(2314,1,'2022-01-03 20:53:13','2022-01-03 20:53:13','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay initiated a security research using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database, stored on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: data minimisation and storage limitation. Possibly data accuracy as part of the data stored would have become inaccurate. Purpose limitation could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients about the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Its only October the 21<sup>st</sup>, 8 months after the initial notification that the CNIL enquired about their notifications data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021 the case was instructed by the ‘commission restreinte’ (restricted commission) for the infringement of articles 28-3 and 28-4, 32 and 34 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection was formulated) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was considered that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the lack of compliant data processing agreements (art 28-3 GDPR), the obligation of securing the data (Art 32 GDPR) and absence of data subject notification.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art 28-3 GDPR</strong><strong></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be comply with the requirements of article 28 GDPR in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art 28-4 <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of art 28 para 3 and 4. These contracts have include specific clauses</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In response to Slimpay argument, the CNIL logically responded that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the obligation to ensure the security of the data</strong><strong></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on article 32 GDPR, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"a\"} -->\n<ol type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argue a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimplay argued the security whole was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Not wistanding an actual damaged caused to data subjects, the lack of security is in itself a breach of article 32. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as article 82 GDPR allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be itself a breach of data as rarely data subjects can prove immediate harm after a data is compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of an employee’s negligent was not retained as in any case the company was liable to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Last week, a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accept Slimplay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considers that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of article 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the article 83 GDPR, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance in securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they have omitted the notifications article 34 to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits I 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains Civil damages for data subjects whose data have been negligently handled. Recital 45 allows data subjects to sue indistinctively the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the criminal offense of not complying with the obligations of article 32 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2313,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement article 28 to his professional accounts, with a lack of transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the invalidation of the Privacy Shield. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\" rel=\"noreferrer noopener\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\" rel=\"noreferrer noopener\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-03 20:53:13','2022-01-03 20:53:13','',2311,'https://www.datarainbow.eu/?p=2314',0,'revision','',0),(2304,1,'2021-09-17 13:13:26','2021-09-17 13:13:26','<!-- wp:image {\"id\":2302,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.24.31-1-1024x584.png\" alt=\"\" class=\"wp-image-2302\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2301,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.24.39-1-1024x590.png\" alt=\"\" class=\"wp-image-2301\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2300,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.24.48-1-1024x587.png\" alt=\"\" class=\"wp-image-2300\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2298,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.24.55-1024x580.png\" alt=\"\" class=\"wp-image-2298\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2295,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.03-1024x584.png\" alt=\"\" class=\"wp-image-2295\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2294,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.12-1024x585.png\" alt=\"\" class=\"wp-image-2294\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2293,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.20-1024x592.png\" alt=\"\" class=\"wp-image-2293\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2292,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.30-1024x585.png\" alt=\"\" class=\"wp-image-2292\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2291,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.37-1024x581.png\" alt=\"\" class=\"wp-image-2291\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2290,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.44-1024x582.png\" alt=\"\" class=\"wp-image-2290\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2289,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.53-1024x585.png\" alt=\"\" class=\"wp-image-2289\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2288,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.00-1024x595.png\" alt=\"\" class=\"wp-image-2288\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2287,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.08-1024x586.png\" alt=\"\" class=\"wp-image-2287\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2286,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.16-1024x595.png\" alt=\"\" class=\"wp-image-2286\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2285,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.22-1024x580.png\" alt=\"\" class=\"wp-image-2285\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2284,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.30-1024x576.png\" alt=\"\" class=\"wp-image-2284\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2283,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.37-1024x594.png\" alt=\"\" class=\"wp-image-2283\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2305,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-14.09.20-1024x587.png\" alt=\"\" class=\"wp-image-2305\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2281,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.51-1024x588.png\" alt=\"\" class=\"wp-image-2281\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2280,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.58-1024x584.png\" alt=\"\" class=\"wp-image-2280\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2279,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.27.06-1024x594.png\" alt=\"\" class=\"wp-image-2279\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2306,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-14.09.08-1024x585.png\" alt=\"\" class=\"wp-image-2306\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2277,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.28.41-1024x579.png\" alt=\"\" class=\"wp-image-2277\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2276,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.28.51-1024x584.png\" alt=\"\" class=\"wp-image-2276\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2275,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.29.00-1024x586.png\" alt=\"\" class=\"wp-image-2275\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2273,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.29.47-781x1024.png\" alt=\"\" class=\"wp-image-2273\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2274,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.29.10-1024x583.png\" alt=\"\" class=\"wp-image-2274\"/></figure>\n<!-- /wp:image -->','','','private','open','open','','2304-2','','','2022-01-03 21:04:04','2022-01-03 21:04:04','',0,'https://www.datarainbow.eu/?p=2304',0,'post','',0),(2305,1,'2021-09-17 13:09:53','2021-09-17 13:09:53','','Screenshot-2021-09-17-at-14.09.20','','inherit','open','closed','','screenshot-2021-09-17-at-14-09-20','','','2021-09-17 13:09:53','2021-09-17 13:09:53','',2304,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-14.09.20.png',0,'attachment','image/png',0),(2306,1,'2021-09-17 13:10:09','2021-09-17 13:10:09','','Screenshot-2021-09-17-at-14.09.08','','inherit','open','closed','','screenshot-2021-09-17-at-14-09-08','','','2021-09-17 13:10:09','2021-09-17 13:10:09','',2304,'https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-14.09.08.png',0,'attachment','image/png',0),(2307,1,'2021-09-17 13:13:26','2021-09-17 13:13:26','<!-- wp:image {\"id\":2302,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.24.31-1-1024x584.png\" alt=\"\" class=\"wp-image-2302\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2301,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.24.39-1-1024x590.png\" alt=\"\" class=\"wp-image-2301\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2300,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.24.48-1-1024x587.png\" alt=\"\" class=\"wp-image-2300\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2298,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.24.55-1024x580.png\" alt=\"\" class=\"wp-image-2298\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2295,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.03-1024x584.png\" alt=\"\" class=\"wp-image-2295\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2294,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.12-1024x585.png\" alt=\"\" class=\"wp-image-2294\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2293,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.20-1024x592.png\" alt=\"\" class=\"wp-image-2293\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2292,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.30-1024x585.png\" alt=\"\" class=\"wp-image-2292\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2291,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.37-1024x581.png\" alt=\"\" class=\"wp-image-2291\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2290,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.44-1024x582.png\" alt=\"\" class=\"wp-image-2290\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2289,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.25.53-1024x585.png\" alt=\"\" class=\"wp-image-2289\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2288,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.00-1024x595.png\" alt=\"\" class=\"wp-image-2288\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2287,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.08-1024x586.png\" alt=\"\" class=\"wp-image-2287\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2286,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.16-1024x595.png\" alt=\"\" class=\"wp-image-2286\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2285,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.22-1024x580.png\" alt=\"\" class=\"wp-image-2285\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2284,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.30-1024x576.png\" alt=\"\" class=\"wp-image-2284\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2283,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.37-1024x594.png\" alt=\"\" class=\"wp-image-2283\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2305,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-14.09.20-1024x587.png\" alt=\"\" class=\"wp-image-2305\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2281,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.51-1024x588.png\" alt=\"\" class=\"wp-image-2281\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2280,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.26.58-1024x584.png\" alt=\"\" class=\"wp-image-2280\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2279,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.27.06-1024x594.png\" alt=\"\" class=\"wp-image-2279\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2306,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-14.09.08-1024x585.png\" alt=\"\" class=\"wp-image-2306\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2277,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.28.41-1024x579.png\" alt=\"\" class=\"wp-image-2277\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2276,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.28.51-1024x584.png\" alt=\"\" class=\"wp-image-2276\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2275,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.29.00-1024x586.png\" alt=\"\" class=\"wp-image-2275\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2273,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.29.47-781x1024.png\" alt=\"\" class=\"wp-image-2273\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2274,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/09/Screenshot-2021-09-17-at-13.29.10-1024x583.png\" alt=\"\" class=\"wp-image-2274\"/></figure>\n<!-- /wp:image -->','','','inherit','closed','closed','','2304-revision-v1','','','2021-09-17 13:13:26','2021-09-17 13:13:26','',2304,'https://www.datarainbow.eu/?p=2307',0,'revision','',0),(2318,1,'2022-01-03 23:13:28','2022-01-03 23:13:28','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay initiated a security research using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database, stored on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: data minimisation and storage limitation. Possibly data accuracy as part of the data stored would have become inaccurate. Purpose limitation could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients about the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Its only October the 21<sup>st</sup>, 8 months after the initial notification that the CNIL enquired about their notifications data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021 the case was instructed by the ‘commission restreinte’ (restricted commission) for the infringement of articles 28-3 and 28-4, 32 and 34 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection was formulated) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was considered that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the lack of compliant data processing agreements (art 28-3 GDPR), the obligation of securing the data (Art 32 GDPR) and absence of data subject notification.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art 28-3 GDPR</strong><strong></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be comply with the requirements of article 28 GDPR in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art 28-4 <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of art 28 para 3 and 4. These contracts have include specific clauses</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In response to Slimpay argument, the CNIL logically responded that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the obligation to ensure the security of the data</strong><strong></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on article 32 GDPR, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"a\"} -->\n<ol type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argue a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimplay argued the security whole was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Not wistanding an actual damaged caused to data subjects, the lack of security is in itself a breach of article 32. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as article 82 GDPR allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be itself a breach of data as rarely data subjects can prove immediate harm after a data is compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of an employee’s negligent was not retained as in any case the company was liable to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Last week, <a href=\"https://eugd.org/2500-euros-damages-eugd-scalable-capital-data-leak/\" target=\"_blank\" rel=\"noreferrer noopener\">a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accept Slimplay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considers that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of article 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the article 83 GDPR, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance in securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they have omitted the notifications article 34 to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits I 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains Civil damages for data subjects whose data have been negligently handled. Recital 45 allows data subjects to sue indistinctively the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the criminal offense of not complying with the obligations of article 32 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2313,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement article 28 to his professional accounts, with a lack of transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the invalidation of the Privacy Shield. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Client had warned about the particular sensitivity of the personal and financial data included in the documents. Tey had refused encryption despite all recommendations by the CNIL and any IT security in breach of article 32 GDPR. They took long time and several contacts before they notify the breach to the CNIL, so far never notified data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO has mentioned secured means of document exchange. The other law firm plays with Wetransfer links to avoid the respect of fair communications. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\" rel=\"noreferrer noopener\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\" rel=\"noreferrer noopener\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-03 23:13:28','2022-01-03 23:13:28','',2311,'https://www.datarainbow.eu/?p=2318',0,'revision','',0),(2317,1,'2022-01-03 21:51:59','2022-01-03 21:51:59','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay initiated a security research using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database, stored on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: data minimisation and storage limitation. Possibly data accuracy as part of the data stored would have become inaccurate. Purpose limitation could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients about the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Its only October the 21<sup>st</sup>, 8 months after the initial notification that the CNIL enquired about their notifications data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021 the case was instructed by the ‘commission restreinte’ (restricted commission) for the infringement of articles 28-3 and 28-4, 32 and 34 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection was formulated) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was considered that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the lack of compliant data processing agreements (art 28-3 GDPR), the obligation of securing the data (Art 32 GDPR) and absence of data subject notification.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art 28-3 GDPR</strong><strong></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be comply with the requirements of article 28 GDPR in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art 28-4 <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of art 28 para 3 and 4. These contracts have include specific clauses</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In response to Slimpay argument, the CNIL logically responded that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the obligation to ensure the security of the data</strong><strong></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on article 32 GDPR, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"a\"} -->\n<ol type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argue a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimplay argued the security whole was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Not wistanding an actual damaged caused to data subjects, the lack of security is in itself a breach of article 32. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as article 82 GDPR allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be itself a breach of data as rarely data subjects can prove immediate harm after a data is compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of an employee’s negligent was not retained as in any case the company was liable to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Last week, a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accept Slimplay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considers that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of article 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the article 83 GDPR, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance in securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they have omitted the notifications article 34 to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits I 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains Civil damages for data subjects whose data have been negligently handled. Recital 45 allows data subjects to sue indistinctively the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the criminal offense of not complying with the obligations of article 32 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2313,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement article 28 to his professional accounts, with a lack of transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the invalidation of the Privacy Shield. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Client had warned about the particular sensitivity of the personal and financial data included in the documents. Tey had refused encryption despite all recommendations by the CNIL and any IT security in breach of article 32 GDPR. They took long time and several contacts before they notify the breach to the CNIL, so far never notified data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO has mentioned secured means of document exchange. The other law firm plays with Wetransfer links to avoid the respect of fair communications. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\" rel=\"noreferrer noopener\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\" rel=\"noreferrer noopener\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-03 21:51:59','2022-01-03 21:51:59','',2311,'https://www.datarainbow.eu/?p=2317',0,'revision','',0),(2320,1,'2022-01-03 23:26:38','2022-01-03 23:26:38','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay initiated a security research using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database, stored on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: data minimisation and storage limitation. Possibly data accuracy as part of the data stored would have become inaccurate. Purpose limitation could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients about the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Its only October the 21<sup>st</sup>, 8 months after the initial notification that the CNIL enquired about their notifications data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021 the case was instructed by the ‘commission restreinte’ (restricted commission) for the infringement of articles 28-3 and 28-4, 32 and 34 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection was formulated) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was considered that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the lack of compliant data processing agreements (art 28-3 GDPR), the obligation of securing the data (Art 32 GDPR) and absence of data subject notification.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art 28-3 GDPR</strong><strong></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be comply with the requirements of article 28 GDPR in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art 28-4 <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of art 28 para 3 and 4. These contracts have include specific clauses</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In response to Slimpay argument, the CNIL logically responded that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the obligation to ensure the security of the data</strong><strong></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on article 32 GDPR, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"a\"} -->\n<ol type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argue a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimplay argued the security whole was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Not wistanding an actual damaged caused to data subjects, the lack of security is in itself a breach of article 32. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as article 82 GDPR allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be itself a breach of data as rarely data subjects can prove immediate harm after a data is compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of an employee’s negligent was not retained as in any case the company was liable to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Last week, <a href=\"https://eugd.org/2500-euros-damages-eugd-scalable-capital-data-leak/\" target=\"_blank\" rel=\"noreferrer noopener\">a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also the Danish DPA announced it found that a public entity sent personal data, including sensitive personal data and children\'s personal data, via unencrypted email. The DPA ruled that the public entity did not implement the necessary security measures, taking into account the amount and type of information being<br><a href=\"https://lnkd.in/ePBCrYyY\" target=\"_blank\" rel=\"noreferrer noopener\">Here\'s the decision</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accept Slimplay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considers that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of article 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the article 83 GDPR, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance in securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they have omitted the notifications article 34 to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits I 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains Civil damages for data subjects whose data have been negligently handled. Recital 45 allows data subjects to sue indistinctively the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the criminal offense of not complying with the obligations of article 32 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2313,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement article 28 to his professional accounts, with a lack of transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the invalidation of the Privacy Shield. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Client had warned about the particular sensitivity of the personal and financial data included in the documents. Tey had refused encryption despite all recommendations by the CNIL and any IT security in breach of article 32 GDPR. They took long time and several contacts before they notify the breach to the CNIL, so far never notified data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO has mentioned secured means of document exchange. The other law firm plays with Wetransfer links to avoid the respect of fair communications. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\" rel=\"noreferrer noopener\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\" rel=\"noreferrer noopener\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-03 23:26:38','2022-01-03 23:26:38','',2311,'https://www.datarainbow.eu/?p=2320',0,'revision','',0),(2322,1,'2022-01-04 10:40:14','2022-01-04 10:40:14','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay initiated a security research using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database, stored on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: data minimisation and storage limitation. Possibly data accuracy as part of the data stored would have become inaccurate. Purpose limitation could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients about the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Its only October the 21<sup>st</sup>, 8 months after the initial notification that the CNIL enquired about their notifications data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021 the case was instructed by the ‘commission restreinte’ (restricted commission) for the infringement of articles 28-3 and 28-4, 32 and 34 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection was formulated) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was considered that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the lack of compliant data processing agreements (art 28-3 GDPR), the obligation of securing the data (Art 32 GDPR) and absence of data subject notification.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art 28-3 GDPR</strong><strong></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be comply with the requirements of article 28 GDPR in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art 28-4 <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of art 28 para 3 and 4. These contracts have include specific clauses</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In response to Slimpay argument, the CNIL logically responded that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the obligation to ensure the security of the data</strong><strong></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on article 32 GDPR, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"a\"} -->\n<ol type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argue a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimplay argued the security whole was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Not wistanding an actual damaged caused to data subjects, the lack of security is in itself a breach of article 32. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as article 82 GDPR allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be itself a breach of data as rarely data subjects can prove immediate harm after a data is compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of an employee’s negligent was not retained as in any case the company was liable to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Last week, <a href=\"https://eugd.org/2500-euros-damages-eugd-scalable-capital-data-leak/\" target=\"_blank\" rel=\"noreferrer noopener\">a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also the Danish DPA announced it found that a public entity sent personal data, including sensitive personal data and children\'s personal data, via unencrypted email. The DPA ruled that the public entity did not implement the necessary security measures, taking into account the amount and type of information being<br><a href=\"https://lnkd.in/ePBCrYyY\" target=\"_blank\" rel=\"noreferrer noopener\">Here\'s the decision</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accept Slimplay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considers that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of article 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the article 83 GDPR, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance in securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they have omitted the notifications article 34 to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits I 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains Civil damages for data subjects whose data have been negligently handled. Recital 45 allows data subjects to sue indistinctively the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the criminal offense of not complying with the obligations of article 32 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2313,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement article 28 to his professional accounts, with a lack of transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the invalidation of the Privacy Shield. