INSERT INTO `wp_posts` (`ID`, `post_author`, `post_date`, `post_date_gmt`, `post_content`, `post_title`, `post_excerpt`, `post_status`, `comment_status`, `ping_status`, `post_password`, `post_name`, `to_ping`, `pinged`, `post_modified`, `post_modified_gmt`, `post_content_filtered`, `post_parent`, `guid`, `menu_order`, `post_type`, `post_mime_type`, `comment_count`) VALUES (1914,1,'2020-11-29 21:54:17','2020-11-29 21:54:17','<!-- wp:paragraph -->\n<p><a href=\"https://www.thetimes.co.uk/edition/news/hundreds-of-thousands-lose-bank-details-as-ba-hacked-nzktw262k?CMP=Sprkr-_-Editorial-_-thetimes-_-Unspecified-_-TWITTER\" target=\"_blank\" rel=\"noreferrer noopener\">Hundreds of thousands lose bank details as British Airways hacked</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://uk.businessinsider.com/british-airways-customer-data-stolen-2018-9?r=US&amp;IR=T\" target=\"_blank\" rel=\"noreferrer noopener\">Data stolen from hundreds of thousands of British Airways customers in major breach</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A data breach follows a data breach. It\'s not IF it\'s when. Is your organisation ready to react?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The New European Data Protection Regulation that entered into force on May 25 after a grace period of two years of adaptation is in continuity of the previous data Protection Directive. One of the main change from the previous situation is a short period of required reactions after a data breach.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR introduced a 72-hour notification requirements. It is therefore critical for organisations to have a systematic GDPR incident response protocol in place to meet these requirements. Having a breach response plan in place is critical. Every organisation need to appoint one central post to receive all data breach in order to act promptly, to evaluate against notification requirements, and analyse overall risk against the underlying data inventory.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to the&nbsp;<a href=\"https://www.bbc.co.uk/news/uk-england-london-45440850\" target=\"_blank\" rel=\"noreferrer noopener\">BBC</a>, BA was made aware of the breach by a partner on Wednesday evening.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"BA said the breach took place between 22:58 BST on 21 August and 21:45 BST on 5 September.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"We have notified the police and relevant authorities. We take the protection of our customers\' data very seriously.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The BBC reports \"<em>BA said all customers affected by the breach had been contacted on Thursday night. The breach only affects those people who bought tickets during the timeframe provided by BA, and not on other occasions</em>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.bbc.co.uk/news/uk-england-london-45440850\" target=\"_blank\" rel=\"noreferrer noopener\">British Airways breach: How did hackers get in?</a>&nbsp;They are assumption that despite the encryption of customers data, these were intercepted from the website.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://Security%20Experts%20Comments%20%E2%80%93%20British%20Airways%20Data%20Breach/\" target=\"_blank\" rel=\"noreferrer noopener\">Security Experts Comments – British Airways Data Breach</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Not sure if every customer has been contacted as Mr Cruz added:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>At the moment, our number one purpose is contacting those customers that made those transactions to make sure they contact their credit card bank providers so they can follow their instructions on how to manage that breach of data.\"</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 33 GDPR requirements in case of data breach are :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>1 - In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with&nbsp;&nbsp;<a href=\"https://gdpr-info.eu/art-55-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 55</a>, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.&nbsp;</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>2 - Where the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>The processor shall notify the controller without undue delay after becoming aware of a personal data breach.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>BA knows how important it is to react on time to notify the Data Protection Authority and each and every customers hurt by the breach. The GDPR fines of 4% of General turn over or 20 Million € are serious incentives. Fine or notBA fine, a breach of customers data cause serious harm to the business reputation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"Already, we are told that Shares in BA owner IAG fell by 3.1% in early trade on Friday.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Social media is getting filled with comments from outraged customers :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Mat Thomas said he placed a booking on 27 August, but had not been contacted about the breach.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"Atrocious that I had to find out about this via news and twitter,\" he tweeted.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"Called bank and had to cancel both mine and my wife\'s card. Probably won\'t get it back before we fly (ironically).\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Gemma Theobald tweeted: \"My bank... are experiencing extremely high call volumes due to this breach! Couldn\'t do anything other than cancel my card... not how I wanted to spend my Thursday evening.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>If you have remained impermeable to the new regulation, should this data breach incident be a wake up call. Data breach and GDPR is not exclusively a concern for big organisations. That includes SMEs or charities or any entity processing personal data outside household activities. To check GDPR wide application, you can read my previous posts.&nbsp;<a href=\"https://www.linkedin.com/pulse/gdpr-material-territorial-scopes-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">GDPR Material and Territorial Scope.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Another major innovation of the GDPR is class action or remedies from data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/\" target=\"_blank\" rel=\"noreferrer noopener\">All you need to know about GDPR compliance.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.telegraph.co.uk/news/2018/09/07/british-airways-hacking-customers-cancel-credit-cards-airline/\" target=\"_blank\" rel=\"noreferrer noopener\">The Telegraph report</a>&nbsp;: \"Alex Cruz, BA\'s chairman, revealed the hackers were \"very sophisticated criminals\" who had not hacked the company\'s encrypted data, but rather gained \"illicit access\" to the airline\'s system.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This meant the breach went unnoticed for more than two weeks and now customers&nbsp;are scrambling to cancel their cards once the airline became aware of the breach on September 5.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>It is thought the number of payments compromised could be up to 400,000 and BA confirmed Friday morning hackers had obtained names, addresses, credit card numbers, expiry dates and the three-digit security codes on the backs of cards - plenty to make a fraudulent payment.&nbsp;</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>THE UK ICO has published \"Records management for small business means safeguarding people’s personal information and making sure any risk has been reduced.&nbsp;<a href=\"https://ico.org.uk/for-organisations/resources-and-support/data-protection-self-assessment/\" target=\"_blank\" rel=\"noreferrer noopener\">We’ve designed a records management checklist and many GDPR checklists</a>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So far, nothing much in the&nbsp;<a href=\"https://lnkd.in/dvAaQRd\" target=\"_blank\" rel=\"noreferrer noopener\">ICO statement in response to British Airways breach announcement</a>&nbsp;nor&nbsp;<a href=\"https://www.ncsc.gov.uk/news/ncsc-statement-reported-british-airways-data-breach\" target=\"_blank\" rel=\"noreferrer noopener\">NCSC statement on the reported British Airways data breach</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Interestingly, in July this year,&nbsp;<a href=\"https://www.theverge.com/2018/7/19/17591732/british-airways-gdpr-compliance-twitter-personal-data-security\" target=\"_blank\" rel=\"noreferrer noopener\">British Airways asked customers to post personal information on Twitter ‘to comply with GDPR’</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And finally, we can wonder if BA has suffered from the absence of an active DPO as they have advertised for the post :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"Role Title: Group Data Protection OfficerPurpose of the role</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>The Group Data Protection Officer will be&nbsp;responsibility for overseeing the Group’s dataprivacy compliance programmes. The role is appointed to fulfil the statutory obligation under the *General Data Protection Regulation to appoint a Data Protection Officer (DPO) for the Group companies meeting the statutory criteria...</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>The ability to remain calm, controlled and resilient\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.information-age.com/british-airways-customer-data-hacked-stolen-123474644/\" target=\"_blank\" rel=\"noreferrer noopener\">British Airways customer data hacked and stolen</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>UPDATE:</u></strong>&nbsp;~If the financial harm is difficult to prove and the ICO fine uncertain, BA risk to be liable to compensate for non-material damage under the Data Protection Act 2018. Psychological harm and distress are used for a customer class action by SPG law.<a href=\"https://www.telegraph.co.uk/business/2018/09/09/british-airways-customers-claim-data-distress/\" target=\"_blank\" rel=\"noreferrer noopener\">&nbsp;Law firm representing customers action asking compensation for distress, not necessary a financial</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Read more :&nbsp;<a href=\"https://londonlovesbusiness.com/spg-law-launch-500m-group-action-against-british-airways-following-catastrophic-data-breach/\" target=\"_blank\" rel=\"noreferrer noopener\">SPG Law launch £500m Group Action against British Airways following catastrophic data breach</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to this security expert,&nbsp;<a href=\"https://twitter.com/kristofera/status/1038262610729156608?s=21\" target=\"_blank\" rel=\"noreferrer noopener\">the website remains unsecure</a>.&nbsp;<a href=\"https://twitter.com/kristofera/status/1038336281325928448?s=21\" target=\"_blank\" rel=\"noreferrer noopener\">read more</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More technical explanation / supposition :&nbsp;<a href=\"https://www.riskiq.com/blog/labs/magecart-british-airways-breach/\" target=\"_blank\" rel=\"noreferrer noopener\">Inside the Magecart Breach of British Airways: How 22 Lines of Code Claimed 380,000 Victims</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','After Air Canada Breach Here Comes British Airways','','inherit','closed','closed','','1912-revision-v1','','','2020-11-29 21:54:17','2020-11-29 21:54:17','',1912,'https://www.datarainbow.eu/1912-revision-v1/',0,'revision','',0),(1918,1,'2018-05-08 22:01:41','2018-05-08 22:01:41','<!-- wp:paragraph -->\n<p>UPDATE from the European Commission :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/grounds-processing/does-consent-given-25-may-2018-continue-be-valid-once-gdpr-starts-apply-25-may-2018_en\" target=\"_blank\" rel=\"noreferrer noopener\">Does consent given before 25 May 2018 continue to be valid once the GDPR starts to apply on 25 May 2018?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A very much timely&nbsp;<a href=\"https://iconewsblog.org.uk/2018/05/09/raising-the-bar-consent-under-the-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">clarification from the ICO</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Myth#9 We have to get fresh consent from all our customers to comply with the GDPR. Steve Wood, Deputy Commissioner busts this myth in his latest blog about consent.&nbsp;<a href=\"https://iconewsblog.org.uk/2018/05/09/raising-the-bar-consent-under-the-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Read</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>So much confusion around Consent, one of the six&nbsp;<a href=\"https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/\" target=\"_blank\" rel=\"noreferrer noopener\">lawful basis of processing Personal Data under the GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some would argue consent is to be avoided at all cost. Too much risky with the right to withdraw and data portability. Go for&nbsp;<a href=\"https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/contract/\" target=\"_blank\" rel=\"noreferrer noopener\">contract</a>&nbsp;or&nbsp;<a href=\"https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/when-can-we-rely-on-legitimate-interests/\" target=\"_blank\" rel=\"noreferrer noopener\">Legitimate Interest</a>, they advise.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Others point that if consent is the first ground and Legitimate Interest the last, there is a good reason for that. ICO have&nbsp;<a href=\"https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/\" target=\"_blank\" rel=\"noreferrer noopener\">stated</a>&nbsp;“<em>no single basis is ’better’ or more important than the others – which basis is most appropriate to use will depend on your purpose and relationship with the individual</em>”.&nbsp;<a href=\"https://iconewsblog.org.uk/2017/08/16/consent-is-not-the-silver-bullet-for-gdpr-compliance/\" target=\"_blank\" rel=\"noreferrer noopener\">Consent is not the ‘silver bullet’ for GDPR compliance</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Legitimate Interest ? Too tricky others argue. It needs necessity and the right balance of rights and freedoms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On Twitter, started a treat around the National Trust requesting new consents.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you previously processed data based on Consent, should you, or should you not renew Consent?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>@PrivacyMatters : It’s really quite simple if you have obtained consent for eMarketing under 2002/58 (&amp; 95/46) then I don’t see the issue. The problem is many orgs haven’t or have incorrectly relied on the exception under R22(3). The big lie is that ‘we need to do this because of the GDPR</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Consent under GDPR is of a higher standard than the Data Protection Directive 1998. GDPR requires&nbsp;consent to be “<em>unambiguous</em>” and demonstrable (i.e. auditable) according to the requirements of&nbsp;<a href=\"https://gdpr-info.eu/art-7-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Art 7</a>. The Working Party Article 29 states : ‘<em>Consent which has been obtained to date continues to be valid in so far as it is in line with the conditions laid down in the GDPR</em>’. If it wasn\'t documented or not at the standard, WP guidance recommends to renew Consent or exceptionally switch ground. So does the&nbsp;<a href=\"https://ico.org.uk/media/about-the-ico/consultations/2013551/draft-gdpr-consent-guidance-for-consultation-201703.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Victoria Cetinkoya from the UK Information Office speaks [at around 21:14\'] on this&nbsp;<a href=\"https://t.co/tsrV6O2uyr\" target=\"_blank\" rel=\"noreferrer noopener\">video</a>&nbsp;where she says when you have Consent you might need to renew at GDPR standard to be compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;<a href=\"https://gdpr-info.eu/recitals/no-47/\" target=\"_blank\" rel=\"noreferrer noopener\">Recital 47</a>&nbsp;of the GDPR actually says that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Therefore, no need for consent as long as an opt-out option is offered&nbsp;<a href=\"https://gdpr-info.eu/art-21-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Art 21(2)</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Consent acquired prior to the GDPR can be undocumented. If Consent cannot be proved or because the pre-GDPR Consent is not sufficiently specific, unambiguous and freely given, it is not valid and therefore there is a need to renew consent. No?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>How to renew Consent without sending unsolicited emails to ask for Consent?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some complain these are unsolicited marketing emails. EPCR soft opt in electronic communication with previous clients with consent requirements for e-marketing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What if these are sent to prospective clients and not existing clients?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What if you don’t get any answer to the re-consent requests ?&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What about the new obligations of transparency?&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent is only valid if freely given.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It should not be detrimental to the use of the service.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So much confusion around Consent that arrises in large part from&nbsp;<a href=\"https://gdpr-info.eu/recitals/no-171/\" target=\"_blank\" rel=\"noreferrer noopener\">Recital 171</a>&nbsp;of the GDPR, which reads: “<em>Where processing is based on consent pursuant to Directive 95/46/EC, it is not necessary for the data subject to give his or her consent again&nbsp;if the manner in which the consent has been given is in line with the conditions of this Regulation, so as to allow the controller to continue such processing after the date of application of this Regulation</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is partly why some would argue consent is to be avoided at all cost. Too much risky with the right to withdraw and data portability.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Go for contract or Legitimate Interest. To what others reply that if consent is the first ground and Legitimate Interest the last, there is a good reason for that. Personally, I am not convinced the order presentation has any significance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Legitimate Interest ? Too tricky others argue. It needs necessity and the right balance of rights and freedoms as mentioned above.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On Twitter, started a treat around the National Trust requesting new consents.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you previously processed data based on Consent, should you, or should you not renew Consent?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>@PrivacyMatters : It’s really quite simple if you have obtained consent for eMarketing under 2002/58 (&amp; 95/46) then I don’t see the issue. The problem is many orgs haven’t or have incorrectly relied on the exception under R22(3). The big lie is that ‘we need to do this because of the GDPR</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The argument is that these are unsolicited marketing emails. Eprivacy soft opt in electronic communication with prior clients. consent requirements for e-marketing</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What if these are sent to prospective clients?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What if you don’t get any answer to the re-consent request ?&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What about the new obligations of transparency?&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent is only valid if freely given.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It should not be detrimental to the use of the service.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I want to share an email I have recently received from an Alumni group :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have recently received an email from an Alumni group:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"You may remember our recent email asking you to confirm how you would like to hear from us.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>I hope you value being part of our international alumni and friends community and enjoy being kept up-to-date with what’s happening at XXXX. However, in May 2018 the law is changing the way we keep in touch with you. In preparation for this change, we want to be clear what relationship you want with us so that we can provide you with information and updates about us. Please click the button below to submit your communication preferences.&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>We would dearly like to stay in contact with you but without us knowing your preferences, it might be goodbye fromXXXXX!</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Confirm preferences</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>By way of thanks for prompt replies, all forms submitted by 2nd March will be entered into a draw to win a £100 Amazon voucher.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An Amazon Voucher of 100£, Really?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>On 25 May 2018, the new General Data Protection Regulation (GDPR) will come into effect in the UK. This will replace the current Data Protection Act, but introduces new and different requirements for xxxxxxx around gaining consent to communicate with you as part of our alumni and friends community.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>As Xxxxxx makes the transition to becoming a UK registered charity in 2018, it is important that we are able to communicate the changes happening and our future plans as a charity with you.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Charities, alongside any private sector organisations, must follow the legal requirements of the General Data Protection Regulation coming into effect in May. The biggest change is that Xxxxxx Alumni and Friends must give permission to Xxxxxxx to send communications. Permission needs to be given by confirming your communication preferences through an online form, ensuring you opt-in to future communications from Xxxxx departments, including Marketing, Development and Alumni Relations.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>An email will be sent next week from the Development and Alumni Relations Office at Xxxxxxx in which you will need to update your communications preferences to receive communications from us via a short online form. Completing this will only take a few seconds of your time.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>We want to ensure we can provide the best service to you as one of our esteemed member of our international alumni and friends community, but we can only do this if we have your active consent to update you about xxxxxx news. As it is now a legal requirement to gain your permission, if you do not opt-in to receiving these, unfortunately Xxxxxxx may not be able to send you future communications.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The best part of the privacy policy, when you click the link, is “<em>From this information, xxxx may carry out wealth screening. Wealth Screening involves reviewing personal informatoin, such as the information listed above, to undertake an analysis&nbsp;of who might support the organization, in the future and to what degree that support might be made available and to understand the preferences of current parents, staff and students about events, communications and services.</em>” Surprising! Is this not why the&nbsp;<a href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2017/04/ico-fines-eleven-more-charities/\" target=\"_blank\" rel=\"noreferrer noopener\">ICO fined 12 UK charities</a>. [<em>The Information Commissioner’s Office has fined eleven charities that breached the Data Protection Act by misusing donors’ personal data. ICO investigations found many of the charities secretly screened millions of donors so they could target them for additional funds. Some charities traced and targeted new or lapsed donors by piecing together personal information obtained from other sources. And some traded personal details with other charities creating a large pool of donor data for sale.</em>] A&nbsp;<a href=\"https://ico.org.uk/action-weve-taken/charity-fundraising-enforcement-action/\" target=\"_blank\" rel=\"noreferrer noopener\">summary of how each charity breached the law can be found here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, you are telling me you share my data with your US office. You forgot to tell me how as US is a country of non adequate data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>By sending me an email to re-consent, I am discovering you’ve been infringing the law. Can I sue you?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I do not Consent to wealth profiling, I still want to be part of the alumni group, is this possible? Consent in principal should not be detrimental to the use of the service.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You tell me you share my data with your US office. You forgot to tell me how?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>By sending me an email to re-consent, I am discovering you’ve been infringing the law. Can I sue you?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://ico.org.uk/action-weve-taken/enforcement/honda-motor-europe-limited/\" target=\"_blank\" rel=\"noreferrer noopener\">Honda Motor</a>&nbsp;played the risky game by sending 289,790 emails aiming to clarify certain customers’ choices for receiving marketing to be fined by the ICO.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As you see, I remain confused.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for&nbsp;<a href=\"https://ico.org.uk/for-organisations/marketing/\" target=\"_blank\" rel=\"noreferrer noopener\">marketing</a>, sending emails or SMSs, the regulation under the GDPR is completed by the&nbsp;<a href=\"http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:2002L0058:20091219:EN:PDF\" target=\"_blank\" rel=\"noreferrer noopener\">Privacy and Electronic Communications Directive</a>. Marketing emails or SMSs can be sent on an opt-out basis where the mailing list is collected following the sale of a product or service. The&nbsp;<a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONSIL%3AST_8537_2018_INIT&amp;from=EN\" target=\"_blank\" rel=\"noreferrer noopener\">e-Privacy Regulation</a>&nbsp;is, undergoing reform presently - to be replaced by a new e-Privacy Regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further reading by Stewart Room of PwC \'<a href=\"http://pwc.blogs.com/data_protection/2017/06/applying-gdpr-to-the-legacy-data-environment-and-the-processor-engagement-framework.html\" target=\"_blank\" rel=\"noreferrer noopener\">The idea of refreshing consents is that same as refreshing processor engagement frameworks.</a>\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Valerie Lyons from BHconsulting&nbsp;<a href=\"http://bhconsulting.ie/permission-slip-consent-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Permission slip: what consent means and where it really applies to GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','Consenting to Consent Needs Consent?','','publish','open','open','','consenting-to-consent-needs-consent','','','2020-11-29 22:03:28','2020-11-29 22:03:28','',0,'https://www.datarainbow.eu/?p=1918',0,'post','',0),(1916,1,'2020-11-29 21:57:12','2020-11-29 21:57:12','','Screenshot 2020-11-29 at 21.56.55','','inherit','open','closed','','screenshot-2020-11-29-at-21-56-55','','','2020-11-29 21:57:12','2020-11-29 21:57:12','',1912,'https://www.datarainbow.eu/wp-content/uploads/2018/09/Screenshot-2020-11-29-at-21.56.55.png',0,'attachment','image/png',0),(1920,1,'2020-11-29 22:03:28','2020-11-29 22:03:28','<!-- wp:paragraph -->\n<p>UPDATE from the European Commission :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/grounds-processing/does-consent-given-25-may-2018-continue-be-valid-once-gdpr-starts-apply-25-may-2018_en\" target=\"_blank\" rel=\"noreferrer noopener\">Does consent given before 25 May 2018 continue to be valid once the GDPR starts to apply on 25 May 2018?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A very much timely&nbsp;<a href=\"https://iconewsblog.org.uk/2018/05/09/raising-the-bar-consent-under-the-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">clarification from the ICO</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Myth#9 We have to get fresh consent from all our customers to comply with the GDPR. Steve Wood, Deputy Commissioner busts this myth in his latest blog about consent.&nbsp;<a href=\"https://iconewsblog.org.uk/2018/05/09/raising-the-bar-consent-under-the-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Read</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>So much confusion around Consent, one of the six&nbsp;<a href=\"https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/\" target=\"_blank\" rel=\"noreferrer noopener\">lawful basis of processing Personal Data under the GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some would argue consent is to be avoided at all cost. Too much risky with the right to withdraw and data portability. Go for&nbsp;<a href=\"https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/contract/\" target=\"_blank\" rel=\"noreferrer noopener\">contract</a>&nbsp;or&nbsp;<a href=\"https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/when-can-we-rely-on-legitimate-interests/\" target=\"_blank\" rel=\"noreferrer noopener\">Legitimate Interest</a>, they advise.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Others point that if consent is the first ground and Legitimate Interest the last, there is a good reason for that. ICO have&nbsp;<a href=\"https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/\" target=\"_blank\" rel=\"noreferrer noopener\">stated</a>&nbsp;“<em>no single basis is ’better’ or more important than the others – which basis is most appropriate to use will depend on your purpose and relationship with the individual</em>”.&nbsp;<a href=\"https://iconewsblog.org.uk/2017/08/16/consent-is-not-the-silver-bullet-for-gdpr-compliance/\" target=\"_blank\" rel=\"noreferrer noopener\">Consent is not the ‘silver bullet’ for GDPR compliance</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Legitimate Interest ? Too tricky others argue. It needs necessity and the right balance of rights and freedoms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On Twitter, started a treat around the National Trust requesting new consents.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you previously processed data based on Consent, should you, or should you not renew Consent?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>@PrivacyMatters : It’s really quite simple if you have obtained consent for eMarketing under 2002/58 (&amp; 95/46) then I don’t see the issue. The problem is many orgs haven’t or have incorrectly relied on the exception under R22(3). The big lie is that ‘we need to do this because of the GDPR</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Consent under GDPR is of a higher standard than the Data Protection Directive 1998. GDPR requires&nbsp;consent to be “<em>unambiguous</em>” and demonstrable (i.e. auditable) according to the requirements of&nbsp;<a href=\"https://gdpr-info.eu/art-7-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Art 7</a>. The Working Party Article 29 states : ‘<em>Consent which has been obtained to date continues to be valid in so far as it is in line with the conditions laid down in the GDPR</em>’. If it wasn\'t documented or not at the standard, WP guidance recommends to renew Consent or exceptionally switch ground. So does the&nbsp;<a href=\"https://ico.org.uk/media/about-the-ico/consultations/2013551/draft-gdpr-consent-guidance-for-consultation-201703.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Victoria Cetinkoya from the UK Information Office speaks [at around 21:14\'] on this&nbsp;<a href=\"https://t.co/tsrV6O2uyr\" target=\"_blank\" rel=\"noreferrer noopener\">video</a>&nbsp;where she says when you have Consent you might need to renew at GDPR standard to be compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;<a href=\"https://gdpr-info.eu/recitals/no-47/\" target=\"_blank\" rel=\"noreferrer noopener\">Recital 47</a>&nbsp;of the GDPR actually says that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Therefore, no need for consent as long as an opt-out option is offered&nbsp;<a href=\"https://gdpr-info.eu/art-21-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Art 21(2)</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Consent acquired prior to the GDPR can be undocumented. If Consent cannot be proved or because the pre-GDPR Consent is not sufficiently specific, unambiguous and freely given, it is not valid and therefore there is a need to renew consent. No?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>How to renew Consent without sending unsolicited emails to ask for Consent?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some complain these are unsolicited marketing emails. EPCR soft opt in electronic communication with previous clients with consent requirements for e-marketing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What if these are sent to prospective clients and not existing clients?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What if you don’t get any answer to the re-consent requests ?&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What about the new obligations of transparency?&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent is only valid if freely given.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It should not be detrimental to the use of the service.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So much confusion around Consent that arrises in large part from&nbsp;<a href=\"https://gdpr-info.eu/recitals/no-171/\" target=\"_blank\" rel=\"noreferrer noopener\">Recital 171</a>&nbsp;of the GDPR, which reads: “<em>Where processing is based on consent pursuant to Directive 95/46/EC, it is not necessary for the data subject to give his or her consent again&nbsp;if the manner in which the consent has been given is in line with the conditions of this Regulation, so as to allow the controller to continue such processing after the date of application of this Regulation</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is partly why some would argue consent is to be avoided at all cost. Too much risky with the right to withdraw and data portability.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Go for contract or Legitimate Interest. To what others reply that if consent is the first ground and Legitimate Interest the last, there is a good reason for that. Personally, I am not convinced the order presentation has any significance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Legitimate Interest ? Too tricky others argue. It needs necessity and the right balance of rights and freedoms as mentioned above.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On Twitter, started a treat around the National Trust requesting new consents.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you previously processed data based on Consent, should you, or should you not renew Consent?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>@PrivacyMatters : It’s really quite simple if you have obtained consent for eMarketing under 2002/58 (&amp; 95/46) then I don’t see the issue. The problem is many orgs haven’t or have incorrectly relied on the exception under R22(3). The big lie is that ‘we need to do this because of the GDPR</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The argument is that these are unsolicited marketing emails. Eprivacy soft opt in electronic communication with prior clients. consent requirements for e-marketing</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What if these are sent to prospective clients?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What if you don’t get any answer to the re-consent request ?&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What about the new obligations of transparency?&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent is only valid if freely given.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It should not be detrimental to the use of the service.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I want to share an email I have recently received from an Alumni group :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have recently received an email from an Alumni group:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"You may remember our recent email asking you to confirm how you would like to hear from us.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>I hope you value being part of our international alumni and friends community and enjoy being kept up-to-date with what’s happening at XXXX. However, in May 2018 the law is changing the way we keep in touch with you. In preparation for this change, we want to be clear what relationship you want with us so that we can provide you with information and updates about us. Please click the button below to submit your communication preferences.&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>We would dearly like to stay in contact with you but without us knowing your preferences, it might be goodbye fromXXXXX!</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Confirm preferences</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>By way of thanks for prompt replies, all forms submitted by 2nd March will be entered into a draw to win a £100 Amazon voucher.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An Amazon Voucher of 100£, Really?!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>On 25 May 2018, the new General Data Protection Regulation (GDPR) will come into effect in the UK. This will replace the current Data Protection Act, but introduces new and different requirements for xxxxxxx around gaining consent to communicate with you as part of our alumni and friends community.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>As Xxxxxx makes the transition to becoming a UK registered charity in 2018, it is important that we are able to communicate the changes happening and our future plans as a charity with you.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Charities, alongside any private sector organisations, must follow the legal requirements of the General Data Protection Regulation coming into effect in May. The biggest change is that Xxxxxx Alumni and Friends must give permission to Xxxxxxx to send communications. Permission needs to be given by confirming your communication preferences through an online form, ensuring you opt-in to future communications from Xxxxx departments, including Marketing, Development and Alumni Relations.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>An email will be sent next week from the Development and Alumni Relations Office at Xxxxxxx in which you will need to update your communications preferences to receive communications from us via a short online form. Completing this will only take a few seconds of your time.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>We want to ensure we can provide the best service to you as one of our esteemed member of our international alumni and friends community, but we can only do this if we have your active consent to update you about xxxxxx news. As it is now a legal requirement to gain your permission, if you do not opt-in to receiving these, unfortunately Xxxxxxx may not be able to send you future communications.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The best part of the privacy policy, when you click the link, is “<em>From this information, xxxx may carry out wealth screening. Wealth Screening involves reviewing personal informatoin, such as the information listed above, to undertake an analysis&nbsp;of who might support the organization, in the future and to what degree that support might be made available and to understand the preferences of current parents, staff and students about events, communications and services.</em>” Surprising! Is this not why the&nbsp;<a href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2017/04/ico-fines-eleven-more-charities/\" target=\"_blank\" rel=\"noreferrer noopener\">ICO fined 12 UK charities</a>. [<em>The Information Commissioner’s Office has fined eleven charities that breached the Data Protection Act by misusing donors’ personal data. ICO investigations found many of the charities secretly screened millions of donors so they could target them for additional funds. Some charities traced and targeted new or lapsed donors by piecing together personal information obtained from other sources. And some traded personal details with other charities creating a large pool of donor data for sale.</em>] A&nbsp;<a href=\"https://ico.org.uk/action-weve-taken/charity-fundraising-enforcement-action/\" target=\"_blank\" rel=\"noreferrer noopener\">summary of how each charity breached the law can be found here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, you are telling me you share my data with your US office. You forgot to tell me how as US is a country of non adequate data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>By sending me an email to re-consent, I am discovering you’ve been infringing the law. Can I sue you?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I do not Consent to wealth profiling, I still want to be part of the alumni group, is this possible? Consent in principal should not be detrimental to the use of the service.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You tell me you share my data with your US office. You forgot to tell me how?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>By sending me an email to re-consent, I am discovering you’ve been infringing the law. Can I sue you?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://ico.org.uk/action-weve-taken/enforcement/honda-motor-europe-limited/\" target=\"_blank\" rel=\"noreferrer noopener\">Honda Motor</a>&nbsp;played the risky game by sending 289,790 emails aiming to clarify certain customers’ choices for receiving marketing to be fined by the ICO.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As you see, I remain confused.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for&nbsp;<a href=\"https://ico.org.uk/for-organisations/marketing/\" target=\"_blank\" rel=\"noreferrer noopener\">marketing</a>, sending emails or SMSs, the regulation under the GDPR is completed by the&nbsp;<a href=\"http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CONSLEG:2002L0058:20091219:EN:PDF\" target=\"_blank\" rel=\"noreferrer noopener\">Privacy and Electronic Communications Directive</a>. Marketing emails or SMSs can be sent on an opt-out basis where the mailing list is collected following the sale of a product or service. The&nbsp;<a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CONSIL%3AST_8537_2018_INIT&amp;from=EN\" target=\"_blank\" rel=\"noreferrer noopener\">e-Privacy Regulation</a>&nbsp;is, undergoing reform presently - to be replaced by a new e-Privacy Regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further reading by Stewart Room of PwC \'<a href=\"http://pwc.blogs.com/data_protection/2017/06/applying-gdpr-to-the-legacy-data-environment-and-the-processor-engagement-framework.html\" target=\"_blank\" rel=\"noreferrer noopener\">The idea of refreshing consents is that same as refreshing processor engagement frameworks.</a>\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Valerie Lyons from BHconsulting&nbsp;<a href=\"http://bhconsulting.ie/permission-slip-consent-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Permission slip: what consent means and where it really applies to GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','Consenting to Consent Needs Consent?','','inherit','closed','closed','','1918-revision-v1','','','2020-11-29 22:03:28','2020-11-29 22:03:28','',1918,'https://www.datarainbow.eu/1918-revision-v1/',0,'revision','',0),(1921,1,'2020-11-29 22:32:13','2020-11-29 22:32:13','<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong>UPDATE November 2020 :</strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recently the European National Security Agencgy, ENISA, has published a <a rel=\"noreferrer noopener\" href=\"https://www.enisa.europa.eu/news/enisa-news/enisa-threat-landscape-2020\" target=\"_blank\">report</a>&nbsp;pointting an increase of cyberattacks since the generalisation of WFH (Work From Home, due to the COVID-19 pandemic.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Since the ECJ decision in Juily 2020, Schrems-II v Facebook, It has been cleared that no personal data should leave the European Economic Area, EEA, or transferred in the hands of a US Communication Provider, a principle extended to any country not benefiting from an adequacy agreement. Therefore, all legal professions regularly exchanging data outside the EEA, need to take specific measures to ensure the security of these data, at an equivalent level as the protection offered by the GDPR within the EEA. Data subjects whom data are being exported have to be informed in all transparency, of the risks associated to such data transfer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>➡️ “70%_of the data breaches expose e-mails. Although username/e-mail and passwords (i.e credentials) are easily changed in contrast with personal details (i.e. date of birth), the focus is mostly on these in data breaches.\"&nbsp;</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Further read :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://securityaffairs.co/wordpress/70320/data-breach/panama-papers-epilogue.html\" target=\"_blank\" rel=\"noreferrer noopener\">Mossack Fonseca law firm shuts down operations 2 years after Panama Papers</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://headtopics.com/fr/rancongiciel-l-enfer-professionnel-des-victimes-au-tribunal-16490877\" target=\"_blank\" rel=\"noreferrer noopener\">Rançongiciel : l’«enfer professionnel» des victimes au tribunal</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Pour moi, il y a eu un avant et un après le mercredi 26 octobre 2016,raconte, la voix ferme et haute, la robe noire de 68 ans, spécialisée en droit corporel.J’ai perdu quatre années de vie, de données et de pratique professionnelle.»</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://securityboulevard.com/2020/04/insurance-client-sues-small-law-firm-1-5m-for-dark-overlord-payment/\" target=\"_blank\" rel=\"noreferrer noopener\">Insurance Client Sues Small Law Firm $1.5M for Dark Overlord Payment</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>...the insurance company sued the law firm in federal court in Kansas City. Hiscox Insurance Co., et. al., v. Warden Grier, Dkt. No. 4:20-cv-00237-NKL (E.D. Missouri). The company alleged that the law firm breached its legal obligations under the retainer agreement with the company, that it breached its ethical obligations to protect client confidences, and that it was negligent in failing to protect the client data.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.legalfutures.co.uk/latest-news/law-firms-under-constant-cyber-attack\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Law firms under constant cyber-attack</strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.bbc.com/news/technology-52632729\" target=\"_blank\" rel=\"noreferrer noopener\">Hackers hit A-list law firm of Lady Gaga, Drake and Madonna</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thegazette.co.uk/all-notices/content/103439\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Report shows UK law firms unprepared for cyber attacks</strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For&nbsp;<a href=\"https://twitter.com/ICOnews\" target=\"_blank\" rel=\"noreferrer noopener\">@ICOnews</a>&nbsp;Firms must protect the personal data of their clients.&nbsp;<a href=\"https://www.fca.org.uk/news/statements/fca-warns-firms-be-responsible-when-handling-client-data?utm_source=linkedin&amp;utm_medium=information+commissioner%27s+office&amp;utm_term=aa1564be-c90b-4871-a695-e6edf4fa4e37&amp;utm_content=&amp;utm_campaign=\" target=\"_blank\" rel=\"noreferrer noopener\">The Financial Conduct Authority warns firms</a>&nbsp;that they must be responsible when they are handling client data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.law.com/international-edition/2020/05/25/the-six-biggest-cybersecurity-threats-to-law-firms/?slreturn=20201020113209\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>The Six Biggest Cybersecurity Threats to Law Firms</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Law Firm Internet Security and Data Protection</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Data breaches are unfortunately becoming more common, and law firms, given the sensitivity – and therefore value – of the data they handle, are falling victim to cyberattacks at an alarming rate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Just recently, we’ve seen a major data issue at legal software provider Advanced Computer Software,&nbsp;<a href=\"https://www.law.com/international-edition/2020/05/05/data-from-hundreds-of-law-firms-left-exposed-on-open-platform/\" target=\"_blank\" rel=\"noreferrer noopener\">affecting</a>&nbsp;over 190 of the industry’s most prestigious law firms.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.law.com/legaltechnews/2020/05/21/meet-the-hacker-groups-snatching-law-firms-client-data/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Meet the Hacker Groups Snatching Law Firms\' Client Data</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In nearly six months, at least seven law firms have been infiltrated by ransomware, according to media reports. Of the attacks, hacker groups Maze and REvil have taken responsibility for them all.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Both groups are well-known, said Mark Sangster, vice president and industry security strategist of cybersecurity firm eSentire. And unfortunately for legal, Sangster added, “it seems they lately have turned their focus upon law firms.”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.linkedin.com/pulse/pourquoi-le-respect-de-la-vie-privee-est-important-tara/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>POURQUOI LE RESPECT DE LA VIE PRIVEE EST UNE IMPERATIVE</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.zataz.com/piratage-davocats-et-de-magistrats-la-piste-de-la-fuite-de-donnees-sous-la-robe/\" target=\"_blank\" rel=\"noreferrer noopener\">Piratage d’avocats et de magistrats, une fuite de données sous la robe ?</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a rel=\"noreferrer noopener\" href=\"https://siecledigital.fr/2019/11/13/acces-a-privileges-les-cabinets-davocat-plus-que-jamais-sensibles-aux-tentatives-de-cyberattaque/\" target=\"_blank\"><strong>Accès à privilèges&nbsp;: les cabinets d’avocat plus que jamais sensibles aux tentatives de cyberattaque</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>‘La moitié des entreprises en France et dans le monde a été victime de fraude au cours des 24 derniers mois’ être en conformité&nbsp;<a href=\"https://twitter.com/hashtag/RGDP?src=hashtag_click\" target=\"_blank\" rel=\"noreferrer noopener\">#RGDP</a>&nbsp;aurait sensiblement réduit les risques d’exposition des données.&nbsp;<a href=\"https://www.lemondedudroit.fr/publications/248-etudes-et-documents/72319-etude-pwc-entreprises-france-monde-fraude.html?utm_source=newsletter_1703&amp;utm_medium=email&amp;utm_campaign=l-hebdo-du-18-novembre-2020-entreprises-et-fraude,-m%C3%A9diation,-elections-ordinales-paris-2020,-proposition-de-loi-relative-%C3%A0-la-s%C3%A9curit%C3%A9-globale\" target=\"_blank\" rel=\"noreferrer noopener\">Le Monde du Droit</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lire plus en detail&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.village-justice.com/articles/les-professionnels-droit-protection-des-donnees,37019.html\" target=\"_blank\">LES PROFESSIONNELS DU DROIT ET LA PROTECTION DES DONNÉES.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.lepoint.fr/justice/le-monde-judiciaire-francais-cible-par-une-vaste-cyberattaque-06-09-2020-2390539_2386.php\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Le monde judiciaire français ciblé par une vaste cyberattaque</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://wilo.blog/avocats-cyber-attaques/#:~:text=Avec%20des%20infrastructures%20de%20protection,%C3%A9manant%20de%20ces%20grands%20groupes.&amp;text=Ce%20sont%20des%20cibles%20parfaites,carrefour%20de%20donn%C3%A9es%20inatteignables%20habituellement.\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Cabinets d’avocats : la cible idéale des cyber-attaques</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.linkedin.com/pulse/why-should-we-all-care-panamapapers-tara-taubman-bassirian/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Un système informatique non sécurisé du cabinet d\'affaires Mossac Fonseka est ce qui a permis la divulgation des Panama Papers</strong></a><strong>.&nbsp;</strong><a href=\"https://www.wired.co.uk/article/panama-papers-mossack-fonseca-website-security-problems\" target=\"_blank\" rel=\"noreferrer noopener\">The security flaws at the heart of the Panama Papers</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.lemondeinformatique.fr/actualites/lire-revil-decryptage-du-plus-terrible-des-ransomware-81071.html\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>REvil : décryptage du plus terrible des ransomware</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.presse-citron.net/donnees-personnelles-plusieurs-celebrites-volees-cabinet-avocat/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Des données personnelles de plusieurs célébrités ont été volées à un cabinet d’avocat</strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.reuters.com/article/us-cyber-insidertrading-idUSKBN14G1D5\" target=\"_blank\" rel=\"noreferrer noopener\">U.S. accuses Chinese citizens of hacking law firms, insider trading</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Three Chinese citizens have been criminally charged in the United States with trading on confidential corporate information obtained by hacking into networks and servers of law firms working on mergers, U.S. prosecutors said on Tuesday.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>🌸.