processing is collected and processed.</em>\' The EDPB has published an <a href=\"https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf\">Assessment and Necessity Toolkit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Balancing fairness and proportionality</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6(1)f  lawful ground of processing personal data balancing exercises require it to be ‘<em>necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject</em>’. In other words, the legitimate interests of the controller&nbsp;<em>and</em>&nbsp;those of third parties against the interests, fundamental rights and freedoms of the data subject have to be balanced. The legitimate interest of the data controlor has to be balanced against the individual’s interests, rights and freedoms. Where same result can reasonably be achieved in a less intrusive way the legitimate interests basis for processing will not apply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The balance of rights between the use of CCTV cameras naming and shaming and the rights of individuals can be considered <a href=\"https://www.independent.co.uk/.../facial-recognition...\">excessive and out of proportion</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When publicly naming and shaming,  this sort of <a href=\"https://www.bbc.co.uk/news/uk-england-coventry-warwickshire-11087061\">out of control incidents </a>should be expected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I understand dumping is bad but it doesn\'t justify destroying someone\'s life and reputation. <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">Internet memory is indelible</a>. In a more legal term, it doesn\'t stand the balance of proportionality to publish the footage. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>When the same result could be achieved in a less intrusive way </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CCTV Code of Conduct suggests other measures such as more lighting for a bette security. In Frankfurt/Germany, twice a month residents would leave outside their unwanted items for the council vans to pick up. Sadly in UK in many areas, they are insuffisant recycling centers, some have even started to charge. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, the balance of proportionality has in one side the constant nuisance caused by dumping and on the other hand, fundamental rights and freedom of innocent residents and their visitors, the security of the network, unauthorised access to CCTV footage, over-reliance on technology and mis-identification of perpetrators, excessive and out of control online reactions, Data subject Subject Access Requests,  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>As example of issues created by pictures posted online to identify criminals:</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.independent.co.uk/news/uk/home-news/facial-recognition-london-inaccurate-met-police-trials-a8898946.html\">Facial recognition wrongly identifies public as potential criminals 96% of time, figures reveal </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.digitaltrends.com/home-theater/dont-be-a-sucker-the-white-van-speaker-scam-explained/\">The white van speaker scam explained, and how it moved to Craigslist and Facebook</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thejournal.ie/paris-white-van-4566347-Mar2019/\">How an internet hoax about a \'white van kidnapper\' sparked violence in Paris</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Was Mary Bale the most evil person in Britain to deserve to be publicly named and shamed <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">that way</a>? <a href=\"https://www.independent.co.uk/news/uk/home-news/is-mary-bale-the-most-evil-woman-in-britain-2064733.html\">The sad reputation of the woman who dumped her cat in a bin.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'<em>In an attempt to crack down on shoplifters, a UK storeowner has begun posting CCTV images of suspected thieves on the company\'s website, along with the incentive of a 500 pound (€580) reward for those who successfully identify thieves. On Saturday, the scheme claimed its first victim. But is it legal?</em>\' <a href=\"https://observers.france24.com/en/20090819-naming-shaming-shoplifters-cctv-legal-home-bargains?fbclid=IwAR26I88C13Nya4Wu3B21FBS9HN-5M61oGrrT5wzXY0y1_ETRqUypijE8JVI\">Read more here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the cost? I hope you share my view to answer no. Help me to explain to privacy consultants why CCTV cameras combined with naming and shaming of dumpers is not a great idea.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CCTV cameras and captured images','Big Brother is taking over our streets and buildings. This omniveillance has severe chilling effects on our Fundamental Rights of freedom and human dignity. We are seriously suffocating in our Panoptican society.','inherit','closed','closed','','402-autosave-v1','','','2020-11-26 21:16:27','2020-11-26 21:16:27','',402,'https://www.datarainbow.eu/402-autosave-v1/',0,'revision','',0),(1819,2,'2020-11-26 21:33:55','2020-11-26 21:33:55','','Screenshot 2020-11-26 at 21.33.06','','inherit','open','closed','','screenshot-2020-11-26-at-21-33-06','','','2020-11-26 21:33:55','2020-11-26 21:33:55','',0,'https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-26-at-21.33.06.png',0,'attachment','image/png',0),(1825,2,'2020-11-26 22:59:37','2020-11-26 22:59:37','<!-- wp:paragraph -->\n<p>Une amende, not an almond, but a fine for cookies. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The French DPA <a href=\"https://www.cnil.fr/fr/sanctions-2250000-euros-et-800000-euros-pour-carrefour-france-carrefour-banque\">CNIL finally enforced the law</a>, Carrefour supermarket and Carrefour Bank fined for 2 250 000 euros and 800 000 euros.<br>- lack of transparency (article 13 GDPR)<br>- unlawful cookies (article 82 de la loi Informatique et Libertés)<br>- storage limitation, article 5.1.e GDPR<br>- lack of mention of data subjects rights, article 12 GDPR<br>- infringement of articles 15, 17 et 21 du RGPD et L34-5 Code des postes et des communications électroniques<br>- unlawful and unfair data processing, article 5 GDPR. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is the new Carrefour\'s website cookie situation with a <a href=\"https://static.carrefour.fr/static/cfr/C4FR/2020/rgpd/tableau-cookies-rgpd-2020_v5.pdf\">link</a> to what looks to be full transparency on third parties. Remains the question of the data transfer outside the eeA, Google Analytics and Facebook Connect have been sued by NOYB NGO since the invalidation of the Privacy shield by the ECJ decision SchremsII v Facebook July 2020.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:coblocks/gallery-carousel -->\n<div class=\"wp-block-coblocks-gallery-carousel\"><div class=\"is-cropped coblocks-gallery has-no-alignment has-caption-style-dark has-horizontal-gutter\"><div class=\"has-carousel has-carousel-lrg\" style=\"height:400px\" data-flickity=\"{&quot;autoPlay&quot;:false,&quot;draggable&quot;:true,&quot;pageDots&quot;:false,&quot;prevNextButtons&quot;:true,&quot;wrapAround&quot;:true,&quot;cellAlign&quot;:&quot;center&quot;,&quot;pauseAutoPlayOnHover&quot;:false,&quot;freeScroll&quot;:false,&quot;arrowShape&quot;:{&quot;x0&quot;:10,&quot;x1&quot;:60,&quot;y1&quot;:50,&quot;x2&quot;:65,&quot;y2&quot;:45,&quot;x3&quot;:20},&quot;thumbnails&quot;:false,&quot;responsiveHeight&quot;:false}\"><div class=\"coblocks-gallery--item\"><figure class=\"coblocks-gallery--figure has-margin-left-5 has-margin-left-mobile-5 has-margin-right-5 has-margin-right-mobile-5\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-26-at-09.45.29-1-1024x532.png\" alt=\"\" data-id=\"1735\" data-link=\"https://www.datarainbow.eu/french-dpa-cnil-fined-carrefour-for-cookies/screenshot-2020-11-26-at-09-45-29-1/\" class=\"wp-image-1735\"/></figure></div></div></div></div>\n<!-- /wp:coblocks/gallery-carousel -->\n\n<!-- wp:paragraph -->\n<p>Time for the many websites with unlawful cookies to check their compliance. Consent is required before any cookies are placed, transparency and - as NOYB NGO has already filed - expect Google Analytics and Facebook Connect transferring data to the US to be infringing the GDPR. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://lnkd.in/egAkGxw\">CNIL\'s decision against Carrefour France.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://lnkd.in/ePd4-yM\">CNIL\'s decision against Carrefour Banque</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://lnkd.in/eNqZK-j\">CNIL\'s press release.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CNIL\'s recommendations of October 1st 2020 on the use of cookies. <a href=\"https://www.cnil.fr/fr/cookies-solutions-pour-les-outils-de-mesure-daudience\">\"Cookies : solutions pour les outils de mesure d\'audience\"</a></p>\n<!-- /wp:paragraph -->','French DPA CNIL Fined Carrefour for Cookies','The French DPA CNIL finally enforced the law, Carrefour supermarket and Carrefour Bank fined for 2 250 000 euros and 800 000 euros.','inherit','closed','closed','','1726-revision-v1','','','2020-11-26 22:59:37','2020-11-26 22:59:37','',1726,'https://www.datarainbow.eu/1726-revision-v1/',0,'revision','',0),(1829,2,'2020-11-26 23:11:22','2020-11-26 23:11:22','<!-- wp:heading {\"align\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Let\'s get in touch</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\">Well hello there, wonderful, fabulous you! If you’d like to get in touch with me, please feel free to to send me a message with the form down below. Either way, I\'ll be in touch shortly!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:coblocks/form -->\n<!-- wp:coblocks/field-name /-->\n\n<!-- wp:coblocks/field-email {\"required\":true} /-->\n\n<!-- wp:coblocks/field-textarea {\"required\":true} /-->\n\n<!-- wp:coblocks/field-submit-button {\"submitButtonText\":\"Contact Us\"} /-->\n<!-- /wp:coblocks/form -->\n\n<!-- wp:coblocks/services {\"columns\":3,\"alignment\":\"center\",\"align\":\"wide\",\"className\":\"is-style-circle\"} -->\n<div class=\"wp-block-coblocks-services alignwide is-style-circle\"><div class=\"is-style-circle has-columns has-3-columns has-responsive-columns has-medium-gutter\"><!-- wp:coblocks/service {\"alignment\":\"center\"} -->\n<div class=\"wp-block-coblocks-service\"><figure class=\"wp-block-coblocks-service__figure\"><img src=\"http://www.datarainbow.eu/wp-content/uploads/2020/11/contact-image-1.jpg\" alt=\"Image description\"/></figure><div class=\"wp-block-coblocks-service__content\"><!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><em>\"I appreciate Everett\'s ability to compose visually stunning photos, brining my memories to live every time I look at them. I couldn\'t be more happier!\"</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\">- Larina H.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:coblocks/service -->\n\n<!-- wp:coblocks/service {\"alignment\":\"center\"} -->\n<div class=\"wp-block-coblocks-service\"><figure class=\"wp-block-coblocks-service__figure\"><img src=\"http://www.datarainbow.eu/wp-content/uploads/2020/11/contact-image-2.jpg\" alt=\"Image description\"/></figure><div class=\"wp-block-coblocks-service__content\"><!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><em>\"Everett should be nominated for photographer of the year. I am so pleased with her photography at my wedding. She’s wonderful!\"</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\">- Kam V.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:coblocks/service -->\n\n<!-- wp:coblocks/service {\"alignment\":\"center\"} -->\n<div class=\"wp-block-coblocks-service\"><figure class=\"wp-block-coblocks-service__figure\"><img src=\"http://www.datarainbow.eu/wp-content/uploads/2020/11/contact-image-3.jpg\" alt=\"Image description\"/></figure><div class=\"wp-block-coblocks-service__content\"><!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><em>\"Everett knew exactly how to pull the best of me out, and into a beautiful portrait. I\'m so glad I met Everett - she\'s my go-to photographer now!\"</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\">- Jerri S.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:coblocks/service --></div></div>\n<!-- /wp:coblocks/services -->','Connect','','inherit','closed','closed','','36-revision-v1','','','2020-11-26 23:11:22','2020-11-26 23:11:22','',36,'https://www.datarainbow.eu/36-revision-v1/',0,'revision','',0),(1830,2,'2020-11-26 23:12:26','2020-11-26 23:12:26','<!-- wp:heading {\"align\":\"center\"} -->\n<h2 class=\"has-text-align-center\">Let\'s get in touch</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\">Well hello there, wonderful, fabulous you! If you’d like to get in touch with us, please feel free to to send an email at data@DataRainbow.eu or send a message with the form down below. Either way, we\'ll be in touch shortly!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:coblocks/form -->\n<!-- wp:coblocks/field-name /-->\n\n<!-- wp:coblocks/field-email {\"required\":true} /-->\n\n<!-- wp:coblocks/field-textarea {\"required\":true} /-->\n\n<!-- wp:coblocks/field-submit-button {\"submitButtonText\":\"Contact Us\"} /-->\n<!-- /wp:coblocks/form -->\n\n<!-- wp:coblocks/services {\"columns\":3,\"alignment\":\"center\",\"align\":\"wide\",\"className\":\"is-style-circle\"} -->\n<div class=\"wp-block-coblocks-services alignwide is-style-circle\"><div class=\"is-style-circle has-columns has-3-columns has-responsive-columns has-medium-gutter\"><!-- wp:coblocks/service {\"alignment\":\"center\"} -->\n<div class=\"wp-block-coblocks-service\"><figure class=\"wp-block-coblocks-service__figure\"><img src=\"http://www.datarainbow.eu/wp-content/uploads/2020/11/contact-image-1.jpg\" alt=\"Image description\"/></figure><div class=\"wp-block-coblocks-service__content\"><!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><em>\"I appreciate Everett\'s ability to compose visually stunning photos, brining my memories to live every time I look at them. I couldn\'t be more happier!\"</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\">- Larina H.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:coblocks/service -->\n\n<!-- wp:coblocks/service {\"alignment\":\"center\"} -->\n<div class=\"wp-block-coblocks-service\"><figure class=\"wp-block-coblocks-service__figure\"><img src=\"http://www.datarainbow.eu/wp-content/uploads/2020/11/contact-image-2.jpg\" alt=\"Image description\"/></figure><div class=\"wp-block-coblocks-service__content\"><!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><em>\"Everett should be nominated for photographer of the year. I am so pleased with her photography at my wedding. She’s wonderful!\"</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\">- Kam V.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:coblocks/service -->\n\n<!-- wp:coblocks/service {\"alignment\":\"center\"} -->\n<div class=\"wp-block-coblocks-service\"><figure class=\"wp-block-coblocks-service__figure\"><img src=\"http://www.datarainbow.eu/wp-content/uploads/2020/11/contact-image-3.jpg\" alt=\"Image description\"/></figure><div class=\"wp-block-coblocks-service__content\"><!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><em>\"Everett knew exactly how to pull the best of me out, and into a beautiful portrait. I\'m so glad I met Everett - she\'s my go-to photographer now!\"</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\">- Jerri S.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:coblocks/service --></div></div>\n<!-- /wp:coblocks/services -->','Connect','','inherit','closed','closed','','36-revision-v1','','','2020-11-26 23:12:26','2020-11-26 23:12:26','',36,'https://www.datarainbow.eu/36-revision-v1/',0,'revision','',0),(2062,1,'2021-06-21 21:23:20','2021-06-21 21:23:20','<!-- wp:image {\"id\":2056,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a-1024x518.jpeg\" alt=\"\" class=\"wp-image-2056\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" rel=\"noreferrer noopener\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a>. Or at least, not yet..</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, The Commission published the <a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\" rel=\"noreferrer noopener\">new Standard Contractual Clauses</a> long awaited. And today, the EDPB has published its<a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\" rel=\"noreferrer noopener\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with<br>the EU level of protection of personal data - Version 2.0 - Adopted on 18 June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\" rel=\"noreferrer noopener\">Since Eduard Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data. The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by Art 82 GDPR. However, we still to see non material damage granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US Safe Harbour agreement then the Privacy Shield being invalidated by the European Court of Justice decisions (commonly known as Schrems-I and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the Charter of the Fundamental Rights of the European Union. with this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an equivalent level of protection for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a>) a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available)..</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received and adequacy decision on the basis of <a href=\"https://www.gdprinfo.info/#a45\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" rel=\"noreferrer noopener\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japon and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give its green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EEA. This requires transfer impact assessment to assess the level of protection in a third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – supplementary measures need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be technical, organisational and/or contractual measures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs models pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a data mapping that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We see the cloud leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' BCR (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) can be more appropriate, usually within different establishments of a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> apply \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on</em>\' restrictive conditions</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU COMMISSION implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations for its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</em>\' This is the case when the importer is falls within the definition of <strong>Art 3(2)</strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a Data Processing Agreement Art 28 is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND judicial redress (EU courts competence) and/or arbitration will be provided. This is what was lacking with the Privacy Shield, an independent authority and the ombudsperson to deal with EU citizens complaints. The EDBP recommendation has not specified this case scenario. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered as transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden in the back of a drawer. The new SCCs requiere adaptation, they are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> for Data controller to Processor, Controller to controller, processor ro processor and Processor back to Controller. They need to be adapted, Third party have now the \'docking option\' to join the contract. They can be adapted as long as the nature of the clauses are not modified</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>, emphasised by the Commission document will not be an easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, data subjects should be provided with a copy of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>the data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start with data mapping, minimising, and securing access. Hold the data as a hot potato. Don’t keep it longer than necessary. Keep your archives out of the network. Limit access to data. Train your staff. Be ready for data breach</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly data heaven with the risk of opening backdoors to data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touch at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\" rel=\"noreferrer noopener\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 21:23:20','2021-06-21 21:23:20','',2054,'https://www.datarainbow.eu/?p=2062',0,'revision','',0),(2063,1,'2021-06-21 21:44:33','2021-06-21 21:44:33','<!-- wp:image {\"id\":2056,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a-1024x518.jpeg\" alt=\"\" class=\"wp-image-2056\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" rel=\"noreferrer noopener\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a>. Or at least, not yet..