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Client had warned about the particular sensitivity of the personal and financial data included in the documents. Tey had refused encryption despite all recommendations by the CNIL and any IT security in breach of article 32 GDPR. They took long time and several contacts before they notify the breach to the CNIL, so far never notified data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO has mentioned secured means of document exchange. The other law firm plays with Wetransfer links to avoid the respect of fair communications. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following closely, as it seems like the French CNIL is starting the year 2022 with vigour, a sanction against the French mobile company Free. Here resumed by the great Jimmy Orucevic :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cnil&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">CNIL</a> fines FREE MOBILE for failure to respond to inquiries from data subjects, false invoices, e-mailing of passwords in plain text --> € 300\'000</p><p>The french <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">DataProtection</a> authority has received many complaints concerning the difficulties encountered by individuals in having responses to their requests for <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=access&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">access</a> and to object to receiving <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=commercial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">commercial</a> prospecting messages from the French mobile telephone operator FREE MOBILE.</p><p>The CNIL retained 4 breaches of the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">#GDPR</a> against the company:</p><p>- a failure to respect the right of access of individuals regarding their <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personal&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">personal</a> data (Art. 12 and 15 of the GDPR), since the company did not respond to the requests made by the complainants within the time limits;</p><p>- a <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=failure&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">failure</a> to respect the right to <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=object&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">object</a> of the persons concerned (Art. 12 and 21 of the GDPR), since the company did not take into account the requests of the complainants that no more commercial prospecting messages be sent to them;</p><p>-a breach of the obligation to protect data by <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=design&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">design</a> (Art. 25 of the GDPR), as the company continued to send invoices to complainants for telephone lines whose <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=subscription&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">subscription</a> had been cancelled;</p><p>- a breach of the obligation to ensure the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">security</a> of personal data (Art. 32 of the GDPR), since the company transmitted by <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=email&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">email</a> - in clear text - the passwords of users when they subscribed to an offer with FREE MOBILE, without these passwords being temporary and the company requiring them to be changed.</p><p>This fine takes into account the size and the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=financial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">financial</a> situation of the company. Its publicity is justified by the need to reiterate the importance of responding to requests for exercising the data subject\'s rights and ensuring the security of users\' data.</p><p>decision accessible <a rel=\"noreferrer noopener\" href=\"https://lnkd.in/dAC5mf9K\" target=\"_blank\">here</a></p><cite>[Hashtags removed]</cite></blockquote>\n<!-- /wp:quote --></div>\n<!-- /wp:group -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-04 10:40:14','2022-01-04 10:40:14','',2311,'https://www.datarainbow.eu/?p=2322',0,'revision','',0),(2323,1,'2022-01-04 10:46:24','2022-01-04 10:46:24','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay initiated a security research using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database, stored on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: data minimisation and storage limitation. Possibly data accuracy as part of the data stored would have become inaccurate. Purpose limitation could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients about the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Its only October the 21<sup>st</sup>, 8 months after the initial notification that the CNIL enquired about their notifications data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021 the case was instructed by the ‘commission restreinte’ (restricted commission) for the infringement of articles 28-3 and 28-4, 32 and 34 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection was formulated) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was considered that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the lack of compliant data processing agreements (art 28-3 GDPR), the obligation of securing the data (Art 32 GDPR) and absence of data subject notification.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art 28-3 GDPR</strong><strong></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be comply with the requirements of article 28 GDPR in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art 28-4 <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of art 28 para 3 and 4. These contracts have include specific clauses</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In response to Slimpay argument, the CNIL logically responded that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the obligation to ensure the security of the data</strong><strong></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on article 32 GDPR, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"a\"} -->\n<ol type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argue a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimplay argued the security whole was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Not wistanding an actual damaged caused to data subjects, the lack of security is in itself a breach of article 32. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as article 82 GDPR allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be itself a breach of data as rarely data subjects can prove immediate harm after a data is compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of an employee’s negligent was not retained as in any case the company was liable to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Last week, <a href=\"https://eugd.org/2500-euros-damages-eugd-scalable-capital-data-leak/\" target=\"_blank\" rel=\"noreferrer noopener\">a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also the Danish DPA announced it found that a public entity sent personal data, including sensitive personal data and children\'s personal data, via unencrypted email. The DPA ruled that the public entity did not implement the necessary security measures, taking into account the amount and type of information being<br><a href=\"https://lnkd.in/ePBCrYyY\" target=\"_blank\" rel=\"noreferrer noopener\">Here\'s the decision</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accept Slimplay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considers that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of article 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the article 83 GDPR, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance in securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they have omitted the notifications article 34 to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits I 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains Civil damages for data subjects whose data have been negligently handled. Recital 45 allows data subjects to sue indistinctively the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the criminal offense of not complying with the obligations of article 32 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2313,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement article 28 to his professional accounts, with a lack of transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the invalidation of the Privacy Shield. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Client had warned about the particular sensitivity of the personal and financial data included in the documents. Tey had refused encryption despite all recommendations by the CNIL and any IT security in breach of article 32 GDPR. They took long time and several contacts before they notify the breach to the CNIL, so far never notified data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO has mentioned secured means of document exchange. The other law firm plays with Wetransfer links to avoid the respect of fair communications. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following closely, as it seems like the French CNIL is starting the year 2022 with vigour, a sanction against the French mobile company Free. Here resumed by the great Jimmy Orucevic :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cnil&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">CNIL</a> fines FREE MOBILE for failure to respond to inquiries from data subjects, false invoices, e-mailing of passwords in plain text --> € 300\'000</em></p><p><em>The french <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">DataProtection</a> authority has received many complaints concerning the difficulties encountered by individuals in having responses to their requests for <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=access&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">access</a> and to object to receiving <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=commercial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">commercial</a> prospecting messages from the French mobile telephone operator FREE MOBILE.</em></p><p><em>The CNIL retained 4 breaches of the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">#GDPR</a> against the company:</em></p><p><em>- a failure to respect the right of access of individuals regarding their <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personal&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">personal</a> data (Art. 12 and 15 of the GDPR), since the company did not respond to the requests made by the complainants within the time limits;</em></p><p><em>- a <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=failure&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">failure</a> to respect the right to <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=object&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">object</a> of the persons concerned (Art. 12 and 21 of the GDPR), since the company did not take into account the requests of the complainants that no more commercial prospecting messages be sent to them;</em></p><p><em>-a breach of the obligation to protect data by <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=design&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">design</a> (Art. 25 of the GDPR), as the company continued to send invoices to complainants for telephone lines whose <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=subscription&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">subscription</a> had been cancelled;</em></p><p><em>- a breach of the obligation to ensure the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">security</a> of personal data (Art. 32 of the GDPR), since the company transmitted by <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=email&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">email</a> - in clear text - the passwords of users when they subscribed to an offer with FREE MOBILE, without these passwords being temporary and the company requiring them to be changed.</em></p><p><em>This fine takes into account the size and the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=financial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">financial</a> situation of the company. Its publicity is justified by the need to reiterate the importance of responding to requests for exercising the data subject\'s rights and ensuring the security of users\' data.</em></p><p><em>decision accessible <a rel=\"noreferrer noopener\" href=\"https://lnkd.in/dAC5mf9K\" target=\"_blank\">here</a></em></p><cite>[Hashtags removed]</cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Again the question of security of data questioned. A password in clear in an email is a no no, as much as personal or confidential documents exchange by unencrypted emails or transfer of documents in the hands of thord party apps without assessment and a Data Protection Agreement article 28 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Renforcer la sécurité de toute transmission de données à caractère personnel. </em></p><p><em><strong>La messagerie électronique ne constitue pas un moyen de communication sûr </strong>pour transmettre des données personnelles, sans mesure complémentaire. Une simple erreur de manipulation peut conduire à divulguer à des destinataires non habilités des données personnelles et à porter ainsi atteinte au droit    à la vie privée des personnes. En outre, toute entité ayant accès aux serveurs de messagerie concernés (notamment ceux des émetteurs et destinataires) peut avoir accès à leur contenu.</em></p><cite><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024#item410340589\" target=\"_blank\">CNIL\'s guidance</a><br><br>\"reinforce the security of any transmission of personal data.<strong> E-mail is not a secure means of communication for transmitting personal data without further action.</strong> A simple error in handling may lead to the disclosure of personal data to unauthorised recipients and thus infringe on the right to privacy of individuals. In addition, any entity with access to the relevant mail servers (including those of the senders and recipients) may have access to their content.\"</cite></blockquote>\n<!-- /wp:quote --></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-04 10:46:24','2022-01-04 10:46:24','',2311,'https://www.datarainbow.eu/?p=2323',0,'revision','',0),(2324,1,'2022-01-04 10:47:23','2022-01-04 10:47:23','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay initiated a security research using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database, stored on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: data minimisation and storage limitation. Possibly data accuracy as part of the data stored would have become inaccurate. Purpose limitation could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients about the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Its only October the 21<sup>st</sup>, 8 months after the initial notification that the CNIL enquired about their notifications data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021 the case was instructed by the ‘commission restreinte’ (restricted commission) for the infringement of articles 28-3 and 28-4, 32 and 34 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection was formulated) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was considered that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the lack of compliant data processing agreements (art 28-3 GDPR), the obligation of securing the data (Art 32 GDPR) and absence of data subject notification.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art 28-3 GDPR</strong><strong></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be comply with the requirements of article 28 GDPR in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art 28-4 <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of art 28 para 3 and 4. These contracts have include specific clauses</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In response to Slimpay argument, the CNIL logically responded that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the obligation to ensure the security of the data</strong><strong></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on article 32 GDPR, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"a\"} -->\n<ol type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argue a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimplay argued the security whole was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Not wistanding an actual damaged caused to data subjects, the lack of security is in itself a breach of article 32. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as article 82 GDPR allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be itself a breach of data as rarely data subjects can prove immediate harm after a data is compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of an employee’s negligent was not retained as in any case the company was liable to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Last week, <a href=\"https://eugd.org/2500-euros-damages-eugd-scalable-capital-data-leak/\" target=\"_blank\" rel=\"noreferrer noopener\">a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also the Danish DPA announced it found that a public entity sent personal data, including sensitive personal data and children\'s personal data, via unencrypted email. The DPA ruled that the public entity did not implement the necessary security measures, taking into account the amount and type of information being<br><a href=\"https://lnkd.in/ePBCrYyY\" target=\"_blank\" rel=\"noreferrer noopener\">Here\'s the decision</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accept Slimplay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considers that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of article 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the article 83 GDPR, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance in securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they have omitted the notifications article 34 to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits I 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains Civil damages for data subjects whose data have been negligently handled. Recital 45 allows data subjects to sue indistinctively the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the criminal offense of not complying with the obligations of article 32 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2313,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement article 28 to his professional accounts, with a lack of transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the invalidation of the Privacy Shield. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Client had warned about the particular sensitivity of the personal and financial data included in the documents. Tey had refused encryption despite all recommendations by the CNIL and any IT security in breach of article 32 GDPR. They took long time and several contacts before they notify the breach to the CNIL, so far never notified data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO has mentioned secured means of document exchange. The other law firm plays with Wetransfer links to avoid the respect of fair communications. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following closely, as it seems like the French CNIL is starting the year 2022 with vigour, a sanction against the French mobile company Free. Here resumed by the great Jimmy Orucevic :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cnil&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">CNIL</a> fines FREE MOBILE for failure to respond to inquiries from data subjects, false invoices, e-mailing of passwords in plain text --> € 300\'000</em></p><p><em>The french <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">DataProtection</a> authority has received many complaints concerning the difficulties encountered by individuals in having responses to their requests for <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=access&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">access</a> and to object to receiving <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=commercial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">commercial</a> prospecting messages from the French mobile telephone operator FREE MOBILE.</em></p><p><em>The CNIL retained 4 breaches of the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">#GDPR</a> against the company:</em></p><p><em>- a failure to respect the right of access of individuals regarding their <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personal&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">personal</a> data (Art. 12 and 15 of the GDPR), since the company did not respond to the requests made by the complainants within the time limits;</em></p><p><em>- a <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=failure&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">failure</a> to respect the right to <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=object&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">object</a> of the persons concerned (Art. 12 and 21 of the GDPR), since the company did not take into account the requests of the complainants that no more commercial prospecting messages be sent to them;</em></p><p><em>-a breach of the obligation to protect data by <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=design&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">design</a> (Art. 25 of the GDPR), as the company continued to send invoices to complainants for telephone lines whose <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=subscription&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">subscription</a> had been cancelled;</em></p><p><em>- a breach of the obligation to ensure the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">security</a> of personal data (Art. 32 of the GDPR), since the company transmitted by <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=email&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">email</a> - in clear text - the passwords of users when they subscribed to an offer with FREE MOBILE, without these passwords being temporary and the company requiring them to be changed.</em></p><p><em>This fine takes into account the size and the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=financial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">financial</a> situation of the company. Its publicity is justified by the need to reiterate the importance of responding to requests for exercising the data subject\'s rights and ensuring the security of users\' data.</em></p><p><em>decision accessible <a rel=\"noreferrer noopener\" href=\"https://lnkd.in/dAC5mf9K\" target=\"_blank\">here</a></em></p><cite>[Hashtags removed]</cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Again the question of security of data questioned. A password in clear in an email is a no no, as much as personal or confidential documents exchange by unencrypted emails or transfer of documents in the hands of thord party apps without assessment and a Data Protection Agreement article 28 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Renforcer la sécurité de toute transmission de données à caractère personnel. </em></p><p><em><strong>La messagerie électronique ne constitue pas un moyen de communication sûr </strong>pour transmettre des données personnelles, sans mesure complémentaire. Une simple erreur de manipulation peut conduire à divulguer à des destinataires non habilités des données personnelles et à porter ainsi atteinte au droit    à la vie privée des personnes. En outre, toute entité ayant accès aux serveurs de messagerie concernés (notamment ceux des émetteurs et destinataires) peut avoir accès à leur contenu.</em></p><cite><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024#item410340589\" target=\"_blank\">CNIL\'s guidance</a><br><br>\"reinforcing the security of any transmission of personal data.<strong> E-mail is not a secure means of communication for transmitting personal data without further action.</strong> A simple error in handling may lead to the disclosure of personal data to unauthorised recipients and thus infringe on the right to privacy of individuals. In addition, any entity with access to the relevant mail servers (including those of the senders and recipients) may have access to their content.\"</cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph --></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-04 10:47:23','2022-01-04 10:47:23','',2311,'https://www.datarainbow.eu/?p=2324',0,'revision','',0),(2325,1,'2022-01-04 11:03:04','2022-01-04 11:03:04','','Screenshot-2022-01-04-at-11.00.34','','inherit','open','closed','','screenshot-2022-01-04-at-11-00-34','','','2022-01-04 11:03:04','2022-01-04 11:03:04','',2311,'https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2022-01-04-at-11.00.34.png',0,'attachment','image/png',0),(2326,1,'2022-01-04 11:05:46','2022-01-04 11:05:46','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay initiated a security research using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database, stored on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: data minimisation and storage limitation. Possibly data accuracy as part of the data stored would have become inaccurate. Purpose limitation could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients about the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Its only October the 21<sup>st</sup>, 8 months after the initial notification that the CNIL enquired about their notifications data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021 the case was instructed by the ‘commission restreinte’ (restricted commission) for the infringement of articles 28-3 and 28-4, 32 and 34 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection was formulated) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was considered that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the lack of compliant data processing agreements (art 28-3 GDPR), the obligation of securing the data (Art 32 GDPR) and absence of data subject notification.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art 28-3 GDPR</strong><strong></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be comply with the requirements of article 28 GDPR in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art 28-4 <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of art 28 para 3 and 4. These contracts have include specific clauses</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In response to Slimpay argument, the CNIL logically responded that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the obligation to ensure the security of the data</strong><strong></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on article 32 GDPR, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"a\"} -->\n<ol type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argue a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimplay argued the security whole was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Not wistanding an actual damaged caused to data subjects, the lack of security is in itself a breach of article 32. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as article 82 GDPR allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be itself a breach of data as rarely data subjects can prove immediate harm after a data is compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of an employee’s negligent was not retained as in any case the company was liable to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Last week, <a href=\"https://eugd.org/2500-euros-damages-eugd-scalable-capital-data-leak/\" target=\"_blank\" rel=\"noreferrer noopener\">a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also the Danish DPA announced it found that a public entity sent personal data, including sensitive personal data and children\'s personal data, via unencrypted email. The DPA ruled that the public entity did not implement the necessary security measures, taking into account the amount and type of information being<br><a href=\"https://lnkd.in/ePBCrYyY\" target=\"_blank\" rel=\"noreferrer noopener\">Here\'s the decision</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accept Slimplay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considers that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of article 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the article 83 GDPR, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance in securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they have omitted the notifications article 34 to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits I 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains Civil damages for data subjects whose data have been negligently handled. Recital 45 allows data subjects to sue indistinctively the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the criminal offense of not complying with the obligations of article 32 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2313,\"width\":840,\"height\":878,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\" width=\"840\" height=\"878\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement article 28 to his professional accounts, with a lack of transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the invalidation of the Privacy Shield. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Client had warned about the particular sensitivity of the personal and financial data included in the documents. Tey had refused encryption despite all recommendations by the CNIL and any IT security in breach of article 32 GDPR. They took long time and several contacts before they notify the breach to the CNIL, so far never notified data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO has mentioned secured means of document exchange. The other law firm plays with Wetransfer links to avoid the respect of fair communications. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is one example of how things can go wrong following a data breach of personal data mentioned in the newly adopted version of the <a href=\"https://www.linkedin.com/company/eu-edpb/\">European Data Protection Board</a>\'s Guidelines 01/2021 on Examples regarding Personal Data <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=breach&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">Breach</a> Notification under the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">GDPR</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2325,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2022-01-04-at-11.00.34-971x1024.png\" alt=\"\" class=\"wp-image-2325\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following closely, as it seems like the French CNIL is starting the year 2022 with vigour, a sanction against the French mobile company Free. Here resumed by the great Jimmy Orucevic :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cnil&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">CNIL</a> fines FREE MOBILE for failure to respond to inquiries from data subjects, false invoices, e-mailing of passwords in plain text --> € 300\'000</em></p><p><em>The french <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">DataProtection</a> authority has received many complaints concerning the difficulties encountered by individuals in having responses to their requests for <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=access&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">access</a> and to object to receiving <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=commercial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">commercial</a> prospecting messages from the French mobile telephone operator FREE MOBILE.