&nbsp;<a href=\"https://www.linkedin.com/in/ACoAADJzMWwB2pVioRKkjCwNeb_bKb_ozIlILSo\" target=\"_blank\" rel=\"noreferrer noopener\">Marie-Hélène FABIANI</a>&nbsp;@Carole Painblanc cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAJArAwBvrFHET0vbliw4F0fXXcrAngsoTo\" target=\"_blank\" rel=\"noreferrer noopener\">François RUHLMANN-FOURNIER - Avocat, Médiateur et Arbitre</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAlsgycBbEKr76ndxvuNefocrWK_dEDoN3w\" target=\"_blank\" rel=\"noreferrer noopener\">Clotilde LEPETIT</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAABdePIBE5xRJAbWs73tb8GdtCgjnDDrIlw\" target=\"_blank\" rel=\"noreferrer noopener\">Brigitte Bogucki</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAFCA8wB5IF2_EN_7w_KbakwWlFCaa_yaZI\" target=\"_blank\" rel=\"noreferrer noopener\">Xavier Autain</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAABkVY40BF4HVRzDvIXDIJAoP7ay1DQAS1LM\" target=\"_blank\" rel=\"noreferrer noopener\">Julie Couturier</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAA5BdcgBMOZ8YDknixl47fJYnMcQgiJbMsk\" target=\"_blank\" rel=\"noreferrer noopener\">Vincent Nioré</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAB4hqL0BMOeLJz57FZAV_1r99R932vX9U6o\" target=\"_blank\" rel=\"noreferrer noopener\">Nathalie ATTIAS</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAACSBDpgBnLfbijuy03AaOYNq0c54ZXRO5ow\" target=\"_blank\" rel=\"noreferrer noopener\">geneviève CATTAN</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAtLk9EBfdVSoqmOT6VQ-8b3QcV0e07ef0E\" target=\"_blank\" rel=\"noreferrer noopener\">Margaux Durand-Poincloux</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAdmWVcBWpDtDnffRPdPiznX9cj4dqIraRw\" target=\"_blank\" rel=\"noreferrer noopener\">Chloe Bouchez</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAB6rAEB4x7Sl-ghKoA-3SWVgi_zYZ2wWTo\" target=\"_blank\" rel=\"noreferrer noopener\">Joëlle Monlouis</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>👨‍🎓. Cybersécurité ➡️ Ransomware ➡️ Data Breach</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ Sensitive data ➡️. ENCRYPTION</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ Transmission des données hors EEA</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ CEJ Schrems-II ➡️ Cookies ➡️ Directive ePrivacy</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ Planet49 ➡️ Fashion ID</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cybers%C3%A9curit%C3%A9&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6734106584634408960\" target=\"_blank\" rel=\"noreferrer noopener\">#cybersécurité</a>&nbsp;des cabinets d’avocats ? Parlons-en avec la Présidente du&nbsp;<a href=\"https://www.linkedin.com/company/conseil-national-des-barreaux-les-avocats/\" target=\"_blank\" rel=\"noreferrer noopener\">CNB Conseil national des barreaux - les avocats</a>,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAQs76YBkocjrI9EdzSBrVT4nET9rpVE5KU\" target=\"_blank\" rel=\"noreferrer noopener\">Christiane Féral-Schuhl</a>: \"Désormais la cybersécurité fait partie de la pratique quotidienne de l’avocat\" &gt;&nbsp;<a href=\"https://lnkd.in/dUwUPh9\" target=\"_blank\" rel=\"noreferrer noopener\">https://lnkd.in/dUwUPh9</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Mossack Fonseca hack and the Panama Papers scandal should have been a wake up call for all law firms to take clients data security more seriously. Here is&nbsp;<a href=\"http://www.linkedin.com/pulse/why-should-we-all-care-panamapapers-tara-taubman-bassirian\" target=\"_blank\" rel=\"noreferrer noopener\">Why we Should All Care About Panamapapers</a>&nbsp;even if we have no offshore investment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Law Firm Cybersecurity is at high risk. Dozens of big firms are targeted by hackers seeking for sensitive financial information. Major law firms including Cravah and Will Gotshal have suffered data breach. FBI has issued warnings. Still too many use insecure email exchange for information transfer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736#item172505250\" target=\"_blank\" rel=\"noreferrer noopener\"><em>Threats of Litigation After Data Breaches at Major Law Firms.</em></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>...both&nbsp;Weil Gotshal &amp; Manges and Cravath, Swaine &amp; Moore as well as other firms have suffered data breaches in recent months, put new attention on the potential consequences for&nbsp;law firms with lax security.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736/item197407102\" target=\"_blank\" rel=\"noreferrer noopener\">Daniel Solove</a>, US privacy scholar wrote</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Law firms are facing grave privacy and security risks. Although a number of firms are taking steps to address these risks, the industry as a whole needs to grasp the severity of the risk. For firms, privacy and security risks can be significantly higher than for other organizations. Incidents can be catastrophic. On a scale of 1 to 10, the risks law firms are facing are an 11.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Daniel Solove describes the situation and offers solutions to avoid the harms caused to the reputation and clients of a law firm attacked.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Just as an example, here is a&nbsp;<a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736#item197405827\" target=\"_blank\" rel=\"noreferrer noopener\">List of data breaches and cyber attacks in February 2017</a>. Recently,&nbsp;<a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736#item197405905\" target=\"_blank\" rel=\"noreferrer noopener\">1500 companies in over 100 countries hit by malicious Adwind backdoor&nbsp;RAT</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, French Data Protection Authority has been publishing advices, including&nbsp;<a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736#item197404361\" target=\"_blank\" rel=\"noreferrer noopener\">easy ways of encryption</a>. I still hear Solicitors, lawyers, Notaries, exchanging sensitive data via simple emails or Dropbox. These are recipes for disaster and lack of consideration for clients. Apart from the reputation disaster, the&nbsp;<a href=\"http://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian?trk=mp-reader-card\" target=\"_blank\" rel=\"noreferrer noopener\">GDPR</a>&nbsp;new EU data protection regulation has serious fines to consider. Think well before too late : 20M Euro or 4% of world turnover fines.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sometimes the treat comes from an insider. You might want to monitor live transfer of data from your network. If your employees bring their own devices, here is a good advice from the&nbsp;<a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736/item197407102\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I keep my sources of information updated on&nbsp;<a href=\"http://www.pearltrees.com/idigital/gdpr-new-text/id15747243#item175275842\" target=\"_blank\" rel=\"noreferrer noopener\">Pearltrees</a>&nbsp;curation:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736\" target=\"_blank\" rel=\"noreferrer noopener\">Law Firm data security</a></li><li>The&nbsp;<a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736\" target=\"_blank\" rel=\"noreferrer noopener\">Panamapapers</a>&nbsp;scandal and the law firm Mossack Fonseca.</li><li><a href=\"https://www.law.com/legaltechnews/2018/12/27/5-cybersecurity-habits-law-firms-should-kick-in-2019/?slreturn=20181127165526\" target=\"_blank\" rel=\"noreferrer noopener\">5 Cybersecurity Habits Law Firms Should Kick in 2019</a></li><li>Read&nbsp;<a href=\"https://www.linkedin.com/pulse/website-transparency-cookies-privacy-notice-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">Website Transparency and Cookies and Privacy Notices</a></li><li>Read&nbsp;<a href=\"https://www.linkedin.com/pulse/gdpr-material-territorial-scopes-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">GDPR Material and Territorial Scope</a></li><li>Read&nbsp;<a href=\"https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/\" target=\"_blank\" rel=\"noreferrer noopener\">All You Need to Know About GDPR</a></li><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','Law Firm Internet Security and Data Protection','Recently the European National Security Agencgy, ENISA, has published a report pointting an increase of cyberattacks since the generalisation of WFH (Work From Home, due to the COVID-19 pandemic.\n\n','publish','open','open','','law-firm-internet-security-and-data-protection-2','','\nhttps://wilo.blog/avocats-cyber-attaques/#:~:text=Avec%20des%20infrastructures%20de%20protection,%C3%A9manant%20de%20ces%20grands%20groupes.&text=Ce%20sont%20des%20cibles%20parfaites,carrefour%20de%20donn%C3%A9es%20inatteignables%20habituellement.','2020-12-11 21:50:29','2020-12-11 21:50:29','',0,'https://www.datarainbow.eu/?p=1921',0,'post','',2),(2007,2,'2020-12-11 21:50:29','2020-12-11 21:50:29','<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong>UPDATE November 2020 :</strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recently the European National Security Agencgy, ENISA, has published a <a rel=\"noreferrer noopener\" href=\"https://www.enisa.europa.eu/news/enisa-news/enisa-threat-landscape-2020\" target=\"_blank\">report</a>&nbsp;pointting an increase of cyberattacks since the generalisation of WFH (Work From Home, due to the COVID-19 pandemic.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Since the ECJ decision in Juily 2020, Schrems-II v Facebook, It has been cleared that no personal data should leave the European Economic Area, EEA, or transferred in the hands of a US Communication Provider, a principle extended to any country not benefiting from an adequacy agreement. Therefore, all legal professions regularly exchanging data outside the EEA, need to take specific measures to ensure the security of these data, at an equivalent level as the protection offered by the GDPR within the EEA. Data subjects whom data are being exported have to be informed in all transparency, of the risks associated to such data transfer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>➡️ “70%_of the data breaches expose e-mails. Although username/e-mail and passwords (i.e credentials) are easily changed in contrast with personal details (i.e. date of birth), the focus is mostly on these in data breaches.\"&nbsp;</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Further read :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://securityaffairs.co/wordpress/70320/data-breach/panama-papers-epilogue.html\" target=\"_blank\" rel=\"noreferrer noopener\">Mossack Fonseca law firm shuts down operations 2 years after Panama Papers</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://headtopics.com/fr/rancongiciel-l-enfer-professionnel-des-victimes-au-tribunal-16490877\" target=\"_blank\" rel=\"noreferrer noopener\">Rançongiciel : l’«enfer professionnel» des victimes au tribunal</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Pour moi, il y a eu un avant et un après le mercredi 26 octobre 2016,raconte, la voix ferme et haute, la robe noire de 68 ans, spécialisée en droit corporel.J’ai perdu quatre années de vie, de données et de pratique professionnelle.»</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://securityboulevard.com/2020/04/insurance-client-sues-small-law-firm-1-5m-for-dark-overlord-payment/\" target=\"_blank\" rel=\"noreferrer noopener\">Insurance Client Sues Small Law Firm $1.5M for Dark Overlord Payment</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>...the insurance company sued the law firm in federal court in Kansas City. Hiscox Insurance Co., et. al., v. Warden Grier, Dkt. No. 4:20-cv-00237-NKL (E.D. Missouri). The company alleged that the law firm breached its legal obligations under the retainer agreement with the company, that it breached its ethical obligations to protect client confidences, and that it was negligent in failing to protect the client data.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.legalfutures.co.uk/latest-news/law-firms-under-constant-cyber-attack\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Law firms under constant cyber-attack</strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.bbc.com/news/technology-52632729\" target=\"_blank\" rel=\"noreferrer noopener\">Hackers hit A-list law firm of Lady Gaga, Drake and Madonna</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thegazette.co.uk/all-notices/content/103439\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Report shows UK law firms unprepared for cyber attacks</strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For&nbsp;<a href=\"https://twitter.com/ICOnews\" target=\"_blank\" rel=\"noreferrer noopener\">@ICOnews</a>&nbsp;Firms must protect the personal data of their clients.&nbsp;<a href=\"https://www.fca.org.uk/news/statements/fca-warns-firms-be-responsible-when-handling-client-data?utm_source=linkedin&amp;utm_medium=information+commissioner%27s+office&amp;utm_term=aa1564be-c90b-4871-a695-e6edf4fa4e37&amp;utm_content=&amp;utm_campaign=\" target=\"_blank\" rel=\"noreferrer noopener\">The Financial Conduct Authority warns firms</a>&nbsp;that they must be responsible when they are handling client data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.law.com/international-edition/2020/05/25/the-six-biggest-cybersecurity-threats-to-law-firms/?slreturn=20201020113209\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>The Six Biggest Cybersecurity Threats to Law Firms</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Law Firm Internet Security and Data Protection</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Data breaches are unfortunately becoming more common, and law firms, given the sensitivity – and therefore value – of the data they handle, are falling victim to cyberattacks at an alarming rate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Just recently, we’ve seen a major data issue at legal software provider Advanced Computer Software,&nbsp;<a href=\"https://www.law.com/international-edition/2020/05/05/data-from-hundreds-of-law-firms-left-exposed-on-open-platform/\" target=\"_blank\" rel=\"noreferrer noopener\">affecting</a>&nbsp;over 190 of the industry’s most prestigious law firms.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.law.com/legaltechnews/2020/05/21/meet-the-hacker-groups-snatching-law-firms-client-data/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Meet the Hacker Groups Snatching Law Firms\' Client Data</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In nearly six months, at least seven law firms have been infiltrated by ransomware, according to media reports. Of the attacks, hacker groups Maze and REvil have taken responsibility for them all.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Both groups are well-known, said Mark Sangster, vice president and industry security strategist of cybersecurity firm eSentire. And unfortunately for legal, Sangster added, “it seems they lately have turned their focus upon law firms.”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.linkedin.com/pulse/pourquoi-le-respect-de-la-vie-privee-est-important-tara/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>POURQUOI LE RESPECT DE LA VIE PRIVEE EST UNE IMPERATIVE</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.zataz.com/piratage-davocats-et-de-magistrats-la-piste-de-la-fuite-de-donnees-sous-la-robe/\" target=\"_blank\" rel=\"noreferrer noopener\">Piratage d’avocats et de magistrats, une fuite de données sous la robe ?</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a rel=\"noreferrer noopener\" href=\"https://siecledigital.fr/2019/11/13/acces-a-privileges-les-cabinets-davocat-plus-que-jamais-sensibles-aux-tentatives-de-cyberattaque/\" target=\"_blank\"><strong>Accès à privilèges&nbsp;: les cabinets d’avocat plus que jamais sensibles aux tentatives de cyberattaque</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>‘La moitié des entreprises en France et dans le monde a été victime de fraude au cours des 24 derniers mois’ être en conformité&nbsp;<a href=\"https://twitter.com/hashtag/RGDP?src=hashtag_click\" target=\"_blank\" rel=\"noreferrer noopener\">#RGDP</a>&nbsp;aurait sensiblement réduit les risques d’exposition des données.&nbsp;<a href=\"https://www.lemondedudroit.fr/publications/248-etudes-et-documents/72319-etude-pwc-entreprises-france-monde-fraude.html?utm_source=newsletter_1703&amp;utm_medium=email&amp;utm_campaign=l-hebdo-du-18-novembre-2020-entreprises-et-fraude,-m%C3%A9diation,-elections-ordinales-paris-2020,-proposition-de-loi-relative-%C3%A0-la-s%C3%A9curit%C3%A9-globale\" target=\"_blank\" rel=\"noreferrer noopener\">Le Monde du Droit</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lire plus en detail&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.village-justice.com/articles/les-professionnels-droit-protection-des-donnees,37019.html\" target=\"_blank\">LES PROFESSIONNELS DU DROIT ET LA PROTECTION DES DONNÉES.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.lepoint.fr/justice/le-monde-judiciaire-francais-cible-par-une-vaste-cyberattaque-06-09-2020-2390539_2386.php\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Le monde judiciaire français ciblé par une vaste cyberattaque</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://wilo.blog/avocats-cyber-attaques/#:~:text=Avec%20des%20infrastructures%20de%20protection,%C3%A9manant%20de%20ces%20grands%20groupes.&amp;text=Ce%20sont%20des%20cibles%20parfaites,carrefour%20de%20donn%C3%A9es%20inatteignables%20habituellement.\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Cabinets d’avocats : la cible idéale des cyber-attaques</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.linkedin.com/pulse/why-should-we-all-care-panamapapers-tara-taubman-bassirian/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Un système informatique non sécurisé du cabinet d\'affaires Mossac Fonseka est ce qui a permis la divulgation des Panama Papers</strong></a><strong>.&nbsp;</strong><a href=\"https://www.wired.co.uk/article/panama-papers-mossack-fonseca-website-security-problems\" target=\"_blank\" rel=\"noreferrer noopener\">The security flaws at the heart of the Panama Papers</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.lemondeinformatique.fr/actualites/lire-revil-decryptage-du-plus-terrible-des-ransomware-81071.html\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>REvil : décryptage du plus terrible des ransomware</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.presse-citron.net/donnees-personnelles-plusieurs-celebrites-volees-cabinet-avocat/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Des données personnelles de plusieurs célébrités ont été volées à un cabinet d’avocat</strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.reuters.com/article/us-cyber-insidertrading-idUSKBN14G1D5\" target=\"_blank\" rel=\"noreferrer noopener\">U.S. accuses Chinese citizens of hacking law firms, insider trading</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Three Chinese citizens have been criminally charged in the United States with trading on confidential corporate information obtained by hacking into networks and servers of law firms working on mergers, U.S. prosecutors said on Tuesday.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>🌸.&nbsp;<a href=\"https://www.linkedin.com/in/ACoAADJzMWwB2pVioRKkjCwNeb_bKb_ozIlILSo\" target=\"_blank\" rel=\"noreferrer noopener\">Marie-Hélène FABIANI</a>&nbsp;@Carole Painblanc cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAJArAwBvrFHET0vbliw4F0fXXcrAngsoTo\" target=\"_blank\" rel=\"noreferrer noopener\">François RUHLMANN-FOURNIER - Avocat, Médiateur et Arbitre</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAlsgycBbEKr76ndxvuNefocrWK_dEDoN3w\" target=\"_blank\" rel=\"noreferrer noopener\">Clotilde LEPETIT</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAABdePIBE5xRJAbWs73tb8GdtCgjnDDrIlw\" target=\"_blank\" rel=\"noreferrer noopener\">Brigitte Bogucki</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAFCA8wB5IF2_EN_7w_KbakwWlFCaa_yaZI\" target=\"_blank\" rel=\"noreferrer noopener\">Xavier Autain</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAABkVY40BF4HVRzDvIXDIJAoP7ay1DQAS1LM\" target=\"_blank\" rel=\"noreferrer noopener\">Julie Couturier</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAA5BdcgBMOZ8YDknixl47fJYnMcQgiJbMsk\" target=\"_blank\" rel=\"noreferrer noopener\">Vincent Nioré</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAB4hqL0BMOeLJz57FZAV_1r99R932vX9U6o\" target=\"_blank\" rel=\"noreferrer noopener\">Nathalie ATTIAS</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAACSBDpgBnLfbijuy03AaOYNq0c54ZXRO5ow\" target=\"_blank\" rel=\"noreferrer noopener\">geneviève CATTAN</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAtLk9EBfdVSoqmOT6VQ-8b3QcV0e07ef0E\" target=\"_blank\" rel=\"noreferrer noopener\">Margaux Durand-Poincloux</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAdmWVcBWpDtDnffRPdPiznX9cj4dqIraRw\" target=\"_blank\" rel=\"noreferrer noopener\">Chloe Bouchez</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAB6rAEB4x7Sl-ghKoA-3SWVgi_zYZ2wWTo\" target=\"_blank\" rel=\"noreferrer noopener\">Joëlle Monlouis</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>👨‍🎓. Cybersécurité ➡️ Ransomware ➡️ Data Breach</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ Sensitive data ➡️. ENCRYPTION</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ Transmission des données hors EEA</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ CEJ Schrems-II ➡️ Cookies ➡️ Directive ePrivacy</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ Planet49 ➡️ Fashion ID</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cybers%C3%A9curit%C3%A9&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6734106584634408960\" target=\"_blank\" rel=\"noreferrer noopener\">#cybersécurité</a>&nbsp;des cabinets d’avocats ? Parlons-en avec la Présidente du&nbsp;<a href=\"https://www.linkedin.com/company/conseil-national-des-barreaux-les-avocats/\" target=\"_blank\" rel=\"noreferrer noopener\">CNB Conseil national des barreaux - les avocats</a>,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAQs76YBkocjrI9EdzSBrVT4nET9rpVE5KU\" target=\"_blank\" rel=\"noreferrer noopener\">Christiane Féral-Schuhl</a>: \"Désormais la cybersécurité fait partie de la pratique quotidienne de l’avocat\" &gt;&nbsp;<a href=\"https://lnkd.in/dUwUPh9\" target=\"_blank\" rel=\"noreferrer noopener\">https://lnkd.in/dUwUPh9</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Mossack Fonseca hack and the Panama Papers scandal should have been a wake up call for all law firms to take clients data security more seriously. Here is&nbsp;<a href=\"http://www.linkedin.com/pulse/why-should-we-all-care-panamapapers-tara-taubman-bassirian\" target=\"_blank\" rel=\"noreferrer noopener\">Why we Should All Care About Panamapapers</a>&nbsp;even if we have no offshore investment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Law Firm Cybersecurity is at high risk. Dozens of big firms are targeted by hackers seeking for sensitive financial information. Major law firms including Cravah and Will Gotshal have suffered data breach. FBI has issued warnings. Still too many use insecure email exchange for information transfer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736#item172505250\" target=\"_blank\" rel=\"noreferrer noopener\"><em>Threats of Litigation After Data Breaches at Major Law Firms.</em></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>...both&nbsp;Weil Gotshal &amp; Manges and Cravath, Swaine &amp; Moore as well as other firms have suffered data breaches in recent months, put new attention on the potential consequences for&nbsp;law firms with lax security.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736/item197407102\" target=\"_blank\" rel=\"noreferrer noopener\">Daniel Solove</a>, US privacy scholar wrote</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Law firms are facing grave privacy and security risks. Although a number of firms are taking steps to address these risks, the industry as a whole needs to grasp the severity of the risk. For firms, privacy and security risks can be significantly higher than for other organizations. Incidents can be catastrophic. On a scale of 1 to 10, the risks law firms are facing are an 11.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Daniel Solove describes the situation and offers solutions to avoid the harms caused to the reputation and clients of a law firm attacked.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Just as an example, here is a&nbsp;<a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736#item197405827\" target=\"_blank\" rel=\"noreferrer noopener\">List of data breaches and cyber attacks in February 2017</a>. Recently,&nbsp;<a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736#item197405905\" target=\"_blank\" rel=\"noreferrer noopener\">1500 companies in over 100 countries hit by malicious Adwind backdoor&nbsp;RAT</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, French Data Protection Authority has been publishing advices, including&nbsp;<a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736#item197404361\" target=\"_blank\" rel=\"noreferrer noopener\">easy ways of encryption</a>. I still hear Solicitors, lawyers, Notaries, exchanging sensitive data via simple emails or Dropbox. These are recipes for disaster and lack of consideration for clients. Apart from the reputation disaster, the&nbsp;<a href=\"http://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian?trk=mp-reader-card\" target=\"_blank\" rel=\"noreferrer noopener\">GDPR</a>&nbsp;new EU data protection regulation has serious fines to consider. Think well before too late : 20M Euro or 4% of world turnover fines.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sometimes the treat comes from an insider. You might want to monitor live transfer of data from your network. If your employees bring their own devices, here is a good advice from the&nbsp;<a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736/item197407102\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I keep my sources of information updated on&nbsp;<a href=\"http://www.pearltrees.com/idigital/gdpr-new-text/id15747243#item175275842\" target=\"_blank\" rel=\"noreferrer noopener\">Pearltrees</a>&nbsp;curation:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736\" target=\"_blank\" rel=\"noreferrer noopener\">Law Firm data security</a></li><li>The&nbsp;<a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736\" target=\"_blank\" rel=\"noreferrer noopener\">Panamapapers</a>&nbsp;scandal and the law firm Mossack Fonseca.</li><li><a href=\"https://www.law.com/legaltechnews/2018/12/27/5-cybersecurity-habits-law-firms-should-kick-in-2019/?slreturn=20181127165526\" target=\"_blank\" rel=\"noreferrer noopener\">5 Cybersecurity Habits Law Firms Should Kick in 2019</a></li><li>Read&nbsp;<a href=\"https://www.linkedin.com/pulse/website-transparency-cookies-privacy-notice-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">Website Transparency and Cookies and Privacy Notices</a></li><li>Read&nbsp;<a href=\"https://www.linkedin.com/pulse/gdpr-material-territorial-scopes-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">GDPR Material and Territorial Scope</a></li><li>Read&nbsp;<a href=\"https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/\" target=\"_blank\" rel=\"noreferrer noopener\">All You Need to Know About GDPR</a></li><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','Law Firm Internet Security and Data Protection','Recently the European National Security Agencgy, ENISA, has published a report pointting an increase of cyberattacks since the generalisation of WFH (Work From Home, due to the COVID-19 pandemic.\n\n','inherit','closed','closed','','1921-revision-v1','','','2020-12-11 21:50:29','2020-12-11 21:50:29','',1921,'https://www.datarainbow.eu/1921-revision-v1/',0,'revision','',0),(1924,1,'2020-11-29 22:32:13','2020-11-29 22:32:13','<!-- wp:paragraph -->\n<p><span style=\"text-decoration: underline;\"><strong>UPDATE November 2020 :</strong></span></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recently the European National Security Agencgy, ENISA, has published a <a rel=\"noreferrer noopener\" href=\"https://www.enisa.europa.eu/news/enisa-news/enisa-threat-landscape-2020\" target=\"_blank\">report</a> pointting an increase of cyberattacks since the generalisation of WFH (Work From Home, due to the COVID-19 pandemic.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Since the ECJ decision in Juily 2020, Schrems-II v Facebook, It has been cleared that no personal data should leave the European Economic Area, EEA, or transferred in the hands of a US Communication Provider, a principle extended to any country not benefiting from an adequacy agreement. Therefore, all legal professions regularly exchanging data outside the EEA, need to take specific measures to ensure the security of these data, at an equivalent level as the protection offered by the GDPR within the EEA. Data subjects whom data are being exported have to be informed in all transparency, of the risks associated to such data transfer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>➡️ “70%_of the data breaches expose e-mails. Although username/e-mail and passwords (i.e credentials) are easily changed in contrast with personal details (i.e. date of birth), the focus is mostly on these in data breaches.\" </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Further read :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://securityaffairs.co/wordpress/70320/data-breach/panama-papers-epilogue.html\" target=\"_blank\" rel=\"noreferrer noopener\">Mossack Fonseca law firm shuts down operations 2 years after Panama Papers</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://headtopics.com/fr/rancongiciel-l-enfer-professionnel-des-victimes-au-tribunal-16490877\" target=\"_blank\" rel=\"noreferrer noopener\">Rançongiciel : l’«enfer professionnel» des victimes au tribunal</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Pour moi, il y a eu un avant et un après le mercredi 26 octobre 2016,raconte, la voix ferme et haute, la robe noire de 68 ans, spécialisée en droit corporel.J’ai perdu quatre années de vie, de données et de pratique professionnelle.»</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://securityboulevard.com/2020/04/insurance-client-sues-small-law-firm-1-5m-for-dark-overlord-payment/\" target=\"_blank\" rel=\"noreferrer noopener\">Insurance Client Sues Small Law Firm $1.5M for Dark Overlord Payment</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>...the insurance company sued the law firm in federal court in Kansas City. Hiscox Insurance Co., et. al., v. Warden Grier, Dkt. No. 4:20-cv-00237-NKL (E.D. Missouri). The company alleged that the law firm breached its legal obligations under the retainer agreement with the company, that it breached its ethical obligations to protect client confidences, and that it was negligent in failing to protect the client data.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.legalfutures.co.uk/latest-news/law-firms-under-constant-cyber-attack\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Law firms under constant cyber-attack</strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.bbc.com/news/technology-52632729\" target=\"_blank\" rel=\"noreferrer noopener\">Hackers hit A-list law firm of Lady Gaga, Drake and Madonna</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.thegazette.co.uk/all-notices/content/103439\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Report shows UK law firms unprepared for cyber attacks</strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For&nbsp;<a href=\"https://twitter.com/ICOnews\" target=\"_blank\" rel=\"noreferrer noopener\">@ICOnews</a>&nbsp;Firms must protect the personal data of their clients.&nbsp;<a href=\"https://www.fca.org.uk/news/statements/fca-warns-firms-be-responsible-when-handling-client-data?utm_source=linkedin&amp;utm_medium=information+commissioner%27s+office&amp;utm_term=aa1564be-c90b-4871-a695-e6edf4fa4e37&amp;utm_content=&amp;utm_campaign=\" target=\"_blank\" rel=\"noreferrer noopener\">The Financial Conduct Authority warns firms</a>&nbsp;that they must be responsible when they are handling client data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.law.com/international-edition/2020/05/25/the-six-biggest-cybersecurity-threats-to-law-firms/?slreturn=20201020113209\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>The Six Biggest Cybersecurity Threats to Law Firms</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Law Firm Internet Security and Data Protection</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Data breaches are unfortunately becoming more common, and law firms, given the sensitivity – and therefore value – of the data they handle, are falling victim to cyberattacks at an alarming rate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Just recently, we’ve seen a major data issue at legal software provider Advanced Computer Software,&nbsp;<a href=\"https://www.law.com/international-edition/2020/05/05/data-from-hundreds-of-law-firms-left-exposed-on-open-platform/\" target=\"_blank\" rel=\"noreferrer noopener\">affecting</a>&nbsp;over 190 of the industry’s most prestigious law firms.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.law.com/legaltechnews/2020/05/21/meet-the-hacker-groups-snatching-law-firms-client-data/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Meet the Hacker Groups Snatching Law Firms\' Client Data</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>In nearly six months, at least seven law firms have been infiltrated by ransomware, according to media reports. Of the attacks, hacker groups Maze and REvil have taken responsibility for them all.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Both groups are well-known, said Mark Sangster, vice president and industry security strategist of cybersecurity firm eSentire. And unfortunately for legal, Sangster added, “it seems they lately have turned their focus upon law firms.”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.linkedin.com/pulse/pourquoi-le-respect-de-la-vie-privee-est-important-tara/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>POURQUOI LE RESPECT DE LA VIE PRIVEE EST UNE IMPERATIVE</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.zataz.com/piratage-davocats-et-de-magistrats-la-piste-de-la-fuite-de-donnees-sous-la-robe/\" target=\"_blank\" rel=\"noreferrer noopener\">Piratage d’avocats et de magistrats, une fuite de données sous la robe ?</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a rel=\"noreferrer noopener\" href=\"https://siecledigital.fr/2019/11/13/acces-a-privileges-les-cabinets-davocat-plus-que-jamais-sensibles-aux-tentatives-de-cyberattaque/\" target=\"_blank\"><strong>Accès à privilèges : les cabinets d’avocat plus que jamais sensibles aux tentatives de cyberattaque</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>‘La moitié des entreprises en France et dans le monde a été victime de fraude au cours des 24 derniers mois’ être en conformité&nbsp;<a href=\"https://twitter.com/hashtag/RGDP?src=hashtag_click\" target=\"_blank\" rel=\"noreferrer noopener\">#RGDP</a>&nbsp;aurait sensiblement réduit les risques d’exposition des données.&nbsp;<a href=\"https://www.lemondedudroit.fr/publications/248-etudes-et-documents/72319-etude-pwc-entreprises-france-monde-fraude.html?utm_source=newsletter_1703&amp;utm_medium=email&amp;utm_campaign=l-hebdo-du-18-novembre-2020-entreprises-et-fraude,-m%C3%A9diation,-elections-ordinales-paris-2020,-proposition-de-loi-relative-%C3%A0-la-s%C3%A9curit%C3%A9-globale\" target=\"_blank\" rel=\"noreferrer noopener\">Le Monde du Droit</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lire plus en detail <a rel=\"noreferrer noopener\" href=\"https://www.village-justice.com/articles/les-professionnels-droit-protection-des-donnees,37019.html\" target=\"_blank\">LES PROFESSIONNELS DU DROIT ET LA PROTECTION DES DONNÉES.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.lepoint.fr/justice/le-monde-judiciaire-francais-cible-par-une-vaste-cyberattaque-06-09-2020-2390539_2386.php\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Le monde judiciaire français ciblé par une vaste cyberattaque</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://wilo.blog/avocats-cyber-attaques/#:~:text=Avec%20des%20infrastructures%20de%20protection,%C3%A9manant%20de%20ces%20grands%20groupes.&amp;text=Ce%20sont%20des%20cibles%20parfaites,carrefour%20de%20donn%C3%A9es%20inatteignables%20habituellement.\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Cabinets d’avocats : la cible idéale des cyber-attaques</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.linkedin.com/pulse/why-should-we-all-care-panamapapers-tara-taubman-bassirian/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Un système informatique non sécurisé du cabinet d\'affaires Mossac Fonseka est ce qui a permis la divulgation des Panama Papers</strong></a><strong>.&nbsp;</strong><a href=\"https://www.wired.co.uk/article/panama-papers-mossack-fonseca-website-security-problems\" target=\"_blank\" rel=\"noreferrer noopener\">The security flaws at the heart of the Panama Papers</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.lemondeinformatique.fr/actualites/lire-revil-decryptage-du-plus-terrible-des-ransomware-81071.html\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>REvil : décryptage du plus terrible des ransomware</strong></a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.presse-citron.net/donnees-personnelles-plusieurs-celebrites-volees-cabinet-avocat/\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Des données personnelles de plusieurs célébrités ont été volées à un cabinet d’avocat</strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><a href=\"https://www.reuters.com/article/us-cyber-insidertrading-idUSKBN14G1D5\" target=\"_blank\" rel=\"noreferrer noopener\">U.S. accuses Chinese citizens of hacking law firms, insider trading</a></h4>\n<!-- /wp:heading -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Three Chinese citizens have been criminally charged in the United States with trading on confidential corporate information obtained by hacking into networks and servers of law firms working on mergers, U.S. prosecutors said on Tuesday.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>🌸.&nbsp;<a href=\"https://www.linkedin.com/in/ACoAADJzMWwB2pVioRKkjCwNeb_bKb_ozIlILSo\" target=\"_blank\" rel=\"noreferrer noopener\">Marie-Hélène FABIANI</a>&nbsp;@Carole Painblanc cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAJArAwBvrFHET0vbliw4F0fXXcrAngsoTo\" target=\"_blank\" rel=\"noreferrer noopener\">François RUHLMANN-FOURNIER - Avocat, Médiateur et Arbitre</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAlsgycBbEKr76ndxvuNefocrWK_dEDoN3w\" target=\"_blank\" rel=\"noreferrer noopener\">Clotilde LEPETIT</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAABdePIBE5xRJAbWs73tb8GdtCgjnDDrIlw\" target=\"_blank\" rel=\"noreferrer noopener\">Brigitte Bogucki</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAFCA8wB5IF2_EN_7w_KbakwWlFCaa_yaZI\" target=\"_blank\" rel=\"noreferrer noopener\">Xavier Autain</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAABkVY40BF4HVRzDvIXDIJAoP7ay1DQAS1LM\" target=\"_blank\" rel=\"noreferrer noopener\">Julie Couturier</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAA5BdcgBMOZ8YDknixl47fJYnMcQgiJbMsk\" target=\"_blank\" rel=\"noreferrer noopener\">Vincent Nioré</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAB4hqL0BMOeLJz57FZAV_1r99R932vX9U6o\" target=\"_blank\" rel=\"noreferrer noopener\">Nathalie ATTIAS</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAACSBDpgBnLfbijuy03AaOYNq0c54ZXRO5ow\" target=\"_blank\" rel=\"noreferrer noopener\">geneviève CATTAN</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAtLk9EBfdVSoqmOT6VQ-8b3QcV0e07ef0E\" target=\"_blank\" rel=\"noreferrer noopener\">Margaux Durand-Poincloux</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAdmWVcBWpDtDnffRPdPiznX9cj4dqIraRw\" target=\"_blank\" rel=\"noreferrer noopener\">Chloe Bouchez</a>&nbsp;cc&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAB6rAEB4x7Sl-ghKoA-3SWVgi_zYZ2wWTo\" target=\"_blank\" rel=\"noreferrer noopener\">Joëlle Monlouis</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>👨‍🎓. Cybersécurité ➡️ Ransomware ➡️ Data Breach</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ Sensitive data ➡️. ENCRYPTION</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ Transmission des données hors EEA</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ CEJ Schrems-II ➡️ Cookies ➡️ Directive ePrivacy</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ Planet49 ➡️ Fashion ID</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>La&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cybers%C3%A9curit%C3%A9&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6734106584634408960\" target=\"_blank\" rel=\"noreferrer noopener\">#cybersécurité</a>&nbsp;des cabinets d’avocats ? Parlons-en avec la Présidente du&nbsp;<a href=\"https://www.linkedin.com/company/conseil-national-des-barreaux-les-avocats/\" target=\"_blank\" rel=\"noreferrer noopener\">CNB Conseil national des barreaux - les avocats</a>,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAQs76YBkocjrI9EdzSBrVT4nET9rpVE5KU\" target=\"_blank\" rel=\"noreferrer noopener\">Christiane Féral-Schuhl</a>: \"Désormais la cybersécurité fait partie de la pratique quotidienne de l’avocat\" &gt;&nbsp;<a href=\"https://lnkd.in/dUwUPh9\" target=\"_blank\" rel=\"noreferrer noopener\">https://lnkd.in/dUwUPh9</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Mossack Fonseca hack and the Panama Papers scandal should have been a wake up call for all law firms to take clients data security more seriously. Here is&nbsp;<a href=\"http://www.linkedin.com/pulse/why-should-we-all-care-panamapapers-tara-taubman-bassirian\" target=\"_blank\" rel=\"noreferrer noopener\">Why we Should All Care About Panamapapers</a>&nbsp;even if we have no offshore investment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Law Firm Cybersecurity is at high risk. Dozens of big firms are targeted by hackers seeking for sensitive financial information. Major law firms including Cravah and Will Gotshal have suffered data breach. FBI has issued warnings. Still too many use insecure email exchange for information transfer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736#item172505250\" target=\"_blank\" rel=\"noreferrer noopener\"><em>Threats of Litigation After Data Breaches at Major Law Firms.</em></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>...both&nbsp;Weil Gotshal &amp; Manges and Cravath, Swaine &amp; Moore as well as other firms have suffered data breaches in recent months, put new attention on the potential consequences for&nbsp;law firms with lax security.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736/item197407102\" target=\"_blank\" rel=\"noreferrer noopener\">Daniel Solove</a>, US privacy scholar wrote</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Law firms are facing grave privacy and security risks. Although a number of firms are taking steps to address these risks, the industry as a whole needs to grasp the severity of the risk. For firms, privacy and security risks can be significantly higher than for other organizations. Incidents can be catastrophic. On a scale of 1 to 10, the risks law firms are facing are an 11.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Daniel Solove describes the situation and offers solutions to avoid the harms caused to the reputation and clients of a law firm attacked.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Just as an example, here is a&nbsp;<a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736#item197405827\" target=\"_blank\" rel=\"noreferrer noopener\">List of data breaches and cyber attacks in February 2017</a>. Recently,&nbsp;<a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736#item197405905\" target=\"_blank\" rel=\"noreferrer noopener\">1500 companies in over 100 countries hit by malicious Adwind backdoor&nbsp;RAT</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, French Data Protection Authority has been publishing advices, including&nbsp;<a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736#item197404361\" target=\"_blank\" rel=\"noreferrer noopener\">easy ways of encryption</a>. I still hear Solicitors, lawyers, Notaries, exchanging sensitive data via simple emails or Dropbox. These are recipes for disaster and lack of consideration for clients. Apart from the reputation disaster, the&nbsp;<a href=\"http://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian?trk=mp-reader-card\" target=\"_blank\" rel=\"noreferrer noopener\">GDPR</a>&nbsp;new EU data protection regulation has serious fines to consider. Think well before too late : 20M Euro or 4% of world turnover fines.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Sometimes the treat comes from an insider. You might want to monitor live transfer of data from your network. If your employees bring their own devices, here is a good advice from the&nbsp;<a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736/item197407102\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I keep my sources of information updated on&nbsp;<a href=\"http://www.pearltrees.com/idigital/gdpr-new-text/id15747243#item175275842\" target=\"_blank\" rel=\"noreferrer noopener\">Pearltrees</a>&nbsp;curation:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736\" target=\"_blank\" rel=\"noreferrer noopener\">Law Firm data security</a></li><li>The&nbsp;<a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736\" target=\"_blank\" rel=\"noreferrer noopener\">Panamapapers</a>&nbsp;scandal and the law firm Mossack Fonseca.</li><li><a href=\"https://www.law.com/legaltechnews/2018/12/27/5-cybersecurity-habits-law-firms-should-kick-in-2019/?slreturn=20181127165526\" target=\"_blank\" rel=\"noreferrer noopener\">5 Cybersecurity Habits Law Firms Should Kick in 2019</a></li><li>Read&nbsp;<a href=\"https://www.linkedin.com/pulse/website-transparency-cookies-privacy-notice-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">Website Transparency and Cookies and Privacy Notices</a></li><li>Read&nbsp;<a href=\"https://www.linkedin.com/pulse/gdpr-material-territorial-scopes-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">GDPR Material and Territorial Scope</a></li><li>Read&nbsp;<a href=\"https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/\" target=\"_blank\" rel=\"noreferrer noopener\">All You Need to Know About GDPR</a></li><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','Law Firm Internet Security and Data Protection','Since the ECJ decision in Juily 2020, Schrems-II v Facebook, It has been cleared that no personal data should leave the European Economic Area, EEA, or transferred in the hands of a US Communication Provider, a principle extended to any country not benefiting from an adequacy agreement. Therefore, all legal professions regularly exchanging data outside the EEA, need to take specific measures to ensure the security of these data, at an equivalent level as the protection offered by the GDPR within the EEA. Data subjects whom data are being exported have to be informed in all transparency, of the risks associated to such data transfer.','inherit','closed','closed','','1921-revision-v1','','','2020-11-29 22:32:13','2020-11-29 22:32:13','',1921,'https://www.datarainbow.eu/1921-revision-v1/',0,'revision','',0),(1923,1,'2020-11-29 22:26:10','2020-11-29 22:26:10','','Screenshot 2020-11-29 at 22.05.15','','inherit','open','closed','','screenshot-2020-11-29-at-22-05-15','','','2020-11-29 22:26:10','2020-11-29 22:26:10','',1921,'https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-29-at-22.05.15.png',0,'attachment','image/png',0),(2048,1,'2021-04-17 14:37:56','2021-04-17 14:37:56','<!-- wp:paragraph -->\n<p>The Data Diva </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In January 2021, I had the honour of being <a rel=\"noreferrer noopener\" href=\"https://www.debbiereynoldsconsulting.com/podcast/e15-tara-taubman-bassirian\" target=\"_blank\">interviewed by Debbie Reynolds</a>, chatting about the GDPR, its slow enforcement by Data Protection Authorities. The position of the French <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/french-dpa-cnil-fined-carrefour-for-cookies/\" target=\"_blank\">CNIL</a>, the UK ICO, the Irish DPC, One stop Shop for US mega corporations, such as Google and Facebook. The future of international data flow since the invalidation of Privacy Shield by the <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">ECJ Schrems-II</a>, the requirement of ensuring the same level of data protection when personal data is transferred outside the EU/EEA and the case of the <a href=\"https://www.datarainbow.eu/beyond-brexit-cyber-security-and-data-protection-the-modern-cassandra-complex/\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy after Brexit</a>. Securing data exchange, encryption and the all time good advice : data minimisation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2022,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/04/Capture-décran-2021-04-17-à-14.21.55-1024x588.png\" alt=\"\" class=\"wp-image-2022\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Transcript of the interview :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>01:03</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hello, thank you for having me on your show. It\'s nice to see you and chat with you. We are both very active, I think, in educating and talking and discussing the subject of data protection. I\'ve been involved for more than a decade on this subject since the French corporate lawyer and I moved to Germany and the UK. And it\'s here that I specialized in privacy and data protection while I did my LLM. And originally, I was expecting to do char diamond safety until during my LLM. I actually realized that governments were sometimes using chart protection to quiet free speech. And so I get involved with the reform of the Data Protection Directive, which became then the regulation GDPR. I guess your auditor would know the difference between a directive and the GDPR regulation, which is a regulation that applies directly to all EU nations. The legislation was quite an ambitious program. It could not be perfect because, within the 28 member states, there are some civil law backgrounds, and the others are common law like the UK. So there has been tension between the different legislations. I still believe that it\'s the best or not the best. I shouldn\'t say that it still needs to be more perfect, but the big fine makes everybody wake up. Everybody started to think, well, GDPR data protection is actually important. I\'m trying to explain that we gain a lot with the digital world. I remember as a lawyer, when we used to, secretaries used to type everything your ears would dictate, and there was a secretary typing everything. And if something was wrong, they had to start all over again. When needed, Internet has made lawyers work much, much easier. Everyone\'s work is much easier automatic. We do search on Google, which brings up so many results in just one click and all for free. Well, free, maybe not. But we don\'t pay straight away. Sonia GDPR, with fines, wakes up. Charities, in my view, have been a bit too slow to enforce. But here comes the COVID and confinement, which also changed a lot of the situation working from home is different. I\'ve been looking and following the cases of cyberattacks, which I guess Debbie, you\'ve seen the same, they\'re just going high up the ceiling. What working from home is less security, obviously. So it needs this training. I\'m not sure every employer gets the training they needed. We had in the UK a very interesting case, the Morrison case, which went up to the High Court of vicarious liability of an employer here for his employee. And in the case of the supermarket, Morrison was he hadn\'t done anything wrong. Apart from having an employment fight with an employee. They sacked the employee. It happened employee was working in the accounting department. He was asked to forward the whole HR data to the outside accountant, would it? Meanwhile, he copied it on a USB stick. And when he gets sacked, one of the whole HR data was published online. That caused a major issue and a problem for all the employees who had the data exposed. There was a class action. The Court of Appeal said, basically, that the employee Morrison\'s should have had cyber insurance to cover these sorts of damages. In the High Courts, Morrison had a very good lawyer, not that the class action lawyer was not as good. But Morrison\'s lawyer did a very good job of convincing the High Court that they hadn\'t done anything wrong. And the ex-employee was a data controller, so he was only responsible. It can sound. I\'m guessing lots of employees, employers, or employers listening would think, well, why would Morrison be liable. They hadn\'t done anything wrong, then it\'s the only liability of the ex-employer. He saw how the other employee could get any damage compensation for the data. So that\'s an issue. And then there was this case that I barely mentioned. I saw it today on LinkedIn. I don\'t have much detail about it. But it\'s a German court that said not every data breach would give compensation. In the UK, we have the Lloyd case class action against Google when they had the green light to go forward. And they say the loss of control and the psychological distress was compensation, we still have to wait and see where it all goes. But the problem with a data breach is the consequences are not immediate. The data is stolen, they are sold on black markets, or they are just thrown away everywhere. And sometimes, many years later, someone whose ID is misused or financial details misused.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><a href=\"https://www.debbiereynoldsconsulting.com/podcast\" target=\"_blank\" rel=\"noreferrer noopener\">Debbie Reynolds</a>  </strong>07:32</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yeah, I think the problem, I mean, that we just can\'t get around is that a lot of times, the harm happens before the law. And if the enforcement doesn\'t happen soon enough, or the remediation or, you know, happen, you know, once the milk is spilled out of the carton, you know, it\'s almost impossible to get that back. So that\'s why it\'s really important that that data be protected the best way possible that individuals have more control over their data and that it not be spilled milk. I think it\'s really interesting that you\'re, you know, sleeping in a lawyer France you lived in Germany and now live in the UK. So you have, you know, the full experience, right, from different countries and, and different ways that they look at things. I love your thoughts, you know, at me being an American and you being in Europe, as we have so many people around the world working in Data Privacy, I hear sometimes people say there\'s like a difference between the way American privacy folks think about privacy as opposed to European people. I want to know, have you had any thoughts about that?