</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, The Commission published the <a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\" rel=\"noreferrer noopener\">new Standard Contractual Clauses</a> long awaited. And today, the EDPB has published its<a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\" rel=\"noreferrer noopener\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with<br>the EU level of protection of personal data - Version 2.0 - Adopted on 18 June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\" rel=\"noreferrer noopener\">Since Eduard Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data. The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by Art 82 GDPR. However, we still to see non material damage granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US Safe Harbour agreement then the Privacy Shield being invalidated by the European Court of Justice decisions (commonly known as Schrems-I and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the Charter of the Fundamental Rights of the European Union. with this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an equivalent level of protection for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a>) a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available)..</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received and adequacy decision on the basis of <a href=\"https://www.gdprinfo.info/#a45\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" rel=\"noreferrer noopener\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japon and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give its green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EEA. This requires transfer impact assessment to assess the level of protection in a third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – supplementary measures need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be technical, organisational and/or contractual measures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs models pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a data mapping that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We see the cloud leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' BCR (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) can be more appropriate, usually within different establishments of a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> apply \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on</em>\' restrictive conditions</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU COMMISSION implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations for its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</em>\' This is the case when the importer is falls within the definition of <strong>Art 3(2)</strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a Data Processing Agreement Art 28 is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND judicial redress (EU courts competence) and/or arbitration will be provided. This is what was lacking with the Privacy Shield, an independent authority and the ombudsperson to deal with EU citizens complaints. The EDBP recommendation has not specified this case scenario. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered as transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden in the back of a drawer. The new SCCs requiere adaptation, they are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> for Data controller to Processor, Controller to controller, processor ro processor and Processor back to Controller. They need to be adapted, Third party have now the \'docking option\' to join the contract. They can be adapted as long as the nature of the clauses are not modified</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>, emphasised by the Commission document will not be an easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, data subjects should be provided with a copy of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>the data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start with data mapping, minimising, and securing access. Hold the data as a hot potato. Don’t keep it longer than necessary. Keep your archives out of the network. Limit access to data. Train your staff. Be ready for data breach</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly data heaven with the risk of opening backdoors to data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touch at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\" rel=\"noreferrer noopener\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 21:44:33','2021-06-21 21:44:33','',2054,'https://www.datarainbow.eu/?p=2063',0,'revision','',0),(2064,1,'2021-06-21 21:45:58','2021-06-21 21:45:58','<!-- wp:image {\"id\":2056,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a-1024x518.jpeg\" alt=\"\" class=\"wp-image-2056\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" rel=\"noreferrer noopener\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a>. Or at least, not yet..</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, The Commission published the <a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\" rel=\"noreferrer noopener\">new Standard Contractual Clauses</a> long awaited. And today, the EDPB has published its<a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\" rel=\"noreferrer noopener\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with<br>the EU level of protection of personal data - Version 2.0 - Adopted on 18 June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\" rel=\"noreferrer noopener\">Since Eduard Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data. The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by Art 82 GDPR. However, we still to see non material damage granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US Safe Harbour agreement then the Privacy Shield being invalidated by the European Court of Justice decisions (commonly known as Schrems-I and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the Charter of the Fundamental Rights of the European Union. with this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an equivalent level of protection for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a>) a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available)..</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japon and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give its green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EEA. This requires transfer impact assessment to assess the level of protection in a third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – supplementary measures need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be technical, organisational and/or contractual measures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs models pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a data mapping that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We see the cloud leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' BCR (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) can be more appropriate, usually within different establishments of a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> apply \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on</em>\' restrictive conditions</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU COMMISSION implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations for its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</em>\' This is the case when the importer is falls within the definition of <strong>Art 3(2)</strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a Data Processing Agreement Art 28 is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND judicial redress (EU courts competence) and/or arbitration will be provided. This is what was lacking with the Privacy Shield, an independent authority and the ombudsperson to deal with EU citizens complaints. The EDBP recommendation has not specified this case scenario. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered as transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden in the back of a drawer. The new SCCs requiere adaptation, they are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> for Data controller to Processor, Controller to controller, processor ro processor and Processor back to Controller. They need to be adapted, Third party have now the \'docking option\' to join the contract. They can be adapted as long as the nature of the clauses are not modified</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>, emphasised by the Commission document will not be an easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, data subjects should be provided with a copy of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>the data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start with data mapping, minimising, and securing access. Hold the data as a hot potato. Don’t keep it longer than necessary. Keep your archives out of the network. Limit access to data. Train your staff. Be ready for data breach</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly data heaven with the risk of opening backdoors to data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touch at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\" rel=\"noreferrer noopener\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 21:45:58','2021-06-21 21:45:58','',2054,'https://www.datarainbow.eu/?p=2064',0,'revision','',0),(2065,1,'2021-06-21 21:52:15','2021-06-21 21:52:15','<!-- wp:image {\"id\":2056,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a-1024x518.jpeg\" alt=\"\" class=\"wp-image-2056\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, The Commission published the <a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\" rel=\"noreferrer noopener\">new Standard Contractual Clauses</a> long awaited. And today, the EDPB has published its<a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\" rel=\"noreferrer noopener\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with<br>the EU level of protection of personal data - Version 2.0 - Adopted on 18 June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\" rel=\"noreferrer noopener\">Since Eduard Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data. The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by Art 82 GDPR. However, we still to see non material damage granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US Safe Harbour agreement then the Privacy Shield being invalidated by the European Court of Justice decisions (commonly known as Schrems-I and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the Charter of the Fundamental Rights of the European Union. with this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an equivalent level of protection for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a>) a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available)..</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japon and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give its green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EEA. This requires transfer impact assessment to assess the level of protection in a third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – supplementary measures need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be technical, organisational and/or contractual measures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>SCCs models pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a data mapping that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We see the cloud leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' BCR (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) can be more appropriate, usually within different establishments of a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> apply \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only on</em>\' restrictive conditions</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU COMMISSION implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations for its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</em>\' This is the case when the importer is falls within the definition of <strong>Art 3(2)</strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a Data Processing Agreement Art 28 is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND judicial redress (EU courts competence) and/or arbitration will be provided. This is what was lacking with the Privacy Shield, an independent authority and the ombudsperson to deal with EU citizens complaints. The EDBP recommendation has not specified this case scenario. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered as transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden in the back of a drawer. The new SCCs requiere adaptation, they are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p> for Data controller to Processor, Controller to controller, processor ro processor and Processor back to Controller. They need to be adapted, Third party have now the \'docking option\' to join the contract. They can be adapted as long as the nature of the clauses are not modified</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>, emphasised by the Commission document will not be an easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, data subjects should be provided with a copy of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>the data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start with data mapping, minimising, and securing access. Hold the data as a hot potato. Don’t keep it longer than necessary. Keep your archives out of the network. Limit access to data. Train your staff. Be ready for data breach</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly data heaven with the risk of opening backdoors to data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touch at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\" rel=\"noreferrer noopener\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 21:52:15','2021-06-21 21:52:15','',2054,'https://www.datarainbow.eu/?p=2065',0,'revision','',0),(1842,1,'2020-11-27 00:04:28','2020-11-27 00:04:28','https://www.datarainbow.eu/wp-content/uploads/2019/01/cropped-Screenshot-2020-11-26-at-20.54.11.png','cropped-Screenshot-2020-11-26-at-20.54.11.png','','inherit','open','closed','','cropped-screenshot-2020-11-26-at-20-54-11-png','','','2020-11-27 00:04:28','2020-11-27 00:04:28','',0,'https://www.datarainbow.eu/wp-content/uploads/2019/01/cropped-Screenshot-2020-11-26-at-20.54.11.png',0,'attachment','image/png',0),(1844,1,'2020-11-27 00:05:30','2020-11-27 00:05:30','https://www.datarainbow.eu/wp-content/uploads/2019/01/cropped-Screenshot-2020-11-26-at-20.54.11-1.png','cropped-Screenshot-2020-11-26-at-20.54.11-1.png','','inherit','open','closed','','cropped-screenshot-2020-11-26-at-20-54-11-1-png','','','2020-11-27 00:05:30','2020-11-27 00:05:30','',0,'https://www.datarainbow.eu/wp-content/uploads/2019/01/cropped-Screenshot-2020-11-26-at-20.54.11-1.png',0,'attachment','image/png',0),(1848,1,'2020-11-27 00:15:25','2020-11-27 00:15:25','<!-- wp:core-embed/wordpress {\"url\":\"https://cybertalks.co.uk/interviews/ico-slow-to-fine-organisations/\",\"type\":\"wp-embed\",\"providerNameSlug\":\"cybertalks\"} -->\n<figure class=\"wp-block-embed-wordpress wp-block-embed is-type-wp-embed is-provider-cybertalks\"><div class=\"wp-block-embed__wrapper\">\nhttps://cybertalks.co.uk/interviews/ico-slow-to-fine-organisations/\n</div></figure>\n<!-- /wp:core-embed/wordpress -->\n\n<!-- wp:paragraph -->\n<p>Pre GDPR data privacy principles were ignored…and companies are still complacent as the ICO has been slow to fine organisations for failure to comply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://cybertalks.co.uk/profile/tara-taubman-bassirian/\">Tara Taubman-Bassirian</a>&nbsp;LLM,&nbsp;GDPR, Data Protection and IP consultant – Voted Privacy Hero of the Year, talks to&nbsp;<a href=\"https://cybertalks.co.uk/profile/karla-reffold/\">Karla Reffold</a>&nbsp;in a <a href=\"https://cybertalks.co.uk/interviews/ico-slow-to-fine-organisations/\">Cybertals interview</a> about GDPR and the rights of Data Subjects.</p>\n<!-- /wp:paragraph -->','Interview with Cybertalks','','inherit','closed','closed','','498-revision-v1','','','2020-11-27 00:15:25','2020-11-27 00:15:25','',498,'https://www.datarainbow.eu/498-revision-v1/',0,'revision','',0),(1851,1,'2020-11-27 00:28:26','2020-11-27 00:28:26','','Screenshot 2020-11-27 at 00.28.00','','inherit','open','closed','','screenshot-2020-11-27-at-00-28-00','','','2020-11-27 00:28:26','2020-11-27 00:28:26','',0,'https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-27-at-00.28.00.png',0,'attachment','image/png',0),(1852,1,'2020-11-27 00:29:48','2020-11-27 00:29:48','https://www.datarainbow.eu/wp-content/uploads/2020/11/cropped-Screenshot-2020-11-27-at-00.28.00.png','cropped-Screenshot-2020-11-27-at-00.28.00.png','','inherit','open','closed','','cropped-screenshot-2020-11-27-at-00-28-00-png','','','2020-11-27 00:29:48','2020-11-27 00:29:48','',0,'https://www.datarainbow.eu/wp-content/uploads/2020/11/cropped-Screenshot-2020-11-27-at-00.28.00.png',0,'attachment','image/png',0),(1853,1,'2020-11-27 00:30:19','2020-11-27 00:30:19','https://www.datarainbow.eu/wp-content/uploads/2020/11/cropped-Screenshot-2020-11-27-at-00.28.00-1.png','cropped-Screenshot-2020-11-27-at-00.28.00-1.png','','inherit','open','closed','','cropped-screenshot-2020-11-27-at-00-28-00-1-png','','','2020-11-27 00:30:19','2020-11-27 00:30:19','',0,'https://www.datarainbow.eu/wp-content/uploads/2020/11/cropped-Screenshot-2020-11-27-at-00.28.00-1.png',0,'attachment','image/png',0),(1858,2,'2020-11-27 01:19:09','2020-11-27 01:19:09','','Screenshot-2020-11-27-at-00.28.00-1','','inherit','open','closed','','screenshot-2020-11-27-at-00-28-00-1','','','2020-11-27 01:19:09','2020-11-27 01:19:09','',85,'https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-27-at-00.28.00-1.png',0,'attachment','image/png',0),(1859,2,'2020-11-27 01:19:26','2020-11-27 01:19:26','','Screenshot-2020-11-27-at-01.17.11','','inherit','open','closed','','screenshot-2020-11-27-at-01-17-11','','','2020-11-27 01:19:26','2020-11-27 01:19:26','',85,'https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-27-at-01.17.11.png',0,'attachment','image/png',0),(1951,2,'2020-12-02 21:06:13','2020-12-02 21:06:13','','Screenshot-2020-12-02-at-21.05.19','','inherit','open','closed','','screenshot-2020-12-02-at-21-05-19','','','2020-12-02 21:06:13','2020-12-02 21:06:13','',85,'https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-02-at-21.05.19.png',0,'attachment','image/png',0),(1952,2,'2020-12-02 21:06:32','2020-12-02 21:06:32','<!-- wp:paragraph -->\n<p>We are working on building a privacy compliant website. This site does not use any analytics.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"left\",\"id\":116,\"width\":360,\"height\":230} -->\n<div class=\"wp-block-image\"><figure class=\"alignleft is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-2.png\" alt=\"\" class=\"wp-image-116\" width=\"360\" height=\"230\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>We do not use cookies unless strictly functional. We are trying our best to not allow third parties to track our visitors by cookies or by Java Script embeded code. It\'s hard job. We might lose traffic and SEO. We have used a Word Press template.  WP templates are mainly server side PHP scripts full of board cascading code built on code. We can\'t even see the actual code.&nbsp;When using the WP admin, the templates are loaded in the back. We wanted to let make you aware that this potential risk. Help us by spreading the word. If you see anything suspicious, lets us know.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We believe our visitors deserve protection and privacy. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want your trust. In particular, we do not use Google analytics, avoiding to share data with external third parties.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1951,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-02-at-21.05.19-1024x528.png\" alt=\"\" class=\"wp-image-1951\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>When links are posted, beware that they will take you to an external website that is hosted by a third-party provider not necessarily in your regional jurisdiction or that of DataRainbow. The company may collect, store and use information independent of DataRainbow including but not limited to IP address, browser details etc. DataRainbow has no control over the collection or use of this information. For more information on the linked sites Privacy Policy and the Lawful basis for this data collection, read their privacy notice/policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Most other web sites don\'t actually comply with the laws relating to data protection and privacy and as such it is impossible for us to guarantee that the sites we link to will not misuse your data. We hope regulators will enforce the law against these organisations. As such please always be mindful of clicking on links to third party web sites - we would recommend that you have various tools and plugins installed on your web browser to protect you such as:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>AdBlock Plus</li><li>NoScript</li><li>Privacy Badger</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Make sure that third party cookies and pop-ups are disabled in your web browser settings. We will produce a video showing you how to do this in the near future.</p>\n<!-- /wp:paragraph -->','Privacy Notice','','inherit','closed','closed','','85-revision-v1','','','2020-12-02 21:06:32','2020-12-02 21:06:32','',85,'https://www.datarainbow.eu/85-revision-v1/',0,'revision','',0),(1861,2,'2020-11-27 01:20:47','2020-11-27 01:20:47','<!-- wp:paragraph -->\n<p>We are working on building a privacy compliant website. This site does not use any analytics.