</em></p><p><em>The CNIL retained 4 breaches of the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">#GDPR</a> against the company:</em></p><p><em>- a failure to respect the right of access of individuals regarding their <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personal&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">personal</a> data (Art. 12 and 15 of the GDPR), since the company did not respond to the requests made by the complainants within the time limits;</em></p><p><em>- a <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=failure&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">failure</a> to respect the right to <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=object&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">object</a> of the persons concerned (Art. 12 and 21 of the GDPR), since the company did not take into account the requests of the complainants that no more commercial prospecting messages be sent to them;</em></p><p><em>-a breach of the obligation to protect data by <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=design&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">design</a> (Art. 25 of the GDPR), as the company continued to send invoices to complainants for telephone lines whose <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=subscription&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">subscription</a> had been cancelled;</em></p><p><em>- a breach of the obligation to ensure the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">security</a> of personal data (Art. 32 of the GDPR), since the company transmitted by <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=email&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">email</a> - in clear text - the passwords of users when they subscribed to an offer with FREE MOBILE, without these passwords being temporary and the company requiring them to be changed.</em></p><p><em>This fine takes into account the size and the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=financial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">financial</a> situation of the company. Its publicity is justified by the need to reiterate the importance of responding to requests for exercising the data subject\'s rights and ensuring the security of users\' data.</em></p><p><em>decision accessible <a rel=\"noreferrer noopener\" href=\"https://lnkd.in/dAC5mf9K\" target=\"_blank\">here</a></em></p><cite>[Hashtags removed]</cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Again the question of security of data questioned. A password in clear in an email is a no no, as much as personal or confidential documents exchange by unencrypted emails or transfer of documents in the hands of thord party apps without assessment and a Data Protection Agreement article 28 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Renforcer la sécurité de toute transmission de données à caractère personnel. </em></p><p><em><strong>La messagerie électronique ne constitue pas un moyen de communication sûr </strong>pour transmettre des données personnelles, sans mesure complémentaire. Une simple erreur de manipulation peut conduire à divulguer à des destinataires non habilités des données personnelles et à porter ainsi atteinte au droit    à la vie privée des personnes. En outre, toute entité ayant accès aux serveurs de messagerie concernés (notamment ceux des émetteurs et destinataires) peut avoir accès à leur</em></p><cite><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024#item410340589\" target=\"_blank\">CNIL\'s guidance</a><br><br>\"reinforcing the security of any transmission of personal data.<strong> E-mail is not a secure means of communication for transmitting personal data without further action.</strong> A simple error in handling may lead to the disclosure of personal data to unauthorised recipients and thus infringe on the right to privacy of individuals. In addition, any entity with access to the relevant mail servers (including those of the senders and recipients) may have access to their content.\"</cite></blockquote>\n<!-- /wp:quote --></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-04 11:05:46','2022-01-04 11:05:46','',2311,'https://www.datarainbow.eu/?p=2326',0,'revision','',0),(2328,1,'2022-01-04 11:23:13','2022-01-04 11:23:13','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay launched a research program using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database, stored on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: data minimisation and storage limitation. Possibly data accuracy as part of the data stored would have become inaccurate. Purpose limitation could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients about the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Its only October the 21<sup>st</sup>, 8 months after the initial notification that the CNIL enquired about their notifications data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021 the case was instructed by the ‘commission restreinte’ (restricted commission) for the infringement of articles 28-3 and 28-4, 32 and 34 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection was formulated) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was considered that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the lack of compliant data processing agreements (art 28-3 GDPR), the obligation of securing the data (Art 32 GDPR) and absence of data subject notification.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art 28-3 GDPR</strong><strong></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be comply with the requirements of article 28 GDPR in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art 28-4 <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of art 28 para 3 and 4. These contracts have include specific clauses</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In response to Slimpay argument, the CNIL logically responded that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the obligation to ensure the security of the data</strong><strong></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on article 32 GDPR, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"a\"} -->\n<ol type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argue a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimplay argued the security whole was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Not wistanding an actual damaged caused to data subjects, the lack of security is in itself a breach of article 32. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as article 82 GDPR allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be itself a breach of data as rarely data subjects can prove immediate harm after a data is compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of an employee’s negligent was not retained as in any case the company was liable to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Last week, <a href=\"https://eugd.org/2500-euros-damages-eugd-scalable-capital-data-leak/\" target=\"_blank\" rel=\"noreferrer noopener\">a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also the Danish DPA announced it found that a public entity sent personal data, including sensitive personal data and children\'s personal data, via unencrypted email. The DPA ruled that the public entity did not implement the necessary security measures, taking into account the amount and type of information being<br><a href=\"https://lnkd.in/ePBCrYyY\" target=\"_blank\" rel=\"noreferrer noopener\">Here\'s the decision</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accept Slimplay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considers that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of article 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the article 83 GDPR, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance in securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they have omitted the notifications article 34 to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits I 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains Civil damages for data subjects whose data have been negligently handled. Recital 45 allows data subjects to sue indistinctively the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the criminal offense of not complying with the obligations of article 32 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2313,\"width\":840,\"height\":878,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\" width=\"840\" height=\"878\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement article 28 to his professional accounts, with a lack of transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the invalidation of the Privacy Shield. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Client had warned about the particular sensitivity of the personal and financial data included in the documents. Tey had refused encryption despite all recommendations by the CNIL and any IT security in breach of article 32 GDPR. They took long time and several contacts before they notify the breach to the CNIL, so far never notified data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO has mentioned secured means of document exchange. The other law firm plays with Wetransfer links to avoid the respect of fair communications. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is one example of how things can go wrong following a data breach of personal data mentioned in the newly adopted version of the&nbsp;<a href=\"https://www.linkedin.com/company/eu-edpb/\">European Data Protection Board</a>\'s Guidelines 01/2021 on Examples regarding Personal Data&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=breach&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">Breach</a>&nbsp;Notification under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">GDPR</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2325,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2022-01-04-at-11.00.34-971x1024.png\" alt=\"\" class=\"wp-image-2325\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Lawyers or other legal professionals bound by attorney client privilege or confidentiality should be more careful when handling documents containing personal or financial data. This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following closely, as it seems like the French CNIL is starting the year 2022 with vigour, a sanction against the French mobile company Free. Here resumed by the great Jimmy Orucevic :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cnil&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">CNIL</a>&nbsp;fines FREE MOBILE for failure to respond to inquiries from data subjects, false invoices, e-mailing of passwords in plain text --&gt; € 300\'000</em></p><p><em>The french&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">DataProtection</a>&nbsp;authority has received many complaints concerning the difficulties encountered by individuals in having responses to their requests for&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=access&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">access</a>&nbsp;and to object to receiving&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=commercial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">commercial</a>&nbsp;prospecting messages from the French mobile telephone operator FREE MOBILE.</em></p><p><em>The CNIL retained 4 breaches of the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">#GDPR</a>&nbsp;against the company:</em></p><p><em>- a failure to respect the right of access of individuals regarding their&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personal&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">personal</a>&nbsp;data (Art. 12 and 15 of the GDPR), since the company did not respond to the requests made by the complainants within the time limits;</em></p><p><em>- a&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=failure&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">failure</a>&nbsp;to respect the right to&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=object&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">object</a>&nbsp;of the persons concerned (Art. 12 and 21 of the GDPR), since the company did not take into account the requests of the complainants that no more commercial prospecting messages be sent to them;</em></p><p><em>-a breach of the obligation to protect data by&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=design&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">design</a>&nbsp;(Art. 25 of the GDPR), as the company continued to send invoices to complainants for telephone lines whose&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=subscription&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">subscription</a>&nbsp;had been cancelled;</em></p><p><em>- a breach of the obligation to ensure the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">security</a>&nbsp;of personal data (Art. 32 of the GDPR), since the company transmitted by&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=email&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">email</a>&nbsp;- in clear text - the passwords of users when they subscribed to an offer with FREE MOBILE, without these passwords being temporary and the company requiring them to be changed.</em></p><p><em>This fine takes into account the size and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=financial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">financial</a>&nbsp;situation of the company. Its publicity is justified by the need to reiterate the importance of responding to requests for exercising the data subject\'s rights and ensuring the security of users\' data.</em></p><p><em>decision accessible <a rel=\"noreferrer noopener\" href=\"https://lnkd.in/dAC5mf9K\" target=\"_blank\">here</a></em></p><cite>[Hashtags removed]</cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Again the question of security of data questioned. A password in clear in an email is a no no, as much as personal or confidential documents exchange by unencrypted emails or transfer of documents in the hands of thord party apps without assessment and a Data Protection Agreement article 28 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Renforcer la sécurité de toute transmission de données à caractère personnel.&nbsp;</em></p><p><em><strong>La messagerie électronique ne constitue pas un moyen de communication sûr&nbsp;</strong>pour transmettre des données personnelles, sans mesure complémentaire. Une simple erreur de manipulation peut conduire à divulguer à des destinataires non habilités des données personnelles et à porter ainsi atteinte au droit&nbsp;&nbsp;&nbsp; à la vie privée des personnes. En outre, toute entité ayant accès aux serveurs de messagerie concernés (notamment ceux des émetteurs et destinataires) peut avoir accès à leur</em></p><cite><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024#item410340589\" target=\"_blank\">CNIL\'s guidance</a><br><br>\"reinforcing the security of any transmission of personal data.<strong> E-mail is not a secure means of communication for transmitting personal data without further action.</strong> A simple error in handling may lead to the disclosure of personal data to unauthorised recipients and thus infringe on the right to privacy of individuals. In addition, any entity with access to the relevant mail servers (including those of the senders and recipients) may have access to their content.\"</cite></blockquote>\n<!-- /wp:quote --></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-04 11:23:13','2022-01-04 11:23:13','',2311,'https://www.datarainbow.eu/?p=2328',0,'revision','',0),(2327,1,'2022-01-04 11:07:17','2022-01-04 11:07:17','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay initiated a security research using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database, stored on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: data minimisation and storage limitation. Possibly data accuracy as part of the data stored would have become inaccurate. Purpose limitation could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients about the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Its only October the 21<sup>st</sup>, 8 months after the initial notification that the CNIL enquired about their notifications data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021 the case was instructed by the ‘commission restreinte’ (restricted commission) for the infringement of articles 28-3 and 28-4, 32 and 34 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection was formulated) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was considered that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the lack of compliant data processing agreements (art 28-3 GDPR), the obligation of securing the data (Art 32 GDPR) and absence of data subject notification.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art 28-3 GDPR</strong><strong></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be comply with the requirements of article 28 GDPR in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art 28-4 <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of art 28 para 3 and 4. These contracts have include specific clauses</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In response to Slimpay argument, the CNIL logically responded that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the obligation to ensure the security of the data</strong><strong></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on article 32 GDPR, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"a\"} -->\n<ol type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argue a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimplay argued the security whole was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Not wistanding an actual damaged caused to data subjects, the lack of security is in itself a breach of article 32. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as article 82 GDPR allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be itself a breach of data as rarely data subjects can prove immediate harm after a data is compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of an employee’s negligent was not retained as in any case the company was liable to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Last week, <a href=\"https://eugd.org/2500-euros-damages-eugd-scalable-capital-data-leak/\" target=\"_blank\" rel=\"noreferrer noopener\">a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also the Danish DPA announced it found that a public entity sent personal data, including sensitive personal data and children\'s personal data, via unencrypted email. The DPA ruled that the public entity did not implement the necessary security measures, taking into account the amount and type of information being<br><a href=\"https://lnkd.in/ePBCrYyY\" target=\"_blank\" rel=\"noreferrer noopener\">Here\'s the decision</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accept Slimplay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considers that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of article 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the article 83 GDPR, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance in securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they have omitted the notifications article 34 to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits I 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains Civil damages for data subjects whose data have been negligently handled. Recital 45 allows data subjects to sue indistinctively the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the criminal offense of not complying with the obligations of article 32 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2313,\"width\":840,\"height\":878,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\" width=\"840\" height=\"878\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement article 28 to his professional accounts, with a lack of transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the invalidation of the Privacy Shield. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Client had warned about the particular sensitivity of the personal and financial data included in the documents. Tey had refused encryption despite all recommendations by the CNIL and any IT security in breach of article 32 GDPR. They took long time and several contacts before they notify the breach to the CNIL, so far never notified data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO has mentioned secured means of document exchange. The other law firm plays with Wetransfer links to avoid the respect of fair communications. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is one example of how things can go wrong following a data breach of personal data mentioned in the newly adopted version of the <a href=\"https://www.linkedin.com/company/eu-edpb/\">European Data Protection Board</a>\'s Guidelines 01/2021 on Examples regarding Personal Data <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=breach&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">Breach</a> Notification under the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">GDPR</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2325,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2022-01-04-at-11.00.34-971x1024.png\" alt=\"\" class=\"wp-image-2325\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Lawyers or other legal professionals bound by attorney client privilege or confidentiality should be more careful when handling documents containing personal or financial data. This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following closely, as it seems like the French CNIL is starting the year 2022 with vigour, a sanction against the French mobile company Free. Here resumed by the great Jimmy Orucevic :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cnil&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">CNIL</a> fines FREE MOBILE for failure to respond to inquiries from data subjects, false invoices, e-mailing of passwords in plain text --> € 300\'000</em></p><p><em>The french <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">DataProtection</a> authority has received many complaints concerning the difficulties encountered by individuals in having responses to their requests for <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=access&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">access</a> and to object to receiving <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=commercial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">commercial</a> prospecting messages from the French mobile telephone operator FREE MOBILE.</em></p><p><em>The CNIL retained 4 breaches of the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">#GDPR</a> against the company:</em></p><p><em>- a failure to respect the right of access of individuals regarding their <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personal&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">personal</a> data (Art. 12 and 15 of the GDPR), since the company did not respond to the requests made by the complainants within the time limits;</em></p><p><em>- a <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=failure&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">failure</a> to respect the right to <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=object&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">object</a> of the persons concerned (Art. 12 and 21 of the GDPR), since the company did not take into account the requests of the complainants that no more commercial prospecting messages be sent to them;</em></p><p><em>-a breach of the obligation to protect data by <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=design&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">design</a> (Art. 25 of the GDPR), as the company continued to send invoices to complainants for telephone lines whose <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=subscription&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">subscription</a> had been cancelled;</em></p><p><em>- a breach of the obligation to ensure the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">security</a> of personal data (Art. 32 of the GDPR), since the company transmitted by <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=email&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">email</a> - in clear text - the passwords of users when they subscribed to an offer with FREE MOBILE, without these passwords being temporary and the company requiring them to be changed.</em></p><p><em>This fine takes into account the size and the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=financial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">financial</a> situation of the company. Its publicity is justified by the need to reiterate the importance of responding to requests for exercising the data subject\'s rights and ensuring the security of users\' data.</em></p><p><em>decision accessible <a rel=\"noreferrer noopener\" href=\"https://lnkd.in/dAC5mf9K\" target=\"_blank\">here</a></em></p><cite>[Hashtags removed]</cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Again the question of security of data questioned. A password in clear in an email is a no no, as much as personal or confidential documents exchange by unencrypted emails or transfer of documents in the hands of thord party apps without assessment and a Data Protection Agreement article 28 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Renforcer la sécurité de toute transmission de données à caractère personnel. </em></p><p><em><strong>La messagerie électronique ne constitue pas un moyen de communication sûr </strong>pour transmettre des données personnelles, sans mesure complémentaire. Une simple erreur de manipulation peut conduire à divulguer à des destinataires non habilités des données personnelles et à porter ainsi atteinte au droit    à la vie privée des personnes. En outre, toute entité ayant accès aux serveurs de messagerie concernés (notamment ceux des émetteurs et destinataires) peut avoir accès à leur</em></p><cite><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024#item410340589\" target=\"_blank\">CNIL\'s guidance</a><br><br>\"reinforcing the security of any transmission of personal data.<strong> E-mail is not a secure means of communication for transmitting personal data without further action.</strong> A simple error in handling may lead to the disclosure of personal data to unauthorised recipients and thus infringe on the right to privacy of individuals. In addition, any entity with access to the relevant mail servers (including those of the senders and recipients) may have access to their content.\"</cite></blockquote>\n<!-- /wp:quote --></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-04 11:07:17','2022-01-04 11:07:17','',2311,'https://www.datarainbow.eu/?p=2327',0,'revision','',0),(2330,1,'2022-01-04 11:25:57','2022-01-04 11:25:57','','Art5_Principles','','inherit','open','closed','','art5_principles','','','2022-01-04 11:25:57','2022-01-04 11:25:57','',2311,'https://www.datarainbow.eu/wp-content/uploads/2022/01/Art5_Principles.png',0,'attachment','image/png',0),(2331,1,'2022-01-04 11:30:30','2022-01-04 11:30:30','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay launched a research program using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database. Data was left on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: <strong>data minimisation</strong> and <strong>storage limitation</strong>. Possibly <strong>data accuracy </strong>as part of the data stored would have become inaccurate after time. <strong>Purpose limitation </strong>could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":2330,\"width\":449,\"height\":253,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Art5_Principles-1024x577.png\" alt=\"\" class=\"wp-image-2330\" width=\"449\" height=\"253\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients concerning the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s only on October the 21<sup>st</sup>, 8 months after the initial notification, that the CNIL enquired about their notifications to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021, the case was instructed by the ‘<em>commission restreinte</em>’ (restricted commission) for the <strong>infringement of articles 28-3 and 28-4, 32 and 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was accepted that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the lack of compliant data processing agreements (art 28-3 GDPR), the obligation of securing the data (Art 32 GDPR) and absence of data subject notification.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art 28-3 GDPR</strong><strong></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be comply with the requirements of article 28 GDPR in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art 28-4 <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of art 28 para 3 and 4. These contracts have include specific clauses</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In response to Slimpay argument, the CNIL logically responded that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the obligation to ensure the security of the data</strong><strong></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on article 32 GDPR, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"a\"} -->\n<ol type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argue a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimplay argued the security whole was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Not wistanding an actual damaged caused to data subjects, the lack of security is in itself a breach of article 32. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as article 82 GDPR allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be itself a breach of data as rarely data subjects can prove immediate harm after a data is compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of an employee’s negligent was not retained as in any case the company was liable to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Last week, <a href=\"https://eugd.org/2500-euros-damages-eugd-scalable-capital-data-leak/\" target=\"_blank\" rel=\"noreferrer noopener\">a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also the Danish DPA announced it found that a public entity sent personal data, including sensitive personal data and children\'s personal data, via unencrypted email. The DPA ruled that the public entity did not implement the necessary security measures, taking into account the amount and type of information being<br><a href=\"https://lnkd.in/ePBCrYyY\" target=\"_blank\" rel=\"noreferrer noopener\">Here\'s the decision</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accept Slimplay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considers that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of article 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the article 83 GDPR, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance in securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they have omitted the notifications article 34 to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits I 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains Civil damages for data subjects whose data have been negligently handled. Recital 45 allows data subjects to sue indistinctively the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the criminal offense of not complying with the obligations of article 32 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2313,\"width\":840,\"height\":878,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\" width=\"840\" height=\"878\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement article 28 to his professional accounts, with a lack of transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the invalidation of the Privacy Shield. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Client had warned about the particular sensitivity of the personal and financial data included in the documents. Tey had refused encryption despite all recommendations by the CNIL and any IT security in breach of article 32 GDPR. They took long time and several contacts before they notify the breach to the CNIL, so far never notified data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO has mentioned secured means of document exchange. The other law firm plays with Wetransfer links to avoid the respect of fair communications. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is one example of how things can go wrong following a data breach of personal data mentioned in the newly adopted version of the&nbsp;<a href=\"https://www.linkedin.com/company/eu-edpb/\">European Data Protection Board</a>\'s Guidelines 01/2021 on Examples regarding Personal Data&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=breach&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">Breach</a>&nbsp;Notification under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">GDPR</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2325,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2022-01-04-at-11.00.34-971x1024.png\" alt=\"\" class=\"wp-image-2325\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Lawyers or other legal professionals bound by attorney client privilege or confidentiality should be more careful when handling documents containing personal or financial data. This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following closely, as it seems like the French CNIL is starting the year 2022 with vigour, a sanction against the French mobile company Free. Here resumed by the great Jimmy Orucevic :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cnil&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">CNIL</a>&nbsp;fines FREE MOBILE for failure to respond to inquiries from data subjects, false invoices, e-mailing of passwords in plain text --&gt; € 300\'000</em></p><p><em>The french&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">DataProtection</a>&nbsp;authority has received many complaints concerning the difficulties encountered by individuals in having responses to their requests for&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=access&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">access</a>&nbsp;and to object to receiving&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=commercial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">commercial</a>&nbsp;prospecting messages from the French mobile telephone operator FREE MOBILE.</em></p><p><em>The CNIL retained 4 breaches of the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">#GDPR</a>&nbsp;against the company:</em></p><p><em>- a failure to respect the right of access of individuals regarding their&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personal&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">personal</a>&nbsp;data (Art. 12 and 15 of the GDPR), since the company did not respond to the requests made by the complainants within the time limits;</em></p><p><em>- a&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=failure&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">failure</a>&nbsp;to respect the right to&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=object&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">object</a>&nbsp;of the persons concerned (Art. 12 and 21 of the GDPR), since the company did not take into account the requests of the complainants that no more commercial prospecting messages be sent to them;</em></p><p><em>-a breach of the obligation to protect data by&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=design&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">design</a>&nbsp;(Art. 25 of the GDPR), as the company continued to send invoices to complainants for telephone lines whose&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=subscription&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">subscription</a>&nbsp;had been cancelled;</em></p><p><em>- a breach of the obligation to ensure the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">security</a>&nbsp;of personal data (Art. 32 of the GDPR), since the company transmitted by&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=email&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">email</a>&nbsp;- in clear text - the passwords of users when they subscribed to an offer with FREE MOBILE, without these passwords being temporary and the company requiring them to be changed.</em></p><p><em>This fine takes into account the size and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=financial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">financial</a>&nbsp;situation of the company. Its publicity is justified by the need to reiterate the importance of responding to requests for exercising the data subject\'s rights and ensuring the security of users\' data.</em></p><p><em>decision accessible <a rel=\"noreferrer noopener\" href=\"https://lnkd.in/dAC5mf9K\" target=\"_blank\">here</a></em></p><cite>[Hashtags removed]</cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Again the question of security of data questioned. A password in clear in an email is a no no, as much as personal or confidential documents exchange by unencrypted emails or transfer of documents in the hands of thord party apps without assessment and a Data Protection Agreement article 28 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Renforcer la sécurité de toute transmission de données à caractère personnel.&nbsp;</em></p><p><em><strong>La messagerie électronique ne constitue pas un moyen de communication sûr&nbsp;</strong>pour transmettre des données personnelles, sans mesure complémentaire. Une simple erreur de manipulation peut conduire à divulguer à des destinataires non habilités des données personnelles et à porter ainsi atteinte au droit&nbsp;&nbsp;&nbsp; à la vie privée des personnes. En outre, toute entité ayant accès aux serveurs de messagerie concernés (notamment ceux des émetteurs et destinataires) peut avoir accès à leur</em></p><cite><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024#item410340589\" target=\"_blank\">CNIL\'s guidance</a><br><br>\"reinforcing the security of any transmission of personal data.<strong> E-mail is not a secure means of communication for transmitting personal data without further action.</strong> A simple error in handling may lead to the disclosure of personal data to unauthorised recipients and thus infringe on the right to privacy of individuals. In addition, any entity with access to the relevant mail servers (including those of the senders and recipients) may have access to their content.\"</cite></blockquote>\n<!-- /wp:quote --></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-04 11:30:30','2022-01-04 11:30:30','',2311,'https://www.datarainbow.eu/?p=2331',0,'revision','',0),(2332,1,'2022-01-04 11:32:21','2022-01-04 11:32:21','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay launched a research program using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database. Data was left on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: <strong>data minimisation</strong> and <strong>storage limitation</strong>. Possibly <strong>data accuracy </strong>as part of the data stored would have become inaccurate after time. <strong>Purpose limitation </strong>could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":2330,\"width\":449,\"height\":253,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Art5_Principles-1024x577.png\" alt=\"\" class=\"wp-image-2330\" width=\"449\" height=\"253\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients concerning the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s only on October the 21<sup>st</sup>, 8 months after the initial notification, that the CNIL enquired about their notifications to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021, the case was instructed by the ‘<em>commission restreinte</em>’ (restricted commission) for the <strong>infringement of articles 28-3 and 28-4, 32 and 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was accepted that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the <strong>lack of compliant data processing agreements (art 28-3 GDPR)</strong>, the <strong>obligation of securing the data (Art 32 GDPR)</strong> and <strong>absence of data subject notification.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art 28-3 GDPR</strong><strong></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be comply with the requirements of article 28 GDPR in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art 28-4 <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of art 28 para 3 and 4. These contracts have include specific clauses</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In response to Slimpay argument, the CNIL logically responded that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. <strong>On the obligation to ensure the security of the data</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on article 32 GDPR, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"type\":\"a\"} -->\n<ul type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argue a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimplay argued the security whole was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Not wistanding an actual damaged caused to data subjects, the lack of security is in itself a breach of article 32. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as article 82 GDPR allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be itself a breach of data as rarely data subjects can prove immediate harm after a data is compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of an employee’s negligent was not retained as in any case the company was liable to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Last week, <a href=\"https://eugd.org/2500-euros-damages-eugd-scalable-capital-data-leak/\" target=\"_blank\" rel=\"noreferrer noopener\">a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also the Danish DPA announced it found that a public entity sent personal data, including sensitive personal data and children\'s personal data, via unencrypted email. The DPA ruled that the public entity did not implement the necessary security measures, taking into account the amount and type of information being<br><a href=\"https://lnkd.in/ePBCrYyY\" target=\"_blank\" rel=\"noreferrer noopener\">Here\'s the decision</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accept Slimplay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considers that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of article 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the article 83 GDPR, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance in securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they have omitted the notifications article 34 to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits I 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains Civil damages for data subjects whose data have been negligently handled. Recital 45 allows data subjects to sue indistinctively the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the criminal offense of not complying with the obligations of article 32 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2313,\"width\":840,\"height\":878,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\" width=\"840\" height=\"878\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement article 28 to his professional accounts, with a lack of transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the invalidation of the Privacy Shield. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Client had warned about the particular sensitivity of the personal and financial data included in the documents. Tey had refused encryption despite all recommendations by the CNIL and any IT security in breach of article 32 GDPR. They took long time and several contacts before they notify the breach to the CNIL, so far never notified data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO has mentioned secured means of document exchange. The other law firm plays with Wetransfer links to avoid the respect of fair communications. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is one example of how things can go wrong following a data breach of personal data mentioned in the newly adopted version of the&nbsp;<a href=\"https://www.linkedin.com/company/eu-edpb/\">European Data Protection Board</a>\'s Guidelines 01/2021 on Examples regarding Personal Data&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=breach&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">Breach</a>&nbsp;Notification under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">GDPR</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2325,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2022-01-04-at-11.00.34-971x1024.png\" alt=\"\" class=\"wp-image-2325\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Lawyers or other legal professionals bound by attorney client privilege or confidentiality should be more careful when handling documents containing personal or financial data. This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following closely, as it seems like the French CNIL is starting the year 2022 with vigour, a sanction against the French mobile company Free. Here resumed by the great Jimmy Orucevic :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cnil&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">CNIL</a>&nbsp;fines FREE MOBILE for failure to respond to inquiries from data subjects, false invoices, e-mailing of passwords in plain text --&gt; € 300\'000</em></p><p><em>The french&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">DataProtection</a>&nbsp;authority has received many complaints concerning the difficulties encountered by individuals in having responses to their requests for&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=access&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">access</a>&nbsp;and to object to receiving&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=commercial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">commercial</a>&nbsp;prospecting messages from the French mobile telephone operator FREE MOBILE.</em></p><p><em>The CNIL retained 4 breaches of the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">#GDPR</a>&nbsp;against the company:</em></p><p><em>- a failure to respect the right of access of individuals regarding their&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personal&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">personal</a>&nbsp;data (Art. 12 and 15 of the GDPR), since the company did not respond to the requests made by the complainants within the time limits;</em></p><p><em>- a&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=failure&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">failure</a>&nbsp;to respect the right to&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=object&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">object</a>&nbsp;of the persons concerned (Art. 12 and 21 of the GDPR), since the company did not take into account the requests of the complainants that no more commercial prospecting messages be sent to them;</em></p><p><em>-a breach of the obligation to protect data by&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=design&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">design</a>&nbsp;(Art. 25 of the GDPR), as the company continued to send invoices to complainants for telephone lines whose&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=subscription&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">subscription</a>&nbsp;had been cancelled;</em></p><p><em>- a breach of the obligation to ensure the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">security</a>&nbsp;of personal data (Art. 32 of the GDPR), since the company transmitted by&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=email&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">email</a>&nbsp;- in clear text - the passwords of users when they subscribed to an offer with FREE MOBILE, without these passwords being temporary and the company requiring them to be changed.</em></p><p><em>This fine takes into account the size and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=financial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">financial</a>&nbsp;situation of the company. Its publicity is justified by the need to reiterate the importance of responding to requests for exercising the data subject\'s rights and ensuring the security of users\' data.</em></p><p><em>decision accessible <a rel=\"noreferrer noopener\" href=\"https://lnkd.in/dAC5mf9K\" target=\"_blank\">here</a></em></p><cite>[Hashtags removed]</cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Again the question of security of data questioned. A password in clear in an email is a no no, as much as personal or confidential documents exchange by unencrypted emails or transfer of documents in the hands of thord party apps without assessment and a Data Protection Agreement article 28 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Renforcer la sécurité de toute transmission de données à caractère personnel.&nbsp;</em></p><p><em><strong>La messagerie électronique ne constitue pas un moyen de communication sûr&nbsp;</strong>pour transmettre des données personnelles, sans mesure complémentaire. Une simple erreur de manipulation peut conduire à divulguer à des destinataires non habilités des données personnelles et à porter ainsi atteinte au droit&nbsp;&nbsp;&nbsp; à la vie privée des personnes. En outre, toute entité ayant accès aux serveurs de messagerie concernés (notamment ceux des émetteurs et destinataires) peut avoir accès à leur</em></p><cite><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024#item410340589\" target=\"_blank\">CNIL\'s guidance</a><br><br>\"reinforcing the security of any transmission of personal data.<strong> E-mail is not a secure means of communication for transmitting personal data without further action.</strong> A simple error in handling may lead to the disclosure of personal data to unauthorised recipients and thus infringe on the right to privacy of individuals. In addition, any entity with access to the relevant mail servers (including those of the senders and recipients) may have access to their content.\"</cite></blockquote>\n<!-- /wp:quote --></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-04 11:32:21','2022-01-04 11:32:21','',2311,'https://www.datarainbow.eu/?p=2332',0,'revision','',0),(2333,1,'2022-01-04 12:01:30','2022-01-04 12:01:30','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay launched a research program using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database. Data was left on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: <strong>data minimisation</strong> and <strong>storage limitation</strong>. Possibly <strong>data accuracy </strong>as part of the data stored would have become inaccurate after time. <strong>Purpose limitation </strong>could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":2330,\"width\":449,\"height\":253,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Art5_Principles-1024x577.png\" alt=\"\" class=\"wp-image-2330\" width=\"449\" height=\"253\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients concerning the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s only on October the 21<sup>st</sup>, 8 months after the initial notification, that the CNIL enquired about their notifications to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021, the case was instructed by the ‘<em>commission restreinte</em>’ (restricted commission) for the <strong>infringement of articles 28-3 and 28-4, 32 and 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was accepted that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the <strong>lack of compliant data processing agreements (art 28-3 GDPR)</strong>, the <strong>obligation of securing the data (Art 32 GDPR)</strong> and <strong>absence of data subject notification.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art 28-3 GDPR</strong><strong></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be compliant with the requirements of article 28 GDPR in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art 28-4 : <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does not comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of art 28 para 3 and 4. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL logically considered that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Something to remember whenever you use a third party to share personal data with, make sure you assess their GDPR compliance and put in place appropriate DPAs. This is a requirement for any processor such as an IT supplier or any kind of data processing tools.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. <strong>On the obligation to ensure the security of the data</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on <strong>article 32 GDPR</strong>, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"type\":\"a\"} -->\n<ul type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted. Always check if you have correctly limited access to data to the strict minimum.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Vainly, Slimpay argued a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was deemed sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued the security flaw was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Notwithstanding an actual damaged caused to data subjects, the lack of security is in itself a breach of article 32. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as article 82 GDPR allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be in itself a breach of data as rarely data subjects can prove immediate harm after data are compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft. (see below the ID and financial theft cited by the EDPB)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of a negligent employee was not retained as in any case it\'s the company\'s duty to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>--> Last week, <a rel=\"noreferrer noopener\" href=\"https://eugd.org/2500-euros-damages-eugd-scalable-capital-data-leak/\" target=\"_blank\">a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>--> Also the Danish DPA announced it found that a public entity sent personal data, including sensitive personal data and children\'s personal data, via unencrypted email. The DPA ruled that the public entity did not implement the necessary security measures, taking into account the amount and type of information being<br><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/ePBCrYyY\" target=\"_blank\">Here\'s the decision</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accepted Slimpay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of article 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the <strong>article 83 GDPR</strong>, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em> » reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance for securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they had omitted the notifications article 34 to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits in 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains <strong>Civil damages article 82 GDPR</strong> for data subjects whose data have been negligently handled. <strong><a href=\"https://gdpr-info.eu/recitals/no-146/\" target=\"_blank\" rel=\"noreferrer noopener\">Recital 146</a></strong> allows data subjects to sue the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Where controllers or processors are involved in the same processing, each controller or processor should be held liable for the entire damage.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Art 79 (1) of the GDPR&nbsp;provides:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the criminal offense of not complying with the obligations of article 32 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2313,\"width\":840,\"height\":878,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\" width=\"840\" height=\"878\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement article 28 to his professional accounts, with a lack of transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the invalidation of the Privacy Shield. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Client had warned about the particular sensitivity of the personal and financial data included in the documents. Tey had refused encryption despite all recommendations by the CNIL and any IT security in breach of article 32 GDPR. They took long time and several contacts before they notify the breach to the CNIL, so far never notified data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO has mentioned secured means of document exchange. The other law firm plays with Wetransfer links to avoid the respect of fair communications. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is one example of how things can go wrong following a data breach of personal data mentioned in the newly adopted version of the&nbsp;<a href=\"https://www.linkedin.com/company/eu-edpb/\">European Data Protection Board</a>\'s Guidelines 01/2021 on Examples regarding Personal Data&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=breach&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">Breach</a>&nbsp;Notification under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">GDPR</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2325,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2022-01-04-at-11.00.34-971x1024.png\" alt=\"\" class=\"wp-image-2325\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Lawyers or other legal professionals bound by attorney client privilege or confidentiality should be more careful when handling documents containing personal or financial data. This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following closely, as it seems like the French CNIL is starting the year 2022 with vigour, a sanction against the French mobile company Free. Here resumed by the great Jimmy Orucevic :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cnil&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">CNIL</a>&nbsp;fines FREE MOBILE for failure to respond to inquiries from data subjects, false invoices, e-mailing of passwords in plain text --&gt; € 300\'000</em></p><p><em>The french&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">DataProtection</a>&nbsp;authority has received many complaints concerning the difficulties encountered by individuals in having responses to their requests for&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=access&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">access</a>&nbsp;and to object to receiving&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=commercial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">commercial</a>&nbsp;prospecting messages from the French mobile telephone operator FREE MOBILE.</em></p><p><em>The CNIL retained 4 breaches of the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">#GDPR</a>&nbsp;against the company:</em></p><p><em>- a failure to respect the right of access of individuals regarding their&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personal&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">personal</a>&nbsp;data (Art. 12 and 15 of the GDPR), since the company did not respond to the requests made by the complainants within the time limits;</em></p><p><em>- a&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=failure&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">failure</a>&nbsp;to respect the right to&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=object&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">object</a>&nbsp;of the persons concerned (Art. 12 and 21 of the GDPR), since the company did not take into account the requests of the complainants that no more commercial prospecting messages be sent to them;</em></p><p><em>-a breach of the obligation to protect data by&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=design&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">design</a>&nbsp;(Art. 25 of the GDPR), as the company continued to send invoices to complainants for telephone lines whose&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=subscription&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">subscription</a>&nbsp;had been cancelled;</em></p><p><em>- a breach of the obligation to ensure the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">security</a>&nbsp;of personal data (Art. 32 of the GDPR), since the company transmitted by&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=email&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">email</a>&nbsp;- in clear text - the passwords of users when they subscribed to an offer with FREE MOBILE, without these passwords being temporary and the company requiring them to be changed.</em></p><p><em>This fine takes into account the size and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=financial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">financial</a>&nbsp;situation of the company. Its publicity is justified by the need to reiterate the importance of responding to requests for exercising the data subject\'s rights and ensuring the security of users\' data.</em></p><p><em>decision accessible <a rel=\"noreferrer noopener\" href=\"https://lnkd.in/dAC5mf9K\" target=\"_blank\">here</a></em></p><cite>[Hashtags removed]</cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Again the question of security of data questioned. A password in clear in an email is a no no, as much as personal or confidential documents exchange by unencrypted emails or transfer of documents in the hands of thord party apps without assessment and a Data Protection Agreement article 28 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Renforcer la sécurité de toute transmission de données à caractère personnel.&nbsp;</em></p><p><em><strong>La messagerie électronique ne constitue pas un moyen de communication sûr&nbsp;</strong>pour transmettre des données personnelles, sans mesure complémentaire. Une simple erreur de manipulation peut conduire à divulguer à des destinataires non habilités des données personnelles et à porter ainsi atteinte au droit&nbsp;&nbsp;&nbsp; à la vie privée des personnes. En outre, toute entité ayant accès aux serveurs de messagerie concernés (notamment ceux des émetteurs et destinataires) peut avoir accès à leur</em></p><cite><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024#item410340589\" target=\"_blank\">CNIL\'s guidance</a><br><br>\"reinforcing the security of any transmission of personal data.<strong> E-mail is not a secure means of communication for transmitting personal data without further action.</strong> A simple error in handling may lead to the disclosure of personal data to unauthorised recipients and thus infringe on the right to privacy of individuals. In addition, any entity with access to the relevant mail servers (including those of the senders and recipients) may have access to their content.\"</cite></blockquote>\n<!-- /wp:quote --></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-04 12:01:30','2022-01-04 12:01:30','',2311,'https://www.datarainbow.eu/?p=2333',0,'revision','',0),(2334,1,'2022-01-04 12:04:38','2022-01-04 12:04:38','','Screenshot-2021-12-20-at-19.01.22','','inherit','open','closed','','screenshot-2021-12-20-at-19-01-22','','','2022-01-04 12:04:38','2022-01-04 12:04:38','',2311,'https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-20-at-19.01.22.png',0,'attachment','image/png',0),(2335,1,'2022-01-04 12:15:32','2022-01-04 12:15:32','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay launched a research program using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database. Data was left on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: <strong>data minimisation</strong> and <strong>storage limitation</strong>. Possibly <strong>data accuracy </strong>as part of the data stored would have become inaccurate after time. <strong>Purpose limitation </strong>could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":2330,\"width\":449,\"height\":253,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Art5_Principles-1024x577.png\" alt=\"\" class=\"wp-image-2330\" width=\"449\" height=\"253\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients concerning the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s only on October the 21<sup>st</sup>, 8 months after the initial notification, that the CNIL enquired about their notifications to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021, the case was instructed by the ‘<em>commission restreinte</em>’ (restricted commission) for the <strong>infringement of articles 28-3 and 28-4, 32 and 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was accepted that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the <strong>lack of compliant data processing agreements (art 28-3 GDPR)</strong>, the <strong>obligation of securing the data (Art 32 GDPR)</strong> and <strong>absence of data subject notification.