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>08:48</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yes, privacy is very much connected to the cultural understanding of how we perceive our intimacy. I think Americans, for example, don\'t like people touching you. Why more Mediterraneans are all touchy, and it\'s different. We had a discussion on Facebook not long ago about what\'s the difference between privacy and data protection. For me, privacy is a fundamental human right. It\'s more of a philosophical concept. When data protection is more the data that is collected that needs to be protected, and the way that we are allowed to collect or not to collect right. And someone posted a picture of a toilet with glass walls. Some people think, well, previously is secrecy, and I have nothing to hide. So why would they care about privacy? And I like to tell them whenever you go to the loo you close the door. It\'s just somewhere you would like to be in peace. However, going back to you three, actually, France was well known on web site. Novelties used to do these things in public. And they will show it as a way of saying, Well, I\'m healthy, there was no barrier. So no problem going to the loo and showing everything you do in a loo to everyone. So things have changed. The understanding and the way we perceive privacy change. And it\'s also changed from one culture to another culture. I\'ve had people in Sweden telling me that we go naked in a sauna, and we don\'t care about privacy. And then I reply, what do you choose to go to the sauna, you choose who you\'re sitting with. And if you\'re not happy, it\'s not a huge sign out there. A certain number of people, you don\'t like them, you just go away, and you go to another sauna. Your privacy online is different. You have absolutely no control over what\'s being done with your data. And this is where previously, you get very close to data protection. A few years ago, I had a chat with an IT person about threats and detection. And whatever chatting, I Googled her, and I find so much private stuff about her online. And I just sent her a link. And she felt like you\'re invading my privacy. I said, I just Googled your name, put speech mark, right, and see everything that comes out about you. Yeah, and this even for someone who is in IT, it was four years ago. I\'m hoping today people understand that a bit more. But Google does the job of a puzzle, different pieces puzzle in one click put next to each other that shows a whole picture that you have no control over, right. It could be your own boss, but it could be someone else destroy your reputation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>10:56</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Absolutely. Right, exactly. I think for people who aren\'t online or don\'t have a very good presence or good full presence online, it is, unfortunately, an opportunity for people to fill it in with bad things or things that aren\'t true. So it\'s very important, I think, for people to really step out and establish their identity. So people know, you know, this, Tara, this is very, you know, so they can differentiate the truth from the facts from fiction. Basically, I would love to get your thoughts on the Schrems II decision and the invalidation of Privacy Shield between the EU and the US. What are your thoughts about it?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>12:43</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s a case been ongoing for a few years. First, the previous adequacy decision, that was the Safe Harbor agreement, was invalidated by the European Court of Justice. Nothing was changed. So Maximillian Schrems, who is behind this case which found that none of your business NGOs continued his battle. In July this summer, the European Court of Justice again said that despite the European Commission giving the green light after the second year of reviewing the Privacy Shield, it should be invalidated. It\'s not because the US stars intelligentsia that European don\'t do. Right. Every country today has intelligence. And they try to grab information. The problem with the US as the European Court of Justice, so is that it is there is no sufficient judicial review. Right. There is a sort of discrimination against you EU citizens who don\'t have a right to redress or so until things change, which is the FISA section 702, the executive order 12 333 and other intelligence regulation Tridacna things that allow the US to intercept data the normal transfer of data from the EU to the US. In principles, standard contractual clauses are still valid. So all the binding corporate rules or a lot of people jumped up and said, oh, you\'re very let\'s continue as we did before. However, the high court saying that additional measures should be taken to make sure that the data that isn\'t exported from the EU and imported to the US is kept safe and not access is given to the US. Government and the EU citizen gotta write. Personally, I don\'t see many ways that this could be done. Right, we can go closer. We can data can be encrypted, the encryption key should remain within the EU clauses could be added to the standard contractual clauses that are being modernized by the Commission. That\'s right. It\'s still not there. Some data protection authorities, like the German when ones, have been very strict, saying the normal transfer of data from the EU to the US. French, we are thinking about it in English. Early, be careful what you\'re doing, what we can stop the trade. Basically, I know, I\'m not very exactly repeating what they said. But that\'s what comes out. But England, UK is concentrating on Brexit. Yeah. Is it suffering itself? Will they get the adequacy decision or not? But that\'s another issue. But what\'s interesting with the Schrems II decision is basically saying we Europe want strong protection to data. And someone like if this was a kind of RFID, sorry, that follows the data wherever it goes. The country of import should be the same level of protection today to this data, which is quite strong. Yes. But hopefully, it\'s a good message that we pass. We had an interesting case in France, if I may mention that. Datahub is a cloud that stores all medical, French medical data, especially since the COVID. Neil said to the highest administrative costs in France to consider that his data should not be put in the hands of Microsoft. So that is confirmation that what we call what the ECG sees, or the transfer of data, is not the physical transfer of data from the EU to the US. Because all these American US laws apply to US companies, even though if their servers are based in Europe, still, US government can intercept the data, right?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>17:46</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>17:47</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is why the German data protection authorities\' position is not pure data, check where it goes. And if you\'re using US companies, rethink it. That\'s a major step.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>18:04</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And I\'ve been watching this play out for over 20 years. So you know, when Safe Harbor was put in place, and they wills invalidated Privacy Shield, I don\'t know what a third try to see would be between the US and the EU. Obviously, there\'s a lot of trade between countries. So there\'s obviously probably more of an economic imperative than the privacy one. But I think we just have fundamental thoughts or differences about how we think about privacy. So in my view, the US is like commerce over privacy. And the EU is like, you know, we want to do commerce, but you have to respect that sort of an impasse, I feel. And then the redress issue is a very serious one because, in the Privacy Shield, they tried to have a sort of a method of redress within the Department of Commerce, I guess. But the big issue, in my view, well two issues in my view. One is that the Department of Commerce only covers certain types. So it\'s not almost all industries, as opposed to the GDPR. And then also the redress. Because the Department of Commerce, again, is limited in the companies that they oversee, means that you know, like, for example, like let\'s say, for instance, I have a problem with a US company, while I\'m here in the US, I don\'t have that level of redress that the Europeans are asking for. So there really has to be a total rethink of how that mechanism could be created in a way that will make it powerful. I think, but then I think that will cause a lot of people in the US to say, well, why can\'t I have that? Right? We don\'t have that right now in terms of the way that ways you guys are thinking about redress. I would love to ask. You had written something a while back about consent fatigue. And I think this is a big issue. So where a lot of people are, you know, you\'re signing up for these companies with different services. And you\'re constantly getting bombarded with cookie notices and different things like that. And some people just, they just click through. So give me your thoughts about consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>20:43</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>one of the cookies is ruled by the policy directive, which is under revision. It\'s been ongoing. However, the consent to be the same level and standard of the GDPR. We are now seeing more and more websites that cookie banners are asking consent before dropping the cookies. Actually, cookies are also under the Schrems II are considered the transfer of data to the US for the website that Google Analytics or Facebook content or other cookies that send the data to the US. It\'s an issue. We see the constant banners. I\'ve noticed with a few people who did research that sometimes some websites, although you did not consent on cookies, or before even you would say yes or no cookies were dropped. I saw several law firms\' websites was that one major Law Society website had cookies. And when we speak about cookies, it\'s a generic term. But it also includes any kind of tracing, some JavaScript pixels, and they all collect data. When you have sensitive clients, if I may call it a law firm, it\'s an issue. And it allows third parties to know who came to your website, what they did, and whichever website they also visited. And it could be that someone else who uses the same device could actually know where you\'ve been and what you\'ve been doing. So when Law Society encourages victims of domestic abuse to visit their website, and on which they are cookies, it\'s a serious issue, depending on the kind of visitors and customers are happy to have to be very vigilant with what is connected. People are today very much annoyed because every website you want to visit, you first have to decide if you want to go queue or not. It is a pain. But I\'m hoping eventually they will stop having any cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>23:18</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yeah, well, so a lot of tech companies because a lot of the laws about cookies have been eliminating cookies. They\'re out there collecting data and other ways. But the law hasn\'t caught up with that yet. So I think by the time that these cookie cases get settled, very few people actually use them, and they will be on to whatever the next evolution in technology may be. I would love to talk with you about the right to be forgotten. This is something that you talk about you\'ve written about a bit for companies is the most difficult thing in the GDPR for them to acquiesce to because the right to be forgotten means that they have to figure out what they have in terms of data about individuals and how they, remove it from an organization and how they communicate that to the individual data subject. What are your thoughts about that?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>24:18</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the question of knowing which data is hold and verities? I think this is something very important. And GDPR is based on the accountability principle. It\'s asking the organization to sit and think which data they hold during that mapping, know where it goes, who access it, for how long they return it. These are the seven principles of data protection on GDPR. My favorite principle is data minimization. If you don\'t hold the data, you don\'t have the burden of the data. If you don\'t need it, delete it.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>24:56</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I agree. I agree with you on that.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>24:58</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s as simple as that. It\'s actually good for you. You don\'t pay for data storage for anything. Another principle is data accuracy. What\'s the point of holding data that is out of date? Your market is all wrong, your everything is wrong because the data is obsolete. So deleted, you don\'t need it. I usually like to advise three-level storage of data. First level active data with more access, and also internet access seven-level, you have to keep the data because you might need it for refund reason, because it also, you know, tax reason, employment reason, you have to keep the data for a certain number of years, you have to sit and decide your data retention periods, depending on the level of data and what you want. But limit data to this second-level storage. Third Level storage would be archiving, no internet access, very limited access to any third parties. Because sometimes, for a historical reason, you need the data, right? I\'ve been asked, well, what happened, we had all these historical data of people who became famous or were famous and visited the hotel or a museum, we would want to keep that forever. Well, you can keep it just don\'t put it online. Keep it on the external hard drive that is not connected to the Internet. You\'re allowed to do that. It\'s not a problem. What people have to understand is an Internet connection. Globalization means easy access to data, easy misuse of data. But if the data is safe, encrypted on your hard drive, and not connected to the Internet, it\'s safe. You can keep it as long as you want. There\'s no problem with that. Right? That\'s what is good for the GDPR. It\'s caused people organization to sit and think, what they\'ve got, how much they are holding, who is accessing it, how they keep it secure. It\'s all common sense.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>27:03</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yeah. I think though, with the Internet age, because I don\'t know, like, I guess to use, for example, like Google, when Google first started, or Microsoft, or started giving people free email addresses, you know, the size of your email box was relatively small, over the years, they made the size of the email boxes bigger. So, as a result, people who just click more stuff may delete less stuff, they have more room. So in some ways, I feel like the Internet age has made people digital packrats, where they keep so much stuff, you know because you know, instead of like, let\'s say, before you have books in the library, now you can have things on a hard drive, and people are less apt to delete things. Also, you know, I\'ve worked a lot with corporations and lawyers. Sometimes, people want to keep data just because they think they may need it, even though they don\'t have a real reason to keep it. And that just piles up over a year over a year. And to me, those are some of you know, especially if they\'re connected to the Internet, a lot of times, you know, they have all data may be on all servers, maybe on something that\'s more vulnerable than maybe their actual data and hackers like that, that\'s just the gateway for them to get into your organization. And it also creates more risk for the company, because now you have people accessing or you have a breach, or someone\'s looking at some old stuff, you don\'t even know what\'s there. So now you have to go through and figure out, you know, whose data is on here. So it\'s just a mess. I think data retention is a big problem for a while where people just keep getting way too much stuff.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>28:54</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Indeed, I call it a Google hype. One school started to collect everything. And it was known that Google is saving all data, and storing and collecting became much, much cheaper. So people don\'t let\'s collect and then we will see what we do with it. But that causes issues that there are serious security issues with over-collecting data. Data breach cause harm, unfortunately. And cases like Morrison\'s will happen again. Yeah. Employees are not devoted to the employer as they used to be there is a much bigger turnover. Young people just change jobs. If they\'re not happy, they will want to take advantage, and it\'s so easy. Get the USB and put it online. Yeah. So yeah, data minimization is very important. And the right to be forgotten. Before the GDPR, there was a right to be forgotten by the jurisprudence of The European Court of Justice, and that was more delinking than actually deleting. Sometimes you do need the Internet and the whole world, forget about something silly that you did one day in your life. Because employers search online, everyone\'s searching online. Young people today are on with their baby pictures online, and even the embryo is already online before they were born. Yeah, it was a very interesting interview of ex-Google CEO. And he suggested that young people should be able to change their identity at the age of 21. Because they\'ve already got so much behind them of silly things, they\'ve done. Yeah, that\'s not feasible.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>30:56</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>That\'s true.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>30:57</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;We have to give a chance for people to redo their life. Everyone doesn\'t mistake. Yeah, the problem with the Internet is you just need someone with a camera next to you to make it memorable.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>31:12</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Exactly.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>31:13</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We\'ve had lots of external debates this week on social media about France. Who wants to pass a law that forbids anyone to record police officers during work and post it on social media? In my interpretation of GDPR already today, we should not be able to post anyone\'s pictures online without their consent. And this is very important. I really ask everyone to reconsider before posting online, ask the person if they\'re okay. They are people with special circumstances. There are people who are in the middle of a divorce. They don\'t want to tell what they are and what they\'re doing. Right. They are protected witnesses. They don\'t want people to know where they are, and their faces would identify them. Facial recognition software for everyone can use it can identify and worse than identifying, it can make fake identification.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>32:13</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Absolutely.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>32:15</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So you might be identified as a criminal, or you are not at all a criminal, but go and try to prove it wasn\'t you, everyone is just attacking you see a police officer video that is posted on social media. It would be one extract of something that happened. You don\'t know what the start was, and you don\'t know how it finished? Right? They are police officers. I\'m not saying what I am not defending at all police violence. I\'m just saying that the judge has studied for that institution for judging. And it\'s not the work of social media to judge the actions of a police officer. They can post by blowing the faces. Yeah. But they should never be anything posted with identifying pictures without asking the person. That\'s very important. Yeah. People have to start to understand that it has consequences. Absolutely. And I thought it was the other way around. discussion with the police officer in my area, and giving the name of a young offender. 18 year old who is suspected of having killed someone with a knife.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>33:27</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It might be true.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>33:29</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>But I want the judge to tell me what he did. And what he did was a crime. Yeah, it\'s not the social Smith\'s at work. And once the local police put that on Facebook, it means that the whole family is ashamed. The siblings, I\'m ashamed. They go to school the next day, and they say, your brother killed someone. We don\'t want to talk to you anymore. You got the COVID they say, oh, I don\'t talk to you because you\'ve got fever.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>33:51</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And they were able to talk to any rain. Exactly, exactly.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>33:58</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is our things that change our relationship because of social media. We get so many good things from it. Yeah. You know, I\'m a great believer in social media. I promote elearning. I have a charity that promotes learning. I have nothing against the Internet and anything digital. I love technology. I\'m a gadget lover. But we have to accept that in the area of social media and Internet interconnection relationship has changed. We are not just broadcasting in our small network when we broadcast, we broadcast it for the whole world. Right, broadcast it as the highest bid ever. And we broadcast it forever.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>34:44</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Exactly.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>34:44</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So it\'s a big catalyst of the Internet. It is changing all scales.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>34:50</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Absolutely.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>34:51</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have been, on the other hand, be more careful with what we\'re doing and what we\'re saying. And it\'s so easy to just push a button. Without</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>35:00</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Absolutely, absolutely. Africa, right, I think we need to, you know, I\'m like you. I love technology. I\'m really excited, you know, when the Internet came into existence, because I grew up without the Internet, obviously. But I\'m a gadget lover as well. But I think we also have to be cognizant of the harms that can happen. So you can\'t dissolve the so, so excited about the innovation without understanding that there can be harm. So we have to really be able to educate around that. The GDPR in Britain, as we know, very influential around the world. So we see laws come out that are taking bits and pieces of the GDPR and incorporating them into their law. So I think there\'s going to be more regulation around Data Privacy and not less in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>35:51</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We know even got in China a similar to GDPR legislation that is coming up so even China.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Debbie Reynolds&nbsp; </strong>35:59</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Yeah, even trying to Iraq. Right, exactly. Was that a pleasure to have you on so, and thank you again, thanks so much.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Tara Taubman-Bassirian&nbsp; </strong>36:08</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>My great pleasure. Thank you, Debbie. By e<a href=\"https://www.debbiereynoldsconsulting.com/podcast/tag/Podcast\">Podcast</a><a href=\"https://www.debbiereynoldsconsulting.com/podcast?author=5d75cb2fcb85fd7521d47f60\">Debbie Reynolds</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.debbiereynoldsconsulting.com/\">The Data Diva</a> </p>\n<!-- /wp:paragraph -->','Interview with Debbie Reynolds','','inherit','closed','closed','','2021-autosave-v1','','','2021-04-17 14:37:56','2021-04-17 14:37:56','',2021,'https://www.datarainbow.eu/?p=2048',0,'revision','',0),(2034,1,'2021-04-17 13:52:56','2021-04-17 13:52:56','<!-- wp:heading {\"level\":3} -->\n<h3>By <a href=\"https://www.linkedin.com/in/daniel-aldridge-2a93922b/\">Daniel Aldridge</a> Senior Policy &amp; Programmes Manager at BCS, The Chartered Institute for IT</h3>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>Published on March 12, 2021</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>I\'m never one to shy away from a niche topic, especially one at the vanguard of politics and technology, so I was happy to speak at the Holyrood Connect event last week on cyber security and data protection post Brexit. <a rel=\"noreferrer noopener\" href=\"https://cybersecurityni.holyrood.com/agenda\" target=\"_blank\">Public Sector Cyber Security Northern Ireland</a> Especially as increasingly I feel that we in the IT and digital communities are are suffering from a modern Cassandra complex where we know there are existential threats that need action, but its so often being put in the too-difficult box.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the panel, I was joined by fellow BCS member, lawyer and Data Protection Consultant, Tara Taubman-Bassirian of Data Rainbow; Joseph Byrne, Privacy Solutions Engineer at OneTrust and the event chair, David Lee, formerly of The Scotsman. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I spent 6 years working in Scottish public policy and campaigns and I’m no stranger to Holyrood Connect as a force for good in addressing the critical digital issues of our times and its place as a strong voice for devolved administrations. Also, the Chartered Institute has sizeable active membership in Scotland, Northern Ireland and Wales and it’s been personal commitment of mine to drive greater engagement and collaboration across the UK’s rich tech landscape so the future of IT and digital technologies</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Chartered Institute is primarily a network of its people and over the past 12 months it’s been amazing how our members and the wider IT and digital communities have continued to make IT good for society whilst we all face huge and unprecedented threats.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>IT workers really are the unsung heroes of the pandemic.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It’s important to note that in the context of rapid service and product delivery changes etc; organisations trying to keep people in jobs, diverting resources and skills on unprecedented scale, that we don’t have things like Schrems2, changes to international data transfer regulations and standard contractual clauses entirely front and centre of our organisations risk register!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>But the problem for many of us working in this area is that so many of our organisations are caught up in this perfect storm without even the awareness they need legal advice and expertise, let alone having it in house.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A big bug bear for me and my colleagues is the absence of CIOs or equivalent at the highest levels of organisational decision making and risk management.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hear often about an encouraging rise in the amount of boards with a dedicated person with responsibility for cyber and data security and protection; but in many situations, it does feel very much like when boards were encouraged to appoint a diversity champion, the person was often not appointed based on real knowledge or expertise and were asked to ‘take on’ the brief. In both cases, the board member often relies almost exclusively on the briefing of the IT team with much lost in translation and debate.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When we look at how many Boards include a CIO or equivalent, the picture is problematic, only 10 -20% of NHS organisations for example have a CIO or equivalent at the highest level of decision making and risk management<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn1\" target=\"_blank\" rel=\"noreferrer noopener\">[1]</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>However, the demand is there though for better, tech led decision making!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The past decade has seen a cottage industry grow up around supporting technologists to speak effectively with boards and decision makers; this is why we are so keen to drive professional standards and professional development across the IT world to drive up this capacity to support innovation and mitigate risk.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A new data regime ushered in by the UK’s Data Strategy will reiterate the need for effective data maintenance and governance while removing obstacles and impediments to innovation, an opportunity to basically clean up our digital processes and make them fit for a more dynamic digital infrastructure. Indeed the new information commissioner’s job specification<a href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftn2\" target=\"_blank\" rel=\"noreferrer noopener\">[2]</a>&nbsp;requires a drive to do just that.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This aside, despite the sabre rattling from both sides over the past few months, most of the signs indicate that the UK and EU want to cooperate on a number of key areas such as enforcement, cyber security, copyright infringement, IP, tech sovereignty and certain areas of competition. This may well mean that the ICO will turn its attention more meaningfully to scrutinising data governance procedures, while also calling out over-burdensome procedures.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite no clear public desire to needlessly interrupt trade, it’s unclear how long an adequacy agreement, if finally ratified by EU states, can be sustainable. As a third country, the UK will be susceptible to judicial review similar to Schrems 2 and outside the EU, we’ll be held to a higher standard.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To be competitive the UK needs to show it is dynamic and has a commercial edge over the EU in certain areas, data will be one of those areas; the political and legal challenges are however huge!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Make no mistake, privacy campaigners have the UK in their sights and will seek to make this the next battleground, so depending on where and how we plan to flex our independence on things like human rights legislation etc, there will be a need for preparatory action.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So what can we do…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>listen to and champion your IT and data protection people to help get our houses in order</li><li>Continue to drive up professional standards and champion the mitigation of risk across the economy and civil society</li><li>Raise the issues you care about with your elected officials, I don\'t think there is enough literacy at national, devolved or local government level for us to reap the benefits, we should be aiming to thrive, not just survive</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>We’re all learning ‘on the job’ on this so let’s continue to have these conversations, mainstream the issues and make sure we’re ahead of the game.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref1\" target=\"_blank\">[1]</a> <a href=\"https://www.digitalhealth.net/2020/01/networks-issues-open-letter-to-get-ccios-and-cios-on-nhs-boards/\" target=\"_blank\" rel=\"noreferrer noopener\">Networks issues open letter to get CCIOs and CIOs on NHS boards</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://bcshq-my.sharepoint.com/personal/daniel_aldridge_bcs_uk/Documents/Documents/BCS%20Policy%20Strategy/Brexit/Holyrood%20Blog%20DA.docx#_ftnref2\" target=\"_blank\">[2]</a> <a rel=\"noreferrer noopener\" href=\"https://publicappointments.cabinetoffice.gov.uk/appointment/information-commissioner-2/\" target=\"_blank\">HM Government Public Appointments</a></p>\n<!-- /wp:paragraph -->','Beyond Brexit: Cyber Security and Data Protection - the modern Cassandra Complex','','inherit','closed','closed','','2026-revision-v1','','','2021-04-17 13:52:56','2021-04-17 13:52:56','',2026,'https://www.datarainbow.eu/?p=2034',0,'revision','',0),(2035,1,'2022-10-07 09:14:26','2021-04-17 13:58:44','','About Tara Taubman-Bassirian','','publish','closed','closed','','2035','','','2022-10-07 09:14:26','2022-10-07 09:14:26','',0,'https://www.datarainbow.eu/?p=2035',16,'nav_menu_item','',0),(2036,1,'2021-04-17 14:03:12','2021-04-17 14:03:12','<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ....</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Who created DATARAINBOW ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, was initially trained in French Law before settling in the UK. She has a Maitre of private law from the prestigious University of Pantheon Assas, Paris 2, before her more recent specialisation in Computer and Communication Law with a Masters at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN’s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group <a class=\"\" href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a> with <a class=\"\" href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTACT : Data@datarainbow.eu</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><br></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018 :&nbsp;Tara Taubman-Bassirian</a></strong><br></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>Privacy Hero of the Year poll, and the results are in...&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of <a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">Rebecca Herold\'s radio show</a>,&nbsp;<a href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\">Data Security and Privacy with The Privacy Professor</a>. I\'ve extended invitations to each today, so stay tuned for more details.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For keeping up with news on IT security, Privacy and Online Security, join our Facebook Group <a href=\"https://www.facebook.com/groups/167255910003191/?multi_permalinks=2203761959685899&amp;notif_id=1548347410584622&amp;notif_t=feedback_reaction_generic\">Fly A Kite</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":881} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Screenshot-2020-05-03-at-18.32.54.png\" alt=\"\" class=\"wp-image-881\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":880} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Screenshot-2020-05-03-at-18.29.42.png\" alt=\"\" class=\"wp-image-880\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":878} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Champion-Badge.png\" alt=\"\" class=\"wp-image-878\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Seen on Twitter</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":252} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-31-at-11.22.40.png\" alt=\"\" class=\"wp-image-252\"/></figure>\n<!-- /wp:image -->','Why DATARAINBOW ?','','inherit','closed','closed','','84-revision-v1','','','2021-04-17 14:03:12','2021-04-17 14:03:12','',84,'https://www.datarainbow.eu/?p=2036',0,'revision','',0),(1926,1,'2020-11-29 23:10:12','2020-11-29 23:10:12','','Screenshot 2020-11-29 at 23.07.25','','inherit','open','closed','','screenshot-2020-11-29-at-23-07-25','','','2020-11-29 23:10:12','2020-11-29 23:10:12','',0,'https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-29-at-23.07.25.png',0,'attachment','image/png',0),(2038,1,'2021-04-17 14:06:38','2021-04-17 14:06:38','<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ....</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Who created DATARAINBOW ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, was initially trained in French Law before settling in the UK. She has a Maitrise of Private Law from the prestigious <a href=\"https://www.u-paris2.fr/fr\" target=\"_blank\" rel=\"noreferrer noopener\">University of Pantheon Assas, Paris 2</a>, before her more recent specialisation in Computer and Communication Law with a Masters at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN’s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group <a class=\"\" href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a> with <a class=\"\" href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTACT : Data@datarainbow.eu</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><br></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018 :&nbsp;Tara Taubman-Bassirian</a></strong><br></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>Privacy Hero of the Year poll, and the results are in...&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of <a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">Rebecca Herold\'s radio show</a>,&nbsp;<a href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\">Data Security and Privacy with The Privacy Professor</a>. I\'ve extended invitations to each today, so stay tuned for more details.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For keeping up with news on IT security, Privacy and Online Security, join our Facebook Group <a href=\"https://www.facebook.com/groups/167255910003191/?multi_permalinks=2203761959685899&amp;notif_id=1548347410584622&amp;notif_t=feedback_reaction_generic\">Fly A Kite</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":881} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Screenshot-2020-05-03-at-18.32.54.png\" alt=\"\" class=\"wp-image-881\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":880} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Screenshot-2020-05-03-at-18.29.42.png\" alt=\"\" class=\"wp-image-880\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":878} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Champion-Badge.png\" alt=\"\" class=\"wp-image-878\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Seen on Twitter</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":252} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-31-at-11.22.40.png\" alt=\"\" class=\"wp-image-252\"/></figure>\n<!-- /wp:image -->','Why DATARAINBOW ?','','inherit','closed','closed','','84-revision-v1','','','2021-04-17 14:06:38','2021-04-17 14:06:38','',84,'https://www.datarainbow.eu/?p=2038',0,'revision','',0),(1929,1,'2020-11-30 00:23:30','2020-11-30 00:23:30','','Screenshot 2020-11-30 at 00.22.11','','inherit','open','closed','','screenshot-2020-11-30-at-00-22-11','','','2020-11-30 00:23:30','2020-11-30 00:23:30','',0,'https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-30-at-00.22.11.png',0,'attachment','image/png',0),(1930,1,'2020-11-30 00:26:54','2020-11-30 00:26:54','<!-- wp:paragraph -->\n<p><a href=\"https://www.handelsblatt.com/politik/deutschland/datenschutzgrundverordnung-behoerden-verhaengen-erste-bussgelder-wegen-verstoessen-gegen-dsgvo/23872806.html?utm_term=Autofeed&amp;social=tw-hb_hk-li-ne-or-&amp;utm_medium=Social&amp;utm_content=hb_hk&amp;utm_source=Twitter&amp;ticket=ST-3132650-6BS3JkvjeZRSOdTaQcJa-ap4#Echobox=1547811383\">The Handlsblatt</a> report the authorities first fines for violations of GDPR (DSGVO)  by the various DPAs in the German Federal States. :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Nationwide, fines have been issued in 41 cases because of DSGVO violations. Especially small companies are apparently unprepared for the new rules. \"<em>Most fines were imposed by North Rhine-Westphalia (33), followed by Hamburg (3) and Baden-Württemberg and Berlin (2 each) and Saarland (1). Alone at the Bavarian State Office for Data Protection Supervision (BayLDA), which monitors the observance of data protection law in private business enterprises, in freelancers, in associations and associations as well as on the internet, currently 85 fine proceedings are under the GDPR.</em>\" </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The large number of consultation requests and the explicit complaints indicate that there has been an increased awareness.</em>\" In this respect one could say: \"<em>The DSGVO has been effective with regard to those affected.</em>\" There are serious deficiencies in the data processing information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to the Hamburg data protection Authority, Johannes Caspar, \"<em>a lot has changed for the better in companies as well</em>\".&nbsp;Awareness of data protection and understanding of one\'s own responsibility for the processing of data has increased significantly.&nbsp;For example regarding the appointment of data protection officers or the creation of processing directories and data protection statements.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>In this respect, this improved awareness is certainly one of the most important changes by the GDPR</em>,\" according to Johannes Caspar.&nbsp;\"<em>The huge increase in consultancy shows the great need of companies to behave in compliance with data protection</em>,\" said BayLDA President Thomas Kranig .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>With regard to global Internet companies, supervisors must be able to enforce data protection in accordance with the GDPR and, where necessary, initiate and implement fast and effective procedures,</em>\" Johannes Caspar said.&nbsp;It will show whether the European Data Protection Board and the national authorities represented therein are able to ensure the uniform and effective protection of the rights and freedoms of stakeholders in this field.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the Bavarian State Commissioner for&nbsp;<a href=\"https://www.handelsblatt.com/themen/datenschutz\">Data Protection</a>,&nbsp;Thomas Petri, it was important that companies such as clinics or transport companies,&nbsp;<a href=\"https://www.handelsblatt.com/unternehmen/it-medien/studie-zur-it-sicherheit-viele-firmen-sind-bei-cyberangriffen-konzeptlos/23178588.html\">adapted as soon as possible their privacy management.</a> He considers \"<em>Sometimes fines can inhibit rather than promote fines,</em>\" while at the same time he warned: \"<em>I should not rely unconditionally on my restraint.</em>\" He had already warned a number of clinics for significant violations that they would result in fines.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was about&nbsp;<a href=\"https://www.handelsblatt.com/unternehmen/it-medien/emotet-angriffe-cybersicherheit-ist-noch-immer-selten-chefsache-das-kann-sich-raechen/23732342.html\">\"significant technical and organizational deficiencies.\"</a>&nbsp;In Brandenburg, it was said in the \"conversion phase\" consultations would be more effective than the \"immediate application of the tightened fine rules\".&nbsp;However, fines would \"make use of them in the future,\" emphasized data protection officer Dagmar Hartge.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Data Protection Authority of Lower Saxony is currently conducting a \"cross-sectional inspection\" of 50 companies in Lower Saxony for the GDPR implementation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We can only agree with the Berlin data protection officer Maja Smoltczyk, \"<em>The General Data Protection Regulation represents a first important step in helping to safeguard our freedoms</em>\" .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This publication is licensed under a Creative Commons Attribution 4.0 International<br>More information on the licence can be found <a href=\"http://creativecommons.org/licenses/by/4.0/\">here</a>. </p>\n<!-- /wp:paragraph -->','Increasing Fines Expected from German DPAs','In Germany, nationwide, fines have been issued in 41 cases because of GDPR violations. Especially small companies are apparently unprepared for the new rules.','inherit','closed','closed','','307-revision-v1','','','2020-11-30 00:26:54','2020-11-30 00:26:54','',307,'https://www.datarainbow.eu/307-revision-v1/',0,'revision','',0),(1931,1,'2020-11-30 00:32:33','2020-11-30 00:32:33','','Screenshot 2020-11-30 at 00.31.06','','inherit','open','closed','','screenshot-2020-11-30-at-00-31-06','','','2020-11-30 00:32:33','2020-11-30 00:32:33','',1067,'https://www.datarainbow.eu/wp-content/uploads/2019/02/Screenshot-2020-11-30-at-00.31.06.png',0,'attachment','image/png',0),(1932,1,'2020-11-30 00:33:13','2020-11-30 00:33:13','<!-- wp:heading {\"level\":4} -->\n<h4></h4>\n<!-- /wp:heading -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Data Security and Privacy interview of Tara Taubman-Bassirian by the Privacy Professor, Rebecca Herold, Tuesday at 2 PM Pacific<strong>January 22nd 2019: GDPR, Data Privacy Day and The Need for Privacy</strong><br></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.voiceamerica.com/promo/episode/112620\">Episode Description</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, with Rebecca.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":49} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-00.33.19.png\" alt=\"\" class=\"wp-image-49\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian is a French Lawyer based in the UK with expertise in areas of privacy, data protection, intellectual property and eCommerce. She has made a name for herself in several areas of the world, most notably the UK, France and the US. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN\'s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group Fly A Kite with Rebecca. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This publication is licensed under a Creative Commons Attribution 4.0 International<br>More information on the licence can be found <a href=\"http://creativecommons.org/licenses/by/4.0/\">here</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Photography by Tara Taubman-Bassirian the Queen Elisabeth in Ascot.</p>\n<!-- /wp:paragraph -->','GDPR, Data Privacy Day and The Need for Privacy','','inherit','closed','closed','','1067-revision-v1','','','2020-11-30 00:33:13','2020-11-30 00:33:13','',1067,'https://www.datarainbow.eu/1067-revision-v1/',0,'revision','',0),(1933,1,'2020-11-30 00:35:36','2020-11-30 00:35:36','','Screenshot 2020-11-30 at 00.34.04','','inherit','open','closed','','screenshot-2020-11-30-at-00-34-04','','','2020-11-30 00:35:36','2020-11-30 00:35:36','',1064,'https://www.datarainbow.eu/wp-content/uploads/2019/01/Screenshot-2020-11-30-at-00.34.04.png',0,'attachment','image/png',0),(1934,1,'2020-11-30 00:36:09','2020-11-30 00:36:09','<!-- wp:paragraph -->\n<p>by MC PÉROUX, LL. M January 14, 2019 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>WHY PRIVACY BY DESIGN UNDER THE GDPR IS IMPORTANT FOR COMPANIES&nbsp;(1)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>MC PÉROUX, LL. M</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>January 22, 2019</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A QUICK RECAP OF THE 7 FOUNDATIONAL PRINCIPLES&nbsp;(2)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have been developed and conceptualised since the 90’s by Ann Cavoukian, Ph.D., and for the first time, a mandatory legal text has included its tenets, the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>➔ purpose limitation (GDPR, art 5-1 b), data minimisation (GDPR, art 5-1 c))</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li>Proactive not Reactive; Preventative not Remedial -&gt; purpose limitation (GDPR, art 5-1 b), data minimisation (GDPR, art 5-1 c))</li><li>Privacy as the Default Setting</li><li>Privacy Embedded into Design -&gt; GDPR art 25</li><li>Full Functionality - Positive-Sum, not Zero-Sum -&gt; “Privacy by Design avoids the pretense of false dichotomies, such as privacy vs. security, demonstrating that it is possible to have both. “&nbsp; -&gt; See the current discussions on different business models of free information services accessibility without a paywall (personal information given of exchange of free information)&nbsp;(4)</li><li>End-to-End Security - Full Lifecycle Protection -&gt; GDPR: art 5-1 f), art 25 and art 32 (“ level of security appropriate to the risk “)</li><li>Visibility and Transparency - Keep it Open -&gt; Accountability, GDPR art 5-2, art12</li><li>Respect for User Privacy - Keep it User-Centric -&gt;  Accuracy GDPR art 5-1 d), Rights of the Data Subjects, GDPR Chapter III</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>WHY SHOULD COMPANIES REALISE THE IMPORTANCE OF PRIVACY BY DESIGN ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR introduces a change in paradigm.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is not centered on the processors but on the individuals’ fundamental rights.&nbsp; (5)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The gauge to assess an envisaged personal treatment remains the risk it represents to the data subjects’ fundamental rights, the right to privacy being one of them.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>NO RIGHT IS ABSOLUTE AND THE GDPR IS A BALANCING ACT BETWEEN THE RIGHT TO PRIVACY AND OTHER RIGHTS</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the current issue on the right to erasure (art 17) where the CJEU Attorney General, M. Maciej Szpunar, recommends a limitation of this rights balancing it with the right to information:&nbsp;§<em>57 “ En revanche, et c’est en quelque sorte le nœud de la présente affaire, le « droit à l’oubli » doit être mis en balance avec d’autres droits fondamentaux. “&nbsp;&nbsp;</em>(6)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When designing any process on personal data the very first question of the processor should be “do I respect and embed the fundamental rights of the persons when I use their personal data? “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I know this is still too rare an attitude especially among the internet personal data giants like the (in)famous GAFAM (7).&nbsp; Their entire business model is based on the gathering of as much personal data (under the GDPR extensive definition) as possible with too often very deceptive opaque methods.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>NEW TRENDS AMONG COMPANIES PROCESSING PERSONAL DATA&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some companies, more forward looking, realise that the users, real persons with real interest in protecting their physical life from intrusive data hogging methods, demand that something has to change in the handling of their private information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have perhaps understood the general move towards more respect for the individuals’ privacy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Look at the legal trend towards the respect of private information from the upcoming Californian Legislation (8), the success of Convention108 in bringing privacy considerations into many jurisdictions (9) , even the president of Apple, Tim Cook, is asking for a legislation on privacy&nbsp;(10).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>At the recent 2019 edition of the CES, privacy made an entrance but it remains to be seen whether the companies do really apply Privacy By Design or if they are just surfing on the trends.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Too often, companies with a business model based on processing personal data or selling software allowing it, announce that they are “100% GDPR compliant “ but when one looks more into the process they use, it is clear that the GDPR principles have been overlooked or interpreted wrongly…&nbsp;(11)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the other end of the spectrum, one finds even some American companies that communicate on privacy as a feature embedded from the start in their business model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example:&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Info: I have no affiliation, no interest in the companies, I do not endorse their products</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ HUMU&nbsp; (12)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although I do not like behavioural analysis in general, finding it extremely invasive on privacy, this company’s communication seems ahead of others on Privacy By Design &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>That’s why we built with the GDPR in mind from day one, and we extend the rights from the GDPR to every user no matter where in the world they live. This includes transparency, control, and data portability. </em>“&nbsp;(13)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ SNIPS&nbsp;(14)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>Snips Global Communications Director Genia Shipova said the focus on privacy by design is what makes Snips a GDPR-friendly solution. »&nbsp; She said Snips wants to avoid data-centric business models used by larger tech companies by focusing on contracts with its customers.</em>“&nbsp; (15)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ Q-Branch Labs (16)&nbsp; and their Vektor&nbsp;(17) product</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\" <em>We start with the assumption that everything we send out of this device has to be GDPR-cleared. We just don\'t want to deal with the problems. All of the logs and security alerts that we send out, we still rip out all of the private information.</em>\" Says the founder Jim McCoy&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ OEKON SAS and its device ASK-HAROLD&nbsp; (19) developed in France&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on an AI that searches for you information on Internet</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONCLUSION</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I hope that companies realise how important it is to understand the principles to protect and respect the ever-growing mass of personal data they handle. They could start reading Art 5 of the GDPR relating to its founding principles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google just learned the hard way what Privacy By Design means for the French DPA, the CNIL.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its last decision,&nbsp; the CNIL clearly states that the users are not properly informed before consenting due to the numerous steps they have to take in order to find information in the process. The decision is a lesson on what is bad and opaque design to lure the users to consent to vague descriptions of processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To respect Privacy By Design is just to respect the persons at the end of the process.