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"left\",\"id\":116,\"width\":360,\"height\":230} -->\n<div class=\"wp-block-image\"><figure class=\"alignleft is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-2.png\" alt=\"\" class=\"wp-image-116\" width=\"360\" height=\"230\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>We do not use cookies unless strictly functional. We are trying our best to not allow third parties to track our visitors by cookies or by Java Script embeded code. It\'s hard job. We might lose traffic and SEO. We have used a Word Press template.  WP templates are mainly server side PHP scripts full of board cascading code built on code. We can\'t even see the actual code.&nbsp;When using the WP admin, the templates are loaded in the back. We wanted to let make you aware that this potential risk. Help us by spreading the word. If you see anything suspicious, lets us know.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We believe our visitors deserve protection and privacy. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want your trust. In particular, we do not use Google analytics, avoiding to share data with external third parties.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1859,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-27-at-01.17.11-1024x527.png\" alt=\"\" class=\"wp-image-1859\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>When links are posted, beware that they will take you to an external website that is hosted by a third-party provider not necessarily in your regional jurisdiction or that of DataRainbow. The company may collect, store and use information independent of DataRainbow including but not limited to IP address, browser details etc. DataRainbow has no control over the collection or use of this information. For more information on the linked sites Privacy Policy and the Lawful basis for this data collection, read their privacy notice/policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Most other web sites don\'t actually comply with the laws relating to data protection and privacy and as such it is impossible for us to guarantee that the sites we link to will not misuse your data. We hope regulators will enforce the law against these organisations. As such please always be mindful of clicking on links to third party web sites - we would recommend that you have various tools and plugins installed on your web browser to protect you such as:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>AdBlock Plus</li><li>NoScript</li><li>Privacy Badger</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Make sure that third party cookies and pop-ups are disabled in your web browser settings. We will produce a video showing you how to do this in the near future.</p>\n<!-- /wp:paragraph -->','Privacy Notice','','inherit','closed','closed','','85-revision-v1','','','2020-11-27 01:20:47','2020-11-27 01:20:47','',85,'https://www.datarainbow.eu/85-revision-v1/',0,'revision','',0),(2084,1,'2022-10-07 09:14:26','2021-07-05 14:20:53','','Schrems II and International Data Transfers: The Journey to a new Privacy Shield and Who Is Leading the Way','','publish','closed','closed','','schrems-ii-and-international-data-transfers-the-journey-to-a-new-privacy-shield-and-who-is-leading-the-way','','','2022-10-07 09:14:26','2022-10-07 09:14:26','',0,'https://www.datarainbow.eu/?p=2084',3,'nav_menu_item','',0),(2056,1,'2021-06-21 17:33:09','2021-06-21 17:33:09','','DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a','','inherit','open','closed','','db7be3b6-fea8-4c95-b109-0586db3f5a1f_1_201_a','','','2021-06-21 17:33:09','2021-06-21 17:33:09','',2054,'https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a.jpeg',0,'attachment','image/jpeg',0),(1881,1,'2020-11-27 13:26:41','2020-11-27 13:26:41','<!-- wp:paragraph -->\n<p>Une amende, not an almond, but a fine for cookies. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The French DPA <a href=\"https://www.cnil.fr/fr/sanctions-2250000-euros-et-800000-euros-pour-carrefour-france-carrefour-banque\">CNIL finally </a><a href=\"https://www.cnil.fr/fr/sanctions-2250000-euros-et-800000-euros-pour-carrefour-france-carrefour-banque\" target=\"_blank\" rel=\"noreferrer noopener\">enforced the</a><a href=\"https://www.cnil.fr/fr/sanctions-2250000-euros-et-800000-euros-pour-carrefour-france-carrefour-banque\"> law</a>, Carrefour supermarket and Carrefour Bank fined for 2 250 000 euros and 800 000 euros.<br>- lack of transparency (article 13 GDPR)<br>- unlawful cookies (article 82 de la loi Informatique et Libertés)<br>- storage limitation, article 5.1.e GDPR<br>- lack of mention of data subjects rights, article 12 GDPR<br>- infringement of articles 15, 17 et 21 du RGPD et L34-5 Code des postes et des communications électroniques<br>- unlawful and unfair data processing, article 5 GDPR. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is the new Carrefour\'s website cookie situation with a <a href=\"https://static.carrefour.fr/static/cfr/C4FR/2020/rgpd/tableau-cookies-rgpd-2020_v5.pdf\">link</a> to what looks to be full transparency on third parties. Remains the question of the data transfer outside the eeA, Google Analytics and Facebook Connect have been sued by NOYB NGO since the invalidation of the Privacy shield by the ECJ decision SchremsII v Facebook July 2020.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:coblocks/gallery-carousel -->\n<div class=\"wp-block-coblocks-gallery-carousel\"><div class=\"is-cropped coblocks-gallery has-no-alignment has-caption-style-dark has-horizontal-gutter\"><div class=\"has-carousel has-carousel-lrg\" style=\"height:400px\" data-flickity=\"{&quot;autoPlay&quot;:false,&quot;draggable&quot;:true,&quot;pageDots&quot;:false,&quot;prevNextButtons&quot;:true,&quot;wrapAround&quot;:true,&quot;cellAlign&quot;:&quot;center&quot;,&quot;pauseAutoPlayOnHover&quot;:false,&quot;freeScroll&quot;:false,&quot;arrowShape&quot;:{&quot;x0&quot;:10,&quot;x1&quot;:60,&quot;y1&quot;:50,&quot;x2&quot;:65,&quot;y2&quot;:45,&quot;x3&quot;:20},&quot;thumbnails&quot;:false,&quot;responsiveHeight&quot;:false}\"><div class=\"coblocks-gallery--item\"><figure class=\"coblocks-gallery--figure has-margin-left-5 has-margin-left-mobile-5 has-margin-right-5 has-margin-right-mobile-5\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-26-at-09.45.29-1-1024x532.png\" alt=\"\" data-id=\"1735\" data-link=\"https://www.datarainbow.eu/french-dpa-cnil-fined-carrefour-for-cookies/screenshot-2020-11-26-at-09-45-29-1/\" class=\"wp-image-1735\"/></figure></div></div></div></div>\n<!-- /wp:coblocks/gallery-carousel -->\n\n<!-- wp:paragraph -->\n<p>Time for the many websites with unlawful cookies to check their compliance. Consent is required before any cookies are placed, transparency and - as NOYB NGO has already filed - expect Google Analytics and Facebook Connect transferring data to the US to be infringing the GDPR. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://lnkd.in/egAkGxw\">CNIL\'s decision against </a><a href=\"https://lnkd.in/egAkGxw\" target=\"_blank\" rel=\"noreferrer noopener\">Carrefour</a><a href=\"https://lnkd.in/egAkGxw\"> France.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://lnkd.in/ePd4-yM\">CNIL\'s </a><a href=\"https://lnkd.in/ePd4-yM\" target=\"_blank\" rel=\"noreferrer noopener\">decision</a><a href=\"https://lnkd.in/ePd4-yM\"> against </a><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/ePd4-yM\" target=\"_blank\">Carrefour Banque</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://lnkd.in/eNqZK-j\">CNIL\'s press release.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CNIL\'s recommendations of October 1st 2020 on the use of cookies. <a href=\"https://www.cnil.fr/fr/cookies-solutions-pour-les-outils-de-mesure-daudience\">\"Cookies : solutions pour les outils de </a><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/cookies-solutions-pour-les-outils-de-mesure-daudience\" target=\"_blank\">mesure</a><a href=\"https://www.cnil.fr/fr/cookies-solutions-pour-les-outils-de-mesure-daudience\"> d\'audience</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://noyb.eu/en/101-complaints-eu-us-transfers-filed\">https://noyb.eu/en/101-complaints-eu-us-transfers-filed</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s \'Non of Your Buisness\' NOYB has filed a complaint against 101 companies</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><strong>A quick analysis of the HTML source code of major EU webpages shows that many companies still use Google Analytics or Facebook Connect one month after a major judgment by the Court of Justice of the European Union (CJEU) - despite both companies clearly falling under US surveillance laws, such as FISA 702. Neither Facebook nor Google seem to have a legal basis for the data transfers. Google still claims to rely on the “Privacy Shield” a month after it was invalidated, while Facebook continues to use the \"SCCs\", despite the Court finding that US surveillance laws violate the essence of EU fundamental rights.</strong></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:list -->\n<ul><li><strong><a href=\"https://noyb.eu/en/eu-us-transfers-complaint-overview\">Link to the list of all 101&nbsp;<em>noyb</em>&nbsp;complaints and companies</a></strong></li><li><strong><a href=\"https://support.google.com/analytics/answer/6004245?hl=en&amp;ref_topic=2919631\">Google’s information claiming to \"move\" to Standard Contractual Clauses</a></strong></li><li><strong><a href=\"https://www.facebook.com/help/566994660333381?ref=dp\">Facebook’s claim to still use Standard Contractual Clauses</a></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Nataliia Bielova PhD, a researcher at INRIA, who has done an extensive research on cookies with her colleagues, said :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>CARREFOUR is also fined for Google Analytics cookies being used together with Google Ads. In our recent work, we\'ve shown that on 38% of websites Google Analytics synchronizes cookies with Google Ads (<a rel=\"noreferrer noopener\" target=\"_blank\" href=\"http://doubleclick.net/\">http://doubleclick.net</a>). Happy to see this sanction that brings this practice to the eyes of the public! Link to our academic peer-reviewed paper: <a rel=\"noreferrer noopener\" target=\"_blank\" href=\"https://hal.inria.fr/hal-01943496\">https://hal.inria.fr/hal-01943496</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Together with her colleagues at Inria, they have designed a Massive Open Online Course (MOOC) entitled “<em><a href=\"https://www.fun-mooc.fr/courses/course-v1:inria+41015+session04/about\" target=\"_blank\" rel=\"noreferrer noopener\">Protection de la vie privée dans le monde numérique</a></em>”. From 2018 till May 2020, the MOOC has been open for 4 sessions and attracted in total over 43,000 French-speaking participants from all over the world. Link to the latest session: </p>\n<!-- /wp:paragraph -->','French DPA CNIL Fined Carrefour for Cookies','The French DPA CNIL finally enforced the law, Carrefour supermarket and Carrefour Bank fined for 2 250 000 euros and 800 000 euros.','inherit','closed','closed','','1726-revision-v1','','','2020-11-27 13:26:41','2020-11-27 13:26:41','',1726,'https://www.datarainbow.eu/1726-revision-v1/',0,'revision','',0),(2039,1,'2021-04-17 14:06:57','2021-04-17 14:06:57','<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ....</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Who created DATARAINBOW ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, was initially trained in French Law before settling in the UK. She has a Maitrise of Private Law from the prestigious <a href=\"https://www.u-paris2.fr/fr\" target=\"_blank\" rel=\"noreferrer noopener\">University of Pantheon Assas, Paris 2</a>, before her more recent specialisation in Computer and Communication Law with a Masters at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN’s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group <a class=\"\" href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a> with <a class=\"\" href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTACT : Data@datarainbow.eu</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><br></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018 :&nbsp;Tara Taubman-Bassirian</a></strong><br></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>Privacy Hero of the Year poll, and the results are in...&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of <a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">Rebecca Herold\'s radio show</a>,&nbsp;<a href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\">Data Security and Privacy with The Privacy Professor</a>. I\'ve extended invitations to each today, so stay tuned for more details.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For keeping up with news on IT security, Privacy and Online Security, join our Facebook Group <a href=\"https://www.facebook.com/groups/167255910003191/?multi_permalinks=2203761959685899&amp;notif_id=1548347410584622&amp;notif_t=feedback_reaction_generic\">Fly A Kite</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":881} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Screenshot-2020-05-03-at-18.32.54.png\" alt=\"\" class=\"wp-image-881\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":880} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Screenshot-2020-05-03-at-18.29.42.png\" alt=\"\" class=\"wp-image-880\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":878} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Champion-Badge.png\" alt=\"\" class=\"wp-image-878\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Seen on Twitter</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":252} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-31-at-11.22.40.png\" alt=\"\" class=\"wp-image-252\"/></figure>\n<!-- /wp:image -->','DATARAINBOW','','inherit','closed','closed','','84-revision-v1','','','2021-04-17 14:06:57','2021-04-17 14:06:57','',84,'https://www.datarainbow.eu/?p=2039',0,'revision','',0),(2025,1,'2021-04-17 13:34:46','2021-04-17 13:34:46','<!-- wp:paragraph -->\n<p>The Data Diva </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In January 2021, I had the honour of being <a rel=\"noreferrer noopener\" href=\"https://www.debbiereynoldsconsulting.com/podcast/e15-tara-taubman-bassirian\" target=\"_blank\">interviewed by Debbie Reynolds</a>, chatting about the GDPR, its slow enforcement by Data Protection Authorities. The position of the French CNIL, the UK ICO, the Irish DPC, first stop shop for US mega corporations, such as Google and Facebook. The future of international data flow since the invalidation of Privacy Shield by the ECJ Schrems-II, the requirement of ensuring the same level of data protection when personal data is transferred outside the EU/EEA and the case of the UK adequacy after Brexit. Securing data exchange, encryption and the all time good advice : data minimisation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2022,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/04/Capture-décran-2021-04-17-à-14.21.55-1024x588.png\" alt=\"\" class=\"wp-image-2022\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Transcript of the interview :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>01:03</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hello, thank you for having me on your show. It\'s nice to see you and chat with you. We are both very active, I think, in educating and talking and discussing the subject of data protection. I\'ve been involved for more than a decade on this subject since the French corporate lawyer and I moved to Germany and the UK. And it\'s here that I specialized in privacy and data protection while I did my LLM. And originally, I was expecting to do char diamond safety until during my LLM. I actually realized that governments were sometimes using chart protection to quiet free speech. And so I get involved with the reform of the Data Protection Directive, which became then the regulation GDPR. I guess your auditor would know the difference between a directive and the GDPR regulation, which is a regulation that applies directly to all EU nations. The legislation was quite an ambitious program. It could not be perfect because, within the 28 member states, there are some civil law backgrounds, and the others are common law like the UK. So there has been tension between the different legislations. I still believe that it\'s the best or not the best. I shouldn\'t say that it still needs to be more perfect, but the big fine makes everybody wake up. Everybody started to think, well, GDPR data protection is actually important. I\'m trying to explain that we gain a lot with the digital world. I remember as a lawyer, when we used to, secretaries used to type everything your ears would dictate, and there was a secretary typing everything. And if something was wrong, they had to start all over again. When needed, Internet has made lawyers work much, much easier. Everyone\'s work is much easier automatic. We do search on Google, which brings up so many results in just one click and all for free. Well, free, maybe not. But we don\'t pay straight away. Sonia GDPR, with fines, wakes up. Charities, in my view, have been a bit too slow to enforce. But here comes the COVID and confinement, which also changed a lot of the situation working from home is different. I\'ve been looking and following the cases of cyberattacks, which I guess Debbie, you\'ve seen the same, they\'re just going high up the ceiling. What working from home is less security, obviously. So it needs this training. I\'m not sure every employer gets the training they needed. We had in the UK a very interesting case, the Morrison case, which went up to the High Court of vicarious liability of an employer here for his employee. And in the case of the supermarket, Morrison was he hadn\'t done anything wrong. Apart from having an employment fight with an employee. They sacked the employee. It happened employee was working in the accounting department. He was asked to forward the whole HR data to the outside accountant, would it? Meanwhile, he copied it on a USB stick. And when he gets sacked, one of the whole HR data was published online. That caused a major issue and a problem for all the employees who had the data exposed. There was a class action. The Court of Appeal said, basically, that the employee Morrison\'s should have had cyber insurance to cover these sorts of damages. In the High Courts, Morrison had a very good lawyer, not that the class action lawyer was not as good. But Morrison\'s lawyer did a very good job of convincing the High Court that they hadn\'t done anything wrong. And the ex-employee was a data controller, so he was only responsible. It can sound. I\'m guessing lots of employees, employers, or employers listening would think, well, why would Morrison be liable. They hadn\'t done anything wrong, then it\'s the only liability of the ex-employer. He saw how the other employee could get any damage compensation for the data. So that\'s an issue. And then there was this case that I barely mentioned. I saw it today on LinkedIn. I don\'t have much detail about it. But it\'s a German court that said not every data breach would give compensation. In the UK, we have the Lloyd case class action against Google when they had the green light to go forward. And they say the loss of control and the psychological distress was compensation, we still have to wait and see where it all goes. But the problem with a data breach is the consequences are not immediate. The data is stolen, they are sold on black markets, or they are just thrown away everywhere. And sometimes, many years later, someone whose ID is misused or financial details misused.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>07:32</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yeah, I think the problem, I mean, that we just can\'t get around is that a lot of times, the harm happens before the law. And if the enforcement doesn\'t happen soon enough, or the remediation or, you know, happen, you know, once the milk is spilled out of the carton, you know, it\'s almost impossible to get that back. So that\'s why it\'s really important that that data be protected the best way possible that individuals have more control over their data and that it not be spilled milk. I think it\'s really interesting that you\'re, you know, sleeping in a lawyer France you lived in Germany and now live in the UK. So you have, you know, the full experience, right, from different countries and, and different ways that they look at things. I love your thoughts, you know, at me being an American and you being in Europe, as we have so many people around the world working in Data Privacy, I hear sometimes people say there\'s like a difference between the way American privacy folks think about privacy as opposed to European people. I want to know, have you had any thoughts about that?