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art 28-3 GDPR</strong><strong></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be compliant with the requirements of article 28 GDPR in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Art 28-4 : <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does not comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of art 28 para 3 and 4. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL logically considered that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Something to remember whenever you use a third party to share personal data with, make sure you assess their GDPR compliance and put in place appropriate DPAs. This is a requirement for any processor such as an IT supplier or any kind of data processing tools.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. <strong>On the obligation to ensure the security of the data</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on <strong>article 32 GDPR</strong>, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"type\":\"a\"} -->\n<ul type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted. Always check if you have correctly limited access to data to the strict minimum.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Vainly, Slimpay argued a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was deemed sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued the security flaw was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Notwithstanding an actual damaged caused to data subjects, the lack of security is in itself a breach of article 32. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as article 82 GDPR allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be in itself a breach of data as rarely data subjects can prove immediate harm after data are compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft. (see below the ID and financial theft cited by the EDPB)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of a negligent employee was not retained as in any case it\'s the company\'s duty to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>--> Last week, <a rel=\"noreferrer noopener\" href=\"https://eugd.org/2500-euros-damages-eugd-scalable-capital-data-leak/\" target=\"_blank\">a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>--> Also the Danish DPA announced it found that a public entity sent personal data, including sensitive personal data and children\'s personal data, via unencrypted email. The DPA ruled that the public entity did not implement the necessary security measures, taking into account the amount and type of information being<br><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/ePBCrYyY\" target=\"_blank\">Here\'s the decision</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accepted Slimpay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of article 34 GDPR</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the <strong>article 83 GDPR</strong>, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em> » reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance for securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they had omitted the notifications article 34 to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits in 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains <strong>Civil damages article 82 GDPR</strong> for data subjects whose data have been negligently handled. <strong><a href=\"https://gdpr-info.eu/recitals/no-146/\" target=\"_blank\" rel=\"noreferrer noopener\">Recital 146</a></strong> allows data subjects to sue the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Where controllers or processors are involved in the same processing, each controller or processor should be held liable for the entire damage.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Art 79 (1) of the GDPR&nbsp;provides:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the <strong>criminal offense </strong>of not complying with the obligations of article 32 GDPR. See below the various laws applying in France</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":2334,\"width\":386,\"height\":260,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-20-at-19.01.22-1024x689.png\" alt=\"\" class=\"wp-image-2334\" width=\"386\" height=\"260\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":2313,\"width\":840,\"height\":878,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\" width=\"840\" height=\"878\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement article 28 to his professional accounts, which lacks transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the<a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\"> invalidation of the Privacy Shield</a>. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the client\'s  warning about the particular sensitivity of the personal and financial data included in the documents. They had refused encryption despite all <a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/securite-securiser-les-echanges-avec-dautres-organismes\" target=\"_blank\">recommendations by the CNIL</a> and any IT security in breach of article 32 GDPR. They took a long time and several requests before they notify the breach to the CNIL, so far no notification to data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO had mentioned they use secured means of document exchange. The other law firm plays with Wetransfer links to escape the respect of fair communications. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To demonstrate how a data breach can cause harm, here is one example of how things can go wrong following a data breach of personal data mentioned in the newly adopted version of the <a href=\"https://www.linkedin.com/company/eu-edpb/\">European Data Protection Board</a>\'s Guidelines 01/2021 on Examples regarding Personal Data <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=breach&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">Breach</a> Notification under the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">GDPR</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2325,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2022-01-04-at-11.00.34-971x1024.png\" alt=\"\" class=\"wp-image-2325\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/law-firm-internet-security-and-data-protection-2/\" target=\"_blank\" rel=\"noreferrer noopener\">Lawyers or other legal professionals</a> bound by attorney client privilege or confidentiality should be more careful when handling documents containing personal or financial data. This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following closely, as it seems like the French CNIL is starting the year 2022 with vigour, a sanction against the French mobile company Free. Here resumed by the great Jimmy Orucevic :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cnil&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">CNIL</a>&nbsp;fines FREE MOBILE for failure to respond to inquiries from data subjects, false invoices, e-mailing of passwords in plain text --&gt; € 300\'000</em></p><p><em>The french&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">DataProtection</a>&nbsp;authority has received many complaints concerning the difficulties encountered by individuals in having responses to their requests for&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=access&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">access</a>&nbsp;and to object to receiving&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=commercial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">commercial</a>&nbsp;prospecting messages from the French mobile telephone operator FREE MOBILE.</em></p><p><em>The CNIL retained 4 breaches of the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">#GDPR</a>&nbsp;against the company:</em></p><p><em>- a failure to respect the right of access of individuals regarding their&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personal&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">personal</a>&nbsp;data (Art. 12 and 15 of the GDPR), since the company did not respond to the requests made by the complainants within the time limits;</em></p><p><em>- a&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=failure&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">failure</a>&nbsp;to respect the right to&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=object&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">object</a>&nbsp;of the persons concerned (Art. 12 and 21 of the GDPR), since the company did not take into account the requests of the complainants that no more commercial prospecting messages be sent to them;</em></p><p><em>-a breach of the obligation to protect data by&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=design&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">design</a>&nbsp;(Art. 25 of the GDPR), as the company continued to send invoices to complainants for telephone lines whose&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=subscription&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">subscription</a>&nbsp;had been cancelled;</em></p><p><em>- a breach of the obligation to ensure the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">security</a>&nbsp;of personal data (Art. 32 of the GDPR), since the company transmitted by&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=email&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">email</a>&nbsp;- in clear text - the passwords of users when they subscribed to an offer with FREE MOBILE, without these passwords being temporary and the company requiring them to be changed.</em></p><p><em>This fine takes into account the size and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=financial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">financial</a>&nbsp;situation of the company. Its publicity is justified by the need to reiterate the importance of responding to requests for exercising the data subject\'s rights and ensuring the security of users\' data.</em></p><p><em>decision accessible <a rel=\"noreferrer noopener\" href=\"https://lnkd.in/dAC5mf9K\" target=\"_blank\">here</a></em></p><cite>[Hashtags removed]</cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Securing data is a duty. A password in clear in an email is a no no, as much as personal or confidential documents exchange by unencrypted emails or transfer of documents in the hands of third party apps without assessment and a Data Protection Agreement article 28 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Renforcer la sécurité de toute transmission de données à caractère personnel.&nbsp;</em></p><p><em><strong>La messagerie électronique ne constitue pas un moyen de communication sûr&nbsp;</strong>pour transmettre des données personnelles, sans mesure complémentaire. Une simple erreur de manipulation peut conduire à divulguer à des destinataires non habilités des données personnelles et à porter ainsi atteinte au droit&nbsp;&nbsp;&nbsp; à la vie privée des personnes. En outre, toute entité ayant accès aux serveurs de messagerie concernés (notamment ceux des émetteurs et destinataires) peut avoir accès à leur</em></p><cite><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024#item410340589\" target=\"_blank\">CNIL\'s guidance</a><br><br>\"reinforcing the security of any transmission of personal data.<strong> E-mail is not a secure means of communication for transmitting personal data without further action.</strong> A simple error in handling may lead to the disclosure of personal data to unauthorised recipients and thus infringe on the right to privacy of individuals. In addition, any entity with access to the relevant mail servers (including those of the senders and recipients) may have access to their content.\"</cite></blockquote>\n<!-- /wp:quote --></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-04 12:15:32','2022-01-04 12:15:32','',2311,'https://www.datarainbow.eu/?p=2335',0,'revision','',0),(2338,1,'2022-01-27 14:41:17','2022-01-27 14:41:17','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay launched a research program using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database. Data was left on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: <strong>data minimisation</strong> and <strong>storage limitation</strong>. Possibly <strong>data accuracy </strong>as part of the data stored would have become inaccurate after time. <strong>Purpose limitation </strong>could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":2330,\"width\":449,\"height\":253,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Art5_Principles-1024x577.png\" alt=\"\" class=\"wp-image-2330\" width=\"449\" height=\"253\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients concerning the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s only on October the 21<sup>st</sup>, 8 months after the initial notification, that the CNIL enquired about their notifications to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021, the case was instructed by the ‘<em>commission restreinte</em>’ (restricted commission) for the <strong>infringement of articles <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">28-3 and 28-4</a>, <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">32</a> and <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-34-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">34 GDPR</a></strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was accepted that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the <strong>lack of compliant data processing agreements (<a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Art 28-3 GDPR</a>)</strong>, the <strong>obligation of securing the data (<a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\">Art 32 GDPR</a>)</strong> and <strong>absence of data subject notification.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">28-3 GDPR</a></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be compliant with the requirements of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 28 GDPR</a> in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Art 28-4</a> : <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does not comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">art 28 para 3 and 4</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL logically considered that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Something to remember whenever you use a third party to share personal data with, make sure you assess their GDPR compliance and put in place appropriate DPAs. This is a requirement for any processor such as an IT supplier or any kind of data processing tools.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. <strong>On the obligation to ensure the security of the data</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on <strong><a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32 GDPR</a></strong>, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"type\":\"a\"} -->\n<ul type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted. Always check if you have correctly limited access to data to the strict minimum.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Vainly, Slimpay argued a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did not check if the data had been accessed, the only fact that the data was easily accessible to unauthorised readers was deemed sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued the security flaw was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Notwithstanding an actual damaged caused to data subjects, the lack of security is in itself a breach of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 32</a>. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as <a href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 82 GDPR</a> allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be in itself a breach of data as rarely data subjects can prove immediate harm after data are compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing is real, including for an ID theft. (see below the ID and financial theft cited by the EDPB)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of a negligent employee was not retained as in any case it\'s the company\'s duty to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>--&gt; Last week, <a rel=\"noreferrer noopener\" href=\"https://eugd.org/2500-euros-damages-eugd-scalable-capital-data-leak/\" target=\"_blank\">a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>--&gt; Also the Danish DPA announced it found that a public entity sent personal data, including sensitive personal data and children\'s personal data, via unencrypted email. The DPA ruled that the public entity did not implement the necessary security measures, taking into account the amount and type of information being<br><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/ePBCrYyY\" target=\"_blank\">Here\'s the decision</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accepted Slimpay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-34-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 34 GDPR</a></strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the <strong>article 83 GDPR</strong>, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance for securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they had omitted the notifications <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-34-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 34</a> to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits in 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains <strong>Civil damages <a href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 82 GDPR</a></strong> for data subjects whose data have been negligently handled. <strong><a rel=\"noreferrer noopener\" href=\"https://gdpr-info.eu/recitals/no-146/\" target=\"_blank\">Recital 146</a></strong> allows data subjects to sue the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Where controllers or processors are involved in the same processing, each controller or processor should be held liable for the entire damage.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Art 79 (1) of the GDPR&nbsp;provides:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the <strong>criminal offense </strong>of not complying with the obligations of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 32 GDPR</a>. See below the various laws applying in France</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":2334,\"width\":386,\"height\":260,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-20-at-19.01.22-1024x689.png\" alt=\"\" class=\"wp-image-2334\" width=\"386\" height=\"260\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":2313,\"width\":840,\"height\":878,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\" width=\"840\" height=\"878\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 28 </a>to his professional accounts, which lacks transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the<a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\"> invalidation of the Privacy Shield</a>. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the client\'s  warning about the particular sensitivity of the personal and financial data included in the documents. They had refused encryption despite all <a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/securite-securiser-les-echanges-avec-dautres-organismes\" target=\"_blank\">recommendations by the CNIL</a> and any IT security in breach of article 32 GDPR. They took a long time and several requests before they notify the breach to the CNIL, so far no notification to data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO had mentioned they use secured means of document exchange. The other law firm plays with Wetransfer links to escape the respect of fair communications. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To demonstrate how a data breach can cause harm, here is one example of how things can go wrong following a data breach of personal data mentioned in the newly adopted version of the&nbsp;<a href=\"https://www.linkedin.com/company/eu-edpb/\">European Data Protection Board</a>\'s Guidelines 01/2021 on Examples regarding Personal Data&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=breach&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">Breach</a>&nbsp;Notification under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">GDPR</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2325,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2022-01-04-at-11.00.34-971x1024.png\" alt=\"\" class=\"wp-image-2325\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/law-firm-internet-security-and-data-protection-2/\" target=\"_blank\" rel=\"noreferrer noopener\">Lawyers or other legal professionals</a> bound by attorney client privilege or confidentiality should be more careful when handling documents containing personal or financial data. This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following closely, as it seems like the French CNIL is starting the year 2022 with vigour, a sanction against the French mobile company Free. Here resumed by the great Jimmy Orucevic :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cnil&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">CNIL</a> fines FREE MOBILE for failure to respond to inquiries from data subjects, false invoices, e-mailing of passwords in plain text --> € 300\'000</em></p><p><em>The french <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">DataProtection</a> authority has received many complaints concerning the difficulties encountered by individuals in having responses to their requests for <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=access&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">access</a> and to object to receiving <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=commercial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">commercial</a> prospecting messages from the French mobile telephone operator FREE MOBILE.</em></p><p><em>The CNIL retained 4 breaches of the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">#GDPR</a> against the company:</em></p><p><em>- a failure to respect the right of access of individuals regarding their <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personal&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">personal</a> data (Art. 12 and 15 of the GDPR), since the company did not respond to the requests made by the complainants within the time limits;</em></p><p><em>- a <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=failure&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">failure</a> to respect the right to <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=object&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">object</a> of the persons concerned (Art. 12 and 21 of the GDPR), since the company did not take into account the requests of the complainants that no more commercial prospecting messages be sent to them;</em></p><p><em>-a breach of the obligation to protect data by <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=design&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">design</a> (Art. 25 of the GDPR), as the company continued to send invoices to complainants for telephone lines whose <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=subscription&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">subscription</a> had been cancelled;</em></p><p><em>- a breach of the obligation to ensure the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">security</a> of personal data (<a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Art. 32 of the GDPR</a>), since the company transmitted by <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=email&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">email</a> - in clear text - the passwords of users when they subscribed to an offer with FREE MOBILE, without these passwords being temporary and the company requiring them to be changed.</em></p><p><em>This fine takes into account the size and the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=financial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">financial</a> situation of the company. Its publicity is justified by the need to reiterate the importance of responding to requests for exercising the data subject\'s rights and ensuring the security of users\' data.</em></p><p><em>decision accessible <a rel=\"noreferrer noopener\" href=\"https://lnkd.in/dAC5mf9K\" target=\"_blank\">here</a></em></p><cite>[Hashtags removed]</cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Securing data is a duty. A password in clear in an email is a no no, as much as personal or confidential documents exchange by unencrypted emails or transfer of documents in the hands of third party apps without assessment and a Data Protection Agreement <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 28 GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Renforcer la sécurité de toute transmission de données à caractère personnel.&nbsp;</em></p><p><em><strong>La messagerie électronique ne constitue pas un moyen de communication sûr&nbsp;</strong>pour transmettre des données personnelles, sans mesure complémentaire. Une simple erreur de manipulation peut conduire à divulguer à des destinataires non habilités des données personnelles et à porter ainsi atteinte au droit&nbsp;&nbsp;&nbsp; à la vie privée des personnes. En outre, toute entité ayant accès aux serveurs de messagerie concernés (notamment ceux des émetteurs et destinataires) peut avoir accès à leur</em></p><cite><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024#item410340589\" target=\"_blank\">CNIL\'s guidance</a><br><br>\"reinforcing the security of any transmission of personal data.<strong> E-mail is not a secure means of communication for transmitting personal data without further action.</strong> A simple error in handling may lead to the disclosure of personal data to unauthorised recipients and thus infringe on the right to privacy of individuals. In addition, any entity with access to the relevant mail servers (including those of the senders and recipients) may have access to their content.\"</cite></blockquote>\n<!-- /wp:quote --></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-27 14:41:17','2022-01-27 14:41:17','',2311,'https://www.datarainbow.eu/?p=2338',0,'revision','',0),(2339,1,'2022-01-27 14:47:29','2022-01-27 14:47:29','<!-- wp:paragraph -->\n<p>In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During summer 2015, Slimpay launched a research program using their database of the payers held on behalf of their clients. Once the research completed, they failed to delete the database. Data was left on an unsecured system accessible online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Breach of at least two processing principles: <strong>data minimisation</strong> and <strong>storage limitation</strong>. Possibly <strong>data accuracy </strong>as part of the data stored would have become inaccurate after time. <strong>Purpose limitation </strong>could initially be justified as increasing the securing of the data could justify the operation although it’s unclear if they needed to research on the entire data base of more than 12 million individuals.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":2330,\"width\":449,\"height\":253,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Art5_Principles-1024x577.png\" alt=\"\" class=\"wp-image-2330\" width=\"449\" height=\"253\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>On February 14<sup>th </sup>2020, they were alerted by one of their clients concerning the vulnerability of their server. They immediately disconnected the database. February 17th 2020 they have notified the data breach to the CNIL, followed by further detailed notifications in February the 20th.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The breach affected the data of 12 million clients’ data including bank BIC and IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s only on October the 21<sup>st</sup>, 8 months after the initial notification, that the CNIL enquired about their notifications to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More than a year later, in 21<sup>st</sup> of September 2021, the case was instructed by the ‘<em>commission restreinte</em>’ (restricted commission) for the <strong>infringement of articles <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">28-3 and 28-4</a>, <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">32</a> and <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-34-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">34 GDPR</a></strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case having cross border elements, the CNIL played the lead authority as the company’s HQ is based in France.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I note that the CNIL mentioned ‘<em>aucune objection pertinente et motivée’</em> (no relevant or reasoned objection) from concerned DPAs was formulated.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was accepted that in the specific context of this internal research, company Slimpay was the data controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL made a series of observations retaining liability of Slimpay for the <strong>lack of compliant data processing agreements (<a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Art 28-3 GDPR</a>)</strong>, the <strong>obligation of securing the data (<a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\">Art 32 GDPR</a>)</strong> and <strong>absence of data subject notification.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><strong>Lack of data processing agreement art <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">28-3 GDPR</a></strong></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Every and each sub processing has to be compliant with the requirements of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 28 GDPR</a> in order to ensure a compliant processing of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Art 28-4</a> : <strong>a data processor using a sub processor on behalf of the data controller has the same liabilities as what has been fixed in the original data processing agreement.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When the sub-processor does not comply with its obligations the initial processor’s liability is engaged.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered a simple questionnaire sent to the sub-processor, without any proof of a response, did not fulfil the requirements of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">art 28 para 3 and 4</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, several contracts passed between the company and its sub-processors did not contain all the required clauses such as the type of data and rights and obligations of the controller. (CNIL has published the <a href=\"https://www.cnil.fr/fr/clauses-contractuelles-types-entre-responsable-de-traitement-et-sous-traitant\">DPA clauses 30 June 2021</a>, modifying the document <a href=\"https://www.cnil.fr/fr/sous-traitance-exemple-de-clauses\">published in 2017</a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL logically considered that the produced amendment to the contract signed in July 2021 was precisely a proof in itself that the company was not compliant at the time it was investigated and it’s still not fully compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Something to remember whenever you use a third party to share personal data with, make sure you assess their GDPR compliance and put in place appropriate DPAs. This is a requirement for any processor such as an IT supplier or any kind of data processing tools.