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Maybe by showing respect, some companies could even gain trust from their customers.</li><li>Place yourself in the shoes of the person when you design any personal data treatment.</li><li>Imagine that this person is someone important to you and see how it really feels to you that her personal data, her life, is processed by your envisaged treatment.</li><li>Educate the developers to the values of privacy during their studies.</li><li>Hire people who understand the value of their own privacy to develop your processes.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Yes business is important but ethics, respect should not be lost.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A person who trusts a company’s handling of her data will give the information needed, it is a trust that companies should gain, not steel away by opaque processes and algorithms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>MC PÉROUX, LL. M</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Blog in French to help SMB’s to understand privacy <a href=\"https://mementosafe.com/\">https://mementosafe.com/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/in/marieclaire74/\">LinkedIn</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://twitter.com/MCPLLM\">Twitter</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(1) More details on PBD “<a href=\"https://www.linkedin.com/pulse/privacy-security-design-data-gdpr-compliance-marieclaire-p%C3%A9roux/\">Privacy and security by design, data security, and GDPR compliance</a>“, MC Péroux, dec.12, 2018 on LinkedIn<br>(2) <a href=\"https://www.ipc.on.ca/wpcontent/uploads/resources/7foundationalprinciples.pdf\">Privacy By Design The 7 Foundational Principles</a>- January 2011 <br>(3) <em>Ibid</em>.<br>(4) “<a href=\"https://www.huntonprivacyblog.com/2019/01/07/austrian-dpa-issues-decision-on-validityof-cookie-consent-solution/\">A</a><em><a href=\"https://www.huntonprivacyblog.com/2019/01/07/austrian-dpa-issues-decision-on-validityof-cookie-consent-solution/\">ustrian DPA Issues Decision on Validity of Cookie Consent Solution</a></em>“ , Hunton Andrews, Kurth LLP, Posted on January 7, 2019,<br> “<em>The differing approaches taken by the Austrian DPA and the UK ICO demonstrates a lack of alignment on this issue, and it remains to be seen how other DPAs will decide on the issue</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(5) <a href=\"http://www.europarl.europa.eu/charter/pdf/text_en.pdf\">Charter of Fundamental Rights of the European Union, art 8(1)</a><br>(6) In French, Conclusions de l’avocat général M. Maciej Szpunar présentées le 10 janvier 2019, <a href=\"http://curia.europa.eu/juris/celex.jsf?celex=62017CC0507&amp;lang1=fr&amp;lang2=EN&amp;type=TXT  &amp;ancre=\">Affaire C-507/17, Google LLC</a>, venant aux droits de Google Inc. Contre Commission Nationale de l’Informatique et des Libertés (CNIL),<br>(7) GOOGLE, AMAZON, FACEBOOK, APPLE, MICROSOFT<br>(8) AB-375 Privacy: personal information: businesses. (2017-2018), Assembly <a href=\"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375\">Bill No. 375 CHAPTER 55</a>, An act to add Title 1.81.5 (commencing with Section 1798.100) to Part 4 of Division 3 of the Civil Code, relating to privacy. [Approved by Governor June 28, 2018. Filed with Secretary of State June 28, 2018.]<br>(9) Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Strasbourg, 28.I.1981, “This Convention is the first binding international instrument which protects the individual against abuses which may accompany the collection and processing of personal data and which seeks to regulate at the same time the transfrontier flow of personal data. “ https://www.coe.int/fr/web/conventions/full-list/-<br> /conventions/rms/0900001680078b37</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(10)  “<em>This Is Surveillance.\' Apple CEO Tim Cook Slams Tech Rivals Over Data Collection“ </em>“ Cook also reiterated calls for federal privacy laws in the U.S., similar to those unveiled in Europe, called the General Data Protection Regulation.“ Natalia Drozdiak and <a href=\"http://time.com/5433499/tim-cookapple-data-privacy/\">Stephanie Bodoni / Bloomberg October 24, 2018 via TIME</a>, </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(11) An example among many “<a href=\"https://twitter.com/gaeel/status/1082702284746883072\">How did we get here? </a>“Twitter feed @<em>gaeel</em><br>(12) https://humu.com/<br>(13) “<a href=\"https://humu.com/2019/01/09/humu-data-privacy-trust-iso-soc/\">Data Privacy at Humu: Building Systems for Trust to Make Work Better</a> “, January 9, 2019, Bryan Zimmer </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(14) https://snips.ai/<br>(15) “<a href=\"https://iapp.org/news/a/ces-2019-gdpr-talk-fills-halls-of-eureka-park/\">CES 2019: GDPR talk fills halls of Eureka Park</a> “, Ryan Chiavetta, CIPP/US, Jan.9, 2019,<br>(16) https://www.q-branch.net/index_d/<br>(17) https://getvektor.com/<br>(18) Above note 15</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(19) http://minim-e.com/ and https://play.google.com/store/apps/details?id=fr.oekon.harold<br>https://itunes.apple.com/us/app/ask-harold/id1332599364</p>\n<!-- /wp:paragraph -->','PRIVACY BY DESIGN AND BY DEFAULT UNDER THE GDPR','PRIVACY BY DESIGN have been developed and conceptualised since the 90’s by Ann Cavoukian, Ph.D., and for the first time, a mandatory legal text has included its tenets, the GDPR.','inherit','closed','closed','','1064-autosave-v1','','','2020-11-30 00:36:09','2020-11-30 00:36:09','',1064,'https://www.datarainbow.eu/1064-autosave-v1/',0,'revision','',0),(1935,1,'2020-11-30 00:38:22','2020-11-30 00:38:22','','Screenshot 2020-11-30 at 00.37.25','','inherit','open','closed','','screenshot-2020-11-30-at-00-37-25','','','2020-11-30 00:38:22','2020-11-30 00:38:22','',1064,'https://www.datarainbow.eu/wp-content/uploads/2019/01/Screenshot-2020-11-30-at-00.37.25.png',0,'attachment','image/png',0),(1936,1,'2020-11-30 00:38:24','2020-11-30 00:38:24','','Screenshot 2020-11-30 at 00.37.09','','inherit','open','closed','','screenshot-2020-11-30-at-00-37-09','','','2020-11-30 00:38:24','2020-11-30 00:38:24','',1064,'https://www.datarainbow.eu/wp-content/uploads/2019/01/Screenshot-2020-11-30-at-00.37.09.png',0,'attachment','image/png',0),(1937,1,'2020-11-30 00:38:29','2020-11-30 00:38:29','','Screenshot 2020-11-30 at 00.36.53','','inherit','open','closed','','screenshot-2020-11-30-at-00-36-53','','','2020-11-30 00:38:29','2020-11-30 00:38:29','',1064,'https://www.datarainbow.eu/wp-content/uploads/2019/01/Screenshot-2020-11-30-at-00.36.53.png',0,'attachment','image/png',0),(1938,1,'2020-11-30 00:39:18','2020-11-30 00:39:18','','Screenshot 2020-11-30 at 00.36.44','','inherit','open','closed','','screenshot-2020-11-30-at-00-36-44','','','2020-11-30 00:39:18','2020-11-30 00:39:18','',1064,'https://www.datarainbow.eu/wp-content/uploads/2019/01/Screenshot-2020-11-30-at-00.36.44.png',0,'attachment','image/png',0),(1939,1,'2020-11-30 00:39:20','2020-11-30 00:39:20','','Screenshot 2020-11-30 at 00.36.33','','inherit','open','closed','','screenshot-2020-11-30-at-00-36-33','','','2020-11-30 00:39:20','2020-11-30 00:39:20','',1064,'https://www.datarainbow.eu/wp-content/uploads/2019/01/Screenshot-2020-11-30-at-00.36.33.png',0,'attachment','image/png',0),(1940,1,'2020-11-30 00:39:21','2020-11-30 00:39:21','','Screenshot 2020-11-30 at 00.36.03','','inherit','open','closed','','screenshot-2020-11-30-at-00-36-03','','','2020-11-30 00:39:21','2020-11-30 00:39:21','',1064,'https://www.datarainbow.eu/wp-content/uploads/2019/01/Screenshot-2020-11-30-at-00.36.03.png',0,'attachment','image/png',0),(1941,1,'2020-11-30 00:39:22','2020-11-30 00:39:22','','Screenshot 2020-11-30 at 00.35.46','','inherit','open','closed','','screenshot-2020-11-30-at-00-35-46','','','2020-11-30 00:39:22','2020-11-30 00:39:22','',1064,'https://www.datarainbow.eu/wp-content/uploads/2019/01/Screenshot-2020-11-30-at-00.35.46.png',0,'attachment','image/png',0),(1942,1,'2020-11-30 00:39:41','2020-11-30 00:39:41','<!-- wp:paragraph -->\n<p>by MC PÉROUX, LL. M January 14, 2019 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>WHY PRIVACY BY DESIGN UNDER THE GDPR IS IMPORTANT FOR COMPANIES&nbsp;(1)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>MC PÉROUX, LL. M</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>January 22, 2019</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A QUICK RECAP OF THE 7 FOUNDATIONAL PRINCIPLES&nbsp;(2)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have been developed and conceptualised since the 90’s by Ann Cavoukian, Ph.D., and for the first time, a mandatory legal text has included its tenets, the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>➔ purpose limitation (GDPR, art 5-1 b), data minimisation (GDPR, art 5-1 c))</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li>Proactive not Reactive; Preventative not Remedial -&gt; purpose limitation (GDPR, art 5-1 b), data minimisation (GDPR, art 5-1 c))</li><li>Privacy as the Default Setting</li><li>Privacy Embedded into Design -&gt; GDPR art 25</li><li>Full Functionality - Positive-Sum, not Zero-Sum -&gt; “Privacy by Design avoids the pretense of false dichotomies, such as privacy vs. security, demonstrating that it is possible to have both. “&nbsp; -&gt; See the current discussions on different business models of free information services accessibility without a paywall (personal information given of exchange of free information)&nbsp;(4)</li><li>End-to-End Security - Full Lifecycle Protection -&gt; GDPR: art 5-1 f), art 25 and art 32 (“ level of security appropriate to the risk “)</li><li>Visibility and Transparency - Keep it Open -&gt; Accountability, GDPR art 5-2, art12</li><li>Respect for User Privacy - Keep it User-Centric -&gt;  Accuracy GDPR art 5-1 d), Rights of the Data Subjects, GDPR Chapter III</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>WHY SHOULD COMPANIES REALISE THE IMPORTANCE OF PRIVACY BY DESIGN ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR introduces a change in paradigm.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is not centered on the processors but on the individuals’ fundamental rights.&nbsp; (5)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The gauge to assess an envisaged personal treatment remains the risk it represents to the data subjects’ fundamental rights, the right to privacy being one of them.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>NO RIGHT IS ABSOLUTE AND THE GDPR IS A BALANCING ACT BETWEEN THE RIGHT TO PRIVACY AND OTHER RIGHTS</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the current issue on the right to erasure (art 17) where the CJEU Attorney General, M. Maciej Szpunar, recommends a limitation of this rights balancing it with the right to information:&nbsp;§<em>57 “ En revanche, et c’est en quelque sorte le nœud de la présente affaire, le « droit à l’oubli » doit être mis en balance avec d’autres droits fondamentaux. “&nbsp;&nbsp;</em>(6)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When designing any process on personal data the very first question of the processor should be “do I respect and embed the fundamental rights of the persons when I use their personal data? “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I know this is still too rare an attitude especially among the internet personal data giants like the (in)famous GAFAM (7).&nbsp; Their entire business model is based on the gathering of as much personal data (under the GDPR extensive definition) as possible with too often very deceptive opaque methods.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>NEW TRENDS AMONG COMPANIES PROCESSING PERSONAL DATA&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some companies, more forward looking, realise that the users, real persons with real interest in protecting their physical life from intrusive data hogging methods, demand that something has to change in the handling of their private information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have perhaps understood the general move towards more respect for the individuals’ privacy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Look at the legal trend towards the respect of private information from the upcoming Californian Legislation (8), the success of Convention108 in bringing privacy considerations into many jurisdictions (9) , even the president of Apple, Tim Cook, is asking for a legislation on privacy&nbsp;(10).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>At the recent 2019 edition of the CES, privacy made an entrance but it remains to be seen whether the companies do really apply Privacy By Design or if they are just surfing on the trends.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Too often, companies with a business model based on processing personal data or selling software allowing it, announce that they are “100% GDPR compliant “ but when one looks more into the process they use, it is clear that the GDPR principles have been overlooked or interpreted wrongly…&nbsp;(11)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the other end of the spectrum, one finds even some American companies that communicate on privacy as a feature embedded from the start in their business model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example:&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Info: I have no affiliation, no interest in the companies, I do not endorse their products</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ HUMU&nbsp; (12)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although I do not like behavioural analysis in general, finding it extremely invasive on privacy, this company’s communication seems ahead of others on Privacy By Design &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>That’s why we built with the GDPR in mind from day one, and we extend the rights from the GDPR to every user no matter where in the world they live. This includes transparency, control, and data portability. </em>“&nbsp;(13)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ SNIPS&nbsp;(14)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>Snips Global Communications Director Genia Shipova said the focus on privacy by design is what makes Snips a GDPR-friendly solution. »&nbsp; She said Snips wants to avoid data-centric business models used by larger tech companies by focusing on contracts with its customers.</em>“&nbsp; (15)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ Q-Branch Labs (16)&nbsp; and their Vektor&nbsp;(17) product</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\" <em>We start with the assumption that everything we send out of this device has to be GDPR-cleared. We just don\'t want to deal with the problems. All of the logs and security alerts that we send out, we still rip out all of the private information.</em>\" Says the founder Jim McCoy&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ OEKON SAS and its device ASK-HAROLD&nbsp; (19) developed in France&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on an AI that searches for you information on Internet</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONCLUSION</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I hope that companies realise how important it is to understand the principles to protect and respect the ever-growing mass of personal data they handle. They could start reading Art 5 of the GDPR relating to its founding principles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google just learned the hard way what Privacy By Design means for the French DPA, the CNIL.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its last decision,&nbsp; the CNIL clearly states that the users are not properly informed before consenting due to the numerous steps they have to take in order to find information in the process. The decision is a lesson on what is bad and opaque design to lure the users to consent to vague descriptions of processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To respect Privacy By Design is just to respect the persons at the end of the process.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Maybe by showing respect, some companies could even gain trust from their customers.</li><li>Place yourself in the shoes of the person when you design any personal data treatment.</li><li>Imagine that this person is someone important to you and see how it really feels to you that her personal data, her life, is processed by your envisaged treatment.</li><li>Educate the developers to the values of privacy during their studies.</li><li>Hire people who understand the value of their own privacy to develop your processes.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Yes business is important but ethics, respect should not be lost.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A person who trusts a company’s handling of her data will give the information needed, it is a trust that companies should gain, not steel away by opaque processes and algorithms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>MC PÉROUX, LL. M</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Blog in French to help SMB’s to understand privacy <a href=\"https://mementosafe.com/\">https://mementosafe.com/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/in/marieclaire74/\">LinkedIn</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://twitter.com/MCPLLM\">Twitter</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(1) More details on PBD “<a href=\"https://www.linkedin.com/pulse/privacy-security-design-data-gdpr-compliance-marieclaire-p%C3%A9roux/\">Privacy and security by design, data security, and GDPR compliance</a>“, MC Péroux, dec.12, 2018 on LinkedIn<br>(2) <a href=\"https://www.ipc.on.ca/wpcontent/uploads/resources/7foundationalprinciples.pdf\">Privacy By Design The 7 Foundational Principles</a>- January 2011 <br>(3) <em>Ibid</em>.<br>(4) “<a href=\"https://www.huntonprivacyblog.com/2019/01/07/austrian-dpa-issues-decision-on-validityof-cookie-consent-solution/\">A</a><em><a href=\"https://www.huntonprivacyblog.com/2019/01/07/austrian-dpa-issues-decision-on-validityof-cookie-consent-solution/\">ustrian DPA Issues Decision on Validity of Cookie Consent Solution</a></em>“ , Hunton Andrews, Kurth LLP, Posted on January 7, 2019,<br> “<em>The differing approaches taken by the Austrian DPA and the UK ICO demonstrates a lack of alignment on this issue, and it remains to be seen how other DPAs will decide on the issue</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(5) <a href=\"http://www.europarl.europa.eu/charter/pdf/text_en.pdf\">Charter of Fundamental Rights of the European Union, art 8(1)</a><br>(6) In French, Conclusions de l’avocat général M. Maciej Szpunar présentées le 10 janvier 2019, <a href=\"http://curia.europa.eu/juris/celex.jsf?celex=62017CC0507&amp;lang1=fr&amp;lang2=EN&amp;type=TXT  &amp;ancre=\">Affaire C-507/17, Google LLC</a>, venant aux droits de Google Inc. Contre Commission Nationale de l’Informatique et des Libertés (CNIL),<br>(7) GOOGLE, AMAZON, FACEBOOK, APPLE, MICROSOFT<br>(8) AB-375 Privacy: personal information: businesses. (2017-2018), Assembly <a href=\"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375\">Bill No. 375 CHAPTER 55</a>, An act to add Title 1.81.5 (commencing with Section 1798.100) to Part 4 of Division 3 of the Civil Code, relating to privacy. [Approved by Governor June 28, 2018. Filed with Secretary of State June 28, 2018.]<br>(9) Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Strasbourg, 28.I.1981, “This Convention is the first binding international instrument which protects the individual against abuses which may accompany the collection and processing of personal data and which seeks to regulate at the same time the transfrontier flow of personal data. “ https://www.coe.int/fr/web/conventions/full-list/-<br> /conventions/rms/0900001680078b37</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(10)  “<em>This Is Surveillance.\' Apple CEO Tim Cook Slams Tech Rivals Over Data Collection“ </em>“ Cook also reiterated calls for federal privacy laws in the U.S., similar to those unveiled in Europe, called the General Data Protection Regulation.“ Natalia Drozdiak and <a href=\"http://time.com/5433499/tim-cookapple-data-privacy/\">Stephanie Bodoni / Bloomberg October 24, 2018 via TIME</a>, </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(11) An example among many “<a href=\"https://twitter.com/gaeel/status/1082702284746883072\">How did we get here? </a>“Twitter feed @<em>gaeel</em><br>(12) https://humu.com/<br>(13) “<a href=\"https://humu.com/2019/01/09/humu-data-privacy-trust-iso-soc/\">Data Privacy at Humu: Building Systems for Trust to Make Work Better</a> “, January 9, 2019, Bryan Zimmer </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(14) https://snips.ai/<br>(15) “<a href=\"https://iapp.org/news/a/ces-2019-gdpr-talk-fills-halls-of-eureka-park/\">CES 2019: GDPR talk fills halls of Eureka Park</a> “, Ryan Chiavetta, CIPP/US, Jan.9, 2019,<br>(16) https://www.q-branch.net/index_d/<br>(17) https://getvektor.com/<br>(18) Above note 15</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(19) http://minim-e.com/ and https://play.google.com/store/apps/details?id=fr.oekon.harold<br>https://itunes.apple.com/us/app/ask-harold/id1332599364</p>\n<!-- /wp:paragraph -->','PRIVACY BY DESIGN AND BY DEFAULT UNDER THE GDPR','PRIVACY BY DESIGN have been developed and conceptualised since the 90’s by Ann Cavoukian, Ph.D., and for the first time, a mandatory legal text has included its tenets, the GDPR.','inherit','closed','closed','','1064-revision-v1','','','2020-11-30 00:39:41','2020-11-30 00:39:41','',1064,'https://www.datarainbow.eu/1064-revision-v1/',0,'revision','',0),(1943,1,'2020-11-30 00:41:20','2020-11-30 00:41:20','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Decembre 2016, <a rel=\"noreferrer noopener\" href=\"http://www.infosecurity-magazine.com/news/over-half-of-global-firms-gdpr/?utm_source=dlvr.it&amp;utm_medium=twitter\" target=\"_blank\">Infosecurity</a> magasine titled \"Over Half of Global Firms Still Not Progressing with GDPR\" reporting :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“GDPR is the most significant change to data protection in a generation and an imminent global issue that will dominate data privacy, management and regulation discussions in 2017,” said Mike Palmer, executive vice-president at Veritas. “To avoid potential regulatory fines or worse, damage to their corporate brands and reputations, global enterprises must take action now to understand where their data resides and how to protect it.”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Since the UK referendum vote for BREXIT much has been speculated about the situation of the UK with regard to compliance to the GDPR enforceable from 28 May 2018. Although they are uncertainties, the recent&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/uk-brexit-perspective-gdpr/id16418899#item186474786\" target=\"_blank\">UK Information Commissioner speech</a>&nbsp;has reinforced the opinion that&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/uk-brexit-perspective-gdpr/id16418899#item186474786\" target=\"_blank\">UK businesses need to get ready to comply</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/gdpr-new-text/id15747243#item175275842\" target=\"_blank\">The GDPR&nbsp;</a>has  significantly raised the bar for compliance. Fines can go up to €20 million or 4% of annual global turnover. Organisations had two years to be ready. Shortage of Data Protection Officers was predicted. After an initial period of panic, the summer 2018 was rather quiet, many organisations were expectative waiting for the enforcement of the regulation. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The new EU data protection law, non sector-specific, is technologically neutral and all types of organisations are affected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Recital 22; Art.3(1), the GDPR applies to organisations that are established in one or more Member State and process personal data in the context of that establishment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 23 Art.3(2)(a) adds :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR applies to organisations established outside the EU if they process data of EU residents when offering them goods or services.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Finally, Recital 24 Art.3(2)(b) states :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR applies to organisations established outside the EU if they monitor the behaviour of EU residents.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What justifies compliance ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Because UK businesses will need to be compliant to continue to trade with the rest of the EU. </li><li>Because gaining customers trust is important. </li><li>Data breach notification cannot be neglected, the organisation\'s reputation can be badly hurt. </li><li>So much can be gained, from Big Data, geolocation data, IoT, etc... Privacy should be seen as an asset and not just a burden. </li><li>Marketers would benefit from accurate data instead of bulk out of date or inaccurate data collection . </li><li>Making privacy and data protection an asset could be the future of Big Data.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Collecting and legitimately processing data with respect to the 8 principals, incorporated into Chapter&nbsp;2, Article 5 (1) (a)-(f). are the future of data industry :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>storing data for a limited period or only where necessary, </li><li>keeping data accurate and adequate,</li><li>processing lawfully, fairly and in a transparent manner, with purpose limitation,</li><li>processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage,</li><li>using appropriate technical or organisational measures,</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>are all major improvements, Much remain to be done with ethics. Read more&nbsp;<a href=\"http://www.linkedin.com/pulse/drones-autonomus-cars-ethics-regulation-tara-taubman-bassirian?trk=mp-reader-card\" target=\"_blank\" rel=\"noreferrer noopener\">here&nbsp;</a>and&nbsp;<a href=\"http://itsecurity.co.uk/2016/10/still-denial-tough-new-privacy-law-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2016/10/still-denial-tough-new-privacy-law-gdpr/\" target=\"_blank\">Still in Denial of the Tough New Privacy Law GDPR?</a></h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Here is my compilation of all various opinions and analysis of the situation:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>to better understand what is required by the&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/gdpr/id15213471\" target=\"_blank\">GDPR</a>,</li><li>The&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/uk-brexit-perspective-gdpr/id16418899\" target=\"_blank\">UK and the GDPR</a>&nbsp;after BREXIT,</li><li>The&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/uk-brexit-perspective-gdpr/id16418899\" target=\"_blank\">Working Party ARticle 29</a>&nbsp;position,</li><li>Opinions of&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/from-privacy-experts-corner/id15213561\" target=\"_blank\">Privacy experts</a>,</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>This work is licensed under a&nbsp;</em></strong><a rel=\"noreferrer noopener\" href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\"><strong><em>Creative Commons Attribution 4.0 International License</em></strong></a><strong><em>.</em></strong></p>\n<!-- /wp:paragraph -->','What to retain from the GDPR after BREXIT','Since the UK referendum vote for BREXIT much has been speculated about the situation of the UK with regard to compliance to the GDPR enforceable from 28 May 2018. Although they are uncertainties, the recent UK Information Commissioner speech has reinforced the opinion that UK businesses need to get ready to comply.','inherit','closed','closed','','1061-revision-v1','','','2020-11-30 00:41:20','2020-11-30 00:41:20','',1061,'https://www.datarainbow.eu/1061-revision-v1/',0,'revision','',0),(1944,1,'2020-11-30 00:43:00','2020-11-30 00:43:00','<!-- wp:heading {\"level\":1} -->\n<h1>The GDPR</h1>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The General Data Protection Regulation, or \"GDPR\" - “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. - was published 4 May 2016. Enforceable after a grace period of two year,  from the 28th of May 2018. What made the headlines was the maximum fines of up to  20 million € or 4% of annual global turnover.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The text is a major reform of Data Protection Directive. An evolution but not a revolution. With the aim of introducing harmonisation, Some of the major  changes are  :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;<strong>mandatory reporting for data breaches</strong>, to the Data Protection Authority and if risk to data subject, within&nbsp;<strong>72 hours,</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;<strong>heavier sanctions</strong>, with significant new fines: Maximum fines of&nbsp;<strong>€20 million&nbsp;</strong>or&nbsp;<strong>4% of annual global turnover&nbsp;</strong><em>per&nbsp;</em>breach (a dramatic increase from the current typical maximum of less than €1 million).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- extra-territorial jurisdiction : businesses outside the EU will be subject to the GDPR, if they are&nbsp;<strong>offering goods or services to</strong>, or&nbsp;<strong>monitoring the behaviour of</strong>, EU residents (currently they are only caught if they operate data processing equipment in the EU). See further on this below.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;<strong>the one-stop-shop</strong>, </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- Organisations will have to formally appoint an&nbsp;<strong>independent Data Protection Officer</strong>, where, according to the Art 37 ; </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li>the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;</li><li>the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or</li><li>the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to&nbsp;<a href=\"https://gdpr-info.eu/art-9-gdpr/\">Article 9</a>&nbsp;or personal data relating to criminal convictions and offences referred to in&nbsp;<a href=\"https://gdpr-info.eu/art-10-gdpr/\">Article 10</a>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;<strong>revised consent</strong>, a higher standard required to be express/opt-in (a ‘clear affirmative action’) whereas, under the previous regime, implied/opt-out consent is sometimes sufficient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;<strong>No more registration for data</strong>&nbsp;controllers. Instead, they are required to maintain internal records of their processing activities (for disclosure on demand to Data Protection Authorities), However, the registration and fees were maintained in the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;<strong>Processor liability:&nbsp;</strong>data processors (i.e. businesses processing personal data solely for and on the instructions of data controllers) will have direct regulatory obligations/liability.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;<strong>data protection impact assessments</strong>&nbsp;featuring as key aspects. If the results of the assessment indicate a high risk, obtain a prior review by the relevant Data Protection Authority. The accountability principle gives some homework to organisations to demonstrate to lead risk assessments and keep registers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EU countries had to consequently modify their national legislations with few options for exceptions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK situation of adequacy is pendant to the Brexit. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/s/file/preview/137285627/GDPR_infographic_PrivacyPerfect.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">GDPR Infographic PrivacyPerfect</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additional sources :<a rel=\"noreferrer noopener\" href=\"http://iapp.org/media/pdf/resource_center/iapp-EY-2016-SLIDES_85%E2%80%9396.pdf%20%E2%80%A6\" target=\"_blank\">Survey: \"most commonly taken steps to prepare for GDPR\"</a><a rel=\"noreferrer noopener\" href=\"http://teachprivacy.com/gdpr-privacy-shield-training-requirements-faq/%20%E2%80%A6\" target=\"_blank\">G</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"http://teachprivacy.com/gdpr-privacy-shield-training-requirements-faq/%20%E2%80%A6\" target=\"_blank\">See more here on&nbsp;</a><a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/gdpr/id15213471\" target=\"_blank\">Pearltrees kept updated.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"http://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian?trk=mp-reader-card\" target=\"_blank\">All You Need To Know About The GDPR Compliance</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/idigital/gdpr/id15213471\" target=\"_blank\" rel=\"noreferrer noopener\">Using the curation tool Pearltrees, the resource will be kept updated.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Publication in ITsecurity.co.uk :&nbsp;<a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/?p=4413\" target=\"_blank\">Still in Denial of the Tough New Privacy Law #GDPR?</a>&nbsp;UK data protection and BREXIT.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li></li></ul>\n<!-- /wp:list -->','Navigating the new EU Data Protection Rules','The General Data Protection Regulation, or \"GDPR\" - “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. - was published 4 May 2016. Enforceable after a grace period of two year,  from the 28th of May 2018. ','inherit','closed','closed','','1060-revision-v1','','','2020-11-30 00:43:00','2020-11-30 00:43:00','',1060,'https://www.datarainbow.eu/1060-revision-v1/',0,'revision','',0),(1945,1,'2020-12-02 14:42:47','2020-12-02 14:42:47','<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major recent cases (Fashion ID (c-40-17) and Planet49 (c-673/17)) highlight the importance of cookies compliance in Europe, and the complex intricacies which organisations must now consider. In addition, an increase in the number of enforcement actions and fines in Europe signify a move towards stricter regulation of ePrivacy.<br>➡️. Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️. Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️. Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️. Five jurisdictions find an implicit consent to be valid<br><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/d2iPwBQ\" target=\"_blank\">DLA PIPER guide</a> summarises practical requirements which organisations should consider when analysing their overall cookies compliance, including in relation to banners, polices and consent collection.<br><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=privacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739908022304284672\">#privacy</a> <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739908022304284672\">#dataprotection</a> <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739908022304284672\">#cookies</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://lnkd.in/ghS6RVy\" target=\"_blank\" rel=\"noreferrer noopener\">NOYB ANNOUNCED</a> : The DPC Ireland at \"work\": 630 pages field with the Irish High Court, to block our Judicial Review and arguing why it should NOT decide the SchremsI and SchremsII complaint after 7½ years, despite the CJEU ruling this summer.<br>Find out more here: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EU Commission proposes <a rel=\"noreferrer noopener\" href=\"https://lnkd.in/dUB_FM8\" target=\"_blank\">new Data Governance Act</a><br><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=datagovernance&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739123308626767872\">#datagovernance</a> <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personaldata&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739123308626767872\">#personaldata</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Half of all organizations experienced security incidents associated with remote working during the lockdown period, according to a report by Tessian. The “<a rel=\"noreferrer noopener\" href=\"https://www.tessian.com/research/the-future-of-hybrid-working/\" target=\"_blank\">Securing the Future of Hybrid Working</a>” report also found that phishing remained the most prevalent threat facing employees working remotely. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.enisa.europa.eu/news/enisa-news/telecom-security-and-resilience-during-covid19\" target=\"_blank\" rel=\"noreferrer noopener\">ENISA Report </a>Highlights Resilience of Telecom Sector in Facing the Pandemic</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/posts/beaconai_globalstateofprivacy-privacy-dataprotection-activity-6706873062916198400-SDFJ\">Beacon AI</a> will host their Global State of Privacy virtual event with <a href=\"https://www.linkedin.com/company/altada-technology-solutions-limited/\">Altada Technology Solutions </a>on September 15th at 11am GMT. You can reserve your tickets now on Eventbrite <a href=\"https://bit.ly/34GwHvf\">https://bit.ly/34GwHvf</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Delighted to be asked to participate in&nbsp;this <a href=\"https://www.linkedin.com/company/beaconai/\">Beacon AI</a>\'s upcoming virtual event, Sharing the screen with some amazing fellow speakers including&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAEjZSMBPHCDNL0ZfbkbHBFk7NBEwjLsbi0\">Gordon&nbsp;Wade</a>, Áine Quirke,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAqCsAcBtx0dA1Lw7VNmUBejjlgS7zW6sNA\">Gail Chalmin</a>,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAGW1hEBKjAOVvS9pL8ollH0kw1TY1y3iJw\">Alexander Hanff</a>,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAA7DYaIB7VdfLfG7VcW5z1b0a5fHRYiUraU\">Niamh Parker</a>,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAACvVXEBcRlW49jJa3QuJdQfqLnC30uMTBg\">JT Lewis</a>&nbsp;and&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAACOxggBCpqn1fqX0pEpAxapf-s7wsALdjk\">Stijn (Stan) Christiaens</a>&nbsp;on a host of the hottest topics in&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6706936641153589248\">#dataprotection</a>&nbsp;right now.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I look forward to seeing you there! Thank you to our event supporters&nbsp;<a href=\"https://www.linkedin.com/company/corkbic/\">CorkBIC</a>,&nbsp;<a href=\"https://www.linkedin.com/company/mason-hayes-curran/\">Mason Hayes &amp; Curran LLP</a>&nbsp;and&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAANQKyMBOTl9pq57vcedDiTn5LNa4VveruE\">Glandore Network</a><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=globalstateofprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6706873062916198400\">#</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://privacylawblog.fieldfisher.com/2019/edpb-prepares-for-a-no-deal-brexit\">EDPB prepares for a \"no deal\" Brexit</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"What this means is that companies in the EU (including the EEA) that are currently freely sending their personal data to the UK will have to implement appropriate safeguards in accordance with article 46 before transferring any personal data to the UK. These appropriate safeguards include:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>Standard Data Protection Clauses adopted by the European Commission of a DPA</em></li><li><em>Ad Hoc Data Protection Clauses adopted the EU based company (data exporter) and the UK based recipient of this data (data importer)</em></li><li><em>Binding Corporate Rules</em></li><li><em>Codes of Conduct</em></li><li><em>Certification Mechanism\"</em>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board Published its guidance :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Information note on data transfers under the GDPR in the event of a no-deal Brexit  <a href=\"https://www.pearltrees.com/s/file/preview/192486822/edpb-2019-02-12-infonote-nodeal-brexit_en.pdf\">Adopted on 12 February 2019</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Information note on BCRs for companies which have ICO<br> as BCR Lead Supervisory Authority - <a href=\"https://www.pearltrees.com/s/file/preview/192486834/edpb-2019-02-12-infonote-bcrs-brexit_en.pdf\">Adopted on 12 February 2019&nbsp;</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>ICO guidance</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>To&nbsp;<em>help</em>&nbsp;organisations prepare for a&nbsp;<em>\'</em>no deal<em>\'</em>&nbsp;Brexit, the ICO has published a short guide for UK businesses:&nbsp;<em>\'</em><a href=\"https://ico.org.uk/media/2553958/leaving-the-eu-six-steps-to-take.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Six Steps to Take</a><em>\'</em>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li><strong><em>Continue to comply</em></strong>&nbsp;with GDPR and follow ICO guidance.</li><li><strong><em>Transfers to the UK</em>:</strong>&nbsp;Review data flows and identify where your organisation receives data into the UK from the EEA to ensure sufficient safeguards are in place to allow the continued flow of personal data.</li><li><strong><em>Transfers from the UK</em>:</strong>&nbsp;Identify data flows to countries outside of the UK, as these will fall under new UK transfer and documentation provisions.</li><li><strong><em>European operations</em>:</strong>&nbsp;For organisations that operate across Europe, data flows, processing operations and group structures should be reviewed to fully understand the effect of Brexit on operations.</li><li><strong><em>Documentation:</em></strong>&nbsp;Identify privacy documentation in the event it needs to be updated when the UK leaves the EU.</li><li><strong><em>Organisational awareness:</em></strong>&nbsp;Ensure key people in the organisation are aware of these key issues and that plans are up to date.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><strong><a href=\"https://www.gov.uk/government/publications/data-protection-law-eu-exit/amendments-to-uk-data-protection-law-in-the-event-the-uk-leaves-the-eu-without-a-deal-on-29-march-2019\">UK Gov Guidance</a> : Amendments to UK data protection law in the event the UK leaves the EU without a deal on 29 March 2019</strong></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Resources on<a href=\"http://www.pearltrees.com/privacyday/uk-brexit/id23426706\"> Brexit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.jdsupra.com/legalnews/google-style-gdpr-fines-for-everyone-23609/\" target=\"_blank\">Google-Style GDPR Fines for Everyone? Bavarian DPA Conducts Website Cookie Practices Sweep, Announces Fines under Consideration</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The French Data Protection Authority, CNIL, <a href=\"https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc\">fining Google 50 Million Euros</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://edpb.europa.eu/news/national-news/2019/cnils-restricted-committee-imposes-financial-penalty-50-million-euros_en\">European Data Protection Board summary </a>explains how the CNIL has played the role of the lead authority to investigate the class actions filed by the Austrian <a href=\"https://noyb.eu/\">Non Of Your Business, NOYB</a>, and the French <a href=\"https://www.laquadrature.net/en/personnal-data/\">La Quadrature Du Net</a>. \'L\'Europe est en marche\' - Europe is leading - and the Union is enforcing its capabilities. Britain will be missed after Brexit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>After Google, here comes Facebook : <a href=\"https://www.lesoir.be/140480/article/2018-02-16/protection-des-donnees-privees-la-belgique-fait-plier-facebook\">A Belgian court injonction to Facebook</a> to stop his illegal collect of personal data in an 80 pages decision. 250.000 € maximum de 100 millions d’euros for everyday they dont comply. Things are acceleration. If you havent yet seen the French CNIL Google fine, have a look and make sure your organisation is compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><strong>* * *</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.voiceamerica.com/promo/episode/112620\">Radio interview of Tara Taubman-Bassirian</a>, voted <strong>Privacy Hero 2018</strong>, is on Voice of America Business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><a target=\"_blank\" href=\"https://www.voiceamerica.com/guest/42903/tara-taubman-bassirian\" rel=\"noreferrer noopener\">Tara Taubman-Bassirian</a></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>Episode Description</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><em>2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, with Rebecca.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the <strong>International Privacy Day</strong> on January the 28th. A <strong>TwitterChat at 3pm GMT</strong> using the hashtag <strong>#PrivacyAware</strong> with help of Kingston Technology. A <strong>drink in a pub in London</strong> from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations. contact data@datarainbow.eu</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><strong>* *&nbsp;*</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Let the data flow, <a href=\"https://blogs.dlapiper.com/privacymatters/eu-japan-let-the-data-flow-free-flow-of-personal-data-between-eu-countries-and-japan-confirmed/\">adequacy decision between EU and Japan</a> adopted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Former European Data Protection Supervisor Peter Hustinx joins <a href=\"https://t.co/2LSgMjSG6b\">ICO </a>as non-executive director.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><strong>* *&nbsp;*</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://www.pearltrees.com/privacyday/twitter/id23766377#item247781087\">Twitter</a></em> under investigation by the Irish Data Protection Commission</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://www.computerweekly.com/news/252456335/Facebooks-objections-to-court-concerns-over-privacy-more-about-optics-than-facts\">Facebook</a></em>’s challenge to a High Court ruling that raises serious concerns about data transfers between Europe and the US is more about appearance than facts, lawyers for the Irish Data Protection Commission told Dublin\'s Supreme Court.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><strong>* * *</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Via EDRI&nbsp;: On 7 February, the European Parliament Committee on Civil Liberties, Justice and Home Affairs (LIBE) presented two new working documents analysing further the issue of cross-border access to data in criminal matters, also known as “e-evidence”.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Conditions for obtaining subscriber information in relation to dynamic versus static IP addresses: overview of relevant court decisions and developments <a href=\"https://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\">here</a> and<a href=\"https://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\"> here.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:embed {\"url\":\"https://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\"} -->\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\n</div></figure>\n<!-- /wp:embed -->\n\n<!-- wp:paragraph -->\n<p>WARNING : Links to external website may contain cookies and tracking of visitors data. Do adjust your privacy setting in accordance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1023} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/09/Screenshot-2020-09-02-at-17.01.04-1024x498.png\" alt=\"\" class=\"wp-image-1023\"/></figure>\n<!-- /wp:image -->','NEWS','','inherit','closed','closed','','88-autosave-v1','','','2020-12-02 14:42:47','2020-12-02 14:42:47','',88,'https://www.datarainbow.eu/88-autosave-v1/',0,'revision','',0),(1946,1,'2020-12-02 14:39:14','2020-12-02 14:39:14','<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major recent cases (Fashion ID (c-40-17) and Planet49 (c-673/17)) highlight the importance of cookies compliance in Europe, and the complex intricacies which organisations must now consider. In addition, an increase in the number of enforcement actions and fines in Europe signify a move towards stricter regulation of ePrivacy.<br>➡️. Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️. Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️. Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️. Five jurisdictions find an implicit consent to be valid<br><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/d2iPwBQ\" target=\"_blank\">DLA PIPER guide</a> summarises practical requirements which organisations should consider when analysing their overall cookies compliance, including in relation to banners, polices and consent collection.<br><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=privacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739908022304284672\">#privacy</a> <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739908022304284672\">#dataprotection</a> <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739908022304284672\">#cookies</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EU Commission proposes <a href=\"https://lnkd.in/dUB_FM8\" target=\"_blank\" rel=\"noreferrer noopener\">new Data Governance Act</a><br><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=datagovernance&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739123308626767872\">#datagovernance</a> <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personaldata&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739123308626767872\">#personaldata</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/posts/beaconai_globalstateofprivacy-privacy-dataprotection-activity-6706873062916198400-SDFJ\">Beacon AI</a> will host their Global State of Privacy virtual event with <a href=\"https://www.linkedin.com/company/altada-technology-solutions-limited/\">Altada Technology Solutions </a>on September 15th at 11am GMT. You can reserve your tickets now on Eventbrite <a href=\"https://bit.ly/34GwHvf\">https://bit.ly/34GwHvf</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Delighted to be asked to participate in&nbsp;this <a href=\"https://www.linkedin.com/company/beaconai/\">Beacon AI</a>\'s upcoming virtual event, Sharing the screen with some amazing fellow speakers including&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAEjZSMBPHCDNL0ZfbkbHBFk7NBEwjLsbi0\">Gordon&nbsp;Wade</a>, Áine Quirke,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAqCsAcBtx0dA1Lw7VNmUBejjlgS7zW6sNA\">Gail Chalmin</a>,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAGW1hEBKjAOVvS9pL8ollH0kw1TY1y3iJw\">Alexander Hanff</a>,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAA7DYaIB7VdfLfG7VcW5z1b0a5fHRYiUraU\">Niamh Parker</a>,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAACvVXEBcRlW49jJa3QuJdQfqLnC30uMTBg\">JT Lewis</a>&nbsp;and&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAACOxggBCpqn1fqX0pEpAxapf-s7wsALdjk\">Stijn (Stan) Christiaens</a>&nbsp;on a host of the hottest topics in&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6706936641153589248\">#dataprotection</a>&nbsp;right now.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I look forward to seeing you there! Thank you to our event supporters&nbsp;<a href=\"https://www.linkedin.com/company/corkbic/\">CorkBIC</a>,&nbsp;<a href=\"https://www.linkedin.com/company/mason-hayes-curran/\">Mason Hayes &amp; Curran LLP</a>&nbsp;and&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAANQKyMBOTl9pq57vcedDiTn5LNa4VveruE\">Glandore Network</a><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=globalstateofprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6706873062916198400\">#</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://privacylawblog.fieldfisher.com/2019/edpb-prepares-for-a-no-deal-brexit\">EDPB prepares for a \"no deal\" Brexit</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"What this means is that companies in the EU (including the EEA) that are currently freely sending their personal data to the UK will have to implement appropriate safeguards in accordance with article 46 before transferring any personal data to the UK. These appropriate safeguards include:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>Standard Data Protection Clauses adopted by the European Commission of a DPA</em></li><li><em>Ad Hoc Data Protection Clauses adopted the EU based company (data exporter) and the UK based recipient of this data (data importer)</em></li><li><em>Binding Corporate Rules</em></li><li><em>Codes of Conduct</em></li><li><em>Certification Mechanism\"</em>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board Published its guidance :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Information note on data transfers under the GDPR in the event of a no-deal Brexit  <a href=\"https://www.pearltrees.com/s/file/preview/192486822/edpb-2019-02-12-infonote-nodeal-brexit_en.pdf\">Adopted on 12 February 2019</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Information note on BCRs for companies which have ICO<br> as BCR Lead Supervisory Authority - <a href=\"https://www.pearltrees.com/s/file/preview/192486834/edpb-2019-02-12-infonote-bcrs-brexit_en.pdf\">Adopted on 12 February 2019&nbsp;</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>ICO guidance</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>To&nbsp;<em>help</em>&nbsp;organisations prepare for a&nbsp;<em>\'</em>no deal<em>\'</em>&nbsp;Brexit, the ICO has published a short guide for UK businesses:&nbsp;<em>\'</em><a href=\"https://ico.org.uk/media/2553958/leaving-the-eu-six-steps-to-take.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Six Steps to Take</a><em>\'</em>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li><strong><em>Continue to comply</em></strong>&nbsp;with GDPR and follow ICO guidance.</li><li><strong><em>Transfers to the UK</em>:</strong>&nbsp;Review data flows and identify where your organisation receives data into the UK from the EEA to ensure sufficient safeguards are in place to allow the continued flow of personal data.</li><li><strong><em>Transfers from the UK</em>:</strong>&nbsp;Identify data flows to countries outside of the UK, as these will fall under new UK transfer and documentation provisions.</li><li><strong><em>European operations</em>:</strong>&nbsp;For organisations that operate across Europe, data flows, processing operations and group structures should be reviewed to fully understand the effect of Brexit on operations.</li><li><strong><em>Documentation:</em></strong>&nbsp;Identify privacy documentation in the event it needs to be updated when the UK leaves the EU.</li><li><strong><em>Organisational awareness:</em></strong>&nbsp;Ensure key people in the organisation are aware of these key issues and that plans are up to date.