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>08:48</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yes, privacy is very much connected to the cultural understanding of how we perceive our intimacy. I think Americans, for example, don\'t like people touching you. Why more Mediterraneans are all touchy, and it\'s different. We had a discussion on Facebook not long ago about what\'s the difference between privacy and data protection. For me, privacy is a fundamental human right. It\'s more of a philosophical concept. When data protection is more the data that is collected that needs to be protected, and the way that we are allowed to collect or not to collect right. And someone posted a picture of a toilet with glass walls. Some people think, well, previously is secrecy, and I have nothing to hide. So why would they care about privacy? And I like to tell them whenever you go to the loo you close the door. It\'s just somewhere you would like to be in peace. However, going back to you three, actually, France was well known on web site. Novelties used to do these things in public. And they will show it as a way of saying, Well, I\'m healthy, there was no barrier. So no problem going to the loo and showing everything you do in a loo to everyone. So things have changed. The understanding and the way we perceive privacy change. And it\'s also changed from one culture to another culture. I\'ve had people in Sweden telling me that we go naked in a sauna, and we don\'t care about privacy. And then I reply, what do you choose to go to the sauna, you choose who you\'re sitting with. And if you\'re not happy, it\'s not a huge sign out there. A certain number of people, you don\'t like them, you just go away, and you go to another sauna. Your privacy online is different. You have absolutely no control over what\'s being done with your data. And this is where previously, you get very close to data protection. A few years ago, I had a chat with an IT person about threats and detection. And whatever chatting, I Googled her, and I find so much private stuff about her online. And I just sent her a link. And she felt like you\'re invading my privacy. I said, I just Googled your name, put speech mark, right, and see everything that comes out about you. Yeah, and this even for someone who is in IT, it was four years ago. I\'m hoping today people understand that a bit more. But Google does the job of a puzzle, different pieces puzzle in one click put next to each other that shows a whole picture that you have no control over, right. It could be your own boss, but it could be someone else destroy your reputation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>10:56</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Absolutely. Right, exactly. I think for people who aren\'t online or don\'t have a very good presence or good full presence online, it is, unfortunately, an opportunity for people to fill it in with bad things or things that aren\'t true. So it\'s very important, I think, for people to really step out and establish their identity. So people know, you know, this, Tara, this is very, you know, so they can differentiate the truth from the facts from fiction. Basically, I would love to get your thoughts on the Schrems II decision and the invalidation of Privacy Shield between the EU and the US. What are your thoughts about it?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>12:43</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s a case been ongoing for a few years. First, the previous adequacy decision, that was the Safe Harbor agreement, was invalidated by the European Court of Justice. Nothing was changed. So Maximillian Schrems, who is behind this case which found that none of your business NGOs continued his battle. In July this summer, the European Court of Justice again said that despite the European Commission giving the green light after the second year of reviewing the Privacy Shield, it should be invalidated. It\'s not because the US stars intelligentsia that European don\'t do. Right. Every country today has intelligence. And they try to grab information. The problem with the US as the European Court of Justice, so is that it is there is no sufficient judicial review. Right. There is a sort of discrimination against you EU citizens who don\'t have a right to redress or so until things change, which is the FISA section 702, the executive order 12 333 and other intelligence regulation Tridacna things that allow the US to intercept data the normal transfer of data from the EU to the US. In principles, standard contractual clauses are still valid. So all the binding corporate rules or a lot of people jumped up and said, oh, you\'re very let\'s continue as we did before. However, the high court saying that additional measures should be taken to make sure that the data that isn\'t exported from the EU and imported to the US is kept safe and not access is given to the US. Government and the EU citizen gotta write. Personally, I don\'t see many ways that this could be done. Right, we can go closer. We can data can be encrypted, the encryption key should remain within the EU clauses could be added to the standard contractual clauses that are being modernized by the Commission. That\'s right. It\'s still not there. Some data protection authorities, like the German when ones, have been very strict, saying the normal transfer of data from the EU to the US. French, we are thinking about it in English. Early, be careful what you\'re doing, what we can stop the trade. Basically, I know, I\'m not very exactly repeating what they said. But that\'s what comes out. But England, UK is concentrating on Brexit. Yeah. Is it suffering itself? Will they get the adequacy decision or not? But that\'s another issue. But what\'s interesting with the Schrems II decision is basically saying we Europe want strong protection to data. And someone like if this was a kind of RFID, sorry, that follows the data wherever it goes. The country of import should be the same level of protection today to this data, which is quite strong. Yes. But hopefully, it\'s a good message that we pass. We had an interesting case in France, if I may mention that. Datahub is a cloud that stores all medical, French medical data, especially since the COVID. Neil said to the highest administrative costs in France to consider that his data should not be put in the hands of Microsoft. So that is confirmation that what we call what the ECG sees, or the transfer of data, is not the physical transfer of data from the EU to the US. Because all these American US laws apply to US companies, even though if their servers are based in Europe, still, US government can intercept the data, right?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>17:46</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>17:47</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is why the German data protection authorities\' position is not pure data, check where it goes. And if you\'re using US companies, rethink it. That\'s a major step.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>18:04</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And I\'ve been watching this play out for over 20 years. So you know, when Safe Harbor was put in place, and they wills invalidated Privacy Shield, I don\'t know what a third try to see would be between the US and the EU. Obviously, there\'s a lot of trade between countries. So there\'s obviously probably more of an economic imperative than the privacy one. But I think we just have fundamental thoughts or differences about how we think about privacy. So in my view, the US is like commerce over privacy. And the EU is like, you know, we want to do commerce, but you have to respect that sort of an impasse, I feel. And then the redress issue is a very serious one because, in the Privacy Shield, they tried to have a sort of a method of redress within the Department of Commerce, I guess. But the big issue, in my view, well two issues in my view. One is that the Department of Commerce only covers certain types. So it\'s not almost all industries, as opposed to the GDPR. And then also the redress. Because the Department of Commerce, again, is limited in the companies that they oversee, means that you know, like, for example, like let\'s say, for instance, I have a problem with a US company, while I\'m here in the US, I don\'t have that level of redress that the Europeans are asking for. So there really has to be a total rethink of how that mechanism could be created in a way that will make it powerful. I think, but then I think that will cause a lot of people in the US to say, well, why can\'t I have that? Right? We don\'t have that right now in terms of the way that ways you guys are thinking about redress. I would love to ask. You had written something a while back about consent fatigue. And I think this is a big issue. So where a lot of people are, you know, you\'re signing up for these companies with different services. And you\'re constantly getting bombarded with cookie notices and different things like that. And some people just, they just click through. So give me your thoughts about consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>20:43</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>one of the cookies is ruled by the policy directive, which is under revision. It\'s been ongoing. However, the consent to be the same level and standard of the GDPR. We are now seeing more and more websites that cookie banners are asking consent before dropping the cookies. Actually, cookies are also under the Schrems II are considered the transfer of data to the US for the website that Google Analytics or Facebook content or other cookies that send the data to the US. It\'s an issue. We see the constant banners. I\'ve noticed with a few people who did research that sometimes some websites, although you did not consent on cookies, or before even you would say yes or no cookies were dropped. I saw several law firms\' websites was that one major Law Society website had cookies. And when we speak about cookies, it\'s a generic term. But it also includes any kind of tracing, some JavaScript pixels, and they all collect data. When you have sensitive clients, if I may call it a law firm, it\'s an issue. And it allows third parties to know who came to your website, what they did, and whichever website they also visited. And it could be that someone else who uses the same device could actually know where you\'ve been and what you\'ve been doing. So when Law Society encourages victims of domestic abuse to visit their website, and on which they are cookies, it\'s a serious issue, depending on the kind of visitors and customers are happy to have to be very vigilant with what is connected. People are today very much annoyed because every website you want to visit, you first have to decide if you want to go queue or not. It is a pain. But I\'m hoping eventually they will stop having any cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>23:18</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yeah, well, so a lot of tech companies because a lot of the laws about cookies have been eliminating cookies. They\'re out there collecting data and other ways. But the law hasn\'t caught up with that yet. So I think by the time that these cookie cases get settled, very few people actually use them, and they will be on to whatever the next evolution in technology may be. I would love to talk with you about the right to be forgotten. This is something that you talk about you\'ve written about a bit for companies is the most difficult thing in the GDPR for them to acquiesce to because the right to be forgotten means that they have to figure out what they have in terms of data about individuals and how they, remove it from an organization and how they communicate that to the individual data subject. What are your thoughts about that?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>24:18</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the question of knowing which data is hold and verities? I think this is something very important. And GDPR is based on the accountability principle. It\'s asking the organization to sit and think which data they hold during that mapping, know where it goes, who access it, for how long they return it. These are the seven principles of data protection on GDPR. My favorite principle is data minimization. If you don\'t hold the data, you don\'t have the burden of the data. If you don\'t need it, delete it.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>24:56</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I agree. I agree with you on that.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>24:58</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s as simple as that. It\'s actually good for you. You don\'t pay for data storage for anything. Another principle is data accuracy. What\'s the point of holding data that is out of date? Your market is all wrong, your everything is wrong because the data is obsolete. So deleted, you don\'t need it. I usually like to advise three-level storage of data. First level active data with more access, and also internet access seven-level, you have to keep the data because you might need it for refund reason, because it also, you know, tax reason, employment reason, you have to keep the data for a certain number of years, you have to sit and decide your data retention periods, depending on the level of data and what you want. But limit data to this second-level storage. Third Level storage would be archiving, no internet access, very limited access to any third parties. Because sometimes, for a historical reason, you need the data, right? I\'ve been asked, well, what happened, we had all these historical data of people who became famous or were famous and visited the hotel or a museum, we would want to keep that forever. Well, you can keep it just don\'t put it online. Keep it on the external hard drive that is not connected to the Internet. You\'re allowed to do that. It\'s not a problem. What people have to understand is an Internet connection. Globalization means easy access to data, easy misuse of data. But if the data is safe, encrypted on your hard drive, and not connected to the Internet, it\'s safe. You can keep it as long as you want. There\'s no problem with that. Right? That\'s what is good for the GDPR. It\'s caused people organization to sit and think, what they\'ve got, how much they are holding, who is accessing it, how they keep it secure. It\'s all common sense.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>27:03</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yeah. I think though, with the Internet age, because I don\'t know, like, I guess to use, for example, like Google, when Google first started, or Microsoft, or started giving people free email addresses, you know, the size of your email box was relatively small, over the years, they made the size of the email boxes bigger. So, as a result, people who just click more stuff may delete less stuff, they have more room. So in some ways, I feel like the Internet age has made people digital packrats, where they keep so much stuff, you know because you know, instead of like, let\'s say, before you have books in the library, now you can have things on a hard drive, and people are less apt to delete things. Also, you know, I\'ve worked a lot with corporations and lawyers. Sometimes, people want to keep data just because they think they may need it, even though they don\'t have a real reason to keep it. And that just piles up over a year over a year. And to me, those are some of you know, especially if they\'re connected to the Internet, a lot of times, you know, they have all data may be on all servers, maybe on something that\'s more vulnerable than maybe their actual data and hackers like that, that\'s just the gateway for them to get into your organization. And it also creates more risk for the company, because now you have people accessing or you have a breach, or someone\'s looking at some old stuff, you don\'t even know what\'s there. So now you have to go through and figure out, you know, whose data is on here. So it\'s just a mess. I think data retention is a big problem for a while where people just keep getting way too much stuff.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>28:54</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Indeed, I call it a Google hype. One school started to collect everything. And it was known that Google is saving all data, and storing and collecting became much, much cheaper. So people don\'t let\'s collect and then we will see what we do with it. But that causes issues that there are serious security issues with over-collecting data. Data breach cause harm, unfortunately. And cases like Morrison\'s will happen again. Yeah. Employees are not devoted to the employer as they used to be there is a much bigger turnover. Young people just change jobs. If they\'re not happy, they will want to take advantage, and it\'s so easy. Get the USB and put it online. Yeah. So yeah, data minimization is very important. And the right to be forgotten. Before the GDPR, there was a right to be forgotten by the jurisprudence of The European Court of Justice, and that was more delinking than actually deleting. Sometimes you do need the Internet and the whole world, forget about something silly that you did one day in your life. Because employers search online, everyone\'s searching online. Young people today are on with their baby pictures online, and even the embryo is already online before they were born. Yeah, it was a very interesting interview of ex-Google CEO. And he suggested that young people should be able to change their identity at the age of 21. Because they\'ve already got so much behind them of silly things, they\'ve done. Yeah, that\'s not feasible.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>30:56</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>That\'s true.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>30:57</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;We have to give a chance for people to redo their life. Everyone doesn\'t mistake. Yeah, the problem with the Internet is you just need someone with a camera next to you to make it memorable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>31:12</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Exactly.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>31:13</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve had lots of external debates this week on social media about France. Who wants to pass a law that forbids anyone to record police officers during work and post it on social media? In my interpretation of GDPR already today, we should not be able to post anyone\'s pictures online without their consent. And this is very important. I really ask everyone to reconsider before posting online, ask the person if they\'re okay. They are people with special circumstances. There are people who are in the middle of a divorce. They don\'t want to tell what they are and what they\'re doing. Right. They are protected witnesses. They don\'t want people to know where they are, and their faces would identify them. Facial recognition software for everyone can use it can identify and worse than identifying, it can make fake identification.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>32:13</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Absolutely.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>32:15</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So you might be identified as a criminal, or you are not at all a criminal, but go and try to prove it wasn\'t you, everyone is just attacking you see a police officer video that is posted on social media. It would be one extract of something that happened. You don\'t know what the start was, and you don\'t know how it finished? Right? They are police officers. I\'m not saying what I am not defending at all police violence. I\'m just saying that the judge has studied for that institution for judging. And it\'s not the work of social media to judge the actions of a police officer. They can post by blowing the faces. Yeah. But they should never be anything posted with identifying pictures without asking the person. That\'s very important. Yeah. People have to start to understand that it has consequences. Absolutely. And I thought it was the other way around. discussion with the police officer in my area, and giving the name of a young offender. 18 year old who is suspected of having killed someone with a knife.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>33:27</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It might be true.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>33:29</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>But I want the judge to tell me what he did. And what he did was a crime. Yeah, it\'s not the social Smith\'s at work. And once the local police put that on Facebook, it means that the whole family is ashamed. The siblings, I\'m ashamed. They go to school the next day, and they say, your brother killed someone. We don\'t want to talk to you anymore. You got the COVID they say, oh, I don\'t talk to you because you\'ve got fever.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>33:51</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And they were able to talk to any rain. Exactly, exactly.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>33:58</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is our things that change our relationship because of social media. We get so many good things from it. Yeah. You know, I\'m a great believer in social media. I promote elearning. I have a charity that promotes learning. I have nothing against the Internet and anything digital. I love technology. I\'m a gadget lover. But we have to accept that in the area of social media and Internet interconnection relationship has changed. We are not just broadcasting in our small network when we broadcast, we broadcast it for the whole world. Right, broadcast it as the highest bid ever. And we broadcast it forever.