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. <strong>On the obligation to ensure the security of the data</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on <strong><a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32 GDPR</a></strong>, taking account of the risks involved,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"type\":\"a\"} -->\n<ul type=\"a\"><li><strong>First on the lack of appropriate security measures</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The database was used in the context of tests measuring fraud resistance between 2015 and 2016. The database then was stored on an insecure server. It was a vigilant client that warned the company. The ongoing security vulnerability was compared to a case previously ruled by the higher administrative court, Conseil d’Etat, on March 2021 concerning Futura Internationale.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Access to the server were not restricted. Always check if you have correctly limited access to data to the strict minimum.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Vainly, Slimpay argued a human error more than a weakness of his security system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the server was accessible via an URL with an easily identifiable IP when using a hoovering software available online. There was no server logging to identify unauthorised access to servers as recommended by ANSSI to detect potential intrusions and track fraudulent access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the database was stored in clear on the server, visible with any text edit tool.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the absence of measures of security of the server and access limitation has made the servers easily accessible from the internet.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>It worth pointing that the CNIL did considered irrelevant the fact that the data had been accessed or not, the only fact that the data was easily accessible to unauthorised readers was deemed sufficient.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued the security flaw was not exploited as no one had complained about any misuse of the personal data. For the CNIL, even in the absence of proof of access, Slimpay has been liable for lack of security measures and risks of fraudulent use were real. Notwithstanding an actual damaged caused to data subjects, the lack of security is in itself a breach of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 32</a>. A large number of 12.478.819 European citizens date of birth, postal and email addresses, telephone number and bank information (BIC/IBAN) have been compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very important point to underline as <a href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 82 GDPR</a> allows civil compensation for non-material damage while courts have been too shy to allow compensation for potential damages. Putting at risk data should be in itself a breach of data as rarely data subjects can prove immediate harm after data are compromised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For the CNIL the risk of data misuse and phishing are real, including for an ID theft. (see below the ID and financial theft cited by the EDPB).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The argument of a negligent employee was not retained as in any case it\'s the company\'s duty to ensure the security of the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>--&gt; Last week, <a rel=\"noreferrer noopener\" href=\"https://eugd.org/2500-euros-damages-eugd-scalable-capital-data-leak/\" target=\"_blank\">a German court allowed a civil claim awarding 2500 € in damage following a data breach Art 82 DPR non-material damage.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>--&gt; Also the Danish DPA announced it found that a public entity sent personal data, including sensitive personal data and children\'s personal data, via unencrypted email. The DPA ruled that the public entity did not implement the necessary security measures, taking into account the amount and type of information being<br><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/ePBCrYyY\" target=\"_blank\">Here\'s the decision</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>On the password weakness</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Clients’ access were protected by an obsolete hash SHA-1 that could be simply one word.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay objected this was a partially incorrect information initially communicated as the new interface would use Bcrypt recommended by the CNIL a brut force interface with multi factor authentication requiring a 10-128 character password. CNIL accepted Slimpay’s evidences.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Absence of data subjects notification</strong>s</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The CNIL considered that in view of the nature of the personal data, the volume of data subjects, the ease of identifying the persons affected by the breach and the possible consequences for the data subjects, the risk associated with the breach could be considered high and that <strong>notification to data subjects should have been made</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL rejects Slimpay’s argument that they initially processed the data on behalf of clients or lack of sufficient risk. <strong>The risks were real: phishing, ID theft and associated risks</strong>. They had the email addresses of half of the data subjects and could have made a public information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL concluded that <strong>Slimpay had been in breach of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-34-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 34 GDPR</a></strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>On the amount of the fine</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fine of 180.000 € is relatively mild comparing to the margin of 4% of global turnover or 20 million €.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on the <strong><a href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-83-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 83 GDPR</a></strong>, taking account of the length of data breach, the number of individuals concerned and the sensitivity of the data, especially as for IBAN numbers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Slimpay argued they have diligently collaborated with the CNIL, notified within 72 hours &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL, based on a document issued by the Banque de France in “<em>paiements et infrastructures de marché à l’ère digitale</em>&nbsp;» reminds that <strong>IBAN numbers can be used in financial frauds</strong>. EDPB has qualified this kind of data of ‘<strong>highly personal’</strong>. Therefore, Slimpay should have deployed exceptional vigilance for securing such data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Taking account of the duration of the breach, the lack of security measures, despite an immediate reaction and their collaboration, the negligence was of particular gravity (lack of logging of access and access to the server). Additionally, they had omitted the notifications <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-34-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 34</a> to data subjects.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the financial situation of the company and its net benefits in 2019 and 2020 (not mentioned), 180.000 € was justified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Considering the number of victims concerned by the breach, the decision was made public.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is for the administrative sanction.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains <strong>Civil damages <a href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 82 GDPR</a></strong> for data subjects whose data have been negligently handled. <strong><a rel=\"noreferrer noopener\" href=\"https://gdpr-info.eu/recitals/no-146/\" target=\"_blank\">Recital 146</a></strong> allows data subjects to sue the data controller or his processors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Where controllers or processors are involved in the same processing, each controller or processor should be held liable for the entire damage.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Art 79 (1) of the GDPR&nbsp;provides:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>\"Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.\"</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Ultimately, there is the <strong>criminal offense </strong>of not complying with the obligations of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 32 GDPR</a>. See below the various laws applying in France</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":2334,\"width\":386,\"height\":260,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-20-at-19.01.22-1024x689.png\" alt=\"\" class=\"wp-image-2334\" width=\"386\" height=\"260\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Here is an example of data breach that has led into phishing. Cybercriminals accessed the legal firm\'s inbox to extract then reproduce personal data from previous email exchanges left on the inbox. Then the data reproduced was sent as a chain of email including a malware attachment. <a rel=\"noreferrer noopener\" href=\"https://www.bleepingcomputer.com/news/security/ikea-email-systems-hit-by-ongoing-cyberattack/\" target=\"_blank\">Ikea</a> and <a rel=\"noreferrer noopener\" href=\"https://petapixel.com/2021/06/03/fujifilm-shuts-down-servers-to-investigate-possible-cyber-attack/\" target=\"_blank\">Fujifilm</a> were recently victims of similar attacks along with several notaires in France. In this case, the data controller had to be reminded after several warnings, finally waken up to remember they a DPO, to notify the data breach to the CNIL. They are still denying data subjects would have occurred any risk despite a large amount of personal data – including IDs, bank details and IBAN numbers being stored without any appropriate security measures on their inbox. These being legal professionals bound by confidentiality of the documents, their liability is aggravated by such negligence, despite client’s warning on the sensitivity of the documents exchange.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"align\":\"center\",\"id\":2313,\"width\":840,\"height\":878,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2021-12-16-at-19.18.28-979x1024.png\" alt=\"\" class=\"wp-image-2313\" width=\"840\" height=\"878\"/></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>One law firm involved persists to exchange these sensitive documents via mainstream application Wetransfer, a processor that only offers data protection agreement <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 28 </a>to his professional accounts, which lacks transparency to third parties. Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">Wetransfer uses AWS cloud storage</a> which constitute a data transfer to the US in breach of Chapitre-V GDPR since the<a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\"> invalidation of the Privacy Shield</a>. Currently the CNIL is instructing the case and a criminal complaint to the French Prosecutor is investigating as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the client\'s  warning about the particular sensitivity of the personal and financial data included in the documents. They had refused encryption despite all <a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/securite-securiser-les-echanges-avec-dautres-organismes\" target=\"_blank\">recommendations by the CNIL</a> and any IT security in breach of article 32 GDPR. They took a long time and several requests before they notify the breach to the CNIL, so far no notification to data subjects as they consider there has been no risk. They would continue to exchange data by simple email attachment if they were not reminded their DPO had mentioned they use secured means of document exchange. The other law firm plays with Wetransfer links to escape the respect of fair communications. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To demonstrate how a data breach can cause harm, here is one example of how things can go wrong following a data breach of personal data mentioned in the newly adopted version of the&nbsp;<a href=\"https://www.linkedin.com/company/eu-edpb/\">European Data Protection Board</a>\'s Guidelines 01/2021 on Examples regarding Personal Data&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=breach&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">Breach</a>&nbsp;Notification under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884055934340001792\">GDPR</a> :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2325,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/01/Screenshot-2022-01-04-at-11.00.34-971x1024.png\" alt=\"\" class=\"wp-image-2325\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/law-firm-internet-security-and-data-protection-2/\" target=\"_blank\" rel=\"noreferrer noopener\">Lawyers or other legal professionals</a> bound by attorney client privilege or confidentiality should be more careful when handling documents containing personal or financial data. This should be a reminder that securing personal data is not optional, especially for professionals handling sensitive data or subject to confidentiality. Lawyers and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024\" target=\"_blank\">legal professions are being increasingly targeted by cyber criminals</a>. According to the security agency ANSSI, 2021 saw an increase of 300% in ransomware attacks. <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/dataleak\" target=\"_blank\">Here are curated some of the major cyberattacks. </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following closely, as it seems like the French CNIL is starting the year 2022 with vigour, a sanction against the French mobile company Free. Here resumed by the great Jimmy Orucevic :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em><a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cnil&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">CNIL</a> fines FREE MOBILE for failure to respond to inquiries from data subjects, false invoices, e-mailing of passwords in plain text --> € 300\'000</em></p><p><em>The french <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=dataprotection&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">DataProtection</a> authority has received many complaints concerning the difficulties encountered by individuals in having responses to their requests for <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=access&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">access</a> and to object to receiving <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=commercial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">commercial</a> prospecting messages from the French mobile telephone operator FREE MOBILE.</em></p><p><em>The CNIL retained 4 breaches of the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">#GDPR</a> against the company:</em></p><p><em>- a failure to respect the right of access of individuals regarding their <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=personal&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">personal</a> data (<a href=\"https://ukgdpr.fieldfisher.com/chapter-3/article-12/\" target=\"_blank\" rel=\"noreferrer noopener\">Art. 12 </a>and <a href=\"https://ukgdpr.fieldfisher.com/chapter-3/article-15-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">15</a> of the GDPR), since the company did not respond to the requests made by the complainants within the time limits;</em></p><p><em>- a <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=failure&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">failure</a> to respect the right to <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=object&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">object</a> of the persons concerned (<a href=\"https://ukgdpr.fieldfisher.com/chapter-3/article-12/\" target=\"_blank\" rel=\"noreferrer noopener\">Art. 12 </a>and<a href=\"https://ukgdpr.fieldfisher.com/chapter-3/article-21-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\"> 21</a> of the GDPR), since the company did not take into account the requests of the complainants that no more commercial prospecting messages be sent to them;</em></p><p><em>-a breach of the obligation to protect data by <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=design&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">design</a> (<a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-25-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Art. 25 of the GDPR</a>), as the company continued to send invoices to complainants for telephone lines whose <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=subscription&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">subscription</a> had been cancelled;</em></p><p><em>- a breach of the obligation to ensure the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">security</a> of personal data (<a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Art. 32 of the GDPR</a>), since the company transmitted by <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=email&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">email</a> - in clear text - the passwords of users when they subscribed to an offer with FREE MOBILE, without these passwords being temporary and the company requiring them to be changed.</em></p><p><em>This fine takes into account the size and the <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=financial&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6884068507982544896\">financial</a> situation of the company. Its publicity is justified by the need to reiterate the importance of responding to requests for exercising the data subject\'s rights and ensuring the security of users\' data.</em></p><p><em>decision accessible <a rel=\"noreferrer noopener\" href=\"https://lnkd.in/dAC5mf9K\" target=\"_blank\">here</a></em></p><cite>[Hashtags removed]</cite></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Securing data is a duty. A password in clear in an email is a no no, as much as personal or confidential documents exchange by unencrypted emails or transfer of documents in the hands of third party apps without assessment and a Data Protection Agreement <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">article 28 GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>Renforcer la sécurité de toute transmission de données à caractère personnel.&nbsp;</em></p><p><em><strong>La messagerie électronique ne constitue pas un moyen de communication sûr&nbsp;</strong>pour transmettre des données personnelles, sans mesure complémentaire. Une simple erreur de manipulation peut conduire à divulguer à des destinataires non habilités des données personnelles et à porter ainsi atteinte au droit&nbsp;&nbsp;&nbsp; à la vie privée des personnes. En outre, toute entité ayant accès aux serveurs de messagerie concernés (notamment ceux des émetteurs et destinataires) peut avoir accès à leur</em></p><cite><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-in-law-firms/id37123024#item410340589\" target=\"_blank\">CNIL\'s guidance</a><br><br>\"reinforcing the security of any transmission of personal data.<strong> E-mail is not a secure means of communication for transmitting personal data without further action.</strong> A simple error in handling may lead to the disclosure of personal data to unauthorised recipients and thus infringe on the right to privacy of individuals. In addition, any entity with access to the relevant mail servers (including those of the senders and recipients) may have access to their content.\"</cite></blockquote>\n<!-- /wp:quote --></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','CNIL Fined Slimpay For its Lack of Security','In the midst of the holiday season, the French Data Protection Authority CNIL issued an administrative sanction to a French company operating in several countries in Europe offering payment solutions for lack of security art 32 GDPR and absence of data subject notification.','inherit','closed','closed','','2311-revision-v1','','','2022-01-27 14:47:29','2022-01-27 14:47:29','',2311,'https://www.datarainbow.eu/?p=2339',0,'revision','',0),(2341,1,'2022-02-11 13:16:47','2022-02-11 13:16:47','<!-- wp:paragraph -->\n<p>Non compliance with the GDPR has three series of legal consequences : We\'ve extensively heard of the administrative enforcement by national Data Protection Authorities. We have less heard of Criminal liabilities for non compliance, especially for the absence of measures of security. The third level is civil liability as set by the <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\">Article 82 GDPR</a>. This article establishes a right to compensation and liability to \'<em>Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.</em>\' Action can be taken individually or in a class action. This is a serious threat while we are witnessing high rise of data breach incidents with increase cyber attacks and ransomware. When a controller has neglected to take appropriate security measures, it has to be liable for compensation. The difficulty here is that often the damage caused is not measurable or not imminent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its recent enforcement against an online payment company Slimpay, the French Data Protection CNIL clearly states that non compliance with the obligations of security in <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 32 GDPR</a> is sufficient without the need to prove access to the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>La formation restreinte considère que l’absence de preuve d’une utilisation frauduleuse des données est sans incidence sur la caractérisation du manquement à l’obligation de sécurité. En effet, le risque d’utilisation frauduleuse des données à caractère personnel était réel, indépendamment des cas de fraude, dans la mesure où les données de nombreuses personnes ont été rendues accessibles à des tiers non autorisés. L’absence de dommage avéré pour les personnes concernées n’a pas d’incidence sur l’existence du défaut de sécurité, qui constitue le manquement à l’article 32 du RGPD.</em>\"</p><p>The restricted panel considers that the absence of evidence of fraudulent use of the data has no bearing on the characterisation of the breach of the security obligation. <strong>The risk of fraudulent use of personal data was real, irrespective of the cases of fraud, in so far as the data of many persons were made accessible to unauthorised third parties. The absence of proven damage to the data subjects does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.</strong></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The Recital 146 goes more into detail on the indemnity:  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The controller or processor should compensate any damage which a person may suffer as a result of processing that infringes this Regulation. The controller or processor should be exempt from liability if it proves that it is not in any way responsible for the damage. <strong>The concept of damage should be broadly interpreted in the light of the case-law of the Court of Justice in a manner which fully reflects the objectives of this Regulation</strong>. This is without prejudice to any claims for damage deriving from the violation of other rules in Union or Member State law. Processing that infringes this Regulation also includes processing that infringes delegated and implementing acts adopted in accordance with this Regulation and Member State law specifying rules of this Regulation. <strong>Data subjects should receive full and effective compensation for the damage they have suffered</strong>. Where controllers or processors are involved in the same processing, <strong>each controller or processor should be held liable for the entire damage.</strong> However, where they are joined to the same judicial proceedings, in accordance with Member State law, compensation may be apportioned according to the responsibility of each controller or processor for the damage caused by the processing, provided that full and effective compensation of the data subject who suffered the damage is ensured. Any controller or processor which has paid full compensation may subsequently institute recourse proceedings against other controllers or processors involved in the same processing.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Recital 85 in the context of a data breach states that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, <strong>material or non-material damage</strong> to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy <strong>or any other significant economic or social disadvantage</strong> to the natural person concerned. </em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Several recent data breaches, British Airways, EASYJET, MARRIOTT, TICKET MASTER, ETC... have been hurt by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/class-actions/id43827607\" target=\"_blank\">class actions</a>. In The UK, the case raised by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/richard-lloyd-v-google-copy/id50888527\" target=\"_blank\">Mr Lloyd against unlawful data access by Google</a> was ultimately rejected by the Supreme Court base to the fact that not all class members had suffers identical harm. When could that ever be the case? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Loss of control and distress have been the criteria in civil compensation following a data breach. Several German and Austrian courts have recognised the liability for non-material damages caused by data subjects. Three referrals for clarification have been made to the <a href=\"https://www.pearltrees.com/clarinettecaselaw/ecj/id43825447\" target=\"_blank\" rel=\"noreferrer noopener\">EUROPEAN COURT OF JUSTICE</a>. If interested by this important subject, you can have a deeper read on all relevant cases we could curate <a href=\"https://www.linkedin.com/posts/taubmanbassirian_gdpr-non-material-damage-liability-ugcPost-6893517983616950272-zPr5\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Criminal liabilities, EU National legislations have introduced into their criminal laws specific incriminations. We know about the offense of <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/ukpga/1990/18/section/1\" target=\"_blank\">Computer Misuse Act</a> 1990 in the UK. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The chart below shows some of the main criminal offences introduced in the French legal system related to data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2343,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/02/Screenshot-2022-01-03-at-21.58.36-1024x654.png\" alt=\"\" class=\"wp-image-2343\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16 </strong>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years\' imprisonment and a fine of 300,000 euros. The same penalties shall be imposed on the act, including negligently, of carrying out or having carried out a processing which has been the subject of one of the measures provided for in 3 ° of III of Article 20 of Law No. 78-17 of 6 January 1978 relating to data processing, files and freedoms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16-1</strong> The fact, except in cases where the processing has been authorized under the conditions provided for by Law No. 78-17 of 6 January 1978 cited above, of carrying out or having carried out a processing of personal data including among the data on which it relates the registration number of persons in the national register of identification of natural persons is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17</strong> The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17-1</strong> The fact that a provider of electronic communications services or a controller does not notify a personal data breach to the Commission nationale de l\'informatique et des libertés or to the interested party, in breach of Articles 33 and 34 of Regulation (EU) 2016/679 of 27 April 2016 or the provisions of II of Article 83 and Article 102 of Law No. 78-17 of 6 January 1978, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply to a processor failing to notify the controller of this breach in breach of Article 33 of Regulation (EU) 2016/679 of 27 April 2016 or Article 102 of The aforementioned Law No 78-17 of 6 January 1978.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18</strong> Collecting personal data by fraudulent, unfair or unlawful means is punishable by five years\' imprisonment and a fine of €300,000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18-1</strong> The fact of processing personal data concerning a natural person despite the opposition of this person, when this processing meets prospecting purposes, in particular commercial, or when this opposition is based on legitimate reasons, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19</strong> The fact, except in the cases provided for by law, of placing or storing in computerized memory, without the express consent of the person concerned, personal data which, directly or indirectly, reveal the racial or ethnic origins, political, philosophical or religious opinions, or trade union memberships of the persons, or which relate to their health or sexual orientation or gender identity, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply, except in the cases provided for by law, to placing or storing in computerized memory personal data concerning offences, convictions or security measures. The provisions of this Article shall apply to non-automated processing of personal data the implementation of which is not limited to the exercise of exclusively personal activities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19-1 </strong>In the event of the processing of personal data for the purpose of research in the field of health, the following is punishable by five years\' imprisonment and a fine of 300,000 euros: 1 ° Without having previously informed individually the persons on whose account personal data are collected or transmitted of their right of access, rectification and opposition, the nature of the data transmitted and the recipients thereof; (2) Despite the objection of the person concerned or, where provided for by law, in the absence of the informed and express consent of the person, or in the case of a deceased person, despite the refusal expressed by the latter during his lifetime.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-20</strong> The fact of keeping personal data beyond the period provided for by law or regulation, by the request for authorisation or opinion, or by the prior declaration addressed to the National Commission for Informatics and Freedoms, is punishable by five years\' imprisonment and a fine of 300,000 euros, unless this retention is carried out for historical purposes, statistical or scientific under the conditions provided for by law. The same penalties shall apply to the fact, except in the cases provided for by law, of processing personal data stored beyond the period mentioned in the first paragraph for purposes other than historical, statistical or scientific purposes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-21</strong> The fact, by any person holding personal data on the occasion of their registration, classification, transmission or any other form of processing, of diverting this information from its purpose as defined by the legislative provision, the regulatory act or the decision of the National Commission for Informatics and Freedoms authorising automated processing, or by the declarations prior to the implementation of this treatment, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22</strong> The fact, by any person who has collected, on the occasion of their registration, classification, transmission or other form of processing, personal data the disclosure of which would have the effect of undermining the consideration of the interested party or the intimacy of his private life, to carry, without authorisation of the interested party, these data to the knowledge of a third party who does not have standing to receive them is punishable by five years\' imprisonment and a fine of 300,000 euros. The disclosure provided for in the preceding paragraph is punishable by three years\' imprisonment and a fine of 100,000 euros when committed by recklessness or negligence. In the cases provided for in the two preceding paragraphs, prosecution may be brought only on the basis of a complaint by the victim, his legal representative or his successors in title.