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><strong><a href=\"https://www.gov.uk/government/publications/data-protection-law-eu-exit/amendments-to-uk-data-protection-law-in-the-event-the-uk-leaves-the-eu-without-a-deal-on-29-march-2019\">UK Gov Guidance</a> : Amendments to UK data protection law in the event the UK leaves the EU without a deal on 29 March 2019</strong></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Resources on<a href=\"http://www.pearltrees.com/privacyday/uk-brexit/id23426706\"> Brexit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.jdsupra.com/legalnews/google-style-gdpr-fines-for-everyone-23609/\" target=\"_blank\">Google-Style GDPR Fines for Everyone? Bavarian DPA Conducts Website Cookie Practices Sweep, Announces Fines under Consideration</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The French Data Protection Authority, CNIL, <a href=\"https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc\">fining Google 50 Million Euros</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://edpb.europa.eu/news/national-news/2019/cnils-restricted-committee-imposes-financial-penalty-50-million-euros_en\">European Data Protection Board summary </a>explains how the CNIL has played the role of the lead authority to investigate the class actions filed by the Austrian <a href=\"https://noyb.eu/\">Non Of Your Business, NOYB</a>, and the French <a href=\"https://www.laquadrature.net/en/personnal-data/\">La Quadrature Du Net</a>. \'L\'Europe est en marche\' - Europe is leading - and the Union is enforcing its capabilities. Britain will be missed after Brexit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>After Google, here comes Facebook : <a href=\"https://www.lesoir.be/140480/article/2018-02-16/protection-des-donnees-privees-la-belgique-fait-plier-facebook\">A Belgian court injonction to Facebook</a> to stop his illegal collect of personal data in an 80 pages decision. 250.000 € maximum de 100 millions d’euros for everyday they dont comply. Things are acceleration. If you havent yet seen the French CNIL Google fine, have a look and make sure your organisation is compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><strong>* * *</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.voiceamerica.com/promo/episode/112620\">Radio interview of Tara Taubman-Bassirian</a>, voted <strong>Privacy Hero 2018</strong>, is on Voice of America Business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><a target=\"_blank\" href=\"https://www.voiceamerica.com/guest/42903/tara-taubman-bassirian\" rel=\"noreferrer noopener\">Tara Taubman-Bassirian</a></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>Episode Description</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><em>2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, with Rebecca.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the <strong>International Privacy Day</strong> on January the 28th. A <strong>TwitterChat at 3pm GMT</strong> using the hashtag <strong>#PrivacyAware</strong> with help of Kingston Technology. A <strong>drink in a pub in London</strong> from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations. contact data@datarainbow.eu</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><strong>* *&nbsp;*</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Let the data flow, <a href=\"https://blogs.dlapiper.com/privacymatters/eu-japan-let-the-data-flow-free-flow-of-personal-data-between-eu-countries-and-japan-confirmed/\">adequacy decision between EU and Japan</a> adopted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Former European Data Protection Supervisor Peter Hustinx joins <a href=\"https://t.co/2LSgMjSG6b\">ICO </a>as non-executive director.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><strong>* *&nbsp;*</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://www.pearltrees.com/privacyday/twitter/id23766377#item247781087\">Twitter</a></em> under investigation by the Irish Data Protection Commission</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://www.computerweekly.com/news/252456335/Facebooks-objections-to-court-concerns-over-privacy-more-about-optics-than-facts\">Facebook</a></em>’s challenge to a High Court ruling that raises serious concerns about data transfers between Europe and the US is more about appearance than facts, lawyers for the Irish Data Protection Commission told Dublin\'s Supreme Court.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><strong>* * *</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Via EDRI&nbsp;: On 7 February, the European Parliament Committee on Civil Liberties, Justice and Home Affairs (LIBE) presented two new working documents analysing further the issue of cross-border access to data in criminal matters, also known as “e-evidence”.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Conditions for obtaining subscriber information in relation to dynamic versus static IP addresses: overview of relevant court decisions and developments <a href=\"https://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\">here</a> and<a href=\"https://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\"> here.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:embed {\"url\":\"https://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\"} -->\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\n</div></figure>\n<!-- /wp:embed -->\n\n<!-- wp:paragraph -->\n<p>WARNING : Links to external website may contain cookies and tracking of visitors data. Do adjust your privacy setting in accordance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1023} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/09/Screenshot-2020-09-02-at-17.01.04-1024x498.png\" alt=\"\" class=\"wp-image-1023\"/></figure>\n<!-- /wp:image -->','NEWS','','inherit','closed','closed','','88-revision-v1','','','2020-12-02 14:39:14','2020-12-02 14:39:14','',88,'https://www.datarainbow.eu/88-revision-v1/',0,'revision','',0),(1948,1,'2020-12-02 15:42:48','2020-12-02 15:42:48','<!-- wp:paragraph -->\n<p>Two major recent cases (Fashion ID (c-40-17) and Planet49 (c-673/17)) highlight the importance of cookies compliance in Europe, and the complex intricacies which organisations must now consider. In addition, an increase in the number of enforcement actions and fines in Europe signify a move towards stricter regulation of ePrivacy.<br>➡️. Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️. Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️. Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️. Five jurisdictions find an implicit consent to be valid<br><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/d2iPwBQ\" target=\"_blank\">DLA PIPER guide</a> summarises practical requirements which organisations should consider when analysing their overall cookies compliance, including in relation to banners, polices and consent collection.<br><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=privacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739908022304284672\">#privacy</a> <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739908022304284672\">#dataprotection</a> <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739908022304284672\">#cookies</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://lnkd.in/ghS6RVy\" target=\"_blank\" rel=\"noreferrer noopener\">NOYB ANNOUNCED</a> : The DPC Ireland at \"work\": 630 pages field with the Irish High Court, to block our Judicial Review and arguing why it should NOT decide the SchremsI and SchremsII complaint after 7½ years, despite the CJEU ruling this summer.<br>Find out more here: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EU Commission proposes <a rel=\"noreferrer noopener\" href=\"https://lnkd.in/dUB_FM8\" target=\"_blank\">new Data Governance Act</a><br><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=datagovernance&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739123308626767872\">#datagovernance</a> <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personaldata&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739123308626767872\">#personaldata</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>IAB Europe publishes a <a rel=\"noreferrer noopener\" href=\"https://iabeurope.eu/blog/gdpr-data-protection-impact-assessments-dpia-for-digital-advertising-under-gdpr/\" target=\"_blank\">\'GDPR Data Protection Impact Assessments (DPIA) for Digital Advertising under GDPR\'</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Half of all organizations experienced security incidents associated with remote working during the lockdown period, according to a report by Tessian. The “<a rel=\"noreferrer noopener\" href=\"https://www.tessian.com/research/the-future-of-hybrid-working/\" target=\"_blank\">Securing the Future of Hybrid Working</a>” report also found that phishing remained the most prevalent threat facing employees working remotely. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.enisa.europa.eu/news/enisa-news/telecom-security-and-resilience-during-covid19\" target=\"_blank\" rel=\"noreferrer noopener\">ENISA Report </a>Highlights Resilience of Telecom Sector in Facing the Pandemic</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/posts/beaconai_globalstateofprivacy-privacy-dataprotection-activity-6706873062916198400-SDFJ\">Beacon AI</a> will host their Global State of Privacy virtual event with <a href=\"https://www.linkedin.com/company/altada-technology-solutions-limited/\">Altada Technology Solutions </a>on September 15th at 11am GMT. You can reserve your tickets now on Eventbrite <a href=\"https://bit.ly/34GwHvf\">https://bit.ly/34GwHvf</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Delighted to be asked to participate in&nbsp;this <a href=\"https://www.linkedin.com/company/beaconai/\">Beacon AI</a>\'s upcoming virtual event, Sharing the screen with some amazing fellow speakers including&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAEjZSMBPHCDNL0ZfbkbHBFk7NBEwjLsbi0\">Gordon&nbsp;Wade</a>, Áine Quirke,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAqCsAcBtx0dA1Lw7VNmUBejjlgS7zW6sNA\">Gail Chalmin</a>,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAGW1hEBKjAOVvS9pL8ollH0kw1TY1y3iJw\">Alexander Hanff</a>,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAA7DYaIB7VdfLfG7VcW5z1b0a5fHRYiUraU\">Niamh Parker</a>,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAACvVXEBcRlW49jJa3QuJdQfqLnC30uMTBg\">JT Lewis</a>&nbsp;and&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAACOxggBCpqn1fqX0pEpAxapf-s7wsALdjk\">Stijn (Stan) Christiaens</a>&nbsp;on a host of the hottest topics in&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6706936641153589248\">#dataprotection</a>&nbsp;right now.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I look forward to seeing you there! Thank you to our event supporters&nbsp;<a href=\"https://www.linkedin.com/company/corkbic/\">CorkBIC</a>,&nbsp;<a href=\"https://www.linkedin.com/company/mason-hayes-curran/\">Mason Hayes &amp; Curran LLP</a>&nbsp;and&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAANQKyMBOTl9pq57vcedDiTn5LNa4VveruE\">Glandore Network</a><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=globalstateofprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6706873062916198400\">#</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://privacylawblog.fieldfisher.com/2019/edpb-prepares-for-a-no-deal-brexit\">EDPB prepares for a \"no deal\" Brexit</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"What this means is that companies in the EU (including the EEA) that are currently freely sending their personal data to the UK will have to implement appropriate safeguards in accordance with article 46 before transferring any personal data to the UK. These appropriate safeguards include:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>Standard Data Protection Clauses adopted by the European Commission of a DPA</em></li><li><em>Ad Hoc Data Protection Clauses adopted the EU based company (data exporter) and the UK based recipient of this data (data importer)</em></li><li><em>Binding Corporate Rules</em></li><li><em>Codes of Conduct</em></li><li><em>Certification Mechanism\"</em>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board Published its guidance :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Information note on data transfers under the GDPR in the event of a no-deal Brexit  <a href=\"https://www.pearltrees.com/s/file/preview/192486822/edpb-2019-02-12-infonote-nodeal-brexit_en.pdf\">Adopted on 12 February 2019</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Information note on BCRs for companies which have ICO<br> as BCR Lead Supervisory Authority - <a href=\"https://www.pearltrees.com/s/file/preview/192486834/edpb-2019-02-12-infonote-bcrs-brexit_en.pdf\">Adopted on 12 February 2019&nbsp;</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>ICO guidance</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>To&nbsp;<em>help</em>&nbsp;organisations prepare for a&nbsp;<em>\'</em>no deal<em>\'</em>&nbsp;Brexit, the ICO has published a short guide for UK businesses:&nbsp;<em>\'</em><a href=\"https://ico.org.uk/media/2553958/leaving-the-eu-six-steps-to-take.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Six Steps to Take</a><em>\'</em>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li><strong><em>Continue to comply</em></strong>&nbsp;with GDPR and follow ICO guidance.</li><li><strong><em>Transfers to the UK</em>:</strong>&nbsp;Review data flows and identify where your organisation receives data into the UK from the EEA to ensure sufficient safeguards are in place to allow the continued flow of personal data.</li><li><strong><em>Transfers from the UK</em>:</strong>&nbsp;Identify data flows to countries outside of the UK, as these will fall under new UK transfer and documentation provisions.</li><li><strong><em>European operations</em>:</strong>&nbsp;For organisations that operate across Europe, data flows, processing operations and group structures should be reviewed to fully understand the effect of Brexit on operations.</li><li><strong><em>Documentation:</em></strong>&nbsp;Identify privacy documentation in the event it needs to be updated when the UK leaves the EU.</li><li><strong><em>Organisational awareness:</em></strong>&nbsp;Ensure key people in the organisation are aware of these key issues and that plans are up to date.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><strong><a href=\"https://www.gov.uk/government/publications/data-protection-law-eu-exit/amendments-to-uk-data-protection-law-in-the-event-the-uk-leaves-the-eu-without-a-deal-on-29-march-2019\">UK Gov Guidance</a> : Amendments to UK data protection law in the event the UK leaves the EU without a deal on 29 March 2019</strong></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Resources on<a href=\"http://www.pearltrees.com/privacyday/uk-brexit/id23426706\"> Brexit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.jdsupra.com/legalnews/google-style-gdpr-fines-for-everyone-23609/\" target=\"_blank\">Google-Style GDPR Fines for Everyone? Bavarian DPA Conducts Website Cookie Practices Sweep, Announces Fines under Consideration</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The French Data Protection Authority, CNIL, <a href=\"https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc\">fining Google 50 Million Euros</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://edpb.europa.eu/news/national-news/2019/cnils-restricted-committee-imposes-financial-penalty-50-million-euros_en\">European Data Protection Board summary </a>explains how the CNIL has played the role of the lead authority to investigate the class actions filed by the Austrian <a href=\"https://noyb.eu/\">Non Of Your Business, NOYB</a>, and the French <a href=\"https://www.laquadrature.net/en/personnal-data/\">La Quadrature Du Net</a>. \'L\'Europe est en marche\' - Europe is leading - and the Union is enforcing its capabilities. Britain will be missed after Brexit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>After Google, here comes Facebook : <a href=\"https://www.lesoir.be/140480/article/2018-02-16/protection-des-donnees-privees-la-belgique-fait-plier-facebook\">A Belgian court injonction to Facebook</a> to stop his illegal collect of personal data in an 80 pages decision. 250.000 € maximum de 100 millions d’euros for everyday they dont comply. Things are acceleration. If you havent yet seen the French CNIL Google fine, have a look and make sure your organisation is compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><strong>* * *</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.voiceamerica.com/promo/episode/112620\">Radio interview of Tara Taubman-Bassirian</a>, voted <strong>Privacy Hero 2018</strong>, is on Voice of America Business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><a target=\"_blank\" href=\"https://www.voiceamerica.com/guest/42903/tara-taubman-bassirian\" rel=\"noreferrer noopener\">Tara Taubman-Bassirian</a></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>Episode Description</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><em>2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, with Rebecca.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the <strong>International Privacy Day</strong> on January the 28th. A <strong>TwitterChat at 3pm GMT</strong> using the hashtag <strong>#PrivacyAware</strong> with help of Kingston Technology. A <strong>drink in a pub in London</strong> from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations. contact data@datarainbow.eu</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><strong>* *&nbsp;*</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Let the data flow, <a href=\"https://blogs.dlapiper.com/privacymatters/eu-japan-let-the-data-flow-free-flow-of-personal-data-between-eu-countries-and-japan-confirmed/\">adequacy decision between EU and Japan</a> adopted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Former European Data Protection Supervisor Peter Hustinx joins <a href=\"https://t.co/2LSgMjSG6b\">ICO </a>as non-executive director.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><strong>* *&nbsp;*</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://www.pearltrees.com/privacyday/twitter/id23766377#item247781087\">Twitter</a></em> under investigation by the Irish Data Protection Commission</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://www.computerweekly.com/news/252456335/Facebooks-objections-to-court-concerns-over-privacy-more-about-optics-than-facts\">Facebook</a></em>’s challenge to a High Court ruling that raises serious concerns about data transfers between Europe and the US is more about appearance than facts, lawyers for the Irish Data Protection Commission told Dublin\'s Supreme Court.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><strong>* * *</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Via EDRI&nbsp;: On 7 February, the European Parliament Committee on Civil Liberties, Justice and Home Affairs (LIBE) presented two new working documents analysing further the issue of cross-border access to data in criminal matters, also known as “e-evidence”.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Conditions for obtaining subscriber information in relation to dynamic versus static IP addresses: overview of relevant court decisions and developments <a href=\"https://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\">here</a> and<a href=\"https://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\"> here.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:embed {\"url\":\"https://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\"} -->\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\n</div></figure>\n<!-- /wp:embed -->\n\n<!-- wp:paragraph -->\n<p>WARNING : Links to external website may contain cookies and tracking of visitors data. Do adjust your privacy setting in accordance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1023} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/09/Screenshot-2020-09-02-at-17.01.04-1024x498.png\" alt=\"\" class=\"wp-image-1023\"/></figure>\n<!-- /wp:image -->','NEWS','','inherit','closed','closed','','88-revision-v1','','','2020-12-02 15:42:48','2020-12-02 15:42:48','',88,'https://www.datarainbow.eu/88-revision-v1/',0,'revision','',0),(1947,1,'2020-12-02 14:45:10','2020-12-02 14:45:10','<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major recent cases (Fashion ID (c-40-17) and Planet49 (c-673/17)) highlight the importance of cookies compliance in Europe, and the complex intricacies which organisations must now consider. In addition, an increase in the number of enforcement actions and fines in Europe signify a move towards stricter regulation of ePrivacy.<br>➡️. Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️. Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️. Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️. Five jurisdictions find an implicit consent to be valid<br><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/d2iPwBQ\" target=\"_blank\">DLA PIPER guide</a> summarises practical requirements which organisations should consider when analysing their overall cookies compliance, including in relation to banners, polices and consent collection.<br><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=privacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739908022304284672\">#privacy</a> <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739908022304284672\">#dataprotection</a> <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739908022304284672\">#cookies</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://lnkd.in/ghS6RVy\" target=\"_blank\" rel=\"noreferrer noopener\">NOYB ANNOUNCED</a> : The DPC Ireland at \"work\": 630 pages field with the Irish High Court, to block our Judicial Review and arguing why it should NOT decide the SchremsI and SchremsII complaint after 7½ years, despite the CJEU ruling this summer.<br>Find out more here: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EU Commission proposes <a rel=\"noreferrer noopener\" href=\"https://lnkd.in/dUB_FM8\" target=\"_blank\">new Data Governance Act</a><br><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=datagovernance&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739123308626767872\">#datagovernance</a> <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personaldata&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6739123308626767872\">#personaldata</a><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>IAB Europe publishes a <a rel=\"noreferrer noopener\" href=\"https://iabeurope.eu/blog/gdpr-data-protection-impact-assessments-dpia-for-digital-advertising-under-gdpr/\" target=\"_blank\">\'GDPR Data Protection Impact Assessments (DPIA) for Digital Advertising under GDPR\'</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Half of all organizations experienced security incidents associated with remote working during the lockdown period, according to a report by Tessian. The “<a rel=\"noreferrer noopener\" href=\"https://www.tessian.com/research/the-future-of-hybrid-working/\" target=\"_blank\">Securing the Future of Hybrid Working</a>” report also found that phishing remained the most prevalent threat facing employees working remotely. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.enisa.europa.eu/news/enisa-news/telecom-security-and-resilience-during-covid19\" target=\"_blank\" rel=\"noreferrer noopener\">ENISA Report </a>Highlights Resilience of Telecom Sector in Facing the Pandemic</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/posts/beaconai_globalstateofprivacy-privacy-dataprotection-activity-6706873062916198400-SDFJ\">Beacon AI</a> will host their Global State of Privacy virtual event with <a href=\"https://www.linkedin.com/company/altada-technology-solutions-limited/\">Altada Technology Solutions </a>on September 15th at 11am GMT. You can reserve your tickets now on Eventbrite <a href=\"https://bit.ly/34GwHvf\">https://bit.ly/34GwHvf</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Delighted to be asked to participate in&nbsp;this <a href=\"https://www.linkedin.com/company/beaconai/\">Beacon AI</a>\'s upcoming virtual event, Sharing the screen with some amazing fellow speakers including&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAEjZSMBPHCDNL0ZfbkbHBFk7NBEwjLsbi0\">Gordon&nbsp;Wade</a>, Áine Quirke,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAqCsAcBtx0dA1Lw7VNmUBejjlgS7zW6sNA\">Gail Chalmin</a>,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAGW1hEBKjAOVvS9pL8ollH0kw1TY1y3iJw\">Alexander Hanff</a>,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAA7DYaIB7VdfLfG7VcW5z1b0a5fHRYiUraU\">Niamh Parker</a>,&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAACvVXEBcRlW49jJa3QuJdQfqLnC30uMTBg\">JT Lewis</a>&nbsp;and&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAACOxggBCpqn1fqX0pEpAxapf-s7wsALdjk\">Stijn (Stan) Christiaens</a>&nbsp;on a host of the hottest topics in&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6706936641153589248\">#dataprotection</a>&nbsp;right now.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I look forward to seeing you there! Thank you to our event supporters&nbsp;<a href=\"https://www.linkedin.com/company/corkbic/\">CorkBIC</a>,&nbsp;<a href=\"https://www.linkedin.com/company/mason-hayes-curran/\">Mason Hayes &amp; Curran LLP</a>&nbsp;and&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAANQKyMBOTl9pq57vcedDiTn5LNa4VveruE\">Glandore Network</a><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=globalstateofprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6706873062916198400\">#</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://privacylawblog.fieldfisher.com/2019/edpb-prepares-for-a-no-deal-brexit\">EDPB prepares for a \"no deal\" Brexit</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>\"What this means is that companies in the EU (including the EEA) that are currently freely sending their personal data to the UK will have to implement appropriate safeguards in accordance with article 46 before transferring any personal data to the UK. These appropriate safeguards include:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>Standard Data Protection Clauses adopted by the European Commission of a DPA</em></li><li><em>Ad Hoc Data Protection Clauses adopted the EU based company (data exporter) and the UK based recipient of this data (data importer)</em></li><li><em>Binding Corporate Rules</em></li><li><em>Codes of Conduct</em></li><li><em>Certification Mechanism\"</em>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board Published its guidance :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Information note on data transfers under the GDPR in the event of a no-deal Brexit  <a href=\"https://www.pearltrees.com/s/file/preview/192486822/edpb-2019-02-12-infonote-nodeal-brexit_en.pdf\">Adopted on 12 February 2019</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Information note on BCRs for companies which have ICO<br> as BCR Lead Supervisory Authority - <a href=\"https://www.pearltrees.com/s/file/preview/192486834/edpb-2019-02-12-infonote-bcrs-brexit_en.pdf\">Adopted on 12 February 2019&nbsp;</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>ICO guidance</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>To&nbsp;<em>help</em>&nbsp;organisations prepare for a&nbsp;<em>\'</em>no deal<em>\'</em>&nbsp;Brexit, the ICO has published a short guide for UK businesses:&nbsp;<em>\'</em><a href=\"https://ico.org.uk/media/2553958/leaving-the-eu-six-steps-to-take.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">Six Steps to Take</a><em>\'</em>:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li><strong><em>Continue to comply</em></strong>&nbsp;with GDPR and follow ICO guidance.</li><li><strong><em>Transfers to the UK</em>:</strong>&nbsp;Review data flows and identify where your organisation receives data into the UK from the EEA to ensure sufficient safeguards are in place to allow the continued flow of personal data.</li><li><strong><em>Transfers from the UK</em>:</strong>&nbsp;Identify data flows to countries outside of the UK, as these will fall under new UK transfer and documentation provisions.</li><li><strong><em>European operations</em>:</strong>&nbsp;For organisations that operate across Europe, data flows, processing operations and group structures should be reviewed to fully understand the effect of Brexit on operations.</li><li><strong><em>Documentation:</em></strong>&nbsp;Identify privacy documentation in the event it needs to be updated when the UK leaves the EU.</li><li><strong><em>Organisational awareness:</em></strong>&nbsp;Ensure key people in the organisation are aware of these key issues and that plans are up to date.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><strong><a href=\"https://www.gov.uk/government/publications/data-protection-law-eu-exit/amendments-to-uk-data-protection-law-in-the-event-the-uk-leaves-the-eu-without-a-deal-on-29-march-2019\">UK Gov Guidance</a> : Amendments to UK data protection law in the event the UK leaves the EU without a deal on 29 March 2019</strong></h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Resources on<a href=\"http://www.pearltrees.com/privacyday/uk-brexit/id23426706\"> Brexit</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.jdsupra.com/legalnews/google-style-gdpr-fines-for-everyone-23609/\" target=\"_blank\">Google-Style GDPR Fines for Everyone? Bavarian DPA Conducts Website Cookie Practices Sweep, Announces Fines under Consideration</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The French Data Protection Authority, CNIL, <a href=\"https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc\">fining Google 50 Million Euros</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://edpb.europa.eu/news/national-news/2019/cnils-restricted-committee-imposes-financial-penalty-50-million-euros_en\">European Data Protection Board summary </a>explains how the CNIL has played the role of the lead authority to investigate the class actions filed by the Austrian <a href=\"https://noyb.eu/\">Non Of Your Business, NOYB</a>, and the French <a href=\"https://www.laquadrature.net/en/personnal-data/\">La Quadrature Du Net</a>. \'L\'Europe est en marche\' - Europe is leading - and the Union is enforcing its capabilities. Britain will be missed after Brexit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>After Google, here comes Facebook : <a href=\"https://www.lesoir.be/140480/article/2018-02-16/protection-des-donnees-privees-la-belgique-fait-plier-facebook\">A Belgian court injonction to Facebook</a> to stop his illegal collect of personal data in an 80 pages decision. 250.000 € maximum de 100 millions d’euros for everyday they dont comply. Things are acceleration. If you havent yet seen the French CNIL Google fine, have a look and make sure your organisation is compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><strong>* * *</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.voiceamerica.com/promo/episode/112620\">Radio interview of Tara Taubman-Bassirian</a>, voted <strong>Privacy Hero 2018</strong>, is on Voice of America Business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><a target=\"_blank\" href=\"https://www.voiceamerica.com/guest/42903/tara-taubman-bassirian\" rel=\"noreferrer noopener\">Tara Taubman-Bassirian</a></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>Episode Description</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><em>2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, with Rebecca.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the <strong>International Privacy Day</strong> on January the 28th. A <strong>TwitterChat at 3pm GMT</strong> using the hashtag <strong>#PrivacyAware</strong> with help of Kingston Technology. A <strong>drink in a pub in London</strong> from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations. contact data@datarainbow.eu</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><strong>* *&nbsp;*</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Let the data flow, <a href=\"https://blogs.dlapiper.com/privacymatters/eu-japan-let-the-data-flow-free-flow-of-personal-data-between-eu-countries-and-japan-confirmed/\">adequacy decision between EU and Japan</a> adopted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Former European Data Protection Supervisor Peter Hustinx joins <a href=\"https://t.co/2LSgMjSG6b\">ICO </a>as non-executive director.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><strong>* *&nbsp;*</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://www.pearltrees.com/privacyday/twitter/id23766377#item247781087\">Twitter</a></em> under investigation by the Irish Data Protection Commission</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://www.computerweekly.com/news/252456335/Facebooks-objections-to-court-concerns-over-privacy-more-about-optics-than-facts\">Facebook</a></em>’s challenge to a High Court ruling that raises serious concerns about data transfers between Europe and the US is more about appearance than facts, lawyers for the Irish Data Protection Commission told Dublin\'s Supreme Court.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p class=\"has-text-align-center\"><strong>* * *</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Via EDRI&nbsp;: On 7 February, the European Parliament Committee on Civil Liberties, Justice and Home Affairs (LIBE) presented two new working documents analysing further the issue of cross-border access to data in criminal matters, also known as “e-evidence”.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Conditions for obtaining subscriber information in relation to dynamic versus static IP addresses: overview of relevant court decisions and developments <a href=\"https://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\">here</a> and<a href=\"https://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\"> here.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:embed {\"url\":\"https://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\"} -->\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps://rm.coe.int/t-cy-2018-26-ip-addresses-v6/16808ea472\n</div></figure>\n<!-- /wp:embed -->\n\n<!-- wp:paragraph -->\n<p>WARNING : Links to external website may contain cookies and tracking of visitors data. Do adjust your privacy setting in accordance.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1023} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/09/Screenshot-2020-09-02-at-17.01.04-1024x498.png\" alt=\"\" class=\"wp-image-1023\"/></figure>\n<!-- /wp:image -->','NEWS','','inherit','closed','closed','','88-revision-v1','','','2020-12-02 14:45:10','2020-12-02 14:45:10','',88,'https://www.datarainbow.eu/88-revision-v1/',0,'revision','',0),(1954,1,'2020-12-02 21:11:12','2020-12-02 21:11:12','<!-- wp:heading {\"align\":\"center\"} -->\n<h2 class=\"has-text-align-center\"><strong>DATARAINBOW </strong></h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ….</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Who created DATARAINBOW ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, is a French Lawyer based in the UK who has studied private law at the prestigious Paris University Pantheon Assas, before specialising on Computer and Communication Law at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN’s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group&nbsp;<a href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a>&nbsp;with&nbsp;<a href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTACT : Data@datarainbow.eu</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018 :&nbsp;Tara Taubman-Bassirian</a></strong></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>Privacy Hero of the Year poll, and the results are in…&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of&nbsp;<a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">Rebecca Herold’s radio show</a>,&nbsp;<a href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\">Data Security and Privacy with The Privacy Professor</a>. I’ve extended invitations to each today, so stay tuned for more details.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For keeping up with news on IT security, Privacy and Online Security, join our Facebook Group&nbsp;<a href=\"https://www.facebook.com/groups/167255910003191/?multi_permalinks=2203761959685899&amp;notif_id=1548347410584622&amp;notif_t=feedback_reaction_generic\">Fly A Kite</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:button {\"align\":\"center\"} -->\n<div class=\"wp-block-button aligncenter\"><a class=\"wp-block-button__link\" href=\"http://www.datarainbow.eu/connect/\">Work With Me</a></div>\n<!-- /wp:button -->\n\n<!-- wp:image {\"id\":178} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Champion-Badge.png\" alt=\"\" class=\"wp-image-178\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:group {\"align\":\"wide\"} -->\n<div class=\"wp-block-group alignwide\"><div class=\"wp-block-group__inner-container\"><!-- wp:image {\"align\":\"wide\",\"id\":1713,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image alignwide size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-26-at-07.53.32.png\" alt=\"\" class=\"wp-image-1713\"/></figure>\n<!-- /wp:image --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:image {\"align\":\"wide\",\"id\":1714,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image alignwide size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-26-at-07.53.15.png\" alt=\"\" class=\"wp-image-1714\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:group {\"align\":\"wide\"} -->\n<div class=\"wp-block-group alignwide\"><div class=\"wp-block-group__inner-container\"></div></div>\n<!-- /wp:group -->\n\n<!-- wp:columns {\"align\":\"wide\"} -->\n<div class=\"wp-block-columns alignwide\"><!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:heading {\"level\":3} -->\n<h3>Privacy Hero of the Year</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Polls, and the results are in…&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp; <strong>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</strong></p>\n<!-- /wp:paragraph --></div>\n<!-- /wp:column -->\n\n<!-- wp:column -->\n<div class=\"wp-block-column\"><!-- wp:heading {\"level\":3} -->\n<h3>Social Media</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Linkedin, Twitter and a little a bit of Facebook to keep informed, share and learn from others.</p>\n<!-- /wp:paragraph --></div>\n<!-- /wp:column --></div>\n<!-- /wp:columns -->','About','','inherit','closed','closed','','34-revision-v1','','','2020-12-02 21:11:12','2020-12-02 21:11:12','',34,'https://www.datarainbow.eu/34-revision-v1/',0,'revision','',0),(2017,1,'2021-04-15 23:59:37','2021-04-15 23:59:37','<div  data-id=\"initial-content-section\" data-export-id=\"initial-content-section\" data-label=\"Initial Content\" id=\"initial-content-section\" class=\"content-section content-section-spacing\">\n   <div  class=\"gridContainer\">\n     <div  class=\"row\">\n\n        <div  class=\"col-xs-12 col-sm-12\">                <p ></p>\n<h2  class=\"has-text-align-center\"><strong >DATARAINBOW </strong></h2>\n<p ></p>\n<p ></p>\n<p >After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ….</p>\n<p ></p>\n<p ></p>\n<p >We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<p ></p>\n<p ></p>\n<p >We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<p ></p>\n<p ></p>\n<p ><strong >Who created DATARAINBOW ?</strong></p>\n<p ></p>\n<p ></p>\n<h2 >Tara Taubman-Bassirian</h2>\n<p ></p>\n<p ></p>\n<p >Tara Taubman-Bassirian, LLM, was initially trained in French Law before settling in the UK. She has a Maitre of private law from the prestigious University of Pantheon Assas, Paris 2, before her more recent specialisation in Computer and Communication Law with a Masters at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN’s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group&nbsp;<a  href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\" class=\"\" data-cp-link=\"1\">Fly A Kite</a>&nbsp;with&nbsp;<a  href=\"https://simbus360.com\" class=\"\" data-cp-link=\"1\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<p ></p>\n<p ></p>\n<p ><strong >CONTACT : Data@datarainbow.eu</strong></p>\n<p ></p>\n<p ></p>\n<figure  class=\"wp-block-table\">\n<table >\n<tbody >\n<tr >\n<td ><strong ><a  href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\" class=\"\">Privacy Hero 2018 :&nbsp;Tara Taubman-Bassirian</a></strong></td>\n</tr>\n</tbody>\n</table>\n</figure>\n<p ></p>\n<p ></p>\n<p >Privacy Hero of the Year poll, and the results are in…&nbsp;&nbsp;<a  href=\"https://www.linkedin.com/in/taubmanbassirian\" class=\"\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<p ></p>\n<p ></p>\n<p >(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<p ></p>\n<p ></p>\n<p >Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of&nbsp;<a  href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\" class=\"\">Rebecca Herold’s radio show</a>,&nbsp;<a  href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\" class=\"\">Data Security and Privacy with The Privacy Professor</a>. I’ve extended invitations to each today, so stay tuned for more details.&nbsp;</p>\n<p ></p>\n<p ></p>\n<p ><em >Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</em>.</p>\n<p ></p>\n<p ></p>\n<p >For keeping up with news on IT security, Privacy and Online Security, join our Facebook Group&nbsp;<a  href=\"https://www.facebook.com/groups/167255910003191?multi_permalinks=2203761959685899&amp;notif_id=1548347410584622&amp;notif_t=feedback_reaction_generic\" class=\"\">Fly A Kite</a>.</p>\n<p ></p>\n<p ></p>\n<div  class=\"wp-block-button aligncenter\"><a  class=\"wp-block-button__link\" href=\"https://www.datarainbow.eu/connect\">Work With Me</a></div>\n<p ></p>\n<p ></p>\n<figure  class=\"wp-block-image\"><img  src=\"/wp-content/uploads/sites/3/2019/01/Champion-Badge.png\" alt=\"\" class=\"wp-image-178\"></figure>\n<p ></p>\n<p ></p>\n<div  class=\"wp-block-group alignwide\">\n<div  class=\"wp-block-group__inner-container\">\n<figure  class=\"wp-block-image alignwide size-large\"><img loading=\"lazy\" width=\"233\" height=\"118\"  src=\"https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-26-at-07.53.32.png\" alt=\"\" class=\"wp-image-1713\"></figure>\n<p ></p></div>\n</div>\n<p ></p>\n<p ></p>\n<figure  class=\"wp-block-image alignwide size-large\"><img loading=\"lazy\" width=\"511\" height=\"246\"  src=\"https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-26-at-07.53.15.png\" alt=\"\" class=\"wp-image-1714\" srcset=\"https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-26-at-07.53.15.png 511w, https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-26-at-07.53.15-300x144.png 300w\" sizes=\"(max-width: 511px) 100vw, 511px\"></figure>\n<p ></p>\n<p ></p>\n<div  class=\"wp-block-group alignwide\">\n<div  class=\"wp-block-group__inner-container\"></div>\n</div>\n<p ></p>\n<p ></p>\n<div  class=\"wp-block-columns alignwide\">\n<div  class=\"wp-block-column\">\n<h3 >Privacy Hero of the Year</h3>\n<p ></p>\n<p ></p>\n<p >Polls, and the results are in…&nbsp;&nbsp;<a  href=\"https://www.linkedin.com/in/taubmanbassirian\" class=\"\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp; <strong >(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</strong></p>\n<p ></p></div>\n<p ></p>\n<p ></p>\n<div  class=\"wp-block-column\">\n<h3 >Social Media</h3>\n<p ></p>\n<p ></p>\n<p >Linkedin, Twitter and a little a bit of Facebook to keep informed, share and learn from others.</p>\n<p ></p></div>\n<p ></p></div>\n<p ></p>\n\n          </div>\n      </div>\n  </div>\n</div>','About','','inherit','closed','closed','','34-revision-v1','','','2021-04-15 23:59:37','2021-04-15 23:59:37','',34,'https://www.datarainbow.eu/?p=2017',0,'revision','',0),(2015,1,'2021-04-15 23:53:56','2021-04-15 23:53:56','<div data-id=\'initial-content-section\' data-export-id=\'initial-content-section\' data-label=\'Initial Content\' id=\'initial-content-section\' class=\'content-section content-section-spacing\'>\n   <div class=\'gridContainer\'>\n     <div class=\'row\'>\n\n        <div class=\'col-xs-12 col-sm-12\'>                <p><!-- wp:heading {\"align\":\"center\"} --></p>\n<h2 class=\"has-text-align-center\"><strong>DATARAINBOW </strong></h2>\n<p><!-- /wp:heading --></p>\n<p><!-- wp:paragraph --></p>\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ….</p>\n<p><!-- /wp:paragraph --></p>\n<p><!-- wp:paragraph --></p>\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<p><!-- /wp:paragraph --></p>\n<p><!-- wp:paragraph --></p>\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<p><!-- /wp:paragraph --></p>\n<p><!-- wp:paragraph --></p>\n<p><strong>Who created DATARAINBOW ?</strong></p>\n<p><!-- /wp:paragraph --></p>\n<p><!-- wp:heading --></p>\n<h2>Tara Taubman-Bassirian</h2>\n<p><!-- /wp:heading --></p>\n<p><!-- wp:paragraph --></p>\n<p>Tara Taubman-Bassirian, LLM, is a French Lawyer based in the UK who has studied private law at the prestigious Paris University Pantheon Assas, before specialising on Computer and Communication Law at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN’s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group&nbsp;<a href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a>&nbsp;with&nbsp;<a href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<p><!-- /wp:paragraph --></p>\n<p><!-- wp:paragraph --></p>\n<p><strong>CONTACT : Data@datarainbow.eu</strong></p>\n<p><!-- /wp:paragraph --></p>\n<p><!-- wp:table --></p>\n<figure class=\"wp-block-table\">\n<table>\n<tbody>\n<tr>\n<td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018 :&nbsp;Tara Taubman-Bassirian</a></strong></td>\n</tr>\n</tbody>\n</table>\n</figure>\n<p><!-- /wp:table --></p>\n<p><!-- wp:paragraph --></p>\n<p>Privacy Hero of the Year poll, and the results are in…&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<p><!-- /wp:paragraph --></p>\n<p><!-- wp:paragraph --></p>\n<p>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<p><!-- /wp:paragraph --></p>\n<p><!-- wp:paragraph --></p>\n<p>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of&nbsp;<a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">Rebecca Herold’s radio show</a>,&nbsp;<a href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\">Data Security and Privacy with The Privacy Professor</a>. I’ve extended invitations to each today, so stay tuned for more details.&nbsp;</p>\n<p><!-- /wp:paragraph --></p>\n<p><!-- wp:paragraph --></p>\n<p><em>Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</em>.</p>\n<p><!-- /wp:paragraph --></p>\n<p><!-- wp:paragraph --></p>\n<p>For keeping up with news on IT security, Privacy and Online Security, join our Facebook Group&nbsp;<a href=\"https://www.facebook.com/groups/167255910003191/?multi_permalinks=2203761959685899&amp;notif_id=1548347410584622&amp;notif_t=feedback_reaction_generic\">Fly A Kite</a>.</p>\n<p><!-- /wp:paragraph --></p>\n<p><!-- wp:button {\"align\":\"center\"} --></p>\n<div class=\"wp-block-button aligncenter\"><a class=\"wp-block-button__link\" href=\"http://www.datarainbow.eu/connect/\">Work With Me</a></div>\n<p><!-- /wp:button --></p>\n<p><!-- wp:image {\"id\":178} --></p>\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Champion-Badge.png\" alt=\"\" class=\"wp-image-178\"/></figure>\n<p><!-- /wp:image --></p>\n<p><!-- wp:group {\"align\":\"wide\"} --></p>\n<div class=\"wp-block-group alignwide\">\n<div class=\"wp-block-group__inner-container\"><!-- wp:image {\"align\":\"wide\",\"id\":1713,\"sizeSlug\":\"large\"} --></p>\n<figure class=\"wp-block-image alignwide size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-26-at-07.53.32.png\" alt=\"\" class=\"wp-image-1713\"/></figure>\n<p><!-- /wp:image --></div>\n</div>\n<p><!-- /wp:group --></p>\n<p><!-- wp:image {\"align\":\"wide\",\"id\":1714,\"sizeSlug\":\"large\"} --></p>\n<figure class=\"wp-block-image alignwide size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/11/Screenshot-2020-11-26-at-07.53.15.png\" alt=\"\" class=\"wp-image-1714\"/></figure>\n<p><!-- /wp:image --></p>\n<p><!-- wp:group {\"align\":\"wide\"} --></p>\n<div class=\"wp-block-group alignwide\">\n<div class=\"wp-block-group__inner-container\"></div>\n</div>\n<p><!-- /wp:group --></p>\n<p><!-- wp:columns {\"align\":\"wide\"} --></p>\n<div class=\"wp-block-columns alignwide\"><!-- wp:column --></p>\n<div class=\"wp-block-column\"><!-- wp:heading {\"level\":3} --></p>\n<h3>Privacy Hero of the Year</h3>\n<p><!-- /wp:heading --></p>\n<p><!-- wp:paragraph --></p>\n<p>Polls, and the results are in…&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp; <strong>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</strong></p>\n<p><!-- /wp:paragraph --></div>\n<p><!-- /wp:column --></p>\n<p><!-- wp:column --></p>\n<div class=\"wp-block-column\"><!-- wp:heading {\"level\":3} --></p>\n<h3>Social Media</h3>\n<p><!-- /wp:heading --></p>\n<p><!-- wp:paragraph --></p>\n<p>Linkedin, Twitter and a little a bit of Facebook to keep informed, share and learn from others.</p>\n<p><!-- /wp:paragraph --></div>\n<p><!-- /wp:column --></div>\n<p><!-- /wp:columns --></p>\n\n          </div>\n      </div>\n  </div>\n</div>\n','About','','inherit','closed','closed','','34-revision-v1','','','2021-04-15 23:53:56','2021-04-15 23:53:56','',34,'https://www.datarainbow.eu/?p=2015',0,'revision','',0),(1964,2,'2020-12-10 15:34:19','2020-12-10 15:34:19','<!-- wp:paragraph -->\n<p>Let’s talk about the future of the pervasive and privacy intrusive tracking from the AdTech industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Will a new system really better protect the right to privacy in the EU?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First, one should not forget that <strong>privacy in the EU is a fundamental human right</strong> protected by the Charter of Fundamental Rights of the&nbsp;European Union <a href=\"#_ftn1\">[1]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The AdTech industry has become a monster controlled by very large, and most of the time unknown to the general public, actors, advertising&nbsp;intermediaries and brokers, exchanging personal data on real time bidding platforms. The deals are made only in a fraction of seconds on these data&nbsp; exchanges.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<strong>So what is programmatic advertising?</strong></p><p>In its simplest form, programmatic advertising is the automated transaction of buying and selling advertising online.</p><p>It’s the process of using different platforms to sell inventory on publishing sites and on the advertising side, buying inventory and place ads on a publishers site. This is also sometimes referred to as programmatic marketing.“ <a href=\"#_ftn2\">[2]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>How much an “a<em>verage</em>” user of a website knows about&nbsp;it when presented with complex and obscure consent panels from the Transparency and Control Framework developed by the IAB Europe <a href=\"#_ftn3\">[3]</a> ? Most certainly nothing .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For more information on the new proposed <strong>IAB Europe TCF scheme</strong> under GDPR, read this study : “<em>Purposes in IAB Europe’s TCF: which legal basis and how are they used by advertisers?</em>“&nbsp; <a href=\"#_ftn4\">[4]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To say the least, this scheme is not GDPR compliant in the sense that it does not provide the persons with a clear and comprehensible information to what and why they agree.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The presentation of legal basis of the processing is very confusing, it sometimes alternates between the legitimate interest and consent&nbsp;without making any sense.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>SIZE&nbsp; OF THE ADTECH MARKET</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An example from a French CNIL study &nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“ By automatically collecting this public data, the LINC has put a study online for each of these standards to understand how this ecosystem is structured, <strong>based on the 5,000 most visited French sites</strong> (Alexa ranking).</p><p>These studies reveal an <strong>ecosystem of around 620 advertising systems and more than 6,000 intermediaries selling advertising inventory</strong>, an ecosystem characterised by a high level of intermediation, thus multiplying the number of players with access to Internet users\' data.“<a href=\"#_ftn5\">[5]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Projection on the market size in the USA</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2021: 87.5 % of the <strong>entire digital ad market of&nbsp; $81 billion</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2019 &nbsp;“<em>Automation will account for $59.45 billion in ad dollars this year, or 84.9% of the US digital display ad market. Of that, two-thirds of those automated dollars will go to mobile. Nearly one of every two ad dollars goes to video.</em>” <a href=\"#_ftn6\">[6]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1966,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Picture-1.png\" alt=\"\" class=\"wp-image-1966\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>From Outbrain Blog <a href=\"#_ftn7\">[7]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The automated selling of private information was developed in the USA in 2009 and since then, it has become a monster serving its own purpose more than the ones of the online publishers, one of the source of personal data collected from users, and of the persons who get served “personalised” ads that do not always help them to better consume .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example: persons that have been classified as in low earnings get presented offers of loans to further push them in debt.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>HOW ARE WE CLASSIFIED BY THE ADTECH INDUSTRY ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On obscure proprietary algorithms, AI&nbsp; and criteria. I could not find a description of any of those.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The only indication of the extremely detailed information collected on individuals could be found for example in the Google Ad offer. Visiting the Google Ad support platform <a href=\"#_ftn8\">[8]</a> shows the very detailed targeting offered to its clients.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some AdTech actors claim that they have already switched to some sort of contextual targeting:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“ <strong>Interest Targeting</strong>: Target your audience based on their real interests, because our profiles are based on actual content consumption, not search or social sharing.“ <a href=\"#_ftn9\">[9]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>One of the largest payer in the AdTech is Outbrain, it advertises on its website “<em>Reaching 1.5B+ users each month requires the right targeting solutions</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A WIDE SOURCE OF INFORMATION FOR DATA BROKERS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Use Criteo Shopper Graph to find your customers online. <strong>Over 10,000 websites worldwide continuously share their data with us,</strong> allowing you to accurately target your shoppers across their devices.