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>34:44</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Exactly.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>34:44</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So it\'s a big catalyst of the Internet. It is changing all scales.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>34:50</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Absolutely.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>34:51</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have been, on the other hand, be more careful with what we\'re doing and what we\'re saying. And it\'s so easy to just push a button. Without</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>35:00</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Absolutely, absolutely. Africa, right, I think we need to, you know, I\'m like you. I love technology. I\'m really excited, you know, when the Internet came into existence, because I grew up without the Internet, obviously. But I\'m a gadget lover as well. But I think we also have to be cognizant of the harms that can happen. So you can\'t dissolve the so, so excited about the innovation without understanding that there can be harm. So we have to really be able to educate around that. The GDPR in Britain, as we know, very influential around the world. So we see laws come out that are taking bits and pieces of the GDPR and incorporating them into their law. So I think there\'s going to be more regulation around Data Privacy and not less in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>35:51</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We know even got in China a similar to GDPR legislation that is coming up so even China.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>35:59</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yeah, even trying to Iraq. Right, exactly. Was that a pleasure to have you on so, and thank you again, thanks so much.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>36:08</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>My great pleasure. Thank you, Debbie. Bye<a href=\"https://www.debbiereynoldsconsulting.com/podcast/tag/Podcast\">Podcast</a><a href=\"https://www.debbiereynoldsconsulting.com/podcast?author=5d75cb2fcb85fd7521d47f60\">Debbie Reynolds</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.debbiereynoldsconsulting.com/\">The Data Diva</a> </p>\n<!-- /wp:paragraph -->','Interview with Debbie Reynolds','','inherit','closed','closed','','2021-revision-v1','','','2021-04-17 13:34:46','2021-04-17 13:34:46','',2021,'https://www.datarainbow.eu/?p=2025',0,'revision','',0),(2026,1,'2021-04-17 13:43:22','2021-04-17 13:43:22','<!-- wp:heading {\"level\":3} -->\n<h3>The modern Cassandra Complex - By <a href=\"https://www.linkedin.com/in/daniel-aldridge-2a93922b/\">Daniel Aldridge</a> Senior Policy &amp; Programmes Manager at BCS, The Chartered Institute for IT</h3>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>Published on March 12, 2021</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>I\'m never one to shy away from a niche topic, especially one at the vanguard of politics and technology, so I was happy to speak at the Holyrood Connect event last week on cyber security and data protection post Brexit. <a rel=\"noreferrer noopener\" href=\"https://cybersecurityni.holyrood.com/agenda\" target=\"_blank\">Public Sector Cyber Security Northern Ireland</a> Especially as increasingly I feel that we in the IT and digital communities are are suffering from a modern Cassandra complex where we know there are existential threats that need action, but its so often being put in the too-difficult box.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the panel, I was joined by fellow BCS member, lawyer and Data Protection Consultant, Tara Taubman-Bassirian of Data Rainbow; Joseph Byrne, Privacy Solutions Engineer at OneTrust and the event chair, David Lee, formerly of The Scotsman. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I spent 6 years working in Scottish public policy and campaigns and I’m no stranger to Holyrood Connect as a force for good in addressing the critical digital issues of our times and its place as a strong voice for devolved administrations. Also, the Chartered Institute has sizeable active membership in Scotland, Northern Ireland and Wales and it’s been personal commitment of mine to drive greater engagement and collaboration across the UK’s rich tech landscape so the future of IT and digital technologies</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Chartered Institute is primarily a network of its people and over the past 12 months it’s been amazing how our members and the wider IT and digital communities have continued to make IT good for society whilst we all face huge and unprecedented threats.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>IT workers really are the unsung heroes of the pandemic.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It’s important to note that in the context of rapid service and product delivery changes etc; organisations trying to keep people in jobs, diverting resources and skills on unprecedented scale, that we don’t have things like Schrems2, changes to international data transfer regulations and standard contractual clauses entirely front and centre of our organisations risk register!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>But the problem for many of us working in this area is that so many of our organisations are caught up in this perfect storm without even the awareness they need legal advice and expertise, let alone having it in house.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A big bug bear for me and my colleagues is the absence of CIOs or equivalent at the highest levels of organisational decision making and risk management.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hear often about an encouraging rise in the amount of boards with a dedicated person with responsibility for cyber and data security and protection; but in many situations, it does feel very much like when boards were encouraged to appoint a diversity champion, the person was often not appointed based on real knowledge or expertise and were asked to ‘take on’ the brief. In both cases, the board member often relies almost exclusively on the briefing of the IT team with much lost in translation and debate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When we look at how many Boards include a CIO or equivalent, the picture is problematic, only 10 -20% of NHS organisations for example have a CIO or equivalent at the highest level of decision making and risk management<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn1\" target=\"_blank\" rel=\"noreferrer noopener\">[1]</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, the demand is there though for better, tech led decision making!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The past decade has seen a cottage industry grow up around supporting technologists to speak effectively with boards and decision makers; this is why we are so keen to drive professional standards and professional development across the IT world to drive up this capacity to support innovation and mitigate risk.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A new data regime ushered in by the UK’s Data Strategy will reiterate the need for effective data maintenance and governance while removing obstacles and impediments to innovation, an opportunity to basically clean up our digital processes and make them fit for a more dynamic digital infrastructure. Indeed the new information commissioner’s job specification<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn2\" target=\"_blank\" rel=\"noreferrer noopener\">[2]</a>&nbsp;requires a drive to do just that.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This aside, despite the sabre rattling from both sides over the past few months, most of the signs indicate that the UK and EU want to cooperate on a number of key areas such as enforcement, cyber security, copyright infringement, IP, tech sovereignty and certain areas of competition. This may well mean that the ICO will turn its attention more meaningfully to scrutinising data governance procedures, while also calling out over-burdensome procedures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite no clear public desire to needlessly interrupt trade, it’s unclear how long an adequacy agreement, if finally ratified by EU states, can be sustainable. As a third country, the UK will be susceptible to judicial review similar to Schrems 2 and outside the EU, we’ll be held to a higher standard.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To be competitive the UK needs to show it is dynamic and has a commercial edge over the EU in certain areas, data will be one of those areas; the political and legal challenges are however huge!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Make no mistake, privacy campaigners have the UK in their sights and will seek to make this the next battleground, so depending on where and how we plan to flex our independence on things like human rights legislation etc, there will be a need for preparatory action.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So what can we do…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>listen to and champion your IT and data protection people to help get our houses in order</li><li>Continue to drive up professional standards and champion the mitigation of risk across the economy and civil society</li><li>Raise the issues you care about with your elected officials, I don\'t think there is enough literacy at national, devolved or local government level for us to reap the benefits, we should be aiming to thrive, not just survive</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>We’re all learning ‘on the job’ on this so let’s continue to have these conversations, mainstream the issues and make sure we’re ahead of the game.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref1\" target=\"_blank\">[1]</a>&nbsp;<a href=\"https://www.digitalhealth.net/2020/01/networks-issues-open-letter-to-get-ccios-and-cios-on-nhs-boards/\" target=\"_blank\" rel=\"noreferrer noopener\">Networks issues open letter to get CCIOs and CIOs on NHS boards</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref2\" target=\"_blank\">[2]</a>&nbsp;<a rel=\"noreferrer noopener\" href=\"https://publicappointments.cabinetoffice.gov.uk/appointment/information-commissioner-2/\" target=\"_blank\">HM Government Public Appointments</a></p>\n<!-- /wp:paragraph -->','Beyond Brexit: Cyber Security and Data Protection','In the context of rapid service and product delivery changes, organisations trying to keep people in jobs, diverting resources and skills on unprecedented scale, that we don’t have things like Schrems2, changes to international data transfer regulations and standard contractual clauses entirely front and centre of our organisations risk register!','publish','open','open','','beyond-brexit-cyber-security-and-data-protection-the-modern-cassandra-complex','','','2022-08-22 16:37:07','2022-08-22 16:37:07','',0,'https://www.datarainbow.eu/?p=2026',0,'post','',0),(2027,1,'2021-04-17 13:41:21','2021-04-17 13:41:21','','Capture d’écran 2021-04-17 à 14.38.51','','inherit','open','closed','','capture-decran-2021-04-17-a-14-38-51','','','2021-04-17 13:41:21','2021-04-17 13:41:21','',2026,'https://www.datarainbow.eu/wp-content/uploads/2021/04/Capture-décran-2021-04-17-à-14.38.51.png',0,'attachment','image/png',0),(2028,1,'2021-04-17 13:43:22','2021-04-17 13:43:22','<!-- wp:heading {\"level\":3} -->\n<h3>By <a href=\"https://www.linkedin.com/in/daniel-aldridge-2a93922b/\">Daniel Aldridge</a>Senior Policy &amp; Programmes Manager at BCS, The Chartered Institute for IT</h3>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>Published on March 12, 2021</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>I\'m never one to shy away from a niche topic, especially one at the vanguard of politics and technology, so I was happy to speak at the Holyrood Connect event last week on cyber security and data protection post Brexit. Especially as increasingly I feel that we in the IT and digital communities are are suffering from a modern Cassandra complex where we know there are existential threats that need action, but its so often being put in the too-difficult box.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the panel, I was joined by fellow BCS member, lawyer and Data Protection Consultant, Tara Taubman-Bassirian of Data Rainbow; Joseph Byrne, Privacy Solutions Engineer at OneTrust and the event chair, David Lee, formerly of The Scotsman.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I spent 6 years working in Scottish public policy and campaigns and I’m no stranger to Holyrood Connect as a force for good in addressing the critical digital issues of our times and its place as a strong voice for devolved administrations. Also, the Chartered Institute has sizeable active membership in Scotland, Northern Ireland and Wales and it’s been personal commitment of mine to drive greater engagement and collaboration across the UK’s rich tech landscape so the future of IT and digital technologies</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Chartered Institute is primarily a network of its people and over the past 12 months it’s been amazing how our members and the wider IT and digital communities have continued to make IT good for society whilst we all face huge and unprecedented threats.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>IT workers really are the unsung heroes of the pandemic.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It’s important to note that in the context of rapid service and product delivery changes etc; organisations trying to keep people in jobs, diverting resources and skills on unprecedented scale, that we don’t have things like Schrems2, changes to international data transfer regulations and standard contractual clauses entirely front and centre of our organisations risk register!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>But the problem for many of us working in this area is that so many of our organisations are caught up in this perfect storm without even the awareness they need legal advice and expertise, let alone having it in house.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A big bug bear for me and my colleagues is the absence of CIOs or equivalent at the highest levels of organisational decision making and risk management.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hear often about an encouraging rise in the amount of boards with a dedicated person with responsibility for cyber and data security and protection; but in many situations, it does feel very much like when boards were encouraged to appoint a diversity champion, the person was often not appointed based on real knowledge or expertise and were asked to ‘take on’ the brief. In both cases, the board member often relies almost exclusively on the briefing of the IT team with much lost in translation and debate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When we look at how many Boards include a CIO or equivalent, the picture is problematic, only 10 -20% of NHS organisations for example have a CIO or equivalent at the highest level of decision making and risk management<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn1\" target=\"_blank\" rel=\"noreferrer noopener\">[1]</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, the demand is there though for better, tech led decision making!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The past decade has seen a cottage industry grow up around supporting technologists to speak effectively with boards and decision makers; this is why we are so keen to drive professional standards and professional development across the IT world to drive up this capacity to support innovation and mitigate risk.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A new data regime ushered in by the UK’s Data Strategy will reiterate the need for effective data maintenance and governance while removing obstacles and impediments to innovation, an opportunity to basically clean up our digital processes and make them fit for a more dynamic digital infrastructure. Indeed the new information commissioner’s job specification<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn2\" target=\"_blank\" rel=\"noreferrer noopener\">[2]</a>&nbsp;requires a drive to do just that.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This aside, despite the sabre rattling from both sides over the past few months, most of the signs indicate that the UK and EU want to cooperate on a number of key areas such as enforcement, cyber security, copyright infringement, IP, tech sovereignty and certain areas of competition. This may well mean that the ICO will turn its attention more meaningfully to scrutinising data governance procedures, while also calling out over-burdensome procedures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite no clear public desire to needlessly interrupt trade, it’s unclear how long an adequacy agreement, if finally ratified by EU states, can be sustainable. As a third country, the UK will be susceptible to judicial review similar to Schrems 2 and outside the EU, we’ll be held to a higher standard.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To be competitive the UK needs to show it is dynamic and has a commercial edge over the EU in certain areas, data will be one of those areas; the political and legal challenges are however huge!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Make no mistake, privacy campaigners have the UK in their sights and will seek to make this the next battleground, so depending on where and how we plan to flex our independence on things like human rights legislation etc, there will be a need for preparatory action.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So what can we do…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>listen to and champion your IT and data protection people to help get our houses in order</li><li>Continue to drive up professional standards and champion the mitigation of risk across the economy and civil society</li><li>Raise the issues you care about with your elected officials, I don\'t think there is enough literacy at national, devolved or local government level for us to reap the benefits, we should be aiming to thrive, not just survive</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>We’re all learning ‘on the job’ on this so let’s continue to have these conversations, mainstream the issues and make sure we’re ahead of the game.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref1\" target=\"_blank\" rel=\"noreferrer noopener\">[1]</a>&nbsp;<a href=\"https://www.digitalhealth.net/2020/01/networks-issues-open-letter-to-get-ccios-and-cios-on-nhs-boards/\" target=\"_blank\" rel=\"noreferrer noopener\">https://www.digitalhealth.net/2020/01/networks-issues-open-letter-to-get-ccios-and-cios-on-nhs-boards/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref2\" target=\"_blank\" rel=\"noreferrer noopener\">[2]</a>&nbsp;<a href=\"https://publicappointments.cabinetoffice.gov.uk/appointment/information-commissioner-2/\" target=\"_blank\" rel=\"noreferrer noopener\">https://publicappointments.cabinetoffice.gov.uk/appointment/information-commissioner-2/</a></p>\n<!-- /wp:paragraph -->','Beyond Brexit: Cyber Security and Data Protection - the modern Cassandra Complex','','inherit','closed','closed','','2026-revision-v1','','','2021-04-17 13:43:22','2021-04-17 13:43:22','',2026,'https://www.datarainbow.eu/?p=2028',0,'revision','',0),(2030,1,'2022-10-07 09:14:26','2021-04-17 13:47:38','','Beyond Brexit: Cyber Security and Data Protection – the modern Cassandra Complex','','publish','closed','closed','','beyond-brexit-cyber-security-and-data-protection-the-modern-cassandra-complex','','','2022-10-07 09:14:26','2022-10-07 09:14:26','',0,'https://www.datarainbow.eu/?p=2030',6,'nav_menu_item','',0),(2033,1,'2021-04-17 13:52:36','2021-04-17 13:52:36','<!-- wp:heading {\"level\":3} -->\n<h3>By <a href=\"https://www.linkedin.com/in/daniel-aldridge-2a93922b/\">Daniel Aldridge</a>Senior Policy &amp; Programmes Manager at BCS, The Chartered Institute for IT</h3>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>Published on March 12, 2021</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>I\'m never one to shy away from a niche topic, especially one at the vanguard of politics and technology, so I was happy to speak at the Holyrood Connect event last week on cyber security and data protection post Brexit. <a rel=\"noreferrer noopener\" href=\"https://cybersecurityni.holyrood.com/agenda\" target=\"_blank\">Public Sector Cyber Security Northern Ireland</a> Especially as increasingly I feel that we in the IT and digital communities are are suffering from a modern Cassandra complex where we know there are existential threats that need action, but its so often being put in the too-difficult box.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the panel, I was joined by fellow BCS member, lawyer and Data Protection Consultant, Tara Taubman-Bassirian of Data Rainbow; Joseph Byrne, Privacy Solutions Engineer at OneTrust and the event chair, David Lee, formerly of The Scotsman. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I spent 6 years working in Scottish public policy and campaigns and I’m no stranger to Holyrood Connect as a force for good in addressing the critical digital issues of our times and its place as a strong voice for devolved administrations. Also, the Chartered Institute has sizeable active membership in Scotland, Northern Ireland and Wales and it’s been personal commitment of mine to drive greater engagement and collaboration across the UK’s rich tech landscape so the future of IT and digital technologies</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Chartered Institute is primarily a network of its people and over the past 12 months it’s been amazing how our members and the wider IT and digital communities have continued to make IT good for society whilst we all face huge and unprecedented threats.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>IT workers really are the unsung heroes of the pandemic.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It’s important to note that in the context of rapid service and product delivery changes etc; organisations trying to keep people in jobs, diverting resources and skills on unprecedented scale, that we don’t have things like Schrems2, changes to international data transfer regulations and standard contractual clauses entirely front and centre of our organisations risk register!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>But the problem for many of us working in this area is that so many of our organisations are caught up in this perfect storm without even the awareness they need legal advice and expertise, let alone having it in house.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A big bug bear for me and my colleagues is the absence of CIOs or equivalent at the highest levels of organisational decision making and risk management.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hear often about an encouraging rise in the amount of boards with a dedicated person with responsibility for cyber and data security and protection; but in many situations, it does feel very much like when boards were encouraged to appoint a diversity champion, the person was often not appointed based on real knowledge or expertise and were asked to ‘take on’ the brief. In both cases, the board member often relies almost exclusively on the briefing of the IT team with much lost in translation and debate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When we look at how many Boards include a CIO or equivalent, the picture is problematic, only 10 -20% of NHS organisations for example have a CIO or equivalent at the highest level of decision making and risk management<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn1\" target=\"_blank\" rel=\"noreferrer noopener\">[1]</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, the demand is there though for better, tech led decision making!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The past decade has seen a cottage industry grow up around supporting technologists to speak effectively with boards and decision makers; this is why we are so keen to drive professional standards and professional development across the IT world to drive up this capacity to support innovation and mitigate risk.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A new data regime ushered in by the UK’s Data Strategy will reiterate the need for effective data maintenance and governance while removing obstacles and impediments to innovation, an opportunity to basically clean up our digital processes and make them fit for a more dynamic digital infrastructure. Indeed the new information commissioner’s job specification<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn2\" target=\"_blank\" rel=\"noreferrer noopener\">[2]</a>&nbsp;requires a drive to do just that.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This aside, despite the sabre rattling from both sides over the past few months, most of the signs indicate that the UK and EU want to cooperate on a number of key areas such as enforcement, cyber security, copyright infringement, IP, tech sovereignty and certain areas of competition. This may well mean that the ICO will turn its attention more meaningfully to scrutinising data governance procedures, while also calling out over-burdensome procedures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite no clear public desire to needlessly interrupt trade, it’s unclear how long an adequacy agreement, if finally ratified by EU states, can be sustainable. As a third country, the UK will be susceptible to judicial review similar to Schrems 2 and outside the EU, we’ll be held to a higher standard.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To be competitive the UK needs to show it is dynamic and has a commercial edge over the EU in certain areas, data will be one of those areas; the political and legal challenges are however huge!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Make no mistake, privacy campaigners have the UK in their sights and will seek to make this the next battleground, so depending on where and how we plan to flex our independence on things like human rights legislation etc, there will be a need for preparatory action.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So what can we do…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>listen to and champion your IT and data protection people to help get our houses in order</li><li>Continue to drive up professional standards and champion the mitigation of risk across the economy and civil society</li><li>Raise the issues you care about with your elected officials, I don\'t think there is enough literacy at national, devolved or local government level for us to reap the benefits, we should be aiming to thrive, not just survive</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>We’re all learning ‘on the job’ on this so let’s continue to have these conversations, mainstream the issues and make sure we’re ahead of the game.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref1\" target=\"_blank\">[1]</a> <a href=\"https://www.digitalhealth.net/2020/01/networks-issues-open-letter-to-get-ccios-and-cios-on-nhs-boards/\" target=\"_blank\" rel=\"noreferrer noopener\">Networks issues open letter to get CCIOs and CIOs on NHS boards</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref2\" target=\"_blank\">[2]</a> <a rel=\"noreferrer noopener\" href=\"https://publicappointments.cabinetoffice.gov.uk/appointment/information-commissioner-2/\" target=\"_blank\">HM Government Public Appointments</a></p>\n<!-- /wp:paragraph -->','Beyond Brexit: Cyber Security and Data Protection - the modern Cassandra Complex','','inherit','closed','closed','','2026-revision-v1','','','2021-04-17 13:52:36','2021-04-17 13:52:36','',2026,'https://www.datarainbow.eu/?p=2033',0,'revision','',0),(2032,1,'2021-04-17 13:49:59','2021-04-17 13:49:59','<!-- wp:heading {\"level\":3} -->\n<h3>By <a href=\"https://www.linkedin.com/in/daniel-aldridge-2a93922b/\">Daniel Aldridge</a>Senior Policy &amp; Programmes Manager at BCS, The Chartered Institute for IT</h3>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>Published on March 12, 2021</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>I\'m never one to shy away from a niche topic, especially one at the vanguard of politics and technology, so I was happy to speak at the Holyrood Connect event last week on cyber security and data protection post Brexit. <a rel=\"noreferrer noopener\" href=\"https://cybersecurityni.holyrood.com/agenda\" target=\"_blank\">Public Sector Cyber Security Northern Ireland</a> Especially as increasingly I feel that we in the IT and digital communities are are suffering from a modern Cassandra complex where we know there are existential threats that need action, but its so often being put in the too-difficult box.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the panel, I was joined by fellow BCS member, lawyer and Data Protection Consultant, Tara Taubman-Bassirian of Data Rainbow; Joseph Byrne, Privacy Solutions Engineer at OneTrust and the event chair, David Lee, formerly of The Scotsman. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I spent 6 years working in Scottish public policy and campaigns and I’m no stranger to Holyrood Connect as a force for good in addressing the critical digital issues of our times and its place as a strong voice for devolved administrations. Also, the Chartered Institute has sizeable active membership in Scotland, Northern Ireland and Wales and it’s been personal commitment of mine to drive greater engagement and collaboration across the UK’s rich tech landscape so the future of IT and digital technologies</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Chartered Institute is primarily a network of its people and over the past 12 months it’s been amazing how our members and the wider IT and digital communities have continued to make IT good for society whilst we all face huge and unprecedented threats.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>IT workers really are the unsung heroes of the pandemic.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It’s important to note that in the context of rapid service and product delivery changes etc; organisations trying to keep people in jobs, diverting resources and skills on unprecedented scale, that we don’t have things like Schrems2, changes to international data transfer regulations and standard contractual clauses entirely front and centre of our organisations risk register!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>But the problem for many of us working in this area is that so many of our organisations are caught up in this perfect storm without even the awareness they need legal advice and expertise, let alone having it in house.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A big bug bear for me and my colleagues is the absence of CIOs or equivalent at the highest levels of organisational decision making and risk management.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hear often about an encouraging rise in the amount of boards with a dedicated person with responsibility for cyber and data security and protection; but in many situations, it does feel very much like when boards were encouraged to appoint a diversity champion, the person was often not appointed based on real knowledge or expertise and were asked to ‘take on’ the brief. In both cases, the board member often relies almost exclusively on the briefing of the IT team with much lost in translation and debate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When we look at how many Boards include a CIO or equivalent, the picture is problematic, only 10 -20% of NHS organisations for example have a CIO or equivalent at the highest level of decision making and risk management<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn1\" target=\"_blank\" rel=\"noreferrer noopener\">[1]</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, the demand is there though for better, tech led decision making!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The past decade has seen a cottage industry grow up around supporting technologists to speak effectively with boards and decision makers; this is why we are so keen to drive professional standards and professional development across the IT world to drive up this capacity to support innovation and mitigate risk.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A new data regime ushered in by the UK’s Data Strategy will reiterate the need for effective data maintenance and governance while removing obstacles and impediments to innovation, an opportunity to basically clean up our digital processes and make them fit for a more dynamic digital infrastructure. Indeed the new information commissioner’s job specification<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn2\" target=\"_blank\" rel=\"noreferrer noopener\">[2]</a>&nbsp;requires a drive to do just that.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This aside, despite the sabre rattling from both sides over the past few months, most of the signs indicate that the UK and EU want to cooperate on a number of key areas such as enforcement, cyber security, copyright infringement, IP, tech sovereignty and certain areas of competition. This may well mean that the ICO will turn its attention more meaningfully to scrutinising data governance procedures, while also calling out over-burdensome procedures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite no clear public desire to needlessly interrupt trade, it’s unclear how long an adequacy agreement, if finally ratified by EU states, can be sustainable. As a third country, the UK will be susceptible to judicial review similar to Schrems 2 and outside the EU, we’ll be held to a higher standard.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To be competitive the UK needs to show it is dynamic and has a commercial edge over the EU in certain areas, data will be one of those areas; the political and legal challenges are however huge!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Make no mistake, privacy campaigners have the UK in their sights and will seek to make this the next battleground, so depending on where and how we plan to flex our independence on things like human rights legislation etc, there will be a need for preparatory action.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So what can we do…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>listen to and champion your IT and data protection people to help get our houses in order</li><li>Continue to drive up professional standards and champion the mitigation of risk across the economy and civil society</li><li>Raise the issues you care about with your elected officials, I don\'t think there is enough literacy at national, devolved or local government level for us to reap the benefits, we should be aiming to thrive, not just survive</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>We’re all learning ‘on the job’ on this so let’s continue to have these conversations, mainstream the issues and make sure we’re ahead of the game.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref1\" target=\"_blank\" rel=\"noreferrer noopener\">[1]</a>&nbsp;<a href=\"https://www.digitalhealth.net/2020/01/networks-issues-open-letter-to-get-ccios-and-cios-on-nhs-boards/\" target=\"_blank\" rel=\"noreferrer noopener\">https://www.digitalhealth.net/2020/01/networks-issues-open-letter-to-get-ccios-and-cios-on-nhs-boards/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref2\" target=\"_blank\" rel=\"noreferrer noopener\">[2]</a>&nbsp;<a href=\"https://publicappointments.cabinetoffice.gov.uk/appointment/information-commissioner-2/\" target=\"_blank\" rel=\"noreferrer noopener\">https://publicappointments.cabinetoffice.gov.uk/appointment/information-commissioner-2/</a></p>\n<!-- /wp:paragraph -->','Beyond Brexit: Cyber Security and Data Protection - the modern Cassandra Complex','','inherit','closed','closed','','2026-revision-v1','','','2021-04-17 13:49:59','2021-04-17 13:49:59','',2026,'https://www.datarainbow.eu/?p=2032',0,'revision','',0),(1905,1,'2020-08-09 21:41:30','2020-08-09 21:41:30','<!-- wp:paragraph -->\n<p>Recent headlines on the news :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://dataprotection.news/morgan-stanley-hit-with-class-lawsuit-over-alleged-data-breaches/\" target=\"_blank\" rel=\"noreferrer noopener\">Former and current Morgan Stanley customers have filed a putative class-action lawsuit alleging negligence and invasion of privacy over the firm’s failure to properly scrub decommissioned hardware of personal information such as social security numbers, account numbers and other personal data</a>.</li><li><a href=\"https://www.silicon.co.uk/e-regulation/legal/garmin-paid-millions-ransomware-346793\" target=\"_blank\" rel=\"noreferrer noopener\">Garmin Paid Millions Of Dollars In Ransom After Attack – Report</a></li><li><a href=\"https://www.techradar.com/news/canon-hit-by-huge-ransomware-attack-user-data-apparently-stolen\" target=\"_blank\" rel=\"noreferrer noopener\">Canon website down after major ransomware attack</a></li><li><a href=\"https://threatpost.com/netgear-wont-patch-45-router-models-vulnerable-to-serious-flaw/157977/\" target=\"_blank\" rel=\"noreferrer noopener\">Almost two months after a high-severity flaw was disclosed – and seven months after it was first reported – Netgear has yet to issue fixes for 45 of its router models.</a></li><li><a href=\"https://www.euractiv.com/section/cybersecurity/news/suspected-russian-hackers-stole-contents-of-ex-uk-trade-ministers-email-account/\" target=\"_blank\" rel=\"noreferrer noopener\">Suspected Russian hackers stole content of ex-UK trade minister\'s email account</a></li><li><a href=\"https://www.techradar.com/uk/news/intel-hacked-confidential-intellectual-data-obtained-and-leaked-by-anonymous-hacker\" target=\"_blank\" rel=\"noreferrer noopener\">Intel hacked: Confidential intellectual data obtained and leaked by anonymous hacker</a></li><li><a href=\"https://securityboulevard.com/2020/08/interior-design-platform-confirms-data-breach-after-data-of-1-3-million-users-is-posted-online/\" target=\"_blank\" rel=\"noreferrer noopener\">interior design platform confirms data</a></li><li><a href=\"https://hotforsecurity.bitdefender.com/blog/thousands-of-websites-at-risk-from-critical-wordpress-plugin-vulnerability-23844.html#new_tab\" target=\"_blank\" rel=\"noreferrer noopener\">Thousands of websites at risk from critical WordPress plugin vulnerability</a></li><li><a href=\"https://arstechnica.com/tech-policy/2020/08/beware-of-find-my-phone-wi-fi-and-bluetooth-nsa-tells-mobile-users/\" target=\"_blank\" rel=\"noreferrer noopener\">Beware of find-my-phone, Wi-Fi, and Bluetooth, NSA tells mobile users</a></li><li><a href=\"https://www.cpomagazine.com/cyber-security/third-party-data-breach-of-ge-vendor-exposes-highly-sensitive-employee-information/\" target=\"_blank\" rel=\"noreferrer noopener\">Third Party Data Breach of GE Vendor Exposes Highly Sensitive Employee Information</a></li><li><a href=\"https://www-bbc-com.cdn.ampproject.org/c/s/www.bbc.com/news/amp/technology-53667664\" target=\"_blank\" rel=\"noreferrer noopener\">Twitter hack court hearing \'Zoombombed\' with porn</a></li><li><a href=\"https://tech.newstatesman.com/security/firms-are-paying-hackers-millions-to-cover-up-gdpr-breaches-researchers-claim\" target=\"_blank\" rel=\"noreferrer noopener\">Hackers are charging millions to cover up GDPR breaches, researchers claim</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>These are just a few from this week\'s headlines on data breach and security. Obviously, it\'s not anymore IF but WHEN a breach will happen. You can check the freshly published Pokemon study of 524 breaches that occurred between August 2019 and April 2020, in organizations of all sizes, across 17 countries and 17 industries-&nbsp;<a href=\"https://www.ibm.com/security/digital-assets/cost-data-breach-report/Cost%20of%20a%20Data%20Breach%20Report%202020.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Cost of Data Breach</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We, in Europe, have one of the most protective data regulations, called the General Data Protection Regulation, passed by all EU members states in 2016 that enters into effect after a two year period of adaptation, in 2018. GDPR compliance imposes accountability measures such as running a Data Protection Impact Assessment to trace where the data is stored, where it comes from, who can access it, how long the data is retained, what are the legal basis of data processing, imposing an obligation of transparency and so on. By requiring data minimisation, purpose limitation, an obligation of security and integrity, risks should be minimised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So why do we still see so many data breaches? Had the courts and jurisdictions run a DPIA, they would avoid the bad surprise of \'zoombombarding\'. Legal professions should really not use a technology without making sure the personal data they handle are safely secured. Politicians, just like the legal professionals should not use insecure email accounts. Encryption is a requirement when handling sensitive data and bound by an obligation of confidentiality. Why do we still read \'<em>The British government does not explicitly bar the use of private email accounts for official business, but says all information must be handled in accordance with the law, including the Official Secrets Act.