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-1</strong> Carrying out or causing to be transferred personal data which is or is intended to be processed to a State not belonging to the European Union or to an international organisation in breach of Chapter V of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, or Articles 112 to 114 of Law No 78-17 of 6 January 1978 cited above, shall be punishable by five years\' imprisonment and a fine of EUR 300 000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-2</strong> The following are punishable by one year\'s imprisonment and a fine of €15,000 for hindering the action of the National Commission for Informatics and Liberties: 1 ° Either by opposing the exercise of the missions entrusted to its members or authorised agents pursuant to the last paragraph of Article 10 of Law No. 78-17 of 6 January 1978 aforementioned when the visit has been authorised by the judge; 2 ° Either by refusing to communicate to its members or to the agents authorised pursuant to the last paragraph of Article 10 of the same law, or to the agents of a supervisory authority of a Member State of the European Union pursuant to Article 62 of Regulation (EU) 2016/679 of 27 April 2016 cited above, the information and documents useful for their mission, or by concealing such documents or information, or by removing them; 3 ° Either by communicating information that does not conform to the content of the recordings as it was at the time when the request was made or that does not present this content in a directly accessible form. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-23</strong> In the cases provided for in Articles 226-16 to 226-22-2, the erasure of all or part of the personal data subject to the processing that gave rise to the offence may be ordered. The members and agents of the National Commission for Informatics and Liberties are entitled to note the erasure of this data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-24</strong> Legal persons declared criminally liable, under the conditions provided for in Article 121-2, for the offences defined in this section shall incur, in addition to the fine in accordance with the procedures laid down in Article 131-38, the penalties provided for in 2 ° to 5 ° and 7 ° to 9 ° of Article 131-39. The prohibition mentioned in 2 ° of article 131-39 relates to the activity in the exercise or in the course of the exercise of which the offence was committed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are few of the French incriminations making liable the data controller or the person unlawfully accessing personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK Data Protection Act 2018 has introduced several offences: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2 id=\"offences-under-the-dpa-2018\">Offences under the DPA 2018</h2>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-119-obstructing-the-commissioner-in-inspecting-personal-data-to-discharge-an-international-obligation\"><a></a>Section 119: Obstructing the Commissioner in inspecting personal data to discharge an international obligation</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 119 is described as a ‘future-proofed’ version of s.54A DPA 1998. It is a provision that criminalises obstructing the ICO’s inspection of European information systems. The Commissioner may inspect personal data where the inspection is necessary in order to discharge an international obligation of the United Kingdom, subject to the restriction in subsection (2). Section 119 (6) states that it is an offence (a)intentionally to obstruct a person exercising the power under subsection (1), or (b)to fail without reasonable excuse to give a person exercising that power any assistance the person may reasonably require.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-132-prohibition-placed-upon-the-commissioner-or-the-commissioner-s-staff-against-disclosing-information-obtained-in-the-course-of-their-role-which-is-not-available-to-the-public\"><a></a>Section 132: Prohibition placed upon the Commissioner, or the Commissioner’s staff against disclosing information obtained in the course of their role (which is not available to the public)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 132 replaces section 59 DPA 1998 and criminalises action by former or current ICO staff who disclose data obtained during the course of their duties. Section 132 (2) clarifies the circumstances in which disclosure – with lawful authority – may be made. Section 132 (3) however confirms that it is an offence for a person knowingly or recklessly to disclose information in contravention of subsection (1).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-144-false-statement-made-in-response-to-an-information-notice\"><a></a>Section 144: False statement made in response to an information notice</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>It is an offence for a person, in response to information notice from the Commissioner, to make or recklessly make, a statement which they know to be false in a material respect.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-148-destroying-or-falsifying-information-and-documents-etc\"><a></a>Section 148: Destroying or falsifying information and documents etc</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Under Section 148 (2) (a) it is an offence for a person to destroy or otherwise dispose of, conceal, block or (where relevant) falsify all or part of the information, document, equipment or material. Section 148 (2) (b) makes to cause or permit the actions set pout in the previous subsection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-170-unlawful-obtaining-etc-of-personal-data\"><a></a>Section 170: Unlawful obtaining etc of personal data</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 170 of the Act builds on section 55 DPA 1998 which criminalised knowingly or recklessly obtaining, disclosing or procuring personal data without the consent of the data controller, and the sale or offering for sale of that data. The provision was most typically/commonly used to prosecute those who had accessed healthcare and financial records without a legitimate reason. Section 170 adds the offence of knowingly or recklessly&nbsp;<strong><em>retaining</em></strong>&nbsp;personal data (which may have been lawfully obtained) without the consent of the data controller. There are some exceptions: for example where such obtaining, disclosing, procuring or retaining was necessary for the purposes of preventing or detecting crime. Section 170 (2) and (3) set out the defences to Section 170 (1).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-171-re-identification-of-de-identified-personal-data\"><a></a>Section 171: Re-identification of de-identified personal data</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 171 - a new offence - criminalises the re-identification of personal data that has been ‘de-identified’ (de-identification being a process - such as redactions - to remove/conceal personal data). Section (5) states that it is an offence for a person knowingly or recklessly to process personal data that is information that has been re-identified. Sections 171 (3) and (4) set out the defences to Section 171 (1) – for example, the re-identification was necessary for the purposes of preventing or detecting crime. Sections 171 (6) and (7) set out the defences to Section 171 (5).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-173-alteration-etc-of-personal-data-to-prevent-disclosure-to-data-subject\"><a></a>Section 173: Alteration etc of personal data to prevent disclosure to data subject</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 173 relates to the processing of requests for data from individuals for their personal data. Section 173 (3) makes it a criminal offence for organisations (persons listed in Section 173 (4)) to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure. It builds on an offence under the Freedom of Information Act 2000. Possible defences to an offence under section 173 (3) are set out in Section 173 (5).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-184-prohibition-of-requirement-to-produce-relevant-records\"><a></a>Section 184: Prohibition of requirement to produce relevant records</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 184 (1) makes it an offence for a person to require another to provide them with or give them access to a relevant record linked to the employment, continued employment of one of their employees or a contract for the provisions of services to them. Section 184 (2) makes it an offence for a person to require another to provide them with or access to a relevant record if the requestor is involved in the provision of goods, facilities or services to the public or the requirement is a condition of providing or offering to provide goods, facilities or services to the other person or a third party. Section 184 (3) details the possible defences to offences under subsection 184 (1) or (2).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"schedule-15-paragraph-15-powers-of-entry-and-inspection\"><a></a>Schedule 15, Paragraph 15. Powers of Entry and Inspection</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>It is an offence under paragraph 15 (1) for a person to intentionally obstruct a person in the execution of a warrant issued under this Schedule or to fail without reasonable excuse to give a person executing the warrant such assistance as may be required. Under paragraph 15 (2) it is an offence for a person to make a statement in response to a requirement under paragraph 5(2(c) or (d) or 3(c) or (d) which the person knows to be false in a material respect or recklessly make such a statement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There are no custodial sentences in respect of offences under DPA 2018 and no powers of arrest; all offences are punishable only by a fine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Schedule 15 – Powers of entry and inspection, sets out the circumstances in which the Information Commissioner may apply for a search warrant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The DPA 2018 removed Section 77 (power to alter penalty for unlawfully obtaining etc personal data) of the Criminal Justice and Immigration Act 2008.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"///Users/New/Downloads/122558_49907c6f-a2e5-4c9e-8ee0-953315da668c.pdf\" target=\"_blank\">Irish Data Protection 2018</a> has introduced in Section 144 et all a series of offences :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"start\":144} -->\n<ol start=\"144\"><li>Unauthorised disclosure by processor</li><li>Disclosure of personal data obtained without authority</li><li>Offences by directors, etc., of bodies corporate</li><li>Prosecution of summary offences by Commission</li></ol>\n<!-- /wp:list -->','Non-Material Damage Compensation','Non compliance with the GDPR has three series of legal consequences : We\'ve extensively heard of the administrative enforcement by national Data Protection Authorities. We have less heard of Criminal liabilities for non compliance, especially for the absence of measures of security. The third level is civil liability as set by the Article 82 GDPR.','publish','open','open','','non-material-damage-compensation','','','2022-02-12 15:10:03','2022-02-12 15:10:03','',0,'https://www.datarainbow.eu/?p=2341',0,'post','',0),(2342,1,'2022-02-11 12:21:37','2022-02-11 12:21:37','{\"version\": 2, \"isGlobalStylesUserThemeJSON\": true }','Custom Styles','','publish','closed','closed','','wp-global-styles-mesmerize-pro','','','2022-02-11 12:21:37','2022-02-11 12:21:37','',0,'https://www.datarainbow.eu/wp-global-styles-mesmerize-pro/',0,'wp_global_styles','',0),(2343,1,'2022-02-11 12:34:42','2022-02-11 12:34:42','','Screenshot-2022-01-03-at-21.58.36','','inherit','open','closed','','screenshot-2022-01-03-at-21-58-36','','','2022-02-11 12:34:42','2022-02-11 12:34:42','',2341,'https://www.datarainbow.eu/wp-content/uploads/2022/02/Screenshot-2022-01-03-at-21.58.36.png',0,'attachment','image/png',0),(2344,1,'2022-02-11 13:08:22','2022-02-11 13:08:22','','CA84BB75-65CC-4143-B2EC-BC4BA3C11CCA','','inherit','open','closed','','ca84bb75-65cc-4143-b2ec-bc4ba3c11cca','','','2022-02-11 13:08:22','2022-02-11 13:08:22','',2341,'https://www.datarainbow.eu/wp-content/uploads/2022/02/CA84BB75-65CC-4143-B2EC-BC4BA3C11CCA.jpeg',0,'attachment','image/jpeg',0),(2345,1,'2022-02-11 13:16:47','2022-02-11 13:16:47','<!-- wp:paragraph -->\n<p>Non compliance with the GDPR has three series of legal consequences : We\'ve extensively heard of the administrative enforcement by national Data Protection Authorities. We have less heard of Criminal liabilities for non compliance, especially for the absence of measures of security. The third level is civil liability as set by the <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\">Article 82 GDPR</a>. This article establishes a right to compensation and liability to \'Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.\' Action can be taken individually or in a class action. This is a serious threat while we are witnessing high rise of data breach incidents with increase cyber attacks and ransomware. When a controller has neglected to take appropriate security measures, it has to be liable for compensation. The difficulty here is that often the damage caused is not measurable or not imminent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its recent enforcement against an online payment company Slimpay, the French Data Protection CNIL clearly states that non compliance with the obligations of security in <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 32 GDPR</a> is sufficient without the need to prove access to the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>La formation restreinte considère que l’absence de preuve d’une utilisation frauduleuse des données est sans incidence sur la caractérisation du manquement à l’obligation de sécurité. En effet, le risque d’utilisation frauduleuse des données à caractère personnel était réel, indépendamment des cas de fraude, dans la mesure où les données de nombreuses personnes ont été rendues accessibles à des tiers non autorisés. L’absence de dommage avéré pour les personnes concernées n’a pas d’incidence sur l’existence du défaut de sécurité, qui constitue le manquement à l’article 32 du RGPD.</em>\"</p><p>The restricted panel considers that the absence of evidence of fraudulent use of the data has no bearing on the characterisation of the breach of the security obligation. <strong>The risk of fraudulent use of personal data was real, irrespective of the cases of fraud, in so far as the data of many persons were made accessible to unauthorised third parties. The absence of proven damage to the data subjects does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.</strong></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Several recent data breaches, British Airways, EASYJET, MARRIOTT, TICKET MASTER, ETC... have been hurt by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/class-actions/id43827607\" target=\"_blank\">class actions</a>. In The UK, the case raised by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/richard-lloyd-v-google-copy/id50888527\" target=\"_blank\">Mr Lloyd against unlawful data access by Google</a> was ultimately rejected by the Supreme Court base to the fact that not all class members had suffers identical harm. When could that ever be the case? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Loss of control and distress have been the criteria in civil compensation following a data breach. Several German and Austrian courts have recognised the liability for non-material damages caused by data subjects. Three referrals for clarification have been made to the <a href=\"https://www.pearltrees.com/clarinettecaselaw/ecj/id43825447\" target=\"_blank\" rel=\"noreferrer noopener\">EUROPEAN COURT OF JUSTICE</a>. If interested by this important subject, you can have a deeper read on all relevant cases we could curate <a href=\"https://www.linkedin.com/posts/taubmanbassirian_gdpr-non-material-damage-liability-ugcPost-6893517983616950272-zPr5\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Criminal liabilities, EU National legislations have introduced into their criminal laws specific incriminations. We know about the offense of <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/ukpga/1990/18/section/1\" target=\"_blank\">Computer Misuse Act</a> 1990 in the UK. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The chart below shows some of the main criminal offences introduced in the French legal system related to data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2343,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/02/Screenshot-2022-01-03-at-21.58.36-1024x654.png\" alt=\"\" class=\"wp-image-2343\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16 </strong>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years\' imprisonment and a fine of 300,000 euros. The same penalties shall be imposed on the act, including negligently, of carrying out or having carried out a processing which has been the subject of one of the measures provided for in 3 ° of III of Article 20 of Law No. 78-17 of 6 January 1978 relating to data processing, files and freedoms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16-1</strong> The fact, except in cases where the processing has been authorized under the conditions provided for by Law No. 78-17 of 6 January 1978 cited above, of carrying out or having carried out a processing of personal data including among the data on which it relates the registration number of persons in the national register of identification of natural persons is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17</strong> The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17-1</strong> The fact that a provider of electronic communications services or a controller does not notify a personal data breach to the Commission nationale de l\'informatique et des libertés or to the interested party, in breach of Articles 33 and 34 of Regulation (EU) 2016/679 of 27 April 2016 or the provisions of II of Article 83 and Article 102 of Law No. 78-17 of 6 January 1978, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply to a processor failing to notify the controller of this breach in breach of Article 33 of Regulation (EU) 2016/679 of 27 April 2016 or Article 102 of The aforementioned Law No 78-17 of 6 January 1978.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18</strong> Collecting personal data by fraudulent, unfair or unlawful means is punishable by five years\' imprisonment and a fine of €300,000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18-1</strong> The fact of processing personal data concerning a natural person despite the opposition of this person, when this processing meets prospecting purposes, in particular commercial, or when this opposition is based on legitimate reasons, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19</strong> The fact, except in the cases provided for by law, of placing or storing in computerized memory, without the express consent of the person concerned, personal data which, directly or indirectly, reveal the racial or ethnic origins, political, philosophical or religious opinions, or trade union memberships of the persons, or which relate to their health or sexual orientation or gender identity, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply, except in the cases provided for by law, to placing or storing in computerized memory personal data concerning offences, convictions or security measures. The provisions of this Article shall apply to non-automated processing of personal data the implementation of which is not limited to the exercise of exclusively personal activities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19-1 </strong>In the event of the processing of personal data for the purpose of research in the field of health, the following is punishable by five years\' imprisonment and a fine of 300,000 euros: 1 ° Without having previously informed individually the persons on whose account personal data are collected or transmitted of their right of access, rectification and opposition, the nature of the data transmitted and the recipients thereof; (2) Despite the objection of the person concerned or, where provided for by law, in the absence of the informed and express consent of the person, or in the case of a deceased person, despite the refusal expressed by the latter during his lifetime.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-20</strong> The fact of keeping personal data beyond the period provided for by law or regulation, by the request for authorisation or opinion, or by the prior declaration addressed to the National Commission for Informatics and Freedoms, is punishable by five years\' imprisonment and a fine of 300,000 euros, unless this retention is carried out for historical purposes, statistical or scientific under the conditions provided for by law. The same penalties shall apply to the fact, except in the cases provided for by law, of processing personal data stored beyond the period mentioned in the first paragraph for purposes other than historical, statistical or scientific purposes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-21</strong> The fact, by any person holding personal data on the occasion of their registration, classification, transmission or any other form of processing, of diverting this information from its purpose as defined by the legislative provision, the regulatory act or the decision of the National Commission for Informatics and Freedoms authorising automated processing, or by the declarations prior to the implementation of this treatment, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22</strong> The fact, by any person who has collected, on the occasion of their registration, classification, transmission or other form of processing, personal data the disclosure of which would have the effect of undermining the consideration of the interested party or the intimacy of his private life, to carry, without authorisation of the interested party, these data to the knowledge of a third party who does not have standing to receive them is punishable by five years\' imprisonment and a fine of 300,000 euros. The disclosure provided for in the preceding paragraph is punishable by three years\' imprisonment and a fine of 100,000 euros when committed by recklessness or negligence. In the cases provided for in the two preceding paragraphs, prosecution may be brought only on the basis of a complaint by the victim, his legal representative or his successors in title.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-1</strong> Carrying out or causing to be transferred personal data which is or is intended to be processed to a State not belonging to the European Union or to an international organisation in breach of Chapter V of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, or Articles 112 to 114 of Law No 78-17 of 6 January 1978 cited above, shall be punishable by five years\' imprisonment and a fine of EUR 300 000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-2</strong> The following are punishable by one year\'s imprisonment and a fine of €15,000 for hindering the action of the National Commission for Informatics and Liberties: 1 ° Either by opposing the exercise of the missions entrusted to its members or authorised agents pursuant to the last paragraph of Article 10 of Law No. 78-17 of 6 January 1978 aforementioned when the visit has been authorised by the judge; 2 ° Either by refusing to communicate to its members or to the agents authorised pursuant to the last paragraph of Article 10 of the same law, or to the agents of a supervisory authority of a Member State of the European Union pursuant to Article 62 of Regulation (EU) 2016/679 of 27 April 2016 cited above, the information and documents useful for their mission, or by concealing such documents or information, or by removing them; 3 ° Either by communicating information that does not conform to the content of the recordings as it was at the time when the request was made or that does not present this content in a directly accessible form. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-23</strong> In the cases provided for in Articles 226-16 to 226-22-2, the erasure of all or part of the personal data subject to the processing that gave rise to the offence may be ordered. The members and agents of the National Commission for Informatics and Liberties are entitled to note the erasure of this data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-24</strong> Legal persons declared criminally liable, under the conditions provided for in Article 121-2, for the offences defined in this section shall incur, in addition to the fine in accordance with the procedures laid down in Article 131-38, the penalties provided for in 2 ° to 5 ° and 7 ° to 9 ° of Article 131-39. The prohibition mentioned in 2 ° of article 131-39 relates to the activity in the exercise or in the course of the exercise of which the offence was committed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are few of the French incriminations making liable the data controller or the person unlawfully accessing personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:embed /-->','Non-Material Damage Compensation','','inherit','closed','closed','','2341-revision-v1','','','2022-02-11 13:16:47','2022-02-11 13:16:47','',2341,'https://www.datarainbow.eu/?p=2345',0,'revision','',0),(2346,1,'2022-02-11 13:18:04','2022-02-11 13:18:04','<!-- wp:paragraph -->\n<p>Non compliance with the GDPR has three series of legal consequences : We\'ve extensively heard of the administrative enforcement by national Data Protection Authorities. We have less heard of Criminal liabilities for non compliance, especially for the absence of measures of security. The third level is civil liability as set by the <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\">Article 82 GDPR</a>. This article establishes a right to compensation and liability to \'<em>Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.</em>\' Action can be taken individually or in a class action. This is a serious threat while we are witnessing high rise of data breach incidents with increase cyber attacks and ransomware. When a controller has neglected to take appropriate security measures, it has to be liable for compensation. The difficulty here is that often the damage caused is not measurable or not imminent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its recent enforcement against an online payment company Slimpay, the French Data Protection CNIL clearly states that non compliance with the obligations of security in <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 32 GDPR</a> is sufficient without the need to prove access to the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>La formation restreinte considère que l’absence de preuve d’une utilisation frauduleuse des données est sans incidence sur la caractérisation du manquement à l’obligation de sécurité. En effet, le risque d’utilisation frauduleuse des données à caractère personnel était réel, indépendamment des cas de fraude, dans la mesure où les données de nombreuses personnes ont été rendues accessibles à des tiers non autorisés. L’absence de dommage avéré pour les personnes concernées n’a pas d’incidence sur l’existence du défaut de sécurité, qui constitue le manquement à l’article 32 du RGPD.</em>\"</p><p>The restricted panel considers that the absence of evidence of fraudulent use of the data has no bearing on the characterisation of the breach of the security obligation. <strong>The risk of fraudulent use of personal data was real, irrespective of the cases of fraud, in so far as the data of many persons were made accessible to unauthorised third parties. The absence of proven damage to the data subjects does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.</strong></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Several recent data breaches, British Airways, EASYJET, MARRIOTT, TICKET MASTER, ETC... have been hurt by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/class-actions/id43827607\" target=\"_blank\">class actions</a>. In The UK, the case raised by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/richard-lloyd-v-google-copy/id50888527\" target=\"_blank\">Mr Lloyd against unlawful data access by Google</a> was ultimately rejected by the Supreme Court base to the fact that not all class members had suffers identical harm. When could that ever be the case? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Loss of control and distress have been the criteria in civil compensation following a data breach. Several German and Austrian courts have recognised the liability for non-material damages caused by data subjects. Three referrals for clarification have been made to the <a href=\"https://www.pearltrees.com/clarinettecaselaw/ecj/id43825447\" target=\"_blank\" rel=\"noreferrer noopener\">EUROPEAN COURT OF JUSTICE</a>. If interested by this important subject, you can have a deeper read on all relevant cases we could curate <a href=\"https://www.linkedin.com/posts/taubmanbassirian_gdpr-non-material-damage-liability-ugcPost-6893517983616950272-zPr5\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Criminal liabilities, EU National legislations have introduced into their criminal laws specific incriminations. We know about the offense of <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/ukpga/1990/18/section/1\" target=\"_blank\">Computer Misuse Act</a> 1990 in the UK. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The chart below shows some of the main criminal offences introduced in the French legal system related to data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2343,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/02/Screenshot-2022-01-03-at-21.58.36-1024x654.png\" alt=\"\" class=\"wp-image-2343\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16 </strong>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years\' imprisonment and a fine of 300,000 euros. The same penalties shall be imposed on the act, including negligently, of carrying out or having carried out a processing which has been the subject of one of the measures provided for in 3 ° of III of Article 20 of Law No. 78-17 of 6 January 1978 relating to data processing, files and freedoms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16-1</strong> The fact, except in cases where the processing has been authorized under the conditions provided for by Law No. 78-17 of 6 January 1978 cited above, of carrying out or having carried out a processing of personal data including among the data on which it relates the registration number of persons in the national register of identification of natural persons is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17</strong> The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17-1</strong> The fact that a provider of electronic communications services or a controller does not notify a personal data breach to the Commission nationale de l\'informatique et des libertés or to the interested party, in breach of Articles 33 and 34 of Regulation (EU) 2016/679 of 27 April 2016 or the provisions of II of Article 83 and Article 102 of Law No. 78-17 of 6 January 1978, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply to a processor failing to notify the controller of this breach in breach of Article 33 of Regulation (EU) 2016/679 of 27 April 2016 or Article 102 of The aforementioned Law No 78-17 of 6 January 1978.