“ <a href=\"#_ftn10\">[10]</a></p><p>“We may associate Criteo identifiers on the basis of:</p><p>- <strong>our own association methods</strong> based on the data we already collect <strong>through our technologies</strong>;</p><p>- the data that may be transmitted to us by an Advertiser or Publisher in an optional and pseudonymised manner, such as your CRM identifiers and/or email addresses in hash and/or encrypted form;</p><p>- the <strong>associations that</strong> <strong>partners can send us</strong>, which they <strong>have obtained by using various methods </strong>that offer the same level of guarantee as ours in terms of respect for your privacy.“ <a href=\"#_ftn11\">[11]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ Where is my personal data in this maze? How could I possibly control what has been inferred on me, rightly or wrongly ? Do they control the legal basis of data obtained from partners ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>WHAT POWERS DO HAVE SMALLER PUBLISHER FACING THE ADTECH &nbsp;BEHEMOTHS ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The current targeted advertising system hardly profits to the main users, the publishers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“publishers are forced to participate in the uneven race for clicks and attention, <strong>sacrificing their readers’ privacy </strong>and – increasingly – the quality of the content they produce, only to hand as much as 70% of profits over to advertising middlemen at the end of the day.</p><p>Instead of the promise of thriving online publishing, the ad tech industry made publishers fight a war for survival.” <a href=\"#_ftn12\">[12]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The source of the personal data collected and inferred will rapidly change after Google announced <strong>the end of 3<sup>rd</sup> party cookies,</strong> tracking the users on websites most of the time without their informed knowledge.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ However, I do not believe any of the new systems will provide a better control to the users on their privacy .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Google remains all powerful in the advertising business</strong> <a href=\"#_ftn13\">[13]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“The next 12 months will see the industry prepare for Google Chrome withdrawing its support of third-party cookies, bringing it in line with the industry’s other leading web browsers.</p><p><strong>Marketers will still be able to target audiences using first-party data,</strong> for instance, by serving ads in walled gardens such as Facebook or logged-in users on a publisher’s website.“</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>(…) “ what appears apparent is that 1:1 targeting using third-party data is soon to be a thing of the past.</p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>Per Google’s documentation released thus far, <strong>contextual ads will soon be targeted using more nuanced means that target users based on cohorts</strong> “ <a href=\"#_ftn14\">[14]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is basically a return to the way advertising was done before the RTB craze.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the meantime, large data intermediary companies are sitting on a huge amount of information collected on us through &nbsp;quite shady means, dark patterns are common in the collection of consent from websites.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The national Data Protection Authorities have been slow or inexistant up until recently &nbsp;in defending the users rights under the E-Privacy directive. <a href=\"#_ftn15\">[15]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The scattered and sometimes lax enforcement&nbsp; of the directive in the EU has certainly favoured the collection of consent to behavioural tracking on a large scale in the EU, at least until the GDPR went into application in 2018. <a href=\"#_ftn16\">[16]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2</strong> <strong>RECENT GROUNDBREAKING DECISIONS FROM THE FRENCH CNIL<a href=\"#_ftn17\"><strong>[17]</strong></a></strong> &nbsp;<strong>MIGHT SEND A DIFFERENT MESSAGE TO THE ADTECH INDUSTRY</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google and Amazon did not wait for the consent of the users, based in France, to attach ad cookies to their electronic device.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Contextual advertising is&nbsp; concerned as well by the E-Directive when it uses location data for example (see § 129 to §131 of the decision on Google <a href=\"#_ftn18\">[18]</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Moreover, the information given to the users based in France was not conform to the requirements of the French law implementing the E-Privacy directive <a href=\"#_ftn19\">[19]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent to tracking is&nbsp; (should ) now be more difficult to obtain but there is still a lot of confusion on the side of publishers in the EU.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A study on e-privacy/ GDPR compliant way <strong>to obtain valid consent from users on websites</strong> points to <strong>22 legal requirements</strong> <a href=\"#_ftn20\">[20]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the ICO, the&nbsp; UK Data Protection Authority, underlined:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“identifying a lawful basis for the processing of personal data in RTB remains challenging, as the scenarios where legitimate interests could apply are limited, and <strong>methods of obtaining consent are often insufficient </strong>in respect of data protection law requirements;</p><p>- the privacy notices provided to individuals lack clarity and do not give them full visibility of what happens to their data;</p><p>- the scale of <strong>the creation and sharing of personal data profiles in RTB appears disproportionate, intrusive and unfair, particularly when in many cases data subjects are unaware that this processing is taking place</strong>; “ <a href=\"#_ftn21\">[21]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>LACK OF TRANSPARENCY IN THE CLASSIFICATION OF THE NATURAL PERSONS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One is amazed by the <strong>number of persona</strong> one can get included in.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The persons have no way to control or correct these classification made by proprietary machine learning and AI.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We do not know what these large data intermediary companies think they know about us and what they are selling about us.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Google and IAB’s RTB systems have in fact been constructed <strong>in a way that makes it impossible to control data once it is shared on the ad exchange </strong>– neither by the publisher who shared it, much less by the user. This is a data breach that affects basically everyone that has ever used the Internet. The violations of other GDPR principles stem from this feature inherent to real-time bidding systems.“ <a href=\"#_ftn22\">[22]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>This is unacceptable and contrary to every principle of transparency supposed to protect us from privacy invasion.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TRANSPARECY MUCH NEEDED</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One could make a parallel with the move to imposed transparency on the parameters of ranking on large intermediary platforms offering a market place for business users.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The EU legal regime on consumer and business protection relies on the principle of transparency.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The EU Regulation (EU) 2019/1150 of the European Parliament and of the Council <a href=\"#_ftn23\">[23]</a>&nbsp; of 20 June 2019 on promoting fairness and transparency for business users of online intermediation services and its guidelines <a href=\"#_ftn24\">[24]</a> are supposed to impose the obligation on a platform like Google or Amazon&nbsp; for example, to inform the businesses on the factors they use to rank their users:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<strong>Ranking</strong>&nbsp; (…) can essentially be thought of as a form of <strong>data-driven, algorithmic decision-making.</strong> When providers present, organise or communicate information on goods or services for consumers or search results, they ‘rank’ results on the basis of certain parameters.”</p><p>“Providers design their ranking methods, including proprietary algorithms, in different ways. <strong>These approaches to ranking are frequently adapted and in general not disclosed</strong>. From the consumers’ perspective, the quality of search results may differentiate services and, therefore, the detailed functioning of ranking methods may be a provider’s competitive edge or trade secret (…) “ <a href=\"#_ftn25\">[25]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ Why not impose the right of the persons, at the source of all the data exchanged for digital advertising purpose, to <strong>access the parameters&nbsp; used by the data <s>hoarders</s>…brokers and traders to classify them and to “feed“ them with what they are supposed to buy.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One should be allowed as well to correct or object the information inferred from one’s data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>THE LEGAL BASIS TO COLLECT PERSONAL DATA IN THE CONTEXT OF TARGETED ADVERTISING IS MAINLY CONSENT OF THE DATA SUBJECT.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the recent proposal for <strong>Guidelines on the targeting of social media users</strong> <a href=\"#_ftn26\">[26]</a>, the EDPD recalls that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“it would be difficult for controllers to justify using legitimate interests as a legal basis for intrusive profiling and tracking practices for marketing or advertising purposes, <strong>for example those that involve tracking individuals across multiple websites, locations, devices, services or data-brokering”</strong></p><p>“Even if the processing of personal data is based on consent of the data subject, this would not legitimize targeting which is disproportionate or unfair.“</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The GDPR is not the only legal regime imposed on the AdTech activities in the EU,&nbsp; at the moment the e-privacy Directive <a href=\"#_ftn27\">[27]</a> &nbsp;applies if cookies or any other tracking process like gif, pixels, plug in… are placed on the user’s electronic device.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They can mostly be placed on the users’ devices only with their consent (art 5-1) in case</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>of :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user” <a href=\"#_ftn28\">[28]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A <strong>new E-Privacy regulation</strong> was due to be adopted at the same time as the GDPR but, at of the time of writing, it seems to be constantly pushed back especially on the problem of the legal basis on which data could be processed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The original text mentioned only GDPR like consent to collect data but the data industry is pushing for the legitimate interest basis <a href=\"#_ftn29\">[29]</a>, a much more vague and difficult to interpret in practice legal basis. So far, the data protection authorities have not strictly checked on the effective use of this basis in the AdTech industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When one sees the size and the interests of the companies with a business model based on the exchange of data, the economic stakes are very high.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There is a clear blockade against a GDPR-like consent to collect data through electronic transmission from natural persons, including all data from the Internet of Things (IOT), a huge market for data <s>hoarders</s>… intermediaries and platforms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>WILL THE NEW PROPOSED ADTECH SYSTEMS EVER PROTECT THE PERSONS’ PRIVACY ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTEXTUAL TARGETING</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To evade the strict consent requirement of the GDPR and from the future E-privacy regulation, the AdTech industry is restructuring its offer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some researchers are positive that one can find a respectful way to collect and infer information on persons to sell them personalised advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>For an extensive study of alternative model of AdTech systems</strong>, I recommend reading for example the interesting study from the Electronic Frontier Foundation, “<em>To track or not to track? Towards privacy-friendly and sustainable online advertising</em>“ <a href=\"#_ftn30\">[30]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It seems that the return to contextual targeting would be “<em>an actual win-win for all groups who should benefit from online advertising: users, publishers and advertisers.</em>“ <a href=\"#_ftn31\">[31]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ However I am not sure that the data intermediaries and platforms &nbsp;will let go their power that easily and will not fight like it is happening for the E-Privacy Regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I am a bit less enthusiastic on contextual tracking being outside the GDPR material application.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The contextual ad targeting needs often location data that are personal data under GDPR and e-privacy directive (and the future E-privacy Regulation)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What we look at during our browsing says a lot on us, with so many personal data already collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I do not see any of the big player giving up a chance to cross all the information on individuals but in an even more proprietary way. (hence the term “<em>walled garden</em>“ used in advertising : “<em>A Walled Garden is a closed ecosystem in which all the operations are controlled by the ecosystem operator. </em><a href=\"#_ftn32\">[32]</a> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Google Display Network</strong> uses this system<a href=\"#_ftn33\">[33]</a> but I do not think that this is not tracking submitted to GDPR consent when I read this in Google’s information :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“While the Search Network can reach people when they\'re already searching for specific good or services, <strong>the Display Network can help you capture someone\'s attention earlier in the buying cycle.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can put your ads in front of people before they start searching for what you offer, which can be key for your overall advertising strategy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>You can also remind people of what they\'re interested in,</strong> as in the case of remarketing to people who\'ve previously visited your site or app.“</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is still tracking from an electronic communication and it still concerns tastes , interests of persons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I do not see why it would not be classified as personal data under GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lot of personal information can be inferred from this scheme and what about the collection of IP addresses, location, navigaton type?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“A user is less likely <strong>to feel they’re being followed</strong> around by an advertisement if it is related to the content they’re consuming at the moment. <strong>Even if the ad is following the user around</strong>, it’s much less evident when it fits contextually.“ <a href=\"#_ftn34\">[34]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>➡️ What ? I call this a dark pattern, a deception towards the users.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Old habits are hard to change…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The publishers’ responsibility is heightened since they are the one setting the parameters like topics or keywords.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Contextual advertising eradicates the risk of discrimination and manipulation through data. <strong>This doesn’t mean that the content of the ad itself cannot be unfair or discriminatory.</strong> However, the fact that such ads are visible at a specific subpage regardless of who visits it, means that <strong>it should be easier</strong> for publishers to monitor them and <strong>for users to report them</strong>.“ <a href=\"#_ftn35\">[35]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ I doubt it</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TO CONCLUDE</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The AdTech environment will change but there is doubts that the changes will not profit the already installed, and very powerful on holding proprietary personal data, intermediaries and platforms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Where is the persons’ power to influence or to check the data collected on them ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Apart from a real informed consent, to which the advertising industry is resisting, I do not see any of those systems not resulting to tracking again and again the persons in stealth mode.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The future of the EU data policy is being decided at the moment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The Data Governance Act</strong> <a href=\"#_ftn36\">[36]</a> (to which data intermediaries for AdTech are excluded)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>introduces a <strong>Data Altruism Consent Form</strong> <a href=\"#_ftn37\">[37]</a> that the Commission should edit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It will be interesting to see how this unified consent form (for personal data and non-personal data) will articulate&nbsp; with the consent required under GDPR and the e-privacy consent for personal data processing .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:separator -->\n<hr class=\"wp-block-separator\"/>\n<!-- /wp:separator -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref1\">[1]</a> Art 7: Everyone has the right to respect for his or her private and family life, home and communications&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:12012P/TXT&amp;from=EN\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:12012P/TXT&amp;from=EN</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref2\">[2]</a> The ultimate guide to programmatic advertising .Bannerflow, accessed dec.8, 2020. <a href=\"https://www.bannerflow.com/inspiration/ultimate-guides/programmatic-advertising/\">https://www.bannerflow.com/inspiration/ultimate-guides/programmatic-advertising/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref3\">[3]</a> Transparency &amp; Consent Framework (TCF) v 2.0 ,&nbsp; IAB Europe, <a href=\"https://iabeurope.eu/transparency-consent-framework/\">https://iabeurope.eu/transparency-consent-framework/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref4\">[4]</a> Célestin Matte, Cristiana Santos, Nataliia Bielova. 7 mai 2020- Purposes in IAB Europe’s TCF: which legal basis and how are they used by advertisers?. APF 2020 - Annual Privacy Forum, Oct 2020, Lisbon, Portugal.pp.1-24. hal-02566891</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref5\">[5]</a> “Discover the advertising web with the !les Ads.txt and Sellers.json“ Benjamin Poilvé, Oct.2, 2020. LINC- CNIL&nbsp; <a href=\"https://linc.cnil.fr/fr/discover-advertising-web-files-adstxt-and-sellersjson\">https://linc.cnil.fr/fr/discover-advertising-web-files-adstxt-and-sellersjson</a>&nbsp;&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref6\">[6]</a> “US Programmatic Ad Spending Forecast 2019” Lauren Fisher – eMarketer Insider Intelligence - April 25, 2019 - <a href=\"https://www.emarketer.com/content/us-programmatic-ad-spending-forecast-2019#page-report\">https://www.emarketer.com/content/us-programmatic-ad-spending-forecast-2019#page-report</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref7\">[7]</a> “What is Programmatic Advertising?“- Moran Brayer- Feb.3, 2020- blog Outbrain <a href=\"https://www.outbrain.com/blog/programmatic-advertising/\">https://www.outbrain.com/blog/programmatic-advertising/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref8\">[8]</a> Your guide to Google Ads – accessed Dec.9, 2020- &nbsp;<a href=\"https://support.google.com/google-ads/answer/6146252?hl=en&amp;ref_topic=3119071,3181080,3126923,&amp;visit_id=637431033948351524-3931166758&amp;rd=1\">https://support.google.com/google-ads/answer/6146252?hl=en&amp;ref_topic=3119071,3181080,3126923,&amp;visit_id=637431033948351524-3931166758&amp;rd=1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref9\">[9]</a> &nbsp;“ Find Your Audience Reach your most valuable customers on the world\'s largest native network.” Outbrain – accessed Dec.8, 2020 - <a href=\"https://www.outbrain.com/advertisers/targeting/\">https://www.outbrain.com/advertisers/targeting/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref10\">[10]</a> Criteo website accessed dec.8, 2020 <a href=\"https://www.criteo.com/products/criteo-audience-match/\">https://www.criteo.com/products/criteo-audience-match/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref11\">[11]</a> <em>Ibid. </em>“What are the methods used by Criteo to associate identifiers? “ <a href=\"https://www.criteo.com/privacy/how-criteo-services-work-across-environments/\">https://www.criteo.com/privacy/how-criteo-services-work-across-environments/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref12\">[12]</a> “The ePrivacy saga: the false choice between privacy and funding online publishing“, Karolina Iwańska, dec.7, 2020, Euractiv. <a href=\"https://www.euractiv.com/section/data-protection/opinion/the-eprivacy-saga-the-false-choice-between-privacy-and-funding-online-publishing/\">https://www.euractiv.com/section/data-protection/opinion/the-eprivacy-saga-the-false-choice-between-privacy-and-funding-online-publishing/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref13\">[13]</a>&nbsp; “Google is now blocking the ads publishers sell if they don’t meet Google’s standards “ Joshua Benton- NiemanLab - Dec.7, 2020 - <a href=\"https://www.niemanlab.org/2020/12/google-is-now-blocking-the-ads-publishers-sell-if-they-dont-meet-googles-standards/\">https://www.niemanlab.org/2020/12/google-is-now-blocking-the-ads-publishers-sell-if-they-dont-meet-googles-standards/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref14\">[14]</a> “Ad Tech and Privacy Lingo for Navigating a Post-Cookie World” Ronan Shields, Adweek, dec.8, 2020.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.adweek.com/programmatic/ad-tech-and-privacy-lingo-for-navigating-a-post-cookie-world/\">https://www.adweek.com/programmatic/ad-tech-and-privacy-lingo-for-navigating-a-post-cookie-world/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref15\">[15]</a> DIRECTIVE 2002/58/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref16\">[16]</a> REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref17\">[17]</a> Délibération SAN-2020-013 du 7 décembre 2020, CNIL , Délibération de la formation restreinte no SAN-2020-013 du 7 décembre 2020 concernant la société AMAZON EUROPE CORE- <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729\">https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Délibération SAN-2020-012 du 7 décembre 2020, CNIL, Délibération de la formation restreinte no SAN-2020-012 du 7 décembre 2020 concernant les sociétés GOOGLE LLC et GOOGLE IRELAND LIMITED- <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref18\">[18]</a> <em>Ibid. délibération GOOGLE</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref19\">[19]</a> Loi n° 78-17 du 6 janvier 1978 relative à l\'informatique, aux fichiers et aux libertés, mise à jour le 01 janvier 2020, <a href=\"https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460/2020-12-10/\">https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460/2020-12-10/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref20\">[20]</a> See table 6 p 100 of this paper for a description of the requirements “Are cookie banners indeed compliant with the law? Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners“&nbsp; Cristiana Santos, Nataliia Bielova and Célestin Matte, Technology and Regulation, 1-12- 2020&nbsp; <a href=\"https://techreg.org/index.php/techreg/article/view/43\">https://techreg.org/index.php/techreg/article/view/43</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref21\">[21]</a> “Update report into adtech and real time bidding“&nbsp; ICO -&nbsp; 20 Jun 2019 - underlining by the author - <a href=\"https://ico.org.uk/media/about-the-ico/documents/2615156/adtech-real-time-bidding-report-201906.pdf\">https://ico.org.uk/media/about-the-ico/documents/2615156/adtech-real-time-bidding-report-201906.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref22\">[22]</a> “To track or not to track? Towards privacy-friendly and sustainable online advertising“ - Karolina Iwańska</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Panoptykon Foundation- November 25,&nbsp; 2020- <a href=\"https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf\">https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref23\">[23]</a> <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32019R1150&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32019R1150&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref24\">[24]</a>&nbsp; European Commission- “ Guidelines on ranking transparency pursuant to Regulation (EU) 2019/1150 of the European Parliament and of the Council“&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020XC1208(01)&amp;from=EN\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020XC1208(01)&amp;from=EN</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref25\">[25]</a> &nbsp;<em>Ibid. </em>§13</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref26\">[26]</a> Guidelines 8/2020 on the targeting of social media users Version 1.0 - Adopted on 2 September 2020 for public consultation <a href=\"https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_202008_onthetargetingofsocialmediausers_en.pdf\">https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_202008_onthetargetingofsocialmediausers_en.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref27\">[27]</a> DIRECTIVE 2002/58/EC, <em>op.cit. </em>note 15</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref28\">[28]</a> <em>Ibid. </em>art 5-3</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref29\">[29]</a> Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, ARTICLE 29 DATA PROTECTION WORKING PARTY. Adopted on 9 April 2014&nbsp;&nbsp; &nbsp;<a href=\"https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf\">https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref30\">[30]</a> “To track or not to track? Towards privacy-friendly and sustainable online advertising“ - Karolina Iwańska</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Panoptykon Foundation- November 25,&nbsp; 2020- <a href=\"https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf\">https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref31\">[31]</a> <em>Ibid. </em>page 32</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref32\">[32]</a>&nbsp; “What is a Walled Garden? And why it is the strategy of Google, Facebook and Amazon Ads platform?“ Pierre de Poulpiquet .Medium,&nbsp; Nov.3, 2017&nbsp; <a href=\"https://medium.com/mediarithmics-what-is/what-is-a-walled-garden-and-why-it-is-the-strategy-of-google-facebook-and-amazon-ads-platform-296ddeb784b1\">https://medium.com/mediarithmics-what-is/what-is-a-walled-garden-and-why-it-is-the-strategy-of-google-facebook-and-amazon-ads-platform-296ddeb784b1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref33\">[33]</a> Google Display Network <a href=\"https://support.google.com/google-ads/answer/2404186\">https://support.google.com/google-ads/answer/2404186</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref34\">[34]</a> “Contextual Advertising 101: How it Works, Benefits &amp; Why It’s Necessary for Relevant Ads“ ted Vrountas- Instapage blog - March 18, 2020 - <a href=\"https://instapage.com/blog/contextual-advertising\">https://instapage.com/blog/contextual-advertising</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref35\">[35]</a> <em>Ibid.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref36\">[36]</a> Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on European data governance (Data Governance Act), 25 November 2020 <a href=\"https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=71222\">https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=71222</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref37\">[37]</a> <em>Ibid. </em>Art 22</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Marie-Claire PEROUX LLM</strong> is a French jurist specialised in EU Law. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"<em>I have always been passionate about privacy protection.<br>I help SMEs to understand and comply with GDPR and the EU privacy protection regime.<br>I publish a blog to inform entrepreneurs, MementoSafe,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://mementosafe.com/\" target=\"_blank\">https://mementosafe.com/</a> </em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Photo kindly provided by Marie-Claire PEROUX ©</p>\n<!-- /wp:paragraph -->','Death of 3rd Party Cookies : Is Privacy Protection Possible For The  Future AdTech In The EU ?','The AdTech industry has become a monster controlled by very large, and most of the time unknown to the general public, actors, advertising intermediaries and brokers, exchanging personal data on real time bidding platforms. The deals are made only in a fraction of seconds on these data  exchanges.','publish','open','open','','death-of-3rd-party-cookies-is-privacy-protection-possible-for-the-future-adtech-in-the-eu','','','2020-12-11 21:36:57','2020-12-11 21:36:57','',0,'https://www.datarainbow.eu/?p=1964',0,'post','',0),(1966,2,'2020-12-10 15:03:44','2020-12-10 15:03:44','','Picture-1','','inherit','open','closed','','picture-1','','','2020-12-10 15:03:44','2020-12-10 15:03:44','',1964,'https://www.datarainbow.eu/wp-content/uploads/2020/12/Picture-1.png',0,'attachment','image/png',0),(1967,2,'2020-12-10 15:34:04','2020-12-10 15:34:04','Photography by Marie-Claire Peroux ©','Screenshot 2020-12-10 at 15.33.41','','inherit','open','closed','','screenshot-2020-12-10-at-15-33-41','','','2020-12-10 17:36:12','2020-12-10 17:36:12','',1964,'https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-15.33.41.png',0,'attachment','image/png',0),(1968,2,'2020-12-10 15:34:19','2020-12-10 15:34:19','<!-- wp:paragraph -->\n<p>Let’s talk about the future of the pervasive and privacy intrusive tracking from the AdTech industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Will a new system really better protect the right to privacy in the EU?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First, one should not forget that <strong>privacy in the EU is a fundamental human right</strong> protected by the Charter of Fundamental Rights of the European Union <a href=\"#_ftn1\">[1]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The AdTech industry has become a monster controlled by very large, and most of the time unknown to the general public, actors, advertising intermediaries and brokers, exchanging personal data on real time bidding platforms. The deals are made only in a fraction of seconds on these data  exchanges.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<strong>So what is programmatic advertising?</strong></p><p>In its simplest form, programmatic advertising is the automated transaction of buying and selling advertising online.</p><p>It’s the process of using different platforms to sell inventory on publishing sites and on the advertising side, buying inventory and place ads on a publishers site. This is also sometimes referred to as programmatic marketing.“ <a href=\"#_ftn2\">[2]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>How much an “a<em>verage</em>” user of a website knows about it when presented with complex and obscure consent panels from the Transparency and Control Framework developed by the IAB Europe <a href=\"#_ftn3\">[3]</a> ? Most certainly nothing .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For more information on the new proposed <strong>IAB Europe TCF scheme</strong> under GDPR, read this study : “<em>Purposes in IAB Europe’s TCF: which legal basis and how are they used by advertisers?</em>“  <a href=\"#_ftn4\">[4]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To say the least, this scheme is not GDPR compliant in the sense that it does not provide the persons with a clear and comprehensible information to what and why they agree.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The presentation of legal basis of the processing is very confusing, it sometimes alternates between the legitimate interest and consent without making any sense.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>SIZE&nbsp; OF THE ADTECH MARKET</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An example from a French CNIL study &nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“ By automatically collecting this public data, the LINC has put a study online for each of these standards to understand how this ecosystem is structured, <strong>based on the 5,000 most visited French sites</strong> (Alexa ranking).</p><p>These studies reveal an <strong>ecosystem of around 620 advertising systems and more than 6,000 intermediaries selling advertising inventory</strong>, an ecosystem characterised by a high level of intermediation, thus multiplying the number of players with access to Internet users\' data.“<a href=\"#_ftn5\">[5]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Projection on the market size in the USA</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2021: 87.5 % of the <strong>entire digital ad market of&nbsp; $81 billion</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2019  “<em>Automation will account for $59.45 billion in ad dollars this year, or 84.9% of the US digital display ad market. Of that, two-thirds of those automated dollars will go to mobile. Nearly one of every two ad dollars goes to video.</em>” <a href=\"#_ftn6\">[6]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1966,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Picture-1.png\" alt=\"\" class=\"wp-image-1966\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>From Outbrain Blog <a href=\"#_ftn7\">[7]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The automated selling of private information was developed in the USA in 2009 and since then, it has become a monster serving its own purpose more than the ones of the online publishers, one of the source of personal data collected from users, and of the persons who get served “personalised” ads that do not always help them to better consume .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example: persons that have been classified as in low earnings get presented offers of loans to further push them in debt.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>HOW ARE WE CLASSIFIED BY THE ADTECH INDUSTRY ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On obscure proprietary algorithms, AI&nbsp; and criteria. I could not find a description of any of those.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The only indication of the extremely detailed information collected on individuals could be found for example in the Google Ad offer. Visiting the Google Ad support platform <a href=\"#_ftn8\">[8]</a> shows the very detailed targeting offered to its clients.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some AdTech actors claim that they have already switched to some sort of contextual targeting:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“ <strong>Interest Targeting</strong>: Target your audience based on their real interests, because our profiles are based on actual content consumption, not search or social sharing.“ <a href=\"#_ftn9\">[9]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>One of the largest payer in the AdTech is Outbrain, it advertises on its website “<em>Reaching 1.5B+ users each month requires the right targeting solutions</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A WIDE SOURCE OF INFORMATION FOR DATA BROKERS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Use Criteo Shopper Graph to find your customers online. <strong>Over 10,000 websites worldwide continuously share their data with us,</strong> allowing you to accurately target your shoppers across their devices.“ <a href=\"#_ftn10\">[10]</a></p><p>“We may associate Criteo identifiers on the basis of:</p><p>- <strong>our own association methods</strong> based on the data we already collect <strong>through our technologies</strong>;</p><p>- the data that may be transmitted to us by an Advertiser or Publisher in an optional and pseudonymised manner, such as your CRM identifiers and/or email addresses in hash and/or encrypted form;</p><p>- the <strong>associations that</strong> <strong>partners can send us</strong>, which they <strong>have obtained by using various methods </strong>that offer the same level of guarantee as ours in terms of respect for your privacy.“ <a href=\"#_ftn11\">[11]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ Where is my personal data in this maze? How could I possibly control what has been inferred on me, rightly or wrongly ? Do they control the legal basis of data obtained from partners ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>WHAT POWERS DO HAVE SMALLER PUBLISHER FACING THE ADTECH &nbsp;BEHEMOTHS ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The current targeted advertising system hardly profits to the main users, the publishers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“publishers are forced to participate in the uneven race for clicks and attention, <strong>sacrificing their readers’ privacy </strong>and – increasingly – the quality of the content they produce, only to hand as much as 70% of profits over to advertising middlemen at the end of the day.</p><p>Instead of the promise of thriving online publishing, the ad tech industry made publishers fight a war for survival.” <a href=\"#_ftn12\">[12]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The source of the personal data collected and inferred will rapidly change after Google announced <strong>the end of 3<sup>rd</sup> party cookies,</strong> tracking the users on websites most of the time without their informed knowledge.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ However, I do not believe any of the new systems will provide a better control to the users on their privacy .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Google remains all powerful in the advertising business</strong> <a href=\"#_ftn13\">[13]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“The next 12 months will see the industry prepare for Google Chrome withdrawing its support of third-party cookies, bringing it in line with the industry’s other leading web browsers.</p><p><strong>Marketers will still be able to target audiences using first-party data,</strong> for instance, by serving ads in walled gardens such as Facebook or logged-in users on a publisher’s website.“</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>(…) “ what appears apparent is that 1:1 targeting using third-party data is soon to be a thing of the past.</p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>Per Google’s documentation released thus far, <strong>contextual ads will soon be targeted using more nuanced means that target users based on cohorts</strong> “ <a href=\"#_ftn14\">[14]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is basically a return to the way advertising was done before the RTB craze.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the meantime, large data intermediary companies are sitting on a huge amount of information collected on us through &nbsp;quite shady means, dark patterns are common in the collection of consent from websites.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The national Data Protection Authorities have been slow or inexistant up until recently &nbsp;in defending the users rights under the E-Privacy directive. <a href=\"#_ftn15\">[15]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The scattered and sometimes lax enforcement&nbsp; of the directive in the EU has certainly favoured the collection of consent to behavioural tracking on a large scale in the EU, at least until the GDPR went into application in 2018. <a href=\"#_ftn16\">[16]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2</strong> <strong>RECENT GROUNDBREAKING DECISIONS FROM THE FRENCH CNIL<a href=\"#_ftn17\"><strong>[17]</strong></a></strong> &nbsp;<strong>MIGHT SEND A DIFFERENT MESSAGE TO THE ADTECH INDUSTRY</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google and Amazon did not wait for the consent of the users, based in France, to attach ad cookies to their electronic device.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Contextual advertising is&nbsp; concerned as well by the E-Directive when it uses location data for example (see § 129 to §131 of the decision on Google <a href=\"#_ftn18\">[18]</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Moreover, the information given to the users based in France was not conform to the requirements of the French law implementing the E-Privacy directive <a href=\"#_ftn19\">[19]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent to tracking is&nbsp; (should ) now be more difficult to obtain but there is still a lot of confusion on the side of publishers in the EU.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A study on e-privacy/ GDPR compliant way <strong>to obtain valid consent from users on websites</strong> points to <strong>22 legal requirements</strong> <a href=\"#_ftn20\">[20]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the ICO, the&nbsp; UK Data Protection Authority, underlined:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“identifying a lawful basis for the processing of personal data in RTB remains challenging, as the scenarios where legitimate interests could apply are limited, and <strong>methods of obtaining consent are often insufficient </strong>in respect of data protection law requirements;</p><p>- the privacy notices provided to individuals lack clarity and do not give them full visibility of what happens to their data;</p><p>- the scale of <strong>the creation and sharing of personal data profiles in RTB appears disproportionate, intrusive and unfair, particularly when in many cases data subjects are unaware that this processing is taking place</strong>; “ <a href=\"#_ftn21\">[21]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>LACK OF TRANSPARENCY IN THE CLASSIFICATION OF THE NATURAL PERSONS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One is amazed by the <strong>number of persona</strong> one can get included in.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The persons have no way to control or correct these classification made by proprietary machine learning and AI.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We do not know what these large data intermediary companies think they know about us and what they are selling about us.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Google and IAB’s RTB systems have in fact been constructed <strong>in a way that makes it impossible to control data once it is shared on the ad exchange </strong>– neither by the publisher who shared it, much less by the user. This is a data breach that affects basically everyone that has ever used the Internet. The violations of other GDPR principles stem from this feature inherent to real-time bidding systems.“ <a href=\"#_ftn22\">[22]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>This is unacceptable and contrary to every principle of transparency supposed to protect us from privacy invasion.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TRANSPARECY MUCH NEEDED</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One could make a parallel with the move to imposed transparency on the parameters of ranking on large intermediary platforms offering a market place for business users.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The EU legal regime on consumer and business protection relies on the principle of transparency.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The EU Regulation (EU) 2019/1150 of the European Parliament and of the Council <a href=\"#_ftn23\">[23]</a>&nbsp; of 20 June 2019 on promoting fairness and transparency for business users of online intermediation services and its guidelines <a href=\"#_ftn24\">[24]</a> are supposed to impose the obligation on a platform like Google or Amazon&nbsp; for example, to inform the businesses on the factors they use to rank their users:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<strong>Ranking</strong>  (…) can essentially be thought of as a form of <strong>data-driven, algorithmic decision-making.</strong> When providers present, organise or communicate information on goods or services for consumers or search results, they ‘rank’ results on the basis of certain parameters.”</p><p>“Providers design their ranking methods, including proprietary algorithms, in different ways. <strong>These approaches to ranking are frequently adapted and in general not disclosed</strong>. From the consumers’ perspective, the quality of search results may differentiate services and, therefore, the detailed functioning of ranking methods may be a provider’s competitive edge or trade secret (…) “ <a href=\"#_ftn25\">[25]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ Why not impose the right of the persons, at the source of all the data exchanged for digital advertising purpose, to <strong>access the parameters  used by the data <s>hoarders</s>…brokers and traders to classify them and to “feed“ them with what they are supposed to buy.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One should be allowed as well to correct or object the information inferred from one’s data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>THE LEGAL BASIS TO COLLECT PERSONAL DATA IN THE CONTEXT OF TARGETED ADVERTISING IS MAINLY CONSENT OF THE DATA SUBJECT.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the recent proposal for <strong>Guidelines on the targeting of social media users</strong> <a href=\"#_ftn26\">[26]</a>, the EDPD recalls that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“it would be difficult for controllers to justify using legitimate interests as a legal basis for intrusive profiling and tracking practices for marketing or advertising purposes, <strong>for example those that involve tracking individuals across multiple websites, locations, devices, services or data-brokering”</strong></p><p>“Even if the processing of personal data is based on consent of the data subject, this would not legitimize targeting which is disproportionate or unfair.“</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The GDPR is not the only legal regime imposed on the AdTech activities in the EU,&nbsp; at the moment the e-privacy Directive <a href=\"#_ftn27\">[27]</a> &nbsp;applies if cookies or any other tracking process like gif, pixels, plug in… are placed on the user’s electronic device.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They can mostly be placed on the users’ devices only with their consent (art 5-1) in case</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>of :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user” <a href=\"#_ftn28\">[28]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A <strong>new E-Privacy regulation</strong> was due to be adopted at the same time as the GDPR but, at of the time of writing, it seems to be constantly pushed back especially on the problem of the legal basis on which data could be processed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The original text mentioned only GDPR like consent to collect data but the data industry is pushing for the legitimate interest basis <a href=\"#_ftn29\">[29]</a>, a much more vague and difficult to interpret in practice legal basis. So far, the data protection authorities have not strictly checked on the effective use of this basis in the AdTech industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When one sees the size and the interests of the companies with a business model based on the exchange of data, the economic stakes are very high.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There is a clear blockade against a GDPR-like consent to collect data through electronic transmission from natural persons, including all data from the Internet of Things (IOT), a huge market for data <s>hoarders</s>… intermediaries and platforms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>WILL THE NEW PROPOSED ADTECH SYSTEMS EVER PROTECT THE PERSONS’ PRIVACY ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTEXTUAL TARGETING</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To evade the strict consent requirement of the GDPR and from the future E-privacy regulation, the AdTech industry is restructuring its offer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some researchers are positive that one can find a respectful way to collect and infer information on persons to sell them personalised advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>For an extensive study of alternative model of AdTech systems</strong>, I recommend reading for example the interesting study from the Electronic Frontier Foundation, “<em>To track or not to track? Towards privacy-friendly and sustainable online advertising</em>“ <a href=\"#_ftn30\">[30]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It seems that the return to contextual targeting would be “<em>an actual win-win for all groups who should benefit from online advertising: users, publishers and advertisers.</em>“ <a href=\"#_ftn31\">[31]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ However I am not sure that the data intermediaries and platforms  will let go their power that easily and will not fight like it is happening for the E-Privacy Regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I am a bit less enthusiastic on contextual tracking being outside the GDPR material application.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The contextual ad targeting needs often location data that are personal data under GDPR and e-privacy directive (and the future E-privacy Regulation)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What we look at during our browsing says a lot on us, with so many personal data already collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I do not see any of the big player giving up a chance to cross all the information on individuals but in an even more proprietary way. (hence the term “<em>walled garden</em>“ used in advertising : “<em>A Walled Garden is a closed ecosystem in which all the operations are controlled by the ecosystem operator. </em><a href=\"#_ftn32\">[32]</a> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Google Display Network</strong> uses this system<a href=\"#_ftn33\">[33]</a> but I do not think that this is not tracking submitted to GDPR consent when I read this in Google’s information :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“While the Search Network can reach people when they\'re already searching for specific good or services, <strong>the Display Network can help you capture someone\'s attention earlier in the buying cycle.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can put your ads in front of people before they start searching for what you offer, which can be key for your overall advertising strategy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>You can also remind people of what they\'re interested in,</strong> as in the case of remarketing to people who\'ve previously visited your site or app.“</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is still tracking from an electronic communication and it still concerns tastes , interests of persons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I do not see why it would not be classified as personal data under GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lot of personal information can be inferred from this scheme and what about the collection of IP addresses, location, navigaton type?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>                                                                 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“A user is less likely <strong>to feel they’re being followed</strong> around by an advertisement if it is related to the content they’re consuming at the moment. <strong>Even if the ad is following the user around</strong>, it’s much less evident when it fits contextually.“ <a href=\"#_ftn34\">[34]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>➡️ What ? I call this a dark pattern, a deception towards the users.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Old habits are hard to change…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The publishers’ responsibility is heightened since they are the one setting the parameters like topics or keywords.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Contextual advertising eradicates the risk of discrimination and manipulation through data. <strong>This doesn’t mean that the content of the ad itself cannot be unfair or discriminatory.</strong> However, the fact that such ads are visible at a specific subpage regardless of who visits it, means that <strong>it should be easier</strong> for publishers to monitor them and <strong>for users to report them</strong>.“ <a href=\"#_ftn35\">[35]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ I doubt it</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TO CONCLUDE</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The AdTech environment will change but there is doubts that the changes will not profit the already installed, and very powerful on holding proprietary personal data, intermediaries and platforms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Where is the persons’ power to influence or to check the data collected on them ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Apart from a real informed consent, to which the advertising industry is resisting, I do not see any of those systems not resulting to tracking again and again the persons in stealth mode.