</em>\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So why, 4 years after the GDPR which actually replaced a pre-existing Data Protection Directive that was mostly reinforced by the GDPR, has still let these breaches to happen ? In others words, we ought to ask, what the national EU Data Protection Authorities have been doing ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>DPAs are said under staffed, and under resourced. The UK ICO in particular have been dragging their feet with an&nbsp;<a href=\"https://www.theregister.com/2020/08/05/marriott_starwood_gdpr_fine_british_airways/\" target=\"_blank\" rel=\"noreferrer noopener\">enforcement against&nbsp;</a><a href=\"https://dataprotection.news/uk-data-watchdog-having-a-hard-time-making-gdpr-fines-stick/\" target=\"_blank\" rel=\"noreferrer noopener\">British Airway and Marriott International&nbsp;</a>whom have each had a severe data breach affecting large number of customers data. An intention to fine was issued that keeps being pushed back in the case of the two companies. £183m for BA and £99m for Marriott. Marriott has obtained another six months prolongation and BA is said to eventually pay only less than 11% of the original amount. Of course in the current economic context, big fines can be fatal, they will eventually hurt the customers. Who wants to see the UK British Airways to file bankruptcy? So what else can be done as no enforcement means no incitement to comply with the regulation. Even if in final GDPR compliant is beneficial for the company, it necessitate an initial investment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I suggest a better option. As still in 2020, fours years after the adoption of the regulation, many ignore their obligations, I suggest the fines to be less financial with more incentives :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First, make sure these companies are compliant, cease and delete all customer data unlawfully obtained. Offer protection to the customers whose data has been breached. Why not offer some sort of compensation to the victims such as free standby tickets or hotel rooms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Furthermore, as it is obvious that general public and many companies lack information on Data protection, GDPR and data security.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>As it is obvious that the U.K. ICO feel trembling fining BA and Marriott with big fines that will kill them or end up costing money to their customers.</li><li>As BA and Marriott are both companies with high volume customer, same applies to EasyJet as well victim of a data breach.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>I suggest they\'d be submitted to an obligation to run&nbsp;<strong>public awareness campaigns on GDPR and data security</strong>&nbsp;in all their public places : aeroplanes, airports, hotel rooms, offices, etc... short videos, posters, tracts,.... like entertaining short videos on plane or before boarding, on their websites or leaflets.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What do you think?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>While the UK ICO are still dragging their feet, the&nbsp;<a href=\"https://gdprhub.eu/index.php?title=CNIL_-_MED-2020-015&amp;oldid=11002&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">French DPA CNIL</a>, acting as lead supervisory, has fined an eCommerce business in cooperation with other national DPAs. Spartoo has been&nbsp;fined for EUR 250,000 for violations of articles 5-1 c), 5-1 e), 13 and 32. Basically, infringement of the principals of data minimisation, data retention period, password security and lack of transparency. Spartoo was also ordered to bring its processing into compliance with the GDPR within three months from the notification of the decision, under a penalty of EUR 250 per day of delay. What triggered the investigation of this company in particular is unkown. In its annual report, the CNIL announced 300 controls. 8 sanctions : 7 fines for a total of 51 370 000 euros, including the biggest fine in Europe to Google (Have they actually paid?) 5 injunctions. From 11 000 complaints in 2018they had 32 % increase for the first 7 months of 2019. CNIL had announced their priorities : cookies, recruitment agencies and real estate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The most active of all, the Spanish AEDP as reported by the GDPRHub :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>he Spanish DPA (AEPD) fined two&nbsp;<strong>telecommunications companies</strong>&nbsp;for the following&nbsp;<strong>violations of&nbsp;Article 6 GDPR</strong>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>€75,000</strong>&nbsp;against Telefonica for&nbsp;<strong>transmitting</strong>&nbsp;a claimant\'s personal data<strong>&nbsp;without consent.&nbsp;</strong><a href=\"https://gdprhub.eu/index.php?title=AEPD_-_PS/00014/2020&amp;oldid=11001&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">Read more or edit on GDPRhub...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>€80,000&nbsp;</strong>against Orange for allowing a client\'s personal data to be used for the&nbsp;<strong>fraudulent hiring of 6 telephone lines</strong>.&nbsp;<a href=\"https://gdprhub.eu/index.php?title=AEPD_-_PS/00452/2019&amp;oldid=11000&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">Read more or edit on GDPRhub...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>€70,000&nbsp;</strong>against Telefonica for using a customer\'s data to incorrectly&nbsp;issue them<strong>&nbsp;invoices for services associated with another person</strong>.&nbsp;<a href=\"https://gdprhub.eu/index.php?title=AEPD_-_PS/00010/2020&amp;oldid=10990&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">Read more or edit on GDPRhub...&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>€55,000</strong>&nbsp;against Telefonica for continuing to process a complainant\'s data following an&nbsp;<strong>identity theft</strong>.&nbsp;<a href=\"https://gdprhub.eu/index.php?title=AEPD_-_PS/00114/2019_938-300320&amp;oldid=10975&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">Read more or edit on GDPRhub...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The AEPD also issued the following fines:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>€40,000&nbsp;</strong>against an airline for a breach of&nbsp;<strong>Article 15 GDPR&nbsp;</strong><a href=\"https://gdprhub.eu/index.php?title=AEPD_-_PS/00060/2020&amp;oldid=10999&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">Read more or edit on GDPRhub...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>€18,000&nbsp;</strong>against a bank for violating&nbsp;<strong>Article 6(1) GDPR</strong>&nbsp;<a href=\"https://gdprhub.eu/index.php?title=AEPD_-_PS/00068/2020&amp;oldid=10978&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">Read more or edit on GDPRhub...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>€6000</strong>&nbsp;against a company for&nbsp;<strong>infringing cookie rules&nbsp;</strong>under Article 22(2) of the Spanish Law of Information Society Services (LSSI) and&nbsp;<strong>Article 13 GDPR</strong>&nbsp;<a href=\"https://gdprhub.eu/index.php?title=AEPD_-_PS/00057/2020&amp;oldid=10991&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">Read more or edit on GDPRhub...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The AEPD also held that a city council&nbsp;<strong>breached data confidentiality principles&nbsp;</strong>under&nbsp;<strong>Article 5(1)(f)</strong>&nbsp;by&nbsp;<strong>publishing a census</strong>&nbsp;featuring individuals\' names, surnames and ID card numbers.&nbsp;<a href=\"https://gdprhub.eu/index.php?title=AEPD_-_PS/00381/2019&amp;oldid=10993&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">Read more or edit on GDPRhub...</a></p>\n<!-- /wp:paragraph -->','A Proposition for A More Effective GDPR Enforcement','What would be the most effective way of enforcing the GDPR while giving incitement to comply without knocking the company, at the best of customers interest ? Will the ICO ever fine BA and Marriott? Should they ? A proposition for a more effective GDPR enforcement. ','publish','open','open','','a-proposition-for-a-more-effective-gdpr-enforcement','','','2020-11-29 21:44:54','2020-11-29 21:44:54','',0,'https://www.datarainbow.eu/?p=1905',0,'post','',0),(1907,1,'2020-11-29 21:43:10','2020-11-29 21:43:10','','Screenshot 2020-11-29 at 21.42.46','','inherit','open','closed','','screenshot-2020-11-29-at-21-42-46','','','2020-11-29 21:43:10','2020-11-29 21:43:10','',1905,'https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-29-at-21.42.46.png',0,'attachment','image/png',0),(1908,1,'2020-11-29 21:44:54','2020-11-29 21:44:54','<!-- wp:paragraph -->\n<p>Recent headlines on the news :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://dataprotection.news/morgan-stanley-hit-with-class-lawsuit-over-alleged-data-breaches/\" target=\"_blank\" rel=\"noreferrer noopener\">Former and current Morgan Stanley customers have filed a putative class-action lawsuit alleging negligence and invasion of privacy over the firm’s failure to properly scrub decommissioned hardware of personal information such as social security numbers, account numbers and other personal data</a>.</li><li><a href=\"https://www.silicon.co.uk/e-regulation/legal/garmin-paid-millions-ransomware-346793\" target=\"_blank\" rel=\"noreferrer noopener\">Garmin Paid Millions Of Dollars In Ransom After Attack – Report</a></li><li><a href=\"https://www.techradar.com/news/canon-hit-by-huge-ransomware-attack-user-data-apparently-stolen\" target=\"_blank\" rel=\"noreferrer noopener\">Canon website down after major ransomware attack</a></li><li><a href=\"https://threatpost.com/netgear-wont-patch-45-router-models-vulnerable-to-serious-flaw/157977/\" target=\"_blank\" rel=\"noreferrer noopener\">Almost two months after a high-severity flaw was disclosed – and seven months after it was first reported – Netgear has yet to issue fixes for 45 of its router models.</a></li><li><a href=\"https://www.euractiv.com/section/cybersecurity/news/suspected-russian-hackers-stole-contents-of-ex-uk-trade-ministers-email-account/\" target=\"_blank\" rel=\"noreferrer noopener\">Suspected Russian hackers stole content of ex-UK trade minister\'s email account</a></li><li><a href=\"https://www.techradar.com/uk/news/intel-hacked-confidential-intellectual-data-obtained-and-leaked-by-anonymous-hacker\" target=\"_blank\" rel=\"noreferrer noopener\">Intel hacked: Confidential intellectual data obtained and leaked by anonymous hacker</a></li><li><a href=\"https://securityboulevard.com/2020/08/interior-design-platform-confirms-data-breach-after-data-of-1-3-million-users-is-posted-online/\" target=\"_blank\" rel=\"noreferrer noopener\">interior design platform confirms data</a></li><li><a href=\"https://hotforsecurity.bitdefender.com/blog/thousands-of-websites-at-risk-from-critical-wordpress-plugin-vulnerability-23844.html#new_tab\" target=\"_blank\" rel=\"noreferrer noopener\">Thousands of websites at risk from critical WordPress plugin vulnerability</a></li><li><a href=\"https://arstechnica.com/tech-policy/2020/08/beware-of-find-my-phone-wi-fi-and-bluetooth-nsa-tells-mobile-users/\" target=\"_blank\" rel=\"noreferrer noopener\">Beware of find-my-phone, Wi-Fi, and Bluetooth, NSA tells mobile users</a></li><li><a href=\"https://www.cpomagazine.com/cyber-security/third-party-data-breach-of-ge-vendor-exposes-highly-sensitive-employee-information/\" target=\"_blank\" rel=\"noreferrer noopener\">Third Party Data Breach of GE Vendor Exposes Highly Sensitive Employee Information</a></li><li><a href=\"https://www-bbc-com.cdn.ampproject.org/c/s/www.bbc.com/news/amp/technology-53667664\" target=\"_blank\" rel=\"noreferrer noopener\">Twitter hack court hearing \'Zoombombed\' with porn</a></li><li><a href=\"https://tech.newstatesman.com/security/firms-are-paying-hackers-millions-to-cover-up-gdpr-breaches-researchers-claim\" target=\"_blank\" rel=\"noreferrer noopener\">Hackers are charging millions to cover up GDPR breaches, researchers claim</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>These are just a few from this week\'s headlines on data breach and security. Obviously, it\'s not anymore IF but WHEN a breach will happen. You can check the freshly published Pokemon study of 524 breaches that occurred between August 2019 and April 2020, in organizations of all sizes, across 17 countries and 17 industries-&nbsp;<a href=\"https://www.ibm.com/security/digital-assets/cost-data-breach-report/Cost%20of%20a%20Data%20Breach%20Report%202020.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Cost of Data Breach</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We, in Europe, have one of the most protective data regulations, called the General Data Protection Regulation, passed by all EU members states in 2016 that enters into effect after a two year period of adaptation, in 2018. GDPR compliance imposes accountability measures such as running a Data Protection Impact Assessment to trace where the data is stored, where it comes from, who can access it, how long the data is retained, what are the legal basis of data processing, imposing an obligation of transparency and so on. By requiring data minimisation, purpose limitation, an obligation of security and integrity, risks should be minimised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So why do we still see so many data breaches? Had the courts and jurisdictions run a DPIA, they would avoid the bad surprise of \'zoombombarding\'. Legal professions should really not use a technology without making sure the personal data they handle are safely secured. Politicians, just like the legal professionals should not use insecure email accounts. Encryption is a requirement when handling sensitive data and bound by an obligation of confidentiality. Why do we still read \'<em>The British government does not explicitly bar the use of private email accounts for official business, but says all information must be handled in accordance with the law, including the Official Secrets Act.</em>\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So why, 4 years after the GDPR which actually replaced a pre-existing Data Protection Directive that was mostly reinforced by the GDPR, has still let these breaches to happen ? In others words, we ought to ask, what the national EU Data Protection Authorities have been doing ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>DPAs are said under staffed, and under resourced. The UK ICO in particular have been dragging their feet with an&nbsp;<a href=\"https://www.theregister.com/2020/08/05/marriott_starwood_gdpr_fine_british_airways/\" target=\"_blank\" rel=\"noreferrer noopener\">enforcement against&nbsp;</a><a href=\"https://dataprotection.news/uk-data-watchdog-having-a-hard-time-making-gdpr-fines-stick/\" target=\"_blank\" rel=\"noreferrer noopener\">British Airway and Marriott International&nbsp;</a>whom have each had a severe data breach affecting large number of customers data. An intention to fine was issued that keeps being pushed back in the case of the two companies. £183m for BA and £99m for Marriott. Marriott has obtained another six months prolongation and BA is said to eventually pay only less than 11% of the original amount. Of course in the current economic context, big fines can be fatal, they will eventually hurt the customers. Who wants to see the UK British Airways to file bankruptcy? So what else can be done as no enforcement means no incitement to comply with the regulation. Even if in final GDPR compliant is beneficial for the company, it necessitate an initial investment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I suggest a better option. As still in 2020, fours years after the adoption of the regulation, many ignore their obligations, I suggest the fines to be less financial with more incentives :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First, make sure these companies are compliant, cease and delete all customer data unlawfully obtained. Offer protection to the customers whose data has been breached. Why not offer some sort of compensation to the victims such as free standby tickets or hotel rooms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Furthermore, as it is obvious that general public and many companies lack information on Data protection, GDPR and data security.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>As it is obvious that the U.K. ICO feel trembling fining BA and Marriott with big fines that will kill them or end up costing money to their customers.</li><li>As BA and Marriott are both companies with high volume customer, same applies to EasyJet as well victim of a data breach.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>I suggest they\'d be submitted to an obligation to run&nbsp;<strong>public awareness campaigns on GDPR and data security</strong>&nbsp;in all their public places : aeroplanes, airports, hotel rooms, offices, etc... short videos, posters, tracts,.... like entertaining short videos on plane or before boarding, on their websites or leaflets.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What do you think?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>While the UK ICO are still dragging their feet, the&nbsp;<a href=\"https://gdprhub.eu/index.php?title=CNIL_-_MED-2020-015&amp;oldid=11002&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">French DPA CNIL</a>, acting as lead supervisory, has fined an eCommerce business in cooperation with other national DPAs. Spartoo has been&nbsp;fined for EUR 250,000 for violations of articles 5-1 c), 5-1 e), 13 and 32. Basically, infringement of the principals of data minimisation, data retention period, password security and lack of transparency. Spartoo was also ordered to bring its processing into compliance with the GDPR within three months from the notification of the decision, under a penalty of EUR 250 per day of delay. What triggered the investigation of this company in particular is unkown. In its annual report, the CNIL announced 300 controls. 8 sanctions : 7 fines for a total of 51 370 000 euros, including the biggest fine in Europe to Google (Have they actually paid?) 5 injunctions. From 11 000 complaints in 2018they had 32 % increase for the first 7 months of 2019. CNIL had announced their priorities : cookies, recruitment agencies and real estate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The most active of all, the Spanish AEDP as reported by the GDPRHub :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>he Spanish DPA (AEPD) fined two&nbsp;<strong>telecommunications companies</strong>&nbsp;for the following&nbsp;<strong>violations of&nbsp;Article 6 GDPR</strong>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>€75,000</strong>&nbsp;against Telefonica for&nbsp;<strong>transmitting</strong>&nbsp;a claimant\'s personal data<strong>&nbsp;without consent.&nbsp;</strong><a href=\"https://gdprhub.eu/index.php?title=AEPD_-_PS/00014/2020&amp;oldid=11001&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">Read more or edit on GDPRhub...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>€80,000&nbsp;</strong>against Orange for allowing a client\'s personal data to be used for the&nbsp;<strong>fraudulent hiring of 6 telephone lines</strong>.&nbsp;<a href=\"https://gdprhub.eu/index.php?title=AEPD_-_PS/00452/2019&amp;oldid=11000&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">Read more or edit on GDPRhub...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>€70,000&nbsp;</strong>against Telefonica for using a customer\'s data to incorrectly&nbsp;issue them<strong>&nbsp;invoices for services associated with another person</strong>.&nbsp;<a href=\"https://gdprhub.eu/index.php?title=AEPD_-_PS/00010/2020&amp;oldid=10990&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">Read more or edit on GDPRhub...&nbsp;</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>€55,000</strong>&nbsp;against Telefonica for continuing to process a complainant\'s data following an&nbsp;<strong>identity theft</strong>.&nbsp;<a href=\"https://gdprhub.eu/index.php?title=AEPD_-_PS/00114/2019_938-300320&amp;oldid=10975&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">Read more or edit on GDPRhub...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The AEPD also issued the following fines:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>€40,000&nbsp;</strong>against an airline for a breach of&nbsp;<strong>Article 15 GDPR&nbsp;</strong><a href=\"https://gdprhub.eu/index.php?title=AEPD_-_PS/00060/2020&amp;oldid=10999&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">Read more or edit on GDPRhub...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>€18,000&nbsp;</strong>against a bank for violating&nbsp;<strong>Article 6(1) GDPR</strong>&nbsp;<a href=\"https://gdprhub.eu/index.php?title=AEPD_-_PS/00068/2020&amp;oldid=10978&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">Read more or edit on GDPRhub...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>€6000</strong>&nbsp;against a company for&nbsp;<strong>infringing cookie rules&nbsp;</strong>under Article 22(2) of the Spanish Law of Information Society Services (LSSI) and&nbsp;<strong>Article 13 GDPR</strong>&nbsp;<a href=\"https://gdprhub.eu/index.php?title=AEPD_-_PS/00057/2020&amp;oldid=10991&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">Read more or edit on GDPRhub...</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The AEPD also held that a city council&nbsp;<strong>breached data confidentiality principles&nbsp;</strong>under&nbsp;<strong>Article 5(1)(f)</strong>&nbsp;by&nbsp;<strong>publishing a census</strong>&nbsp;featuring individuals\' names, surnames and ID card numbers.&nbsp;<a href=\"https://gdprhub.eu/index.php?title=AEPD_-_PS/00381/2019&amp;oldid=10993&amp;mtc=today\" target=\"_blank\" rel=\"noreferrer noopener\">Read more or edit on GDPRhub...</a></p>\n<!