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The future of the EU data policy is being decided at the moment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The Data Governance Act</strong> <a href=\"#_ftn36\">[36]</a> (to which data intermediaries for AdTech are excluded)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>introduces a <strong>Data Altruism Consent Form</strong> <a href=\"#_ftn37\">[37]</a> that the Commission should edit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It will be interesting to see how this unified consent form (for personal data and non-personal data) will articulate&nbsp; with the consent required under GDPR and the e-privacy consent for personal data processing .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:separator -->\n<hr class=\"wp-block-separator\"/>\n<!-- /wp:separator -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref1\">[1]</a> Art 7: Everyone has the right to respect for his or her private and family life, home and communications&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:12012P/TXT&amp;from=EN\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:12012P/TXT&amp;from=EN</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref2\">[2]</a> The ultimate guide to programmatic advertising .Bannerflow, accessed dec.8, 2020. <a href=\"https://www.bannerflow.com/inspiration/ultimate-guides/programmatic-advertising/\">https://www.bannerflow.com/inspiration/ultimate-guides/programmatic-advertising/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref3\">[3]</a> Transparency &amp; Consent Framework (TCF) v 2.0 ,&nbsp; IAB Europe, <a href=\"https://iabeurope.eu/transparency-consent-framework/\">https://iabeurope.eu/transparency-consent-framework/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref4\">[4]</a> Célestin Matte, Cristiana Santos, Nataliia Bielova. 7 mai 2020- Purposes in IAB Europe’s TCF: which legal basis and how are they used by advertisers?. APF 2020 - Annual Privacy Forum, Oct 2020, Lisbon, Portugal.pp.1-24. hal-02566891</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref5\">[5]</a> “Discover the advertising web with the !les Ads.txt and Sellers.json“ Benjamin Poilvé, Oct.2, 2020. LINC- CNIL&nbsp; <a href=\"https://linc.cnil.fr/fr/discover-advertising-web-files-adstxt-and-sellersjson\">https://linc.cnil.fr/fr/discover-advertising-web-files-adstxt-and-sellersjson</a>&nbsp;&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref6\">[6]</a> “US Programmatic Ad Spending Forecast 2019” Lauren Fisher – eMarketer Insider Intelligence - April 25, 2019 - <a href=\"https://www.emarketer.com/content/us-programmatic-ad-spending-forecast-2019#page-report\">https://www.emarketer.com/content/us-programmatic-ad-spending-forecast-2019#page-report</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref7\">[7]</a> “What is Programmatic Advertising?“- Moran Brayer- Feb.3, 2020- blog Outbrain <a href=\"https://www.outbrain.com/blog/programmatic-advertising/\">https://www.outbrain.com/blog/programmatic-advertising/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref8\">[8]</a> Your guide to Google Ads – accessed Dec.9, 2020- &nbsp;<a href=\"https://support.google.com/google-ads/answer/6146252?hl=en&amp;ref_topic=3119071,3181080,3126923,&amp;visit_id=637431033948351524-3931166758&amp;rd=1\">https://support.google.com/google-ads/answer/6146252?hl=en&amp;ref_topic=3119071,3181080,3126923,&amp;visit_id=637431033948351524-3931166758&amp;rd=1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref9\">[9]</a> &nbsp;“ Find Your Audience Reach your most valuable customers on the world\'s largest native network.” Outbrain – accessed Dec.8, 2020 - <a href=\"https://www.outbrain.com/advertisers/targeting/\">https://www.outbrain.com/advertisers/targeting/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref10\">[10]</a> Criteo website accessed dec.8, 2020 <a href=\"https://www.criteo.com/products/criteo-audience-match/\">https://www.criteo.com/products/criteo-audience-match/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref11\">[11]</a> <em>Ibid. </em>“What are the methods used by Criteo to associate identifiers? “ <a href=\"https://www.criteo.com/privacy/how-criteo-services-work-across-environments/\">https://www.criteo.com/privacy/how-criteo-services-work-across-environments/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref12\">[12]</a> “The ePrivacy saga: the false choice between privacy and funding online publishing“, Karolina Iwańska, dec.7, 2020, Euractiv. <a href=\"https://www.euractiv.com/section/data-protection/opinion/the-eprivacy-saga-the-false-choice-between-privacy-and-funding-online-publishing/\">https://www.euractiv.com/section/data-protection/opinion/the-eprivacy-saga-the-false-choice-between-privacy-and-funding-online-publishing/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref13\">[13]</a>&nbsp; “Google is now blocking the ads publishers sell if they don’t meet Google’s standards “ Joshua Benton- NiemanLab - Dec.7, 2020 - <a href=\"https://www.niemanlab.org/2020/12/google-is-now-blocking-the-ads-publishers-sell-if-they-dont-meet-googles-standards/\">https://www.niemanlab.org/2020/12/google-is-now-blocking-the-ads-publishers-sell-if-they-dont-meet-googles-standards/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref14\">[14]</a> “Ad Tech and Privacy Lingo for Navigating a Post-Cookie World” Ronan Shields, Adweek, dec.8, 2020.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.adweek.com/programmatic/ad-tech-and-privacy-lingo-for-navigating-a-post-cookie-world/\">https://www.adweek.com/programmatic/ad-tech-and-privacy-lingo-for-navigating-a-post-cookie-world/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref15\">[15]</a> DIRECTIVE 2002/58/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref16\">[16]</a> REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref17\">[17]</a> Délibération SAN-2020-013 du 7 décembre 2020, CNIL , Délibération de la formation restreinte no SAN-2020-013 du 7 décembre 2020 concernant la société AMAZON EUROPE CORE- <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729\">https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Délibération SAN-2020-012 du 7 décembre 2020, CNIL, Délibération de la formation restreinte no SAN-2020-012 du 7 décembre 2020 concernant les sociétés GOOGLE LLC et GOOGLE IRELAND LIMITED- <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref18\">[18]</a> <em>Ibid. délibération GOOGLE</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref19\">[19]</a> Loi n° 78-17 du 6 janvier 1978 relative à l\'informatique, aux fichiers et aux libertés, mise à jour le 01 janvier 2020, <a href=\"https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460/2020-12-10/\">https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460/2020-12-10/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref20\">[20]</a> See table 6 p 100 of this paper for a description of the requirements “Are cookie banners indeed compliant with the law? Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners“&nbsp; Cristiana Santos, Nataliia Bielova and Célestin Matte, Technology and Regulation, 1-12- 2020&nbsp; <a href=\"https://techreg.org/index.php/techreg/article/view/43\">https://techreg.org/index.php/techreg/article/view/43</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref21\">[21]</a> “Update report into adtech and real time bidding“&nbsp; ICO -&nbsp; 20 Jun 2019 - underlining by the author - <a href=\"https://ico.org.uk/media/about-the-ico/documents/2615156/adtech-real-time-bidding-report-201906.pdf\">https://ico.org.uk/media/about-the-ico/documents/2615156/adtech-real-time-bidding-report-201906.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref22\">[22]</a> “To track or not to track? Towards privacy-friendly and sustainable online advertising“ - Karolina Iwańska</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Panoptykon Foundation- November 25,&nbsp; 2020- <a href=\"https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf\">https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref23\">[23]</a> <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32019R1150&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32019R1150&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref24\">[24]</a>&nbsp; European Commission- “ Guidelines on ranking transparency pursuant to Regulation (EU) 2019/1150 of the European Parliament and of the Council“&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020XC1208(01)&amp;from=EN\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020XC1208(01)&amp;from=EN</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref25\">[25]</a> &nbsp;<em>Ibid. </em>§13</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref26\">[26]</a> Guidelines 8/2020 on the targeting of social media users Version 1.0 - Adopted on 2 September 2020 for public consultation <a href=\"https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_202008_onthetargetingofsocialmediausers_en.pdf\">https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_202008_onthetargetingofsocialmediausers_en.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref27\">[27]</a> DIRECTIVE 2002/58/EC, <em>op.cit. </em>note 15</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref28\">[28]</a> <em>Ibid. </em>art 5-3</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref29\">[29]</a> Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, ARTICLE 29 DATA PROTECTION WORKING PARTY. Adopted on 9 April 2014&nbsp;&nbsp; &nbsp;<a href=\"https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf\">https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref30\">[30]</a> “To track or not to track? Towards privacy-friendly and sustainable online advertising“ - Karolina Iwańska</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Panoptykon Foundation- November 25,&nbsp; 2020- <a href=\"https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf\">https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref31\">[31]</a> <em>Ibid. </em>page 32</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref32\">[32]</a>&nbsp; “What is a Walled Garden? And why it is the strategy of Google, Facebook and Amazon Ads platform?“ Pierre de Poulpiquet .Medium,&nbsp; Nov.3, 2017&nbsp; <a href=\"https://medium.com/mediarithmics-what-is/what-is-a-walled-garden-and-why-it-is-the-strategy-of-google-facebook-and-amazon-ads-platform-296ddeb784b1\">https://medium.com/mediarithmics-what-is/what-is-a-walled-garden-and-why-it-is-the-strategy-of-google-facebook-and-amazon-ads-platform-296ddeb784b1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref33\">[33]</a> Google Display Network <a href=\"https://support.google.com/google-ads/answer/2404186\">https://support.google.com/google-ads/answer/2404186</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref34\">[34]</a> “Contextual Advertising 101: How it Works, Benefits &amp; Why It’s Necessary for Relevant Ads“ ted Vrountas- Instapage blog - March 18, 2020 - <a href=\"https://instapage.com/blog/contextual-advertising\">https://instapage.com/blog/contextual-advertising</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref35\">[35]</a> <em>Ibid.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref36\">[36]</a> Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on European data governance (Data Governance Act), 25 November 2020 <a href=\"https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=71222\">https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=71222</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref37\">[37]</a> <em>Ibid. </em>Art 22</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Marie-Claire PERROUX is a French jurist specialised in EU Law. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"I have always been passionate about privacy protection.<br>I help SMEs to understand and comply with GDPR and the EU privacy protection regime.<br>I publish a blog to inform entrepreneurs, MementoSafe, <a rel=\"noreferrer noopener\" href=\"https://mementosafe.com/\" target=\"_blank\">https://mementosafe.com/</a> \"</p>\n<!-- /wp:paragraph -->','Death of 3rd Party Cookies : Is Privacy Protection Possible For The  Future AdTech In The EU ?','','inherit','closed','closed','','1964-revision-v1','','','2020-12-10 15:34:19','2020-12-10 15:34:19','',1964,'https://www.datarainbow.eu/1964-revision-v1/',0,'revision','',0),(1970,2,'2019-12-10 17:11:00','2019-12-10 17:11:00','<!-- wp:paragraph -->\n<p>In the week that the world started celebrating the news that not one but three experimental vaccines against Covid-19 have proved at least 90% effective at preventing disease in late-stage clinical trials, research into understanding how the Sars-CoV-2 virus, which causes Covid-19, interacts with the human immune system never paused.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There are plenty of questions still to answer about the Pfizer/BioNTech and Moderna vaccines and now the Oxford and AstraZeneca and how well they might protect the elderly, for example, and how long for? Which aspects of the immune response that they elicit are protective and which aren’t? Can even better results be achieved, with vaccines that target different parts of the immune system. However, one question that seems to be overlooked by the entire world whilst celebrating, is what security measures are in place to secure the research and development and to stop counterfeit copies that are not as effective or only replicate a % of the real vaccine? It certainly does not seem important for the organisations involved as the research and findings below evidence.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On 11th May 2020 Archer, the UK national supercomputing service that was collating Covid-19 research and developments, was breached reportedly by Russia and Chinese state sponsored groups stealing the IP and data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":1975,\"sizeSlug\":\"large\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.56.02.png\" alt=\"\" class=\"wp-image-1975\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br>Initially blamed for being targeted to be used for crypto currency mining, the rationale for the attack quickly became clear. $billions in research and developments in Covid-19. Archers homepage became Not Secure, unencrypted with no data integrity several weeks prior to the attack when its digital certificate was allowed to expire. Bizarrely, it remains Not Secure to this day and as a government managed supercomputer, defies all<br>rationale of security and remains a major target.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was also in the weeks leading up to the Archer breach in May that our research discovered Oxford University was maintaining a Not Secure homepage. We continuously informed Oxford University that they were maintaining sub optimal internet facing domains and a homepage that was Not Secure in the same way Archer were. This was ignored for months. Although Oxford did not report a breach at this time, it is important to note they receive £100’s of millions in grants for research and work closely with Archer, as do many of the Pharmaceutical organisations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":1976,\"sizeSlug\":\"large\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.56.24.png\" alt=\"\" class=\"wp-image-1976\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br>With the further news of the Covid-19 vaccines we started researching the other Pharmaceutical companies to ensure they were not compromised facing the internet and to our disbelief, when we researched Pfizer. Our research discovered Pfizer are also running sub optimal internet facing domains. We quickly alerted the Board of Pfizer and have yet to receive confirmation or a reply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":1977,\"sizeSlug\":\"large\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.56.34.png\" alt=\"\" class=\"wp-image-1977\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br>Our research took us onto Moderna and AstraZeneca. The same situation of negligence of security facing the internet at Moderna and AstraZeneca confirms and shows a worrying systemic security issue that makes one consider, and question the motivation to secure, what could be considered the world’s most incredible development in many generations. Yet at every single organisation, security of IP and data has absolutely no consideration or focus.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":1978,\"sizeSlug\":\"large\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.57.41.png\" alt=\"\" class=\"wp-image-1978\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br>The pharmaceutical sector is among the very highest of sectors targeted for cyber attacks and a Covid-19 vaccine may be the single largest development in modern times. So why is the research and development on vaccines open to cyber attacks and IP theft?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Andy Jenkinson</strong> is a thought provoking, challenging consummate professional and natural leader whose drive, energy and enthusiasm is not only infectious but inspirational ensuring everyone succeeds together as a group. Andy has a no nonsense attitude to security, be that internal PKI or internet facing and is renowned for his candour and straight forward approach. If you want security, you might not like what you hear, but you’ll love the results.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Andrew&nbsp;Jenkinson​|Group&nbsp;CEO</td></tr><tr><td><a rel=\"noreferrer noopener\" href=\"tel:+447894%20062867\" target=\"_blank\"><strong>+447894&nbsp;062867</strong></a>|<img width=\"20\" alt=\"\" src=\"blob:https://mail.protonmail.com/d67da364-a0d7-42e0-89c6-9e07535ec26a\"><a rel=\"noreferrer noopener\" href=\"mailto:andrew.jenkinson@cybersecip.com\" target=\"_blank\"><strong>andrew.jenkinson@cybersecip.com</strong></a>|<img width=\"20\" alt=\"\" src=\"blob:https://mail.protonmail.com/8422d502-0bb1-4389-aefb-dff23909f81c\"><a rel=\"noreferrer noopener\" href=\"http://www.cybersecip.com/\" target=\"_blank\"><strong>www.cybersecip.com</strong></a><a rel=\"noreferrer noopener\" href=\"https://www.cybersecip.com/\" target=\"_blank\"></a></td></tr><tr><td></td></tr></tbody></table></figure>\n<!-- /wp:table -->','COVID 19: Security & Protection Concerns','More than ever during this COVID-19 pandemic, online security and keeping websites secure has become a priority.','publish','open','open','','covid-19-security-protection-concerns','','','2021-08-02 16:37:43','2021-08-02 16:37:43','',0,'https://www.datarainbow.eu/?p=1970',0,'post','',0),(1972,2,'2020-12-10 16:44:07','2020-12-10 16:44:07','<!-- wp:paragraph -->\n<p>COVID 19: SECURITY &amp; PROTECTION CONCERNS<br>In the week that the world started celebrating the news that not one but three experimental vaccines against<br>Covid-19 have proved at least 90% effective at preventing disease in late-stage clinical trials, research into<br>understanding how the Sars-CoV-2 virus, which causes Covid-19, interacts with the human immune system never<br>paused.<br>There are plenty of questions still to answer about the Pfizer/BioNTech and Moderna vaccines and now the<br>Oxford and AstraZeneca and how well they might protect the elderly, for example, and how long for? Which<br>aspects of the immune response that they elicit are protective and which aren’t? Can even better results be<br>achieved, with vaccines that target different parts of the immune system. However, one question that seems to<br>be overlooked by the entire world whilst celebrating, is what security measures are in place to secure the<br>research and development and to stop counterfeit copies that are not as effective or only replicate a % of the real<br>vaccine? It certainly does not seem important for the organisations involved as the research and findings below<br>evidence.<br>On 11th May 2020 Archer, the UK national supercomputing service that was collating Covid-19 research and<br>developments, was breached reportedly by Russia and Chinese state sponsored groups stealing the IP and data.<br>Initially blamed for being targeted to be used for crypto currency mining, the rationale for the attack quickly<br>became clear. $billions in research and developments in Covid-19. Archers homepage became Not Secure,<br>unencrypted with no data integrity several weeks prior to the attack when its digital certificate was allowed to<br>expire. Bizarrely, it remains Not Secure to this day and as a government managed supercomputer, defies all<br>rationale of security and remains a major target.<br>It was also in the weeks leading up to the Archer breach in May that our research discovered Oxford University<br>was maintaining a Not Secure homepage. We continuously informed Oxford University that they were<br>maintaining sub optimal internet facing domains and a homepage that was Not Secure in the same way Archer<br>were. This was ignored for months. Although Oxford did not report a breach at this time, it is important to note</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:separator -->\n<hr class=\"wp-block-separator\"/>\n<!-- /wp:separator -->\n\n<!-- wp:paragraph -->\n<p><strong><em><strong><em>__________________________________</em></strong></em></strong> Cybersec Innovation Partners Ltd, 24/25 The Shard, 32 London Bridge Street, London SE1 9SG, United Kingdom.<br>Registered in England and Wales with registration number: 11465050. Registered Office: Linden House, Linden Close,<br>Tunbridge Wells, TN4 8HH. VAT Registration No: GB 302 3877 21<br>they receive £100’s of millions in grants for research and work closely with Archer, as do many of the<br>Pharmaceutical organisations.<br>With the further news of the Covid-19 vaccines we started researching the other Pharmaceutical companies to<br>ensure they were not compromised facing the internet and to our disbelief, when we researched Pfizer. Our<br>research discovered Pfizer are also running sub optimal internet facing domains. We quickly alerted the Board of<br>Pfizer and have yet to receive confirmation or a reply.<br>Our research took us onto Moderna and AstraZeneca. The same situation of negligence of security facing the<br>internet at Moderna and AstraZeneca confirms and shows a worrying systemic security issue that makes one</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:separator -->\n<hr class=\"wp-block-separator\"/>\n<!-- /wp:separator -->\n\n<!-- wp:paragraph -->\n<p><strong><em><strong><em>__________________________________</em></strong></em></strong> Cybersec Innovation Partners Ltd, 24/25 The Shard, 32 London Bridge Street, London SE1 9SG, United Kingdom.<br>Registered in England and Wales with registration number: 11465050. Registered Office: Linden House, Linden Close,<br>Tunbridge Wells, TN4 8HH. VAT Registration No: GB 302 3877 21<br>consider, and question the motivation to secure, what could be considered the world’s most incredible<br>development in many generations. Yet at every single organisation, security of IP and data has absolutely no<br>consideration or focus.<br>The pharmaceutical sector is among the very highest of sectors targeted for cyber attacks and a Covid-19<br>vaccine may be the single largest development in modern times. So why is the research and development on<br>vaccines open to cyber attacks and IP theft?</p>\n<!-- /wp:paragraph -->','','','inherit','closed','closed','','1970-revision-v1','','','2020-12-10 16:44:07','2020-12-10 16:44:07','',1970,'https://www.datarainbow.eu/1970-revision-v1/',0,'revision','',0),(1973,2,'2020-12-10 16:44:48','2020-12-10 16:44:48','<!-- wp:paragraph -->\n<p>Let’s talk about the future of the pervasive and privacy intrusive tracking from the AdTech industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Will a new system really better protect the right to privacy in the EU?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First, one should not forget that <strong>privacy in the EU is a fundamental human right</strong> protected by the Charter of Fundamental Rights of the&nbsp;European Union <a href=\"#_ftn1\">[1]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The AdTech industry has become a monster controlled by very large, and most of the time unknown to the general public, actors, advertising&nbsp;intermediaries and brokers, exchanging personal data on real time bidding platforms. The deals are made only in a fraction of seconds on these data&nbsp; exchanges.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<strong>So what is programmatic advertising?</strong></p><p>In its simplest form, programmatic advertising is the automated transaction of buying and selling advertising online.</p><p>It’s the process of using different platforms to sell inventory on publishing sites and on the advertising side, buying inventory and place ads on a publishers site. This is also sometimes referred to as programmatic marketing.“ <a href=\"#_ftn2\">[2]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>How much an “a<em>verage</em>” user of a website knows about&nbsp;it when presented with complex and obscure consent panels from the Transparency and Control Framework developed by the IAB Europe <a href=\"#_ftn3\">[3]</a> ? Most certainly nothing .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For more information on the new proposed <strong>IAB Europe TCF scheme</strong> under GDPR, read this study : “<em>Purposes in IAB Europe’s TCF: which legal basis and how are they used by advertisers?</em>“&nbsp; <a href=\"#_ftn4\">[4]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To say the least, this scheme is not GDPR compliant in the sense that it does not provide the persons with a clear and comprehensible information to what and why they agree.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The presentation of legal basis of the processing is very confusing, it sometimes alternates between the legitimate interest and consent&nbsp;without making any sense.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>SIZE&nbsp; OF THE ADTECH MARKET</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An example from a French CNIL study &nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“ By automatically collecting this public data, the LINC has put a study online for each of these standards to understand how this ecosystem is structured, <strong>based on the 5,000 most visited French sites</strong> (Alexa ranking).</p><p>These studies reveal an <strong>ecosystem of around 620 advertising systems and more than 6,000 intermediaries selling advertising inventory</strong>, an ecosystem characterised by a high level of intermediation, thus multiplying the number of players with access to Internet users\' data.“<a href=\"#_ftn5\">[5]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Projection on the market size in the USA</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2021: 87.5 % of the <strong>entire digital ad market of&nbsp; $81 billion</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2019 &nbsp;“<em>Automation will account for $59.45 billion in ad dollars this year, or 84.9% of the US digital display ad market. Of that, two-thirds of those automated dollars will go to mobile. Nearly one of every two ad dollars goes to video.</em>” <a href=\"#_ftn6\">[6]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1966,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Picture-1.png\" alt=\"\" class=\"wp-image-1966\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>From Outbrain Blog <a href=\"#_ftn7\">[7]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The automated selling of private information was developed in the USA in 2009 and since then, it has become a monster serving its own purpose more than the ones of the online publishers, one of the source of personal data collected from users, and of the persons who get served “personalised” ads that do not always help them to better consume .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example: persons that have been classified as in low earnings get presented offers of loans to further push them in debt.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>HOW ARE WE CLASSIFIED BY THE ADTECH INDUSTRY ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On obscure proprietary algorithms, AI&nbsp; and criteria. I could not find a description of any of those.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The only indication of the extremely detailed information collected on individuals could be found for example in the Google Ad offer. Visiting the Google Ad support platform <a href=\"#_ftn8\">[8]</a> shows the very detailed targeting offered to its clients.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some AdTech actors claim that they have already switched to some sort of contextual targeting:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“ <strong>Interest Targeting</strong>: Target your audience based on their real interests, because our profiles are based on actual content consumption, not search or social sharing.“ <a href=\"#_ftn9\">[9]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>One of the largest payer in the AdTech is Outbrain, it advertises on its website “<em>Reaching 1.5B+ users each month requires the right targeting solutions</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A WIDE SOURCE OF INFORMATION FOR DATA BROKERS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Use Criteo Shopper Graph to find your customers online. <strong>Over 10,000 websites worldwide continuously share their data with us,</strong> allowing you to accurately target your shoppers across their devices.“ <a href=\"#_ftn10\">[10]</a></p><p>“We may associate Criteo identifiers on the basis of:</p><p>- <strong>our own association methods</strong> based on the data we already collect <strong>through our technologies</strong>;</p><p>- the data that may be transmitted to us by an Advertiser or Publisher in an optional and pseudonymised manner, such as your CRM identifiers and/or email addresses in hash and/or encrypted form;</p><p>- the <strong>associations that</strong> <strong>partners can send us</strong>, which they <strong>have obtained by using various methods </strong>that offer the same level of guarantee as ours in terms of respect for your privacy.“ <a href=\"#_ftn11\">[11]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ Where is my personal data in this maze? How could I possibly control what has been inferred on me, rightly or wrongly ? Do they control the legal basis of data obtained from partners ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>WHAT POWERS DO HAVE SMALLER PUBLISHER FACING THE ADTECH &nbsp;BEHEMOTHS ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The current targeted advertising system hardly profits to the main users, the publishers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“publishers are forced to participate in the uneven race for clicks and attention, <strong>sacrificing their readers’ privacy </strong>and – increasingly – the quality of the content they produce, only to hand as much as 70% of profits over to advertising middlemen at the end of the day.</p><p>Instead of the promise of thriving online publishing, the ad tech industry made publishers fight a war for survival.” <a href=\"#_ftn12\">[12]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The source of the personal data collected and inferred will rapidly change after Google announced <strong>the end of 3<sup>rd</sup> party cookies,</strong> tracking the users on websites most of the time without their informed knowledge.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ However, I do not believe any of the new systems will provide a better control to the users on their privacy .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Google remains all powerful in the advertising business</strong> <a href=\"#_ftn13\">[13]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“The next 12 months will see the industry prepare for Google Chrome withdrawing its support of third-party cookies, bringing it in line with the industry’s other leading web browsers.</p><p><strong>Marketers will still be able to target audiences using first-party data,</strong> for instance, by serving ads in walled gardens such as Facebook or logged-in users on a publisher’s website.“</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>(…) “ what appears apparent is that 1:1 targeting using third-party data is soon to be a thing of the past.</p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>Per Google’s documentation released thus far, <strong>contextual ads will soon be targeted using more nuanced means that target users based on cohorts</strong> “ <a href=\"#_ftn14\">[14]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is basically a return to the way advertising was done before the RTB craze.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the meantime, large data intermediary companies are sitting on a huge amount of information collected on us through &nbsp;quite shady means, dark patterns are common in the collection of consent from websites.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The national Data Protection Authorities have been slow or inexistant up until recently &nbsp;in defending the users rights under the E-Privacy directive. <a href=\"#_ftn15\">[15]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The scattered and sometimes lax enforcement&nbsp; of the directive in the EU has certainly favoured the collection of consent to behavioural tracking on a large scale in the EU, at least until the GDPR went into application in 2018. <a href=\"#_ftn16\">[16]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2</strong> <strong>RECENT GROUNDBREAKING DECISIONS FROM THE FRENCH CNIL<a href=\"#_ftn17\"><strong>[17]</strong></a></strong> &nbsp;<strong>MIGHT SEND A DIFFERENT MESSAGE TO THE ADTECH INDUSTRY</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google and Amazon did not wait for the consent of the users, based in France, to attach ad cookies to their electronic device.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Contextual advertising is&nbsp; concerned as well by the E-Directive when it uses location data for example (see § 129 to §131 of the decision on Google <a href=\"#_ftn18\">[18]</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Moreover, the information given to the users based in France was not conform to the requirements of the French law implementing the E-Privacy directive <a href=\"#_ftn19\">[19]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent to tracking is&nbsp; (should ) now be more difficult to obtain but there is still a lot of confusion on the side of publishers in the EU.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A study on e-privacy/ GDPR compliant way <strong>to obtain valid consent from users on websites</strong> points to <strong>22 legal requirements</strong> <a href=\"#_ftn20\">[20]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the ICO, the&nbsp; UK Data Protection Authority, underlined:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“identifying a lawful basis for the processing of personal data in RTB remains challenging, as the scenarios where legitimate interests could apply are limited, and <strong>methods of obtaining consent are often insufficient </strong>in respect of data protection law requirements;</p><p>- the privacy notices provided to individuals lack clarity and do not give them full visibility of what happens to their data;</p><p>- the scale of <strong>the creation and sharing of personal data profiles in RTB appears disproportionate, intrusive and unfair, particularly when in many cases data subjects are unaware that this processing is taking place</strong>; “ <a href=\"#_ftn21\">[21]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>LACK OF TRANSPARENCY IN THE CLASSIFICATION OF THE NATURAL PERSONS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One is amazed by the <strong>number of persona</strong> one can get included in.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The persons have no way to control or correct these classification made by proprietary machine learning and AI.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We do not know what these large data intermediary companies think they know about us and what they are selling about us.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Google and IAB’s RTB systems have in fact been constructed <strong>in a way that makes it impossible to control data once it is shared on the ad exchange </strong>– neither by the publisher who shared it, much less by the user. This is a data breach that affects basically everyone that has ever used the Internet. The violations of other GDPR principles stem from this feature inherent to real-time bidding systems.“ <a href=\"#_ftn22\">[22]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>This is unacceptable and contrary to every principle of transparency supposed to protect us from privacy invasion.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TRANSPARECY MUCH NEEDED</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One could make a parallel with the move to imposed transparency on the parameters of ranking on large intermediary platforms offering a market place for business users.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The EU legal regime on consumer and business protection relies on the principle of transparency.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The EU Regulation (EU) 2019/1150 of the European Parliament and of the Council <a href=\"#_ftn23\">[23]</a>&nbsp; of 20 June 2019 on promoting fairness and transparency for business users of online intermediation services and its guidelines <a href=\"#_ftn24\">[24]</a> are supposed to impose the obligation on a platform like Google or Amazon&nbsp; for example, to inform the businesses on the factors they use to rank their users:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<strong>Ranking</strong>&nbsp; (…) can essentially be thought of as a form of <strong>data-driven, algorithmic decision-making.</strong> When providers present, organise or communicate information on goods or services for consumers or search results, they ‘rank’ results on the basis of certain parameters.”</p><p>“Providers design their ranking methods, including proprietary algorithms, in different ways. <strong>These approaches to ranking are frequently adapted and in general not disclosed</strong>. From the consumers’ perspective, the quality of search results may differentiate services and, therefore, the detailed functioning of ranking methods may be a provider’s competitive edge or trade secret (…) “ <a href=\"#_ftn25\">[25]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ Why not impose the right of the persons, at the source of all the data exchanged for digital advertising purpose, to <strong>access the parameters&nbsp; used by the data <s>hoarders</s>…brokers and traders to classify them and to “feed“ them with what they are supposed to buy.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One should be allowed as well to correct or object the information inferred from one’s data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>THE LEGAL BASIS TO COLLECT PERSONAL DATA IN THE CONTEXT OF TARGETED ADVERTISING IS MAINLY CONSENT OF THE DATA SUBJECT.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the recent proposal for <strong>Guidelines on the targeting of social media users</strong> <a href=\"#_ftn26\">[26]</a>, the EDPD recalls that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“it would be difficult for controllers to justify using legitimate interests as a legal basis for intrusive profiling and tracking practices for marketing or advertising purposes, <strong>for example those that involve tracking individuals across multiple websites, locations, devices, services or data-brokering”</strong></p><p>“Even if the processing of personal data is based on consent of the data subject, this would not legitimize targeting which is disproportionate or unfair.“</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The GDPR is not the only legal regime imposed on the AdTech activities in the EU,&nbsp; at the moment the e-privacy Directive <a href=\"#_ftn27\">[27]</a> &nbsp;applies if cookies or any other tracking process like gif, pixels, plug in… are placed on the user’s electronic device.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They can mostly be placed on the users’ devices only with their consent (art 5-1) in case</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>of :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user” <a href=\"#_ftn28\">[28]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A <strong>new E-Privacy regulation</strong> was due to be adopted at the same time as the GDPR but, at of the time of writing, it seems to be constantly pushed back especially on the problem of the legal basis on which data could be processed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The original text mentioned only GDPR like consent to collect data but the data industry is pushing for the legitimate interest basis <a href=\"#_ftn29\">[29]</a>, a much more vague and difficult to interpret in practice legal basis. So far, the data protection authorities have not strictly checked on the effective use of this basis in the AdTech industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When one sees the size and the interests of the companies with a business model based on the exchange of data, the economic stakes are very high.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There is a clear blockade against a GDPR-like consent to collect data through electronic transmission from natural persons, including all data from the Internet of Things (IOT), a huge market for data <s>hoarders</s>… intermediaries and platforms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>WILL THE NEW PROPOSED ADTECH SYSTEMS EVER PROTECT THE PERSONS’ PRIVACY ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTEXTUAL TARGETING</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To evade the strict consent requirement of the GDPR and from the future E-privacy regulation, the AdTech industry is restructuring its offer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some researchers are positive that one can find a respectful way to collect and infer information on persons to sell them personalised advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>For an extensive study of alternative model of AdTech systems</strong>, I recommend reading for example the interesting study from the Electronic Frontier Foundation, “<em>To track or not to track? Towards privacy-friendly and sustainable online advertising</em>“ <a href=\"#_ftn30\">[30]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It seems that the return to contextual targeting would be “<em>an actual win-win for all groups who should benefit from online advertising: users, publishers and advertisers.</em>“ <a href=\"#_ftn31\">[31]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ However I am not sure that the data intermediaries and platforms &nbsp;will let go their power that easily and will not fight like it is happening for the E-Privacy Regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I am a bit less enthusiastic on contextual tracking being outside the GDPR material application.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The contextual ad targeting needs often location data that are personal data under GDPR and e-privacy directive (and the future E-privacy Regulation)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What we look at during our browsing says a lot on us, with so many personal data already collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I do not see any of the big player giving up a chance to cross all the information on individuals but in an even more proprietary way. (hence the term “<em>walled garden</em>“ used in advertising : “<em>A Walled Garden is a closed ecosystem in which all the operations are controlled by the ecosystem operator. </em><a href=\"#_ftn32\">[32]</a> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Google Display Network</strong> uses this system<a href=\"#_ftn33\">[33]</a> but I do not think that this is not tracking submitted to GDPR consent when I read this in Google’s information :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“While the Search Network can reach people when they\'re already searching for specific good or services, <strong>the Display Network can help you capture someone\'s attention earlier in the buying cycle.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can put your ads in front of people before they start searching for what you offer, which can be key for your overall advertising strategy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>You can also remind people of what they\'re interested in,</strong> as in the case of remarketing to people who\'ve previously visited your site or app.“</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is still tracking from an electronic communication and it still concerns tastes , interests of persons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I do not see why it would not be classified as personal data under GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lot of personal information can be inferred from this scheme and what about the collection of IP addresses, location, navigaton type?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“A user is less likely <strong>to feel they’re being followed</strong> around by an advertisement if it is related to the content they’re consuming at the moment. <strong>Even if the ad is following the user around</strong>, it’s much less evident when it fits contextually.“ <a href=\"#_ftn34\">[34]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>➡️ What ? I call this a dark pattern, a deception towards the users.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Old habits are hard to change…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The publishers’ responsibility is heightened since they are the one setting the parameters like topics or keywords.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Contextual advertising eradicates the risk of discrimination and manipulation through data. <strong>This doesn’t mean that the content of the ad itself cannot be unfair or discriminatory.</strong> However, the fact that such ads are visible at a specific subpage regardless of who visits it, means that <strong>it should be easier</strong> for publishers to monitor them and <strong>for users to report them</strong>.“ <a href=\"#_ftn35\">[35]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ I doubt it</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TO CONCLUDE</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The AdTech environment will change but there is doubts that the changes will not profit the already installed, and very powerful on holding proprietary personal data, intermediaries and platforms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Where is the persons’ power to influence or to check the data collected on them ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Apart from a real informed consent, to which the advertising industry is resisting, I do not see any of those systems not resulting to tracking again and again the persons in stealth mode.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The future of the EU data policy is being decided at the moment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The Data Governance Act</strong> <a href=\"#_ftn36\">[36]</a> (to which data intermediaries for AdTech are excluded)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>introduces a <strong>Data Altruism Consent Form</strong> <a href=\"#_ftn37\">[37]</a> that the Commission should edit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It will be interesting to see how this unified consent form (for personal data and non-personal data) will articulate&nbsp; with the consent required under GDPR and the e-privacy consent for personal data processing .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:separator -->\n<hr class=\"wp-block-separator\"/>\n<!-- /wp:separator -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref1\">[1]</a> Art 7: Everyone has the right to respect for his or her private and family life, home and communications&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:12012P/TXT&amp;from=EN\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:12012P/TXT&amp;from=EN</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref2\">[2]</a> The ultimate guide to programmatic advertising .Bannerflow, accessed dec.8, 2020. <a href=\"https://www.bannerflow.com/inspiration/ultimate-guides/programmatic-advertising/\">https://www.bannerflow.com/inspiration/ultimate-guides/programmatic-advertising/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref3\">[3]</a> Transparency &amp; Consent Framework (TCF) v 2.0 ,&nbsp; IAB Europe, <a href=\"https://iabeurope.eu/transparency-consent-framework/\">https://iabeurope.eu/transparency-consent-framework/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref4\">[4]</a> Célestin Matte, Cristiana Santos, Nataliia Bielova. 7 mai 2020- Purposes in IAB Europe’s TCF: which legal basis and how are they used by advertisers?. APF 2020 - Annual Privacy Forum, Oct 2020, Lisbon, Portugal.pp.1-24. hal-02566891</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref5\">[5]</a> “Discover the advertising web with the !les Ads.txt and Sellers.json“ Benjamin Poilvé, Oct.2, 2020. LINC- CNIL&nbsp; <a href=\"https://linc.cnil.fr/fr/discover-advertising-web-files-adstxt-and-sellersjson\">https://linc.cnil.fr/fr/discover-advertising-web-files-adstxt-and-sellersjson</a>&nbsp;&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref6\">[6]</a> “US Programmatic Ad Spending Forecast 2019” Lauren Fisher – eMarketer Insider Intelligence - April 25, 2019 - <a href=\"https://www.emarketer.com/content/us-programmatic-ad-spending-forecast-2019#page-report\">https://www.emarketer.com/content/us-programmatic-ad-spending-forecast-2019#page-report</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref7\">[7]</a> “What is Programmatic Advertising?“- Moran Brayer- Feb.3, 2020- blog Outbrain <a href=\"https://www.outbrain.com/blog/programmatic-advertising/\">https://www.outbrain.com/blog/programmatic-advertising/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref8\">[8]</a> Your guide to Google Ads – accessed Dec.9, 2020- &nbsp;<a href=\"https://support.google.com/google-ads/answer/6146252?hl=en&amp;ref_topic=3119071,3181080,3126923,&amp;visit_id=637431033948351524-3931166758&amp;rd=1\">https://support.google.com/google-ads/answer/6146252?hl=en&amp;ref_topic=3119071,3181080,3126923,&amp;visit_id=637431033948351524-3931166758&amp;rd=1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref9\">[9]</a> &nbsp;“ Find Your Audience Reach your most valuable customers on the world\'s largest native network.” Outbrain – accessed Dec.8, 2020 - <a href=\"https://www.outbrain.com/advertisers/targeting/\">https://www.outbrain.com/advertisers/targeting/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref10\">[10]</a> Criteo website accessed dec.8, 2020 <a href=\"https://www.criteo.com/products/criteo-audience-match/\">https://www.criteo.com/products/criteo-audience-match/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref11\">[11]</a> <em>Ibid. </em>“What are the methods used by Criteo to associate identifiers? “ <a href=\"https://www.criteo.com/privacy/how-criteo-services-work-across-environments/\">https://www.criteo.com/privacy/how-criteo-services-work-across-environments/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref12\">[12]</a> “The ePrivacy saga: the false choice between privacy and funding online publishing“, Karolina Iwańska, dec.7, 2020, Euractiv. <a href=\"https://www.euractiv.com/section/data-protection/opinion/the-eprivacy-saga-the-false-choice-between-privacy-and-funding-online-publishing/\">https://www.euractiv.com/section/data-protection/opinion/the-eprivacy-saga-the-false-choice-between-privacy-and-funding-online-publishing/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref13\">[13]</a>&nbsp; “Google is now blocking the ads publishers sell if they don’t meet Google’s standards “ Joshua Benton- NiemanLab - Dec.7, 2020 - <a href=\"https://www.niemanlab.org/2020/12/google-is-now-blocking-the-ads-publishers-sell-if-they-dont-meet-googles-standards/\">https://www.niemanlab.org/2020/12/google-is-now-blocking-the-ads-publishers-sell-if-they-dont-meet-googles-standards/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref14\">[14]</a> “Ad Tech and Privacy Lingo for Navigating a Post-Cookie World” Ronan Shields, Adweek, dec.8, 2020.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.adweek.com/programmatic/ad-tech-and-privacy-lingo-for-navigating-a-post-cookie-world/\">https://www.adweek.com/programmatic/ad-tech-and-privacy-lingo-for-navigating-a-post-cookie-world/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref15\">[15]</a> DIRECTIVE 2002/58/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref16\">[16]</a> REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref17\">[17]</a> Délibération SAN-2020-013 du 7 décembre 2020, CNIL , Délibération de la formation restreinte no SAN-2020-013 du 7 décembre 2020 concernant la société AMAZON EUROPE CORE- <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729\">https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Délibération SAN-2020-012 du 7 décembre 2020, CNIL, Délibération de la formation restreinte no SAN-2020-012 du 7 décembre 2020 concernant les sociétés GOOGLE LLC et GOOGLE IRELAND LIMITED- <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref18\">[18]</a> <em>Ibid. délibération GOOGLE</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref19\">[19]</a> Loi n° 78-17 du 6 janvier 1978 relative à l\'informatique, aux fichiers et aux libertés, mise à jour le 01 janvier 2020, <a href=\"https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460/2020-12-10/\">https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460/2020-12-10/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref20\">[20]</a> See table 6 p 100 of this paper for a description of the requirements “Are cookie banners indeed compliant with the law? Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners“&nbsp; Cristiana Santos, Nataliia Bielova and Célestin Matte, Technology and Regulation, 1-12- 2020&nbsp; <a href=\"https://techreg.org/index.php/techreg/article/view/43\">https://techreg.org/index.php/techreg/article/view/43</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref21\">[21]</a> “Update report into adtech and real time bidding“&nbsp; ICO -&nbsp; 20 Jun 2019 - underlining by the author - <a href=\"https://ico.org.uk/media/about-the-ico/documents/2615156/adtech-real-time-bidding-report-201906.pdf\">https://ico.org.uk/media/about-the-ico/documents/2615156/adtech-real-time-bidding-report-201906.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref22\">[22]</a> “To track or not to track? Towards privacy-friendly and sustainable online advertising“ - Karolina Iwańska</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Panoptykon Foundation- November 25,&nbsp; 2020- <a href=\"https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf\">https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref23\">[23]</a> <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32019R1150&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32019R1150&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref24\">[24]</a>&nbsp; European Commission- “ Guidelines on ranking transparency pursuant to Regulation (EU) 2019/1150 of the European Parliament and of the Council“&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020XC1208(01)&amp;from=EN\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020XC1208(01)&amp;from=EN</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref25\">[25]</a> &nbsp;<em>Ibid. </em>§13</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref26\">[26]</a> Guidelines 8/2020 on the targeting of social media users Version 1.0 - Adopted on 2 September 2020 for public consultation <a href=\"https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_202008_onthetargetingofsocialmediausers_en.pdf\">https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_202008_onthetargetingofsocialmediausers_en.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref27\">[27]</a> DIRECTIVE 2002/58/EC, <em>op.cit. </em>note 15</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref28\">[28]</a> <em>Ibid. </em>art 5-3</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref29\">[29]</a> Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, ARTICLE 29 DATA PROTECTION WORKING PARTY. Adopted on 9 April 2014&nbsp;&nbsp; &nbsp;<a href=\"https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf\">https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref30\">[30]</a> “To track or not to track? Towards privacy-friendly and sustainable online advertising“ - Karolina Iwańska</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Panoptykon Foundation- November 25,&nbsp; 2020- <a href=\"https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf\">https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref31\">[31]</a> <em>Ibid. </em>page 32</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref32\">[32]</a>&nbsp; “What is a Walled Garden? And why it is the strategy of Google, Facebook and Amazon Ads platform?“ Pierre de Poulpiquet .Medium,&nbsp; Nov.3, 2017&nbsp; <a href=\"https://medium.com/mediarithmics-what-is/what-is-a-walled-garden-and-why-it-is-the-strategy-of-google-facebook-and-amazon-ads-platform-296ddeb784b1\">https://medium.com/mediarithmics-what-is/what-is-a-walled-garden-and-why-it-is-the-strategy-of-google-facebook-and-amazon-ads-platform-296ddeb784b1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref33\">[33]</a> Google Display Network <a href=\"https://support.google.com/google-ads/answer/2404186\">https://support.google.com/google-ads/answer/2404186</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref34\">[34]</a> “Contextual Advertising 101: How it Works, Benefits &amp; Why It’s Necessary for Relevant Ads“ ted Vrountas- Instapage blog - March 18, 2020 - <a href=\"https://instapage.com/blog/contextual-advertising\">https://instapage.com/blog/contextual-advertising</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref35\">[35]</a> <em>Ibid.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref36\">[36]</a> Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on European data governance (Data Governance Act), 25 November 2020 <a href=\"https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=71222\">https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=71222</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref37\">[37]</a> <em>Ibid. </em>Art 22</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Marie-Claire PEROUX is a French jurist specialised in EU Law. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"I have always been passionate about privacy protection.<br>I help SMEs to understand and comply with GDPR and the EU privacy protection regime.<br>I publish a blog to inform entrepreneurs, MementoSafe,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://mementosafe.com/\" target=\"_blank\">https://mementosafe.com/</a> \"</p>\n<!-- /wp:paragraph -->','Death of 3rd Party Cookies : Is Privacy Protection Possible For The  Future AdTech In The EU ?','','inherit','closed','closed','','1964-revision-v1','','','2020-12-10 16:44:48','2020-12-10 16:44:48','',1964,'https://www.datarainbow.eu/1964-revision-v1/',0,'revision','',0),(1974,2,'2020-12-10 16:47:42','2020-12-10 16:47:42','<!-- wp:paragraph -->\n<p>Let’s talk about the future of the pervasive and privacy intrusive tracking from the AdTech industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Will a new system really better protect the right to privacy in the EU?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First, one should not forget that <strong>privacy in the EU is a fundamental human right</strong> protected by the Charter of Fundamental Rights of the&nbsp;European Union <a href=\"#_ftn1\">[1]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The AdTech industry has become a monster controlled by very large, and most of the time unknown to the general public, actors, advertising&nbsp;intermediaries and brokers, exchanging personal data on real time bidding platforms. The deals are made only in a fraction of seconds on these data&nbsp; exchanges.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<strong>So what is programmatic advertising?</strong></p><p>In its simplest form, programmatic advertising is the automated transaction of buying and selling advertising online.</p><p>It’s the process of using different platforms to sell inventory on publishing sites and on the advertising side, buying inventory and place ads on a publishers site. This is also sometimes referred to as programmatic marketing.“ <a href=\"#_ftn2\">[2]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>How much an “a<em>verage</em>” user of a website knows about&nbsp;it when presented with complex and obscure consent panels from the Transparency and Control Framework developed by the IAB Europe <a href=\"#_ftn3\">[3]</a> ? Most certainly nothing .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For more information on the new proposed <strong>IAB Europe TCF scheme</strong> under GDPR, read this study : “<em>Purposes in IAB Europe’s TCF: which legal basis and how are they used by advertisers?</em>“&nbsp; <a href=\"#_ftn4\">[4]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To say the least, this scheme is not GDPR compliant in the sense that it does not provide the persons with a clear and comprehensible information to what and why they agree.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The presentation of legal basis of the processing is very confusing, it sometimes alternates between the legitimate interest and consent&nbsp;without making any sense.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>SIZE&nbsp; OF THE ADTECH MARKET</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>An example from a French CNIL study &nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“ By automatically collecting this public data, the LINC has put a study online for each of these standards to understand how this ecosystem is structured, <strong>based on the 5,000 most visited French sites</strong> (Alexa ranking).</p><p>These studies reveal an <strong>ecosystem of around 620 advertising systems and more than 6,000 intermediaries selling advertising inventory</strong>, an ecosystem characterised by a high level of intermediation, thus multiplying the number of players with access to Internet users\' data.“<a href=\"#_ftn5\">[5]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Projection on the market size in the USA</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2021: 87.5 % of the <strong>entire digital ad market of&nbsp; $81 billion</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2019 &nbsp;“<em>Automation will account for $59.45 billion in ad dollars this year, or 84.9% of the US digital display ad market. Of that, two-thirds of those automated dollars will go to mobile. Nearly one of every two ad dollars goes to video.</em>” <a href=\"#_ftn6\">[6]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1966,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Picture-1.png\" alt=\"\" class=\"wp-image-1966\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>From Outbrain Blog <a href=\"#_ftn7\">[7]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The automated selling of private information was developed in the USA in 2009 and since then, it has become a monster serving its own purpose more than the ones of the online publishers, one of the source of personal data collected from users, and of the persons who get served “personalised” ads that do not always help them to better consume .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example: persons that have been classified as in low earnings get presented offers of loans to further push them in debt.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>HOW ARE WE CLASSIFIED BY THE ADTECH INDUSTRY ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On obscure proprietary algorithms, AI&nbsp; and criteria. I could not find a description of any of those.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The only indication of the extremely detailed information collected on individuals could be found for example in the Google Ad offer. Visiting the Google Ad support platform <a href=\"#_ftn8\">[8]</a> shows the very detailed targeting offered to its clients.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some AdTech actors claim that they have already switched to some sort of contextual targeting:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“ <strong>Interest Targeting</strong>: Target your audience based on their real interests, because our profiles are based on actual content consumption, not search or social sharing.“ <a href=\"#_ftn9\">[9]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>One of the largest payer in the AdTech is Outbrain, it advertises on its website “<em>Reaching 1.5B+ users each month requires the right targeting solutions</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A WIDE SOURCE OF INFORMATION FOR DATA BROKERS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Use Criteo Shopper Graph to find your customers online. <strong>Over 10,000 websites worldwide continuously share their data with us,</strong> allowing you to accurately target your shoppers across their devices.“ <a href=\"#_ftn10\">[10]</a></p><p>“We may associate Criteo identifiers on the basis of:</p><p>- <strong>our own association methods</strong> based on the data we already collect <strong>through our technologies</strong>;</p><p>- the data that may be transmitted to us by an Advertiser or Publisher in an optional and pseudonymised manner, such as your CRM identifiers and/or email addresses in hash and/or encrypted form;</p><p>- the <strong>associations that</strong> <strong>partners can send us</strong>, which they <strong>have obtained by using various methods </strong>that offer the same level of guarantee as ours in terms of respect for your privacy.“ <a href=\"#_ftn11\">[11]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ Where is my personal data in this maze? How could I possibly control what has been inferred on me, rightly or wrongly ? Do they control the legal basis of data obtained from partners ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>WHAT POWERS DO HAVE SMALLER PUBLISHER FACING THE ADTECH &nbsp;BEHEMOTHS ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The current targeted advertising system hardly profits to the main users, the publishers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“publishers are forced to participate in the uneven race for clicks and attention, <strong>sacrificing their readers’ privacy </strong>and – increasingly – the quality of the content they produce, only to hand as much as 70% of profits over to advertising middlemen at the end of the day.</p><p>Instead of the promise of thriving online publishing, the ad tech industry made publishers fight a war for survival.” <a href=\"#_ftn12\">[12]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The source of the personal data collected and inferred will rapidly change after Google announced <strong>the end of 3<sup>rd</sup> party cookies,</strong> tracking the users on websites most of the time without their informed knowledge.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ However, I do not believe any of the new systems will provide a better control to the users on their privacy .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Google remains all powerful in the advertising business</strong> <a href=\"#_ftn13\">[13]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“The next 12 months will see the industry prepare for Google Chrome withdrawing its support of third-party cookies, bringing it in line with the industry’s other leading web browsers.</p><p><strong>Marketers will still be able to target audiences using first-party data,</strong> for instance, by serving ads in walled gardens such as Facebook or logged-in users on a publisher’s website.“</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>(…) “ what appears apparent is that 1:1 targeting using third-party data is soon to be a thing of the past.</p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>Per Google’s documentation released thus far, <strong>contextual ads will soon be targeted using more nuanced means that target users based on cohorts</strong> “ <a href=\"#_ftn14\">[14]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is basically a return to the way advertising was done before the RTB craze.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the meantime, large data intermediary companies are sitting on a huge amount of information collected on us through &nbsp;quite shady means, dark patterns are common in the collection of consent from websites.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The national Data Protection Authorities have been slow or inexistant up until recently &nbsp;in defending the users rights under the E-Privacy directive. <a href=\"#_ftn15\">[15]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The scattered and sometimes lax enforcement&nbsp; of the directive in the EU has certainly favoured the collection of consent to behavioural tracking on a large scale in the EU, at least until the GDPR went into application in 2018. <a href=\"#_ftn16\">[16]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2</strong> <strong>RECENT GROUNDBREAKING DECISIONS FROM THE FRENCH CNIL<a href=\"#_ftn17\"><strong>[17]</strong></a></strong> &nbsp;<strong>MIGHT SEND A DIFFERENT MESSAGE TO THE ADTECH INDUSTRY</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google and Amazon did not wait for the consent of the users, based in France, to attach ad cookies to their electronic device.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Contextual advertising is&nbsp; concerned as well by the E-Directive when it uses location data for example (see § 129 to §131 of the decision on Google <a href=\"#_ftn18\">[18]</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Moreover, the information given to the users based in France was not conform to the requirements of the French law implementing the E-Privacy directive <a href=\"#_ftn19\">[19]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent to tracking is&nbsp; (should ) now be more difficult to obtain but there is still a lot of confusion on the side of publishers in the EU.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A study on e-privacy/ GDPR compliant way <strong>to obtain valid consent from users on websites</strong> points to <strong>22 legal requirements</strong> <a href=\"#_ftn20\">[20]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the ICO, the&nbsp; UK Data Protection Authority, underlined:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“identifying a lawful basis for the processing of personal data in RTB remains challenging, as the scenarios where legitimate interests could apply are limited, and <strong>methods of obtaining consent are often insufficient </strong>in respect of data protection law requirements;</p><p>- the privacy notices provided to individuals lack clarity and do not give them full visibility of what happens to their data;</p><p>- the scale of <strong>the creation and sharing of personal data profiles in RTB appears disproportionate, intrusive and unfair, particularly when in many cases data subjects are unaware that this processing is taking place</strong>; “ <a href=\"#_ftn21\">[21]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>LACK OF TRANSPARENCY IN THE CLASSIFICATION OF THE NATURAL PERSONS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One is amazed by the <strong>number of persona</strong> one can get included in.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The persons have no way to control or correct these classification made by proprietary machine learning and AI.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We do not know what these large data intermediary companies think they know about us and what they are selling about us.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Google and IAB’s RTB systems have in fact been constructed <strong>in a way that makes it impossible to control data once it is shared on the ad exchange </strong>– neither by the publisher who shared it, much less by the user. This is a data breach that affects basically everyone that has ever used the Internet. The violations of other GDPR principles stem from this feature inherent to real-time bidding systems.“ <a href=\"#_ftn22\">[22]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>This is unacceptable and contrary to every principle of transparency supposed to protect us from privacy invasion.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TRANSPARECY MUCH NEEDED</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One could make a parallel with the move to imposed transparency on the parameters of ranking on large intermediary platforms offering a market place for business users.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The EU legal regime on consumer and business protection relies on the principle of transparency.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The EU Regulation (EU) 2019/1150 of the European Parliament and of the Council <a href=\"#_ftn23\">[23]</a>&nbsp; of 20 June 2019 on promoting fairness and transparency for business users of online intermediation services and its guidelines <a href=\"#_ftn24\">[24]</a> are supposed to impose the obligation on a platform like Google or Amazon&nbsp; for example, to inform the businesses on the factors they use to rank their users:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“<strong>Ranking</strong>&nbsp; (…) can essentially be thought of as a form of <strong>data-driven, algorithmic decision-making.</strong> When providers present, organise or communicate information on goods or services for consumers or search results, they ‘rank’ results on the basis of certain parameters.”</p><p>“Providers design their ranking methods, including proprietary algorithms, in different ways. <strong>These approaches to ranking are frequently adapted and in general not disclosed</strong>. From the consumers’ perspective, the quality of search results may differentiate services and, therefore, the detailed functioning of ranking methods may be a provider’s competitive edge or trade secret (…) “ <a href=\"#_ftn25\">[25]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ Why not impose the right of the persons, at the source of all the data exchanged for digital advertising purpose, to <strong>access the parameters&nbsp; used by the data <s>hoarders</s>…brokers and traders to classify them and to “feed“ them with what they are supposed to buy.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One should be allowed as well to correct or object the information inferred from one’s data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>THE LEGAL BASIS TO COLLECT PERSONAL DATA IN THE CONTEXT OF TARGETED ADVERTISING IS MAINLY CONSENT OF THE DATA SUBJECT.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the recent proposal for <strong>Guidelines on the targeting of social media users</strong> <a href=\"#_ftn26\">[26]</a>, the EDPD recalls that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“it would be difficult for controllers to justify using legitimate interests as a legal basis for intrusive profiling and tracking practices for marketing or advertising purposes, <strong>for example those that involve tracking individuals across multiple websites, locations, devices, services or data-brokering”</strong></p><p>“Even if the processing of personal data is based on consent of the data subject, this would not legitimize targeting which is disproportionate or unfair.“</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The GDPR is not the only legal regime imposed on the AdTech activities in the EU,&nbsp; at the moment the e-privacy Directive <a href=\"#_ftn27\">[27]</a> &nbsp;applies if cookies or any other tracking process like gif, pixels, plug in… are placed on the user’s electronic device.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They can mostly be placed on the users’ devices only with their consent (art 5-1) in case</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>of :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user” <a href=\"#_ftn28\">[28]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>A <strong>new E-Privacy regulation</strong> was due to be adopted at the same time as the GDPR but, at of the time of writing, it seems to be constantly pushed back especially on the problem of the legal basis on which data could be processed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The original text mentioned only GDPR like consent to collect data but the data industry is pushing for the legitimate interest basis <a href=\"#_ftn29\">[29]</a>, a much more vague and difficult to interpret in practice legal basis. So far, the data protection authorities have not strictly checked on the effective use of this basis in the AdTech industry.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When one sees the size and the interests of the companies with a business model based on the exchange of data, the economic stakes are very high.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There is a clear blockade against a GDPR-like consent to collect data through electronic transmission from natural persons, including all data from the Internet of Things (IOT), a huge market for data <s>hoarders</s>… intermediaries and platforms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>WILL THE NEW PROPOSED ADTECH SYSTEMS EVER PROTECT THE PERSONS’ PRIVACY ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTEXTUAL TARGETING</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To evade the strict consent requirement of the GDPR and from the future E-privacy regulation, the AdTech industry is restructuring its offer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some researchers are positive that one can find a respectful way to collect and infer information on persons to sell them personalised advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>For an extensive study of alternative model of AdTech systems</strong>, I recommend reading for example the interesting study from the Electronic Frontier Foundation, “<em>To track or not to track? Towards privacy-friendly and sustainable online advertising</em>“ <a href=\"#_ftn30\">[30]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It seems that the return to contextual targeting would be “<em>an actual win-win for all groups who should benefit from online advertising: users, publishers and advertisers.</em>“ <a href=\"#_ftn31\">[31]</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ However I am not sure that the data intermediaries and platforms &nbsp;will let go their power that easily and will not fight like it is happening for the E-Privacy Regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I am a bit less enthusiastic on contextual tracking being outside the GDPR material application.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The contextual ad targeting needs often location data that are personal data under GDPR and e-privacy directive (and the future E-privacy Regulation)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What we look at during our browsing says a lot on us, with so many personal data already collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I do not see any of the big player giving up a chance to cross all the information on individuals but in an even more proprietary way. (hence the term “<em>walled garden</em>“ used in advertising : “<em>A Walled Garden is a closed ecosystem in which all the operations are controlled by the ecosystem operator. </em><a href=\"#_ftn32\">[32]</a> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Google Display Network</strong> uses this system<a href=\"#_ftn33\">[33]</a> but I do not think that this is not tracking submitted to GDPR consent when I read this in Google’s information :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“While the Search Network can reach people when they\'re already searching for specific good or services, <strong>the Display Network can help you capture someone\'s attention earlier in the buying cycle.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can put your ads in front of people before they start searching for what you offer, which can be key for your overall advertising strategy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>You can also remind people of what they\'re interested in,</strong> as in the case of remarketing to people who\'ve previously visited your site or app.“</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is still tracking from an electronic communication and it still concerns tastes , interests of persons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➡️ I do not see why it would not be classified as personal data under GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lot of personal information can be inferred from this scheme and what about the collection of IP addresses, location, navigaton type?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“A user is less likely <strong>to feel they’re being followed</strong> around by an advertisement if it is related to the content they’re consuming at the moment. <strong>Even if the ad is following the user around</strong>, it’s much less evident when it fits contextually.“ <a href=\"#_ftn34\">[34]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>➡️ What ? I call this a dark pattern, a deception towards the users.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Old habits are hard to change…</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The publishers’ responsibility is heightened since they are the one setting the parameters like topics or keywords.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Contextual advertising eradicates the risk of discrimination and manipulation through data. <strong>This doesn’t mean that the content of the ad itself cannot be unfair or discriminatory.</strong> However, the fact that such ads are visible at a specific subpage regardless of who visits it, means that <strong>it should be easier</strong> for publishers to monitor them and <strong>for users to report them</strong>.“ <a href=\"#_ftn35\">[35]</a></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>➡️ I doubt it</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>TO CONCLUDE</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The AdTech environment will change but there is doubts that the changes will not profit the already installed, and very powerful on holding proprietary personal data, intermediaries and platforms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Where is the persons’ power to influence or to check the data collected on them ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Apart from a real informed consent, to which the advertising industry is resisting, I do not see any of those systems not resulting to tracking again and again the persons in stealth mode.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The future of the EU data policy is being decided at the moment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The Data Governance Act</strong> <a href=\"#_ftn36\">[36]</a> (to which data intermediaries for AdTech are excluded)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>introduces a <strong>Data Altruism Consent Form</strong> <a href=\"#_ftn37\">[37]</a> that the Commission should edit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It will be interesting to see how this unified consent form (for personal data and non-personal data) will articulate&nbsp; with the consent required under GDPR and the e-privacy consent for personal data processing .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:separator -->\n<hr class=\"wp-block-separator\"/>\n<!-- /wp:separator -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref1\">[1]</a> Art 7: Everyone has the right to respect for his or her private and family life, home and communications&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:12012P/TXT&amp;from=EN\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:12012P/TXT&amp;from=EN</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref2\">[2]</a> The ultimate guide to programmatic advertising .Bannerflow, accessed dec.8, 2020. <a href=\"https://www.bannerflow.com/inspiration/ultimate-guides/programmatic-advertising/\">https://www.bannerflow.com/inspiration/ultimate-guides/programmatic-advertising/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref3\">[3]</a> Transparency &amp; Consent Framework (TCF) v 2.0 ,&nbsp; IAB Europe, <a href=\"https://iabeurope.eu/transparency-consent-framework/\">https://iabeurope.eu/transparency-consent-framework/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref4\">[4]</a> Célestin Matte, Cristiana Santos, Nataliia Bielova. 7 mai 2020- Purposes in IAB Europe’s TCF: which legal basis and how are they used by advertisers?. APF 2020 - Annual Privacy Forum, Oct 2020, Lisbon, Portugal.pp.1-24. hal-02566891</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref5\">[5]</a> “Discover the advertising web with the !les Ads.txt and Sellers.json“ Benjamin Poilvé, Oct.2, 2020. LINC- CNIL&nbsp; <a href=\"https://linc.cnil.fr/fr/discover-advertising-web-files-adstxt-and-sellersjson\">https://linc.cnil.fr/fr/discover-advertising-web-files-adstxt-and-sellersjson</a>&nbsp;&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref6\">[6]</a> “US Programmatic Ad Spending Forecast 2019” Lauren Fisher – eMarketer Insider Intelligence - April 25, 2019 - <a href=\"https://www.emarketer.com/content/us-programmatic-ad-spending-forecast-2019#page-report\">https://www.emarketer.com/content/us-programmatic-ad-spending-forecast-2019#page-report</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref7\">[7]</a> “What is Programmatic Advertising?“- Moran Brayer- Feb.3, 2020- blog Outbrain <a href=\"https://www.outbrain.com/blog/programmatic-advertising/\">https://www.outbrain.com/blog/programmatic-advertising/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref8\">[8]</a> Your guide to Google Ads – accessed Dec.9, 2020- &nbsp;<a href=\"https://support.google.com/google-ads/answer/6146252?hl=en&amp;ref_topic=3119071,3181080,3126923,&amp;visit_id=637431033948351524-3931166758&amp;rd=1\">https://support.google.com/google-ads/answer/6146252?hl=en&amp;ref_topic=3119071,3181080,3126923,&amp;visit_id=637431033948351524-3931166758&amp;rd=1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref9\">[9]</a> &nbsp;“ Find Your Audience Reach your most valuable customers on the world\'s largest native network.” Outbrain – accessed Dec.8, 2020 - <a href=\"https://www.outbrain.com/advertisers/targeting/\">https://www.outbrain.com/advertisers/targeting/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref10\">[10]</a> Criteo website accessed dec.8, 2020 <a href=\"https://www.criteo.com/products/criteo-audience-match/\">https://www.criteo.com/products/criteo-audience-match/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref11\">[11]</a> <em>Ibid. </em>“What are the methods used by Criteo to associate identifiers? “ <a href=\"https://www.criteo.com/privacy/how-criteo-services-work-across-environments/\">https://www.criteo.com/privacy/how-criteo-services-work-across-environments/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref12\">[12]</a> “The ePrivacy saga: the false choice between privacy and funding online publishing“, Karolina Iwańska, dec.7, 2020, Euractiv. <a href=\"https://www.euractiv.com/section/data-protection/opinion/the-eprivacy-saga-the-false-choice-between-privacy-and-funding-online-publishing/\">https://www.euractiv.com/section/data-protection/opinion/the-eprivacy-saga-the-false-choice-between-privacy-and-funding-online-publishing/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref13\">[13]</a>&nbsp; “Google is now blocking the ads publishers sell if they don’t meet Google’s standards “ Joshua Benton- NiemanLab - Dec.7, 2020 - <a href=\"https://www.niemanlab.org/2020/12/google-is-now-blocking-the-ads-publishers-sell-if-they-dont-meet-googles-standards/\">https://www.niemanlab.org/2020/12/google-is-now-blocking-the-ads-publishers-sell-if-they-dont-meet-googles-standards/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref14\">[14]</a> “Ad Tech and Privacy Lingo for Navigating a Post-Cookie World” Ronan Shields, Adweek, dec.8, 2020.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.adweek.com/programmatic/ad-tech-and-privacy-lingo-for-navigating-a-post-cookie-world/\">https://www.adweek.com/programmatic/ad-tech-and-privacy-lingo-for-navigating-a-post-cookie-world/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref15\">[15]</a> DIRECTIVE 2002/58/EC OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref16\">[16]</a> REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref17\">[17]</a> Délibération SAN-2020-013 du 7 décembre 2020, CNIL , Délibération de la formation restreinte no SAN-2020-013 du 7 décembre 2020 concernant la société AMAZON EUROPE CORE- <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729\">https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635729</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Délibération SAN-2020-012 du 7 décembre 2020, CNIL, Délibération de la formation restreinte no SAN-2020-012 du 7 décembre 2020 concernant les sociétés GOOGLE LLC et GOOGLE IRELAND LIMITED- <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref18\">[18]</a> <em>Ibid. délibération GOOGLE</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref19\">[19]</a> Loi n° 78-17 du 6 janvier 1978 relative à l\'informatique, aux fichiers et aux libertés, mise à jour le 01 janvier 2020, <a href=\"https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460/2020-12-10/\">https://www.legifrance.gouv.fr/loda/id/JORFTEXT000000886460/2020-12-10/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref20\">[20]</a> See table 6 p 100 of this paper for a description of the requirements “Are cookie banners indeed compliant with the law? Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners“&nbsp; Cristiana Santos, Nataliia Bielova and Célestin Matte, Technology and Regulation, 1-12- 2020&nbsp; <a href=\"https://techreg.org/index.php/techreg/article/view/43\">https://techreg.org/index.php/techreg/article/view/43</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref21\">[21]</a> “Update report into adtech and real time bidding“&nbsp; ICO -&nbsp; 20 Jun 2019 - underlining by the author - <a href=\"https://ico.org.uk/media/about-the-ico/documents/2615156/adtech-real-time-bidding-report-201906.pdf\">https://ico.org.uk/media/about-the-ico/documents/2615156/adtech-real-time-bidding-report-201906.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref22\">[22]</a> “To track or not to track? Towards privacy-friendly and sustainable online advertising“ - Karolina Iwańska</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Panoptykon Foundation- November 25,&nbsp; 2020- <a href=\"https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf\">https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref23\">[23]</a> <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32019R1150&amp;from=FR\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32019R1150&amp;from=FR</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref24\">[24]</a>&nbsp; European Commission- “ Guidelines on ranking transparency pursuant to Regulation (EU) 2019/1150 of the European Parliament and of the Council“&nbsp;&nbsp;&nbsp; <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020XC1208(01)&amp;from=EN\">https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:52020XC1208(01)&amp;from=EN</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref25\">[25]</a> &nbsp;<em>Ibid. </em>§13</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref26\">[26]</a> Guidelines 8/2020 on the targeting of social media users Version 1.0 - Adopted on 2 September 2020 for public consultation <a href=\"https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_202008_onthetargetingofsocialmediausers_en.pdf\">https://edpb.europa.eu/sites/edpb/files/consultation/edpb_guidelines_202008_onthetargetingofsocialmediausers_en.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref27\">[27]</a> DIRECTIVE 2002/58/EC, <em>op.cit. </em>note 15</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref28\">[28]</a> <em>Ibid. </em>art 5-3</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref29\">[29]</a> Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC, ARTICLE 29 DATA PROTECTION WORKING PARTY. Adopted on 9 April 2014&nbsp;&nbsp; &nbsp;<a href=\"https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf\">https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref30\">[30]</a> “To track or not to track? Towards privacy-friendly and sustainable online advertising“ - Karolina Iwańska</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Panoptykon Foundation- November 25,&nbsp; 2020- <a href=\"https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf\">https://panoptykon.org/sites/default/files/publikacje/panoptykon_to_track_or_not_to_track_final.pdf</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref31\">[31]</a> <em>Ibid. </em>page 32</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref32\">[32]</a>&nbsp; “What is a Walled Garden? And why it is the strategy of Google, Facebook and Amazon Ads platform?“ Pierre de Poulpiquet .Medium,&nbsp; Nov.3, 2017&nbsp; <a href=\"https://medium.com/mediarithmics-what-is/what-is-a-walled-garden-and-why-it-is-the-strategy-of-google-facebook-and-amazon-ads-platform-296ddeb784b1\">https://medium.com/mediarithmics-what-is/what-is-a-walled-garden-and-why-it-is-the-strategy-of-google-facebook-and-amazon-ads-platform-296ddeb784b1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref33\">[33]</a> Google Display Network <a href=\"https://support.google.com/google-ads/answer/2404186\">https://support.google.com/google-ads/answer/2404186</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref34\">[34]</a> “Contextual Advertising 101: How it Works, Benefits &amp; Why It’s Necessary for Relevant Ads“ ted Vrountas- Instapage blog - March 18, 2020 - <a href=\"https://instapage.com/blog/contextual-advertising\">https://instapage.com/blog/contextual-advertising</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref35\">[35]</a> <em>Ibid.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref36\">[36]</a> Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on European data governance (Data Governance Act), 25 November 2020 <a href=\"https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=71222\">https://ec.europa.eu/newsroom/dae/document.cfm?doc_id=71222</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"#_ftnref37\">[37]</a> <em>Ibid. </em>Art 22</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Marie-Claire PEROUX LLM is a French jurist specialised in EU Law. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\"I have always been passionate about privacy protection.<br>I help SMEs to understand and comply with GDPR and the EU privacy protection regime.<br>I publish a blog to inform entrepreneurs, MementoSafe, <a rel=\"noreferrer noopener\" href=\"https://mementosafe.com/\" target=\"_blank\">https://mementosafe.com/</a> \"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Photo kindly provided by Marie-claire PEROUX ©</p>\n<!-- /wp:paragraph -->','Death of 3rd Party Cookies : Is Privacy Protection Possible For The  Future AdTech In The EU ?','','inherit','closed','closed','','1964-revision-v1','','','2020-12-10 16:47:42','2020-12-10 16:47:42','',1964,'https://www.datarainbow.eu/1964-revision-v1/',0,'revision','',0),(1975,2,'2020-12-10 16:58:09','2020-12-10 16:58:09','','Screenshot-2020-12-10-at-16.56.02','','inherit','open','closed','','screenshot-2020-12-10-at-16-56-02','','','2020-12-10 16:58:09','2020-12-10 16:58:09','',1970,'https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.56.02.png',0,'attachment','image/png',0),(1976,2,'2020-12-10 17:03:05','2020-12-10 17:03:05','','Screenshot-2020-12-10-at-16.56.24','','inherit','open','closed','','screenshot-2020-12-10-at-16-56-24','','','2020-12-10 17:03:05','2020-12-10 17:03:05','',1970,'https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.56.24.png',0,'attachment','image/png',0),(1977,2,'2020-12-10 17:03:57','2020-12-10 17:03:57','','Screenshot-2020-12-10-at-16.56.34','','inherit','open','closed','','screenshot-2020-12-10-at-16-56-34','','','2020-12-10 17:03:57','2020-12-10 17:03:57','',1970,'https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.56.34.png',0,'attachment','image/png',0),(1978,2,'2020-12-10 17:05:28','2020-12-10 17:05:28','','Screenshot-2020-12-10-at-16.57.41','','inherit','open','closed','','screenshot-2020-12-10-at-16-57-41','','','2020-12-10 17:05:28','2020-12-10 17:05:28','',1970,'https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.57.41.png',0,'attachment','image/png',0),(1979,2,'2020-12-10 17:11:21','2020-12-10 17:11:21','<!-- wp:paragraph -->\n<p>In the week that the world started celebrating the news that not one but three experimental vaccines against Covid-19 have proved at least 90% effective at preventing disease in late-stage clinical trials, research into understanding how the Sars-CoV-2 virus, which causes Covid-19, interacts with the human immune system never paused.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There are plenty of questions still to answer about the Pfizer/BioNTech and Moderna vaccines and now the Oxford and AstraZeneca and how well they might protect the elderly, for example, and how long for? Which aspects of the immune response that they elicit are protective and which aren’t? Can even better results be achieved, with vaccines that target different parts of the immune system. However, one question that seems to be overlooked by the entire world whilst celebrating, is what security measures are in place to secure the research and development and to stop counterfeit copies that are not as effective or only replicate a % of the real vaccine? It certainly does not seem important for the organisations involved as the research and findings below evidence.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On 11th May 2020 Archer, the UK national supercomputing service that was collating Covid-19 research and developments, was breached reportedly by Russia and Chinese state sponsored groups stealing the IP and data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":1975,\"sizeSlug\":\"large\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.56.02.png\" alt=\"\" class=\"wp-image-1975\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br>Initially blamed for being targeted to be used for crypto currency mining, the rationale for the attack quickly became clear. $billions in research and developments in Covid-19. Archers homepage became Not Secure, unencrypted with no data integrity several weeks prior to the attack when its digital certificate was allowed to expire. Bizarrely, it remains Not Secure to this day and as a government managed supercomputer, defies all<br>rationale of security and remains a major target.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was also in the weeks leading up to the Archer breach in May that our research discovered Oxford University was maintaining a Not Secure homepage. We continuously informed Oxford University that they were maintaining sub optimal internet facing domains and a homepage that was Not Secure in the same way Archer were. This was ignored for months. Although Oxford did not report a breach at this time, it is important to note they receive £100’s of millions in grants for research and work closely with Archer, as do many of the Pharmaceutical organisations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":1976,\"sizeSlug\":\"large\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.56.24.png\" alt=\"\" class=\"wp-image-1976\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br>With the further news of the Covid-19 vaccines we started researching the other Pharmaceutical companies to ensure they were not compromised facing the internet and to our disbelief, when we researched Pfizer. Our research discovered Pfizer are also running sub optimal internet facing domains. We quickly alerted the Board of Pfizer and have yet to receive confirmation or a reply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":1977,\"sizeSlug\":\"large\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.56.34.png\" alt=\"\" class=\"wp-image-1977\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br>Our research took us onto Moderna and AstraZeneca. The same situation of negligence of security facing the internet at Moderna and AstraZeneca confirms and shows a worrying systemic security issue that makes one consider, and question the motivation to secure, what could be considered the world’s most incredible development in many generations. Yet at every single organisation, security of IP and data has absolutely no consideration or focus.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":1978,\"sizeSlug\":\"large\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.57.41.png\" alt=\"\" class=\"wp-image-1978\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br>The pharmaceutical sector is among the very highest of sectors targeted for cyber attacks and a Covid-19 vaccine may be the single largest development in modern times. So why is the research and development on vaccines open to cyber attacks and IP theft?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Andy Jenkinson</strong> is a thought provoking, challenging consummate professional and natural leader whose drive, energy and enthusiasm is not only infectious but inspirational ensuring everyone succeeds together as a group. Andy has a no nonsense attitude to security, be that internal PKI or internet facing and is renowned for his candour and straight forward approach. If you want security, you might not like what you hear, but you’ll love the results.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Andrew&nbsp;Jenkinson​|Group&nbsp;CEO</td></tr><tr><td><a rel=\"noreferrer noopener\" href=\"tel:+447894%20062867\" target=\"_blank\"><strong>+447894 062867</strong></a>|<img width=\"20\" alt=\"\" src=\"blob:https://mail.protonmail.com/d67da364-a0d7-42e0-89c6-9e07535ec26a\"><a rel=\"noreferrer noopener\" href=\"mailto:andrew.jenkinson@cybersecip.com\" target=\"_blank\"><strong>andrew.jenkinson@cybersecip.com</strong></a>|<img width=\"20\" alt=\"\" src=\"blob:https://mail.protonmail.com/8422d502-0bb1-4389-aefb-dff23909f81c\"><a rel=\"noreferrer noopener\" href=\"http://www.cybersecip.com/\" target=\"_blank\"><strong>www.cybersecip.com</strong></a><a rel=\"noreferrer noopener\" href=\"https://www.cybersecip.com/\" target=\"_blank\"></a></td></tr><tr><td></td></tr></tbody></table></figure>\n<!-- /wp:table -->','COVID 19: Security & Protection Concerns','','inherit','closed','closed','','1970-revision-v1','','','2020-12-10 17:11:21','2020-12-10 17:11:21','',1970,'https://www.datarainbow.eu/1970-revision-v1/',0,'revision','',0),(1980,2,'2020-12-10 17:11:57','2020-12-10 17:11:57','','Screenshot 2020-12-10 at 17.11.07','','inherit','open','closed','','screenshot-2020-12-10-at-17-11-07','','','2020-12-10 17:11:57','2020-12-10 17:11:57','',1970,'https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-17.11.07.png',0,'attachment','image/png',0),(1981,2,'2020-12-10 17:12:04','2020-12-10 17:12:04','<!-- wp:paragraph -->\n<p>In the week that the world started celebrating the news that not one but three experimental vaccines against Covid-19 have proved at least 90% effective at preventing disease in late-stage clinical trials, research into understanding how the Sars-CoV-2 virus, which causes Covid-19, interacts with the human immune system never paused.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There are plenty of questions still to answer about the Pfizer/BioNTech and Moderna vaccines and now the Oxford and AstraZeneca and how well they might protect the elderly, for example, and how long for? Which aspects of the immune response that they elicit are protective and which aren’t? Can even better results be achieved, with vaccines that target different parts of the immune system. However, one question that seems to be overlooked by the entire world whilst celebrating, is what security measures are in place to secure the research and development and to stop counterfeit copies that are not as effective or only replicate a % of the real vaccine? It certainly does not seem important for the organisations involved as the research and findings below evidence.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On 11th May 2020 Archer, the UK national supercomputing service that was collating Covid-19 research and developments, was breached reportedly by Russia and Chinese state sponsored groups stealing the IP and data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":1975,\"sizeSlug\":\"large\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.56.02.png\" alt=\"\" class=\"wp-image-1975\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br>Initially blamed for being targeted to be used for crypto currency mining, the rationale for the attack quickly became clear. $billions in research and developments in Covid-19. Archers homepage became Not Secure, unencrypted with no data integrity several weeks prior to the attack when its digital certificate was allowed to expire. Bizarrely, it remains Not Secure to this day and as a government managed supercomputer, defies all<br>rationale of security and remains a major target.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was also in the weeks leading up to the Archer breach in May that our research discovered Oxford University was maintaining a Not Secure homepage. We continuously informed Oxford University that they were maintaining sub optimal internet facing domains and a homepage that was Not Secure in the same way Archer were. This was ignored for months. Although Oxford did not report a breach at this time, it is important to note they receive £100’s of millions in grants for research and work closely with Archer, as do many of the Pharmaceutical organisations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":1976,\"sizeSlug\":\"large\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.56.24.png\" alt=\"\" class=\"wp-image-1976\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br>With the further news of the Covid-19 vaccines we started researching the other Pharmaceutical companies to ensure they were not compromised facing the internet and to our disbelief, when we researched Pfizer. Our research discovered Pfizer are also running sub optimal internet facing domains. We quickly alerted the Board of Pfizer and have yet to receive confirmation or a reply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":1977,\"sizeSlug\":\"large\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.56.34.png\" alt=\"\" class=\"wp-image-1977\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br>Our research took us onto Moderna and AstraZeneca. The same situation of negligence of security facing the internet at Moderna and AstraZeneca confirms and shows a worrying systemic security issue that makes one consider, and question the motivation to secure, what could be considered the world’s most incredible development in many generations. Yet at every single organisation, security of IP and data has absolutely no consideration or focus.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":1978,\"sizeSlug\":\"large\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-16.57.41.png\" alt=\"\" class=\"wp-image-1978\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><br>The pharmaceutical sector is among the very highest of sectors targeted for cyber attacks and a Covid-19 vaccine may be the single largest development in modern times. So why is the research and development on vaccines open to cyber attacks and IP theft?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Andy Jenkinson</strong> is a thought provoking, challenging consummate professional and natural leader whose drive, energy and enthusiasm is not only infectious but inspirational ensuring everyone succeeds together as a group. Andy has a no nonsense attitude to security, be that internal PKI or internet facing and is renowned for his candour and straight forward approach. If you want security, you might not like what you hear, but you’ll love the results.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Andrew&nbsp;Jenkinson​|Group&nbsp;CEO</td></tr><tr><td><a rel=\"noreferrer noopener\" href=\"tel:+447894%20062867\" target=\"_blank\"><strong>+447894&nbsp;062867</strong></a>|<img width=\"20\" alt=\"\" src=\"blob:https://mail.protonmail.com/d67da364-a0d7-42e0-89c6-9e07535ec26a\"><a rel=\"noreferrer noopener\" href=\"mailto:andrew.jenkinson@cybersecip.com\" target=\"_blank\"><strong>andrew.jenkinson@cybersecip.com</strong></a>|<img width=\"20\" alt=\"\" src=\"blob:https://mail.protonmail.com/8422d502-0bb1-4389-aefb-dff23909f81c\"><a rel=\"noreferrer noopener\" href=\"http://www.cybersecip.com/\" target=\"_blank\"><strong>www.cybersecip.com</strong></a><a rel=\"noreferrer noopener\" href=\"https://www.cybersecip.com/\" target=\"_blank\"></a></td></tr><tr><td></td></tr></tbody></table></figure>\n<!-- /wp:table -->','COVID 19: Security & Protection Concerns','','inherit','closed','closed','','1970-revision-v1','','','2020-12-10 17:12:04','2020-12-10 17:12:04','',1970,'https://www.datarainbow.eu/1970-revision-v1/',0,'revision','',0),