-- /wp:paragraph -->','A Proposition for A More Effective GDPR Enforcement','What would be the most effective way of enforcing the GDPR while giving incitement to comply without knocking the company, at the best of customers interest ? Will the ICO ever fine BA and Marriott? Should they ? A proposition for a more effective GDPR enforcement. ','inherit','closed','closed','','1905-revision-v1','','','2020-11-29 21:44:54','2020-11-29 21:44:54','',1905,'https://www.datarainbow.eu/1905-revision-v1/',0,'revision','',0),(1909,1,'2020-11-29 21:48:35','2020-11-29 21:48:35','','Screenshot 2020-11-29 at 21.47.46','','inherit','open','closed','','screenshot-2020-11-29-at-21-47-46','','','2020-11-29 21:48:35','2020-11-29 21:48:35','',267,'https://www.datarainbow.eu/wp-content/uploads/2019/02/Screenshot-2020-11-29-at-21.47.46.png',0,'attachment','image/png',0),(1910,1,'2020-11-29 21:48:41','2020-11-29 21:48:41','<!-- wp:paragraph -->\n<p>Much confusion around the concept of Legitimate Interest justifying Personal Data Processing. Worth going back to the roots.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Article 6(1) of the GDPR</strong> sets out the conditions that must be met for the processing of personal data to be lawful. They are:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(a) the data subject has given <strong>consent</strong> to the processing of their personal data for one or more specific purposes;&nbsp;</em><br><em>(b) processing is necessary for the performance of a <strong>contract</strong> to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;&nbsp;</em><br><em>(c) processing is necessary for compliance with a <strong>legal obligation</strong> to which the controller is subject;&nbsp;</em><br><em>(d) processing is necessary in order to protect the <strong>vital interests</strong> of the data subject;&nbsp;</em><br><em>(e) processing is necessary for the performance of a task carried out in the <strong>public interest</strong> or in the exercise of official authority vested in the controller;&nbsp;</em><br><em>(f) processing is necessary for the purposes of the <strong>legitimate interests</strong> pursued by a controller, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This shall not apply to processing carried out by public authorities in the performance of their tasks.</em><br>These conditions are all equally valid, regardless the order of appearance. Organisations should assess which of these grounds are most appropriate for different processing activities and then fulfil any further requirements the GDPR sets out for these conditions (GDPR Article 5).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many organisations have been wrongly advised to opt for consent. The new regulation that entered into force on May 2018 requires a higher standard of consent. That explains the deluge of re-consent emails sent out around May last year. The other inconvenient of consent is the requirement to keep a register of all granted consents, with the risk that at anytime the data subject could withdraw its consent to processing. Imagine an individual giving consent for his image to be used in a commercial movie. at anytime, this person could revise its position and withdraw its consent, The organisation will have to pull out the movie. That should explain why consent is not always the most appropriate basis.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/when-can-we-rely-on-legitimate-interests/\">The UK ICO</a> website explain : \"<em>Legitimate interests is the most flexible of the six lawful bases. It is not focused on a particular purpose and therefore gives you more scope to potentially rely on it in many different circumstances.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>It may be the most appropriate basis when:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>the processing is not required by law but is of a clear benefit to you or others;</em></li><li><em>there’s a limited privacy impact on the individual;</em></li><li><em>the individual should reasonably expect you to use their data in that way; and</em></li><li><em>you cannot, or do not want to, give the individual full upfront control (ie consent) or bother them with disruptive consent requests when they are unlikely to object to the processing.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>However, it must be clear that Legitimate Interest is not simply the interest of the organisation. It is framed within strict conditions. A three part assessment that needs to be carefully conducted and communicated to the data subject at the time the data is collected. The jurisprudence has based the conditions of necessity and the respect of rights and freedoms of individuals.  Legitimate Interest, when validly demonstrated, can exempt from requesting formal consent. In a way, consent can be implicite as the data controller will be processing the data the way it is expected to act. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Extracts of the UK ICO website, for processing for marketing purposes to be lawful : \"<em>You still need to show that your processing passes the necessity and balancing tests</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>You may also need to be more specific about your purposes for some elements of your processing in order to show that processing is necessary and to weigh the benefits in the balancing test. For example, if you use profiling to target your marketing.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>When looking at the balancing test, you should also consider factors such as:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>whether people would expect you to use their details in this way;</em></li><li><em>the potential nuisance factor of unwanted marketing messages; and</em></li><li><em>the effect your chosen method and frequency of communication might have on more vulnerable individuals.</em>\"</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Rowenna Fielding - a <em>\"Professional Data Protection Nerd, Information Governance\"</em> as she describes herself on her Linkedin profile - published a very useful reminder that hopefully will help to clarify some of the misinformation around Legitimate Interest. I could not say it any better, so I reproduce this here with her authorisation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>&nbsp;10 Legitimate Interests Lessons for Marketers :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. Just because you\'re interested, doesn\'t make it legitimate.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. You can\'t use LI to avoid getting consent when you suspect the answer will be \"No\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> 3. Whether LI can be applied depends on your own assessment of what you\'re doing, why and how - which you will be expected to justify and defend. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>4. LI is not \'unclear\' or \'ambiguous\'; it requires thinking to be done and a decision to be made. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>5. Publish your Legitimate Interests Assessments (LIA) if you anticipate/plan to reject objections to processing. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>6. If a law says you have to get consent for a processing activity, then forget about LI. You can\'t use it. Move on. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>7. LI is only a valid lawful basis for processing personal data if you\'re adhering to all of the principles. It\'s not a loophole around compliance. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>8. If your LIA is post-hoc rationalisation of something you won\'t consider ceasing to do even though you suspect it\'s a bit dodgy; then you wasted your time. Just make sure you have funds set aside to deal with complaints, regulatory action and reputation damage when you get found out. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>9. The ICO is not responsible for your continuing professional development 10. No-one else can do your thinking for you.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The same way that consent is not a universal panacea, Legitimate Interest has to be balanced and where there is a contract to justify the processing of personal data it can be better suited. The UK ICO has an <a href=\"https://ico.org.uk/for-organisations/resources-and-support/lawful-basis-interactive-guidance-tool\">online interactive tool</a> that helps select the most appropriate lawful base of processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>UPDATE by the UK ICO : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ICO has published a report highlighting major data protection concerns  in the advertising industry and the real time bidding (online advertising space sold to bidders almost instantaneously). Data about users, including personal data collected from cookies is shared, in real time, in order for marketplace participants to be informed about viewers of the advertising space . The data is being used without a lawful basis and that appropriate consent to deploy cookies under PECR has not been obtained. &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ICO has flagged an incorrect reliance on legitimate interests as the lawful basis for processing personal data. When personal data is collected from cookies, consent is the only appropriate lawful basis under the GDPR and consent is nevertheless also a prerequisite under PECR for the associated cookies to be placed. The report highlights issues with transparency and accountability, control and supervision by market participants over the flows and sharing of data. Here is the full <a href=\"https://ico.org.uk/media/about-the-ico/documents/2615156/adtech-real-time-bidding-report-201906.pdf\">report</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Contact us at Data@DataRainbow.eu if you need further assistance to take you trough some of these complexities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This publication is licensed under a Creative Commons Attribution 4.0 International<br>More information on the licence can be found <a href=\"http://creativecommons.org/licenses/by/4.0/\">here</a>. </p>\n<!-- /wp:paragraph -->','How to Understand the GDPR Legitimate Interest','Much confusion around the concept of Legitimate Interest justifying Personal Data Processing. Worth going back to the roots.','inherit','closed','closed','','267-revision-v1','','','2020-11-29 21:48:41','2020-11-29 21:48:41','',267,'https://www.datarainbow.eu/267-revision-v1/',0,'revision','',0),(1912,1,'2018-09-07 21:52:00','2018-09-07 21:52:00','<!-- wp:paragraph -->\n<p><a href=\"https://www.thetimes.co.uk/edition/news/hundreds-of-thousands-lose-bank-details-as-ba-hacked-nzktw262k?CMP=Sprkr-_-Editorial-_-thetimes-_-Unspecified-_-TWITTER\" target=\"_blank\" rel=\"noreferrer noopener\">Hundreds of thousands lose bank details as British Airways hacked</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://uk.businessinsider.com/british-airways-customer-data-stolen-2018-9?r=US&amp;IR=T\" target=\"_blank\" rel=\"noreferrer noopener\">Data stolen from hundreds of thousands of British Airways customers in major breach</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A data breach follows a data breach. It\'s not IF it\'s when. Is your organisation ready to react?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The New European Data Protection Regulation that entered into force on May 25 after a grace period of two years of adaptation is in continuity of the previous data Protection Directive. One of the main change from the previous situation is a short period of required reactions after a data breach.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR introduced a 72-hour notification requirements. It is therefore critical for organisations to have a systematic GDPR incident response protocol in place to meet these requirements. Having a breach response plan in place is critical. Every organisation need to appoint one central post to receive all data breach in order to act promptly, to evaluate against notification requirements, and analyse overall risk against the underlying data inventory.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to the&nbsp;<a href=\"https://www.bbc.co.uk/news/uk-england-london-45440850\" target=\"_blank\" rel=\"noreferrer noopener\">BBC</a>, BA was made aware of the breach by a partner on Wednesday evening.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"BA said the breach took place between 22:58 BST on 21 August and 21:45 BST on 5 September.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"We have notified the police and relevant authorities. We take the protection of our customers\' data very seriously.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The BBC reports \"<em>BA said all customers affected by the breach had been contacted on Thursday night. The breach only affects those people who bought tickets during the timeframe provided by BA, and not on other occasions</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.bbc.co.uk/news/uk-england-london-45440850\" target=\"_blank\" rel=\"noreferrer noopener\">British Airways breach: How did hackers get in?</a>&nbsp;They are assumption that despite the encryption of customers data, these were intercepted from the website.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://Security%20Experts%20Comments%20%E2%80%93%20British%20Airways%20Data%20Breach/\" target=\"_blank\" rel=\"noreferrer noopener\">Security Experts Comments – British Airways Data Breach</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not sure if every customer has been contacted as Mr Cruz added:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>At the moment, our number one purpose is contacting those customers that made those transactions to make sure they contact their credit card bank providers so they can follow their instructions on how to manage that breach of data.\"</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 33 GDPR requirements in case of data breach are :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>1 - In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with&nbsp;&nbsp;<a href=\"https://gdpr-info.eu/art-55-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 55</a>, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.&nbsp;</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>2 - Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>The processor shall notify the controller without undue delay after becoming aware of a personal data breach.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>BA knows how important it is to react on time to notify the Data Protection Authority and each and every customers hurt by the breach. The GDPR fines of 4% of General turn over or 20 Million € are serious incentives. Fine or notBA fine, a breach of customers data cause serious harm to the business reputation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"Already, we are told that Shares in BA owner IAG fell by 3.1% in early trade on Friday.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Social media is getting filled with comments from outraged customers :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Mat Thomas said he placed a booking on 27 August, but had not been contacted about the breach.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"Atrocious that I had to find out about this via news and twitter,\" he tweeted.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"Called bank and had to cancel both mine and my wife\'s card. Probably won\'t get it back before we fly (ironically).\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Gemma Theobald tweeted: \"My bank... are experiencing extremely high call volumes due to this breach! Couldn\'t do anything other than cancel my card... not how I wanted to spend my Thursday evening.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>If you have remained impermeable to the new regulation, should this data breach incident be a wake up call. Data breach and GDPR is not exclusively a concern for big organisations. That includes SMEs or charities or any entity processing personal data outside household activities. To check GDPR wide application, you can read my previous posts.&nbsp;<a href=\"https://www.linkedin.com/pulse/gdpr-material-territorial-scopes-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">GDPR Material and Territorial Scope.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Another major innovation of the GDPR is class action or remedies from data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/\" target=\"_blank\" rel=\"noreferrer noopener\">All you need to know about GDPR compliance.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.telegraph.co.uk/news/2018/09/07/british-airways-hacking-customers-cancel-credit-cards-airline/\" target=\"_blank\" rel=\"noreferrer noopener\">The Telegraph report</a>&nbsp;: \"Alex Cruz, BA\'s chairman, revealed the hackers were \"very sophisticated criminals\" who had not hacked the company\'s encrypted data, but rather gained \"illicit access\" to the airline\'s system.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This meant the breach went unnoticed for more than two weeks and now customers&nbsp;are scrambling to cancel their cards once the airline became aware of the breach on September 5.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>It is thought the number of payments compromised could be up to 400,000 and BA confirmed Friday morning hackers had obtained names, addresses, credit card numbers, expiry dates and the three-digit security codes on the backs of cards - plenty to make a fraudulent payment.&nbsp;</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>THE UK ICO has published \"Records management for small business means safeguarding people’s personal information and making sure any risk has been reduced.&nbsp;<a href=\"https://ico.org.uk/for-organisations/resources-and-support/data-protection-self-assessment/\" target=\"_blank\" rel=\"noreferrer noopener\">We’ve designed a records management checklist and many GDPR checklists</a>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So far, nothing much in the&nbsp;<a href=\"https://lnkd.in/dvAaQRd\" target=\"_blank\" rel=\"noreferrer noopener\">ICO statement in response to British Airways breach announcement</a>&nbsp;nor&nbsp;<a href=\"https://www.ncsc.gov.uk/news/ncsc-statement-reported-british-airways-data-breach\" target=\"_blank\" rel=\"noreferrer noopener\">NCSC statement on the reported British Airways data breach</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Interestingly, in July this year,&nbsp;<a href=\"https://www.theverge.com/2018/7/19/17591732/british-airways-gdpr-compliance-twitter-personal-data-security\" target=\"_blank\" rel=\"noreferrer noopener\">British Airways asked customers to post personal information on Twitter ‘to comply with GDPR’</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And finally, we can wonder if BA has suffered from the absence of an active DPO as they have advertised for the post :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"Role Title: Group Data Protection OfficerPurpose of the role</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>The Group Data Protection Officer will be&nbsp;responsibility for overseeing the Group’s dataprivacy compliance programmes. The role is appointed to fulfil the statutory obligation under the *General Data Protection Regulation to appoint a Data Protection Officer (DPO) for the Group companies meeting the statutory criteria...</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>The ability to remain calm, controlled and resilient\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.information-age.com/british-airways-customer-data-hacked-stolen-123474644/\" target=\"_blank\" rel=\"noreferrer noopener\">British Airways customer data hacked and stolen</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>UPDATE:</u></strong>&nbsp;~If the financial harm is difficult to prove and the ICO fine uncertain, BA risk to be liable to compensate for non-material damage under the Data Protection Act 2018. Psychological harm and distress are used for a customer class action by SPG law.<a href=\"https://www.telegraph.co.uk/business/2018/09/09/british-airways-customers-claim-data-distress/\" target=\"_blank\" rel=\"noreferrer noopener\">&nbsp;Law firm representing customers action asking compensation for distress, not necessary a financial</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Read more :&nbsp;<a href=\"https://londonlovesbusiness.com/spg-law-launch-500m-group-action-against-british-airways-following-catastrophic-data-breach/\" target=\"_blank\" rel=\"noreferrer noopener\">SPG Law launch £500m Group Action against British Airways following catastrophic data breach</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to this security expert,&nbsp;<a href=\"https://twitter.com/kristofera/status/1038262610729156608?s=21\" target=\"_blank\" rel=\"noreferrer noopener\">the website remains unsecure</a>.&nbsp;<a href=\"https://twitter.com/kristofera/status/1038336281325928448?s=21\" target=\"_blank\" rel=\"noreferrer noopener\">read more</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More technical explanation / supposition :&nbsp;<a href=\"https://www.riskiq.com/blog/labs/magecart-british-airways-breach/\" target=\"_blank\" rel=\"noreferrer noopener\">Inside the Magecart Breach of British Airways: How 22 Lines of Code Claimed 380,000 Victims</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','After Air Canada Breach Here Comes British Airways','','publish','open','open','','after-air-canada-breach-here-comes-british-airways','','\nhttps://www.riskiq.com/blog/labs/magecart-british-airways-breach/','2020-11-29 21:57:20','2020-11-29 21:57:20','',0,'https://www.datarainbow.eu/?p=1912',0,'post','',0);