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18</strong> Collecting personal data by fraudulent, unfair or unlawful means is punishable by five years\' imprisonment and a fine of €300,000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18-1</strong> The fact of processing personal data concerning a natural person despite the opposition of this person, when this processing meets prospecting purposes, in particular commercial, or when this opposition is based on legitimate reasons, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19</strong> The fact, except in the cases provided for by law, of placing or storing in computerized memory, without the express consent of the person concerned, personal data which, directly or indirectly, reveal the racial or ethnic origins, political, philosophical or religious opinions, or trade union memberships of the persons, or which relate to their health or sexual orientation or gender identity, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply, except in the cases provided for by law, to placing or storing in computerized memory personal data concerning offences, convictions or security measures. The provisions of this Article shall apply to non-automated processing of personal data the implementation of which is not limited to the exercise of exclusively personal activities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19-1 </strong>In the event of the processing of personal data for the purpose of research in the field of health, the following is punishable by five years\' imprisonment and a fine of 300,000 euros: 1 ° Without having previously informed individually the persons on whose account personal data are collected or transmitted of their right of access, rectification and opposition, the nature of the data transmitted and the recipients thereof; (2) Despite the objection of the person concerned or, where provided for by law, in the absence of the informed and express consent of the person, or in the case of a deceased person, despite the refusal expressed by the latter during his lifetime.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-20</strong> The fact of keeping personal data beyond the period provided for by law or regulation, by the request for authorisation or opinion, or by the prior declaration addressed to the National Commission for Informatics and Freedoms, is punishable by five years\' imprisonment and a fine of 300,000 euros, unless this retention is carried out for historical purposes, statistical or scientific under the conditions provided for by law. The same penalties shall apply to the fact, except in the cases provided for by law, of processing personal data stored beyond the period mentioned in the first paragraph for purposes other than historical, statistical or scientific purposes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-21</strong> The fact, by any person holding personal data on the occasion of their registration, classification, transmission or any other form of processing, of diverting this information from its purpose as defined by the legislative provision, the regulatory act or the decision of the National Commission for Informatics and Freedoms authorising automated processing, or by the declarations prior to the implementation of this treatment, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22</strong> The fact, by any person who has collected, on the occasion of their registration, classification, transmission or other form of processing, personal data the disclosure of which would have the effect of undermining the consideration of the interested party or the intimacy of his private life, to carry, without authorisation of the interested party, these data to the knowledge of a third party who does not have standing to receive them is punishable by five years\' imprisonment and a fine of 300,000 euros. The disclosure provided for in the preceding paragraph is punishable by three years\' imprisonment and a fine of 100,000 euros when committed by recklessness or negligence. In the cases provided for in the two preceding paragraphs, prosecution may be brought only on the basis of a complaint by the victim, his legal representative or his successors in title.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-1</strong> Carrying out or causing to be transferred personal data which is or is intended to be processed to a State not belonging to the European Union or to an international organisation in breach of Chapter V of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, or Articles 112 to 114 of Law No 78-17 of 6 January 1978 cited above, shall be punishable by five years\' imprisonment and a fine of EUR 300 000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-2</strong> The following are punishable by one year\'s imprisonment and a fine of €15,000 for hindering the action of the National Commission for Informatics and Liberties: 1 ° Either by opposing the exercise of the missions entrusted to its members or authorised agents pursuant to the last paragraph of Article 10 of Law No. 78-17 of 6 January 1978 aforementioned when the visit has been authorised by the judge; 2 ° Either by refusing to communicate to its members or to the agents authorised pursuant to the last paragraph of Article 10 of the same law, or to the agents of a supervisory authority of a Member State of the European Union pursuant to Article 62 of Regulation (EU) 2016/679 of 27 April 2016 cited above, the information and documents useful for their mission, or by concealing such documents or information, or by removing them; 3 ° Either by communicating information that does not conform to the content of the recordings as it was at the time when the request was made or that does not present this content in a directly accessible form. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-23</strong> In the cases provided for in Articles 226-16 to 226-22-2, the erasure of all or part of the personal data subject to the processing that gave rise to the offence may be ordered. The members and agents of the National Commission for Informatics and Liberties are entitled to note the erasure of this data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-24</strong> Legal persons declared criminally liable, under the conditions provided for in Article 121-2, for the offences defined in this section shall incur, in addition to the fine in accordance with the procedures laid down in Article 131-38, the penalties provided for in 2 ° to 5 ° and 7 ° to 9 ° of Article 131-39. The prohibition mentioned in 2 ° of article 131-39 relates to the activity in the exercise or in the course of the exercise of which the offence was committed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are few of the French incriminations making liable the data controller or the person unlawfully accessing personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:embed /-->','Non-Material Damage Compensation','','inherit','closed','closed','','2341-revision-v1','','','2022-02-11 13:18:04','2022-02-11 13:18:04','',2341,'https://www.datarainbow.eu/?p=2346',0,'revision','',0),(2348,1,'2022-02-11 14:06:58','2022-02-11 14:06:58','<!-- wp:paragraph -->\n<p>Non compliance with the GDPR has three series of legal consequences : We\'ve extensively heard of the administrative enforcement by national Data Protection Authorities. We have less heard of Criminal liabilities for non compliance, especially for the absence of measures of security. The third level is civil liability as set by the <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\">Article 82 GDPR</a>. This article establishes a right to compensation and liability to \'<em>Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.</em>\' Action can be taken individually or in a class action. This is a serious threat while we are witnessing high rise of data breach incidents with increase cyber attacks and ransomware. When a controller has neglected to take appropriate security measures, it has to be liable for compensation. The difficulty here is that often the damage caused is not measurable or not imminent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its recent enforcement against an online payment company Slimpay, the French Data Protection CNIL clearly states that non compliance with the obligations of security in <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 32 GDPR</a> is sufficient without the need to prove access to the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>La formation restreinte considère que l’absence de preuve d’une utilisation frauduleuse des données est sans incidence sur la caractérisation du manquement à l’obligation de sécurité. En effet, le risque d’utilisation frauduleuse des données à caractère personnel était réel, indépendamment des cas de fraude, dans la mesure où les données de nombreuses personnes ont été rendues accessibles à des tiers non autorisés. L’absence de dommage avéré pour les personnes concernées n’a pas d’incidence sur l’existence du défaut de sécurité, qui constitue le manquement à l’article 32 du RGPD.</em>\"</p><p>The restricted panel considers that the absence of evidence of fraudulent use of the data has no bearing on the characterisation of the breach of the security obligation. <strong>The risk of fraudulent use of personal data was real, irrespective of the cases of fraud, in so far as the data of many persons were made accessible to unauthorised third parties. The absence of proven damage to the data subjects does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.</strong></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Several recent data breaches, British Airways, EASYJET, MARRIOTT, TICKET MASTER, ETC... have been hurt by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/class-actions/id43827607\" target=\"_blank\">class actions</a>. In The UK, the case raised by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/richard-lloyd-v-google-copy/id50888527\" target=\"_blank\">Mr Lloyd against unlawful data access by Google</a> was ultimately rejected by the Supreme Court base to the fact that not all class members had suffers identical harm. When could that ever be the case? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Loss of control and distress have been the criteria in civil compensation following a data breach. Several German and Austrian courts have recognised the liability for non-material damages caused by data subjects. Three referrals for clarification have been made to the <a href=\"https://www.pearltrees.com/clarinettecaselaw/ecj/id43825447\" target=\"_blank\" rel=\"noreferrer noopener\">EUROPEAN COURT OF JUSTICE</a>. If interested by this important subject, you can have a deeper read on all relevant cases we could curate <a href=\"https://www.linkedin.com/posts/taubmanbassirian_gdpr-non-material-damage-liability-ugcPost-6893517983616950272-zPr5\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Criminal liabilities, EU National legislations have introduced into their criminal laws specific incriminations. We know about the offense of <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/ukpga/1990/18/section/1\" target=\"_blank\">Computer Misuse Act</a> 1990 in the UK. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The chart below shows some of the main criminal offences introduced in the French legal system related to data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2343,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/02/Screenshot-2022-01-03-at-21.58.36-1024x654.png\" alt=\"\" class=\"wp-image-2343\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16 </strong>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years\' imprisonment and a fine of 300,000 euros. The same penalties shall be imposed on the act, including negligently, of carrying out or having carried out a processing which has been the subject of one of the measures provided for in 3 ° of III of Article 20 of Law No. 78-17 of 6 January 1978 relating to data processing, files and freedoms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16-1</strong> The fact, except in cases where the processing has been authorized under the conditions provided for by Law No. 78-17 of 6 January 1978 cited above, of carrying out or having carried out a processing of personal data including among the data on which it relates the registration number of persons in the national register of identification of natural persons is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17</strong> The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17-1</strong> The fact that a provider of electronic communications services or a controller does not notify a personal data breach to the Commission nationale de l\'informatique et des libertés or to the interested party, in breach of Articles 33 and 34 of Regulation (EU) 2016/679 of 27 April 2016 or the provisions of II of Article 83 and Article 102 of Law No. 78-17 of 6 January 1978, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply to a processor failing to notify the controller of this breach in breach of Article 33 of Regulation (EU) 2016/679 of 27 April 2016 or Article 102 of The aforementioned Law No 78-17 of 6 January 1978.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18</strong> Collecting personal data by fraudulent, unfair or unlawful means is punishable by five years\' imprisonment and a fine of €300,000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18-1</strong> The fact of processing personal data concerning a natural person despite the opposition of this person, when this processing meets prospecting purposes, in particular commercial, or when this opposition is based on legitimate reasons, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19</strong> The fact, except in the cases provided for by law, of placing or storing in computerized memory, without the express consent of the person concerned, personal data which, directly or indirectly, reveal the racial or ethnic origins, political, philosophical or religious opinions, or trade union memberships of the persons, or which relate to their health or sexual orientation or gender identity, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply, except in the cases provided for by law, to placing or storing in computerized memory personal data concerning offences, convictions or security measures. The provisions of this Article shall apply to non-automated processing of personal data the implementation of which is not limited to the exercise of exclusively personal activities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19-1 </strong>In the event of the processing of personal data for the purpose of research in the field of health, the following is punishable by five years\' imprisonment and a fine of 300,000 euros: 1 ° Without having previously informed individually the persons on whose account personal data are collected or transmitted of their right of access, rectification and opposition, the nature of the data transmitted and the recipients thereof; (2) Despite the objection of the person concerned or, where provided for by law, in the absence of the informed and express consent of the person, or in the case of a deceased person, despite the refusal expressed by the latter during his lifetime.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-20</strong> The fact of keeping personal data beyond the period provided for by law or regulation, by the request for authorisation or opinion, or by the prior declaration addressed to the National Commission for Informatics and Freedoms, is punishable by five years\' imprisonment and a fine of 300,000 euros, unless this retention is carried out for historical purposes, statistical or scientific under the conditions provided for by law. The same penalties shall apply to the fact, except in the cases provided for by law, of processing personal data stored beyond the period mentioned in the first paragraph for purposes other than historical, statistical or scientific purposes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-21</strong> The fact, by any person holding personal data on the occasion of their registration, classification, transmission or any other form of processing, of diverting this information from its purpose as defined by the legislative provision, the regulatory act or the decision of the National Commission for Informatics and Freedoms authorising automated processing, or by the declarations prior to the implementation of this treatment, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22</strong> The fact, by any person who has collected, on the occasion of their registration, classification, transmission or other form of processing, personal data the disclosure of which would have the effect of undermining the consideration of the interested party or the intimacy of his private life, to carry, without authorisation of the interested party, these data to the knowledge of a third party who does not have standing to receive them is punishable by five years\' imprisonment and a fine of 300,000 euros. The disclosure provided for in the preceding paragraph is punishable by three years\' imprisonment and a fine of 100,000 euros when committed by recklessness or negligence. In the cases provided for in the two preceding paragraphs, prosecution may be brought only on the basis of a complaint by the victim, his legal representative or his successors in title.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-1</strong> Carrying out or causing to be transferred personal data which is or is intended to be processed to a State not belonging to the European Union or to an international organisation in breach of Chapter V of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, or Articles 112 to 114 of Law No 78-17 of 6 January 1978 cited above, shall be punishable by five years\' imprisonment and a fine of EUR 300 000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-2</strong> The following are punishable by one year\'s imprisonment and a fine of €15,000 for hindering the action of the National Commission for Informatics and Liberties: 1 ° Either by opposing the exercise of the missions entrusted to its members or authorised agents pursuant to the last paragraph of Article 10 of Law No. 78-17 of 6 January 1978 aforementioned when the visit has been authorised by the judge; 2 ° Either by refusing to communicate to its members or to the agents authorised pursuant to the last paragraph of Article 10 of the same law, or to the agents of a supervisory authority of a Member State of the European Union pursuant to Article 62 of Regulation (EU) 2016/679 of 27 April 2016 cited above, the information and documents useful for their mission, or by concealing such documents or information, or by removing them; 3 ° Either by communicating information that does not conform to the content of the recordings as it was at the time when the request was made or that does not present this content in a directly accessible form. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-23</strong> In the cases provided for in Articles 226-16 to 226-22-2, the erasure of all or part of the personal data subject to the processing that gave rise to the offence may be ordered. The members and agents of the National Commission for Informatics and Liberties are entitled to note the erasure of this data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-24</strong> Legal persons declared criminally liable, under the conditions provided for in Article 121-2, for the offences defined in this section shall incur, in addition to the fine in accordance with the procedures laid down in Article 131-38, the penalties provided for in 2 ° to 5 ° and 7 ° to 9 ° of Article 131-39. The prohibition mentioned in 2 ° of article 131-39 relates to the activity in the exercise or in the course of the exercise of which the offence was committed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are few of the French incriminations making liable the data controller or the person unlawfully accessing personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK Data Protection Act 2018 has introduced several offences: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2 id=\"offences-under-the-dpa-2018\">Offences under the DPA 2018</h2>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-119-obstructing-the-commissioner-in-inspecting-personal-data-to-discharge-an-international-obligation\"><a></a>Section 119: Obstructing the Commissioner in inspecting personal data to discharge an international obligation</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 119 is described as a ‘future-proofed’ version of s.54A DPA 1998. It is a provision that criminalises obstructing the ICO’s inspection of European information systems. The Commissioner may inspect personal data where the inspection is necessary in order to discharge an international obligation of the United Kingdom, subject to the restriction in subsection (2). Section 119 (6) states that it is an offence (a)intentionally to obstruct a person exercising the power under subsection (1), or (b)to fail without reasonable excuse to give a person exercising that power any assistance the person may reasonably require.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-132-prohibition-placed-upon-the-commissioner-or-the-commissioner-s-staff-against-disclosing-information-obtained-in-the-course-of-their-role-which-is-not-available-to-the-public\"><a></a>Section 132: Prohibition placed upon the Commissioner, or the Commissioner’s staff against disclosing information obtained in the course of their role (which is not available to the public)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 132 replaces section 59 DPA 1998 and criminalises action by former or current ICO staff who disclose data obtained during the course of their duties. Section 132 (2) clarifies the circumstances in which disclosure – with lawful authority – may be made. Section 132 (3) however confirms that it is an offence for a person knowingly or recklessly to disclose information in contravention of subsection (1).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-144-false-statement-made-in-response-to-an-information-notice\"><a></a>Section 144: False statement made in response to an information notice</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>It is an offence for a person, in response to information notice from the Commissioner, to make or recklessly make, a statement which they know to be false in a material respect.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-148-destroying-or-falsifying-information-and-documents-etc\"><a></a>Section 148: Destroying or falsifying information and documents etc</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Under Section 148 (2) (a) it is an offence for a person to destroy or otherwise dispose of, conceal, block or (where relevant) falsify all or part of the information, document, equipment or material. Section 148 (2) (b) makes to cause or permit the actions set pout in the previous subsection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-170-unlawful-obtaining-etc-of-personal-data\"><a></a>Section 170: Unlawful obtaining etc of personal data</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 170 of the Act builds on section 55 DPA 1998 which criminalised knowingly or recklessly obtaining, disclosing or procuring personal data without the consent of the data controller, and the sale or offering for sale of that data. The provision was most typically/commonly used to prosecute those who had accessed healthcare and financial records without a legitimate reason. Section 170 adds the offence of knowingly or recklessly&nbsp;<strong><em>retaining</em></strong>&nbsp;personal data (which may have been lawfully obtained) without the consent of the data controller. There are some exceptions: for example where such obtaining, disclosing, procuring or retaining was necessary for the purposes of preventing or detecting crime. Section 170 (2) and (3) set out the defences to Section 170 (1).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-171-re-identification-of-de-identified-personal-data\"><a></a>Section 171: Re-identification of de-identified personal data</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 171 - a new offence - criminalises the re-identification of personal data that has been ‘de-identified’ (de-identification being a process - such as redactions - to remove/conceal personal data). Section (5) states that it is an offence for a person knowingly or recklessly to process personal data that is information that has been re-identified. Sections 171 (3) and (4) set out the defences to Section 171 (1) – for example, the re-identification was necessary for the purposes of preventing or detecting crime. Sections 171 (6) and (7) set out the defences to Section 171 (5).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-173-alteration-etc-of-personal-data-to-prevent-disclosure-to-data-subject\"><a></a>Section 173: Alteration etc of personal data to prevent disclosure to data subject</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 173 relates to the processing of requests for data from individuals for their personal data. Section 173 (3) makes it a criminal offence for organisations (persons listed in Section 173 (4)) to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure. It builds on an offence under the Freedom of Information Act 2000. Possible defences to an offence under section 173 (3) are set out in Section 173 (5).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-184-prohibition-of-requirement-to-produce-relevant-records\"><a></a>Section 184: Prohibition of requirement to produce relevant records</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 184 (1) makes it an offence for a person to require another to provide them with or give them access to a relevant record linked to the employment, continued employment of one of their employees or a contract for the provisions of services to them. Section 184 (2) makes it an offence for a person to require another to provide them with or access to a relevant record if the requestor is involved in the provision of goods, facilities or services to the public or the requirement is a condition of providing or offering to provide goods, facilities or services to the other person or a third party. Section 184 (3) details the possible defences to offences under subsection 184 (1) or (2).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"schedule-15-paragraph-15-powers-of-entry-and-inspection\"><a></a>Schedule 15, Paragraph 15. Powers of Entry and Inspection</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>It is an offence under paragraph 15 (1) for a person to intentionally obstruct a person in the execution of a warrant issued under this Schedule or to fail without reasonable excuse to give a person executing the warrant such assistance as may be required. Under paragraph 15 (2) it is an offence for a person to make a statement in response to a requirement under paragraph 5(2(c) or (d) or 3(c) or (d) which the person knows to be false in a material respect or recklessly make such a statement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There are no custodial sentences in respect of offences under DPA 2018 and no powers of arrest; all offences are punishable only by a fine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Schedule 15 – Powers of entry and inspection, sets out the circumstances in which the Information Commissioner may apply for a search warrant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The DPA 2018 removed Section 77 (power to alter penalty for unlawfully obtaining etc personal data) of the Criminal Justice and Immigration Act 2008.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"///Users/New/Downloads/122558_49907c6f-a2e5-4c9e-8ee0-953315da668c.pdf\" target=\"_blank\">Irish Data Protection 2018</a> has introduced in Section 144 et all a series of offences :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"start\":144} -->\n<ol start=\"144\"><li>Unauthorised disclosure by processor</li><li>Disclosure of personal data obtained without authority</li><li>Offences by directors, etc., of bodies corporate</li><li>Prosecution of summary offences by Commission</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:embed /-->','Non-Material Damage Compensation','','inherit','closed','closed','','2341-revision-v1','','','2022-02-11 14:06:58','2022-02-11 14:06:58','',2341,'https://www.datarainbow.eu/?p=2348',0,'revision','',0),(2350,1,'2022-02-11 16:31:06','2022-02-11 16:31:06','<!-- wp:paragraph -->\n<p>Non compliance with the GDPR has three series of legal consequences : We\'ve extensively heard of the administrative enforcement by national Data Protection Authorities. We have less heard of Criminal liabilities for non compliance, especially for the absence of measures of security. The third level is civil liability as set by the <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\">Article 82 GDPR</a>. This article establishes a right to compensation and liability to \'<em>Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.</em>\' Action can be taken individually or in a class action. This is a serious threat while we are witnessing high rise of data breach incidents with increase cyber attacks and ransomware. When a controller has neglected to take appropriate security measures, it has to be liable for compensation. The difficulty here is that often the damage caused is not measurable or not imminent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its recent enforcement against an online payment company Slimpay, the French Data Protection CNIL clearly states that non compliance with the obligations of security in <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 32 GDPR</a> is sufficient without the need to prove access to the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>La formation restreinte considère que l’absence de preuve d’une utilisation frauduleuse des données est sans incidence sur la caractérisation du manquement à l’obligation de sécurité. En effet, le risque d’utilisation frauduleuse des données à caractère personnel était réel, indépendamment des cas de fraude, dans la mesure où les données de nombreuses personnes ont été rendues accessibles à des tiers non autorisés. L’absence de dommage avéré pour les personnes concernées n’a pas d’incidence sur l’existence du défaut de sécurité, qui constitue le manquement à l’article 32 du RGPD.</em>\"</p><p>The restricted panel considers that the absence of evidence of fraudulent use of the data has no bearing on the characterisation of the breach of the security obligation. <strong>The risk of fraudulent use of personal data was real, irrespective of the cases of fraud, in so far as the data of many persons were made accessible to unauthorised third parties. The absence of proven damage to the data subjects does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.</strong></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Several recent data breaches, British Airways, EASYJET, MARRIOTT, TICKET MASTER, ETC... have been hurt by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/class-actions/id43827607\" target=\"_blank\">class actions</a>. In The UK, the case raised by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/richard-lloyd-v-google-copy/id50888527\" target=\"_blank\">Mr Lloyd against unlawful data access by Google</a> was ultimately rejected by the Supreme Court base to the fact that not all class members had suffers identical harm. When could that ever be the case? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Loss of control and distress have been the criteria in civil compensation following a data breach. Several German and Austrian courts have recognised the liability for non-material damages caused by data subjects. Three referrals for clarification have been made to the <a href=\"https://www.pearltrees.com/clarinettecaselaw/ecj/id43825447\" target=\"_blank\" rel=\"noreferrer noopener\">EUROPEAN COURT OF JUSTICE</a>. If interested by this important subject, you can have a deeper read on all relevant cases we could curate <a href=\"https://www.linkedin.com/posts/taubmanbassirian_gdpr-non-material-damage-liability-ugcPost-6893517983616950272-zPr5\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Criminal liabilities, EU National legislations have introduced into their criminal laws specific incriminations. We know about the offense of <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/ukpga/1990/18/section/1\" target=\"_blank\">Computer Misuse Act</a> 1990 in the UK. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The chart below shows some of the main criminal offences introduced in the French legal system related to data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2343,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/02/Screenshot-2022-01-03-at-21.58.36-1024x654.png\" alt=\"\" class=\"wp-image-2343\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16 </strong>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years\' imprisonment and a fine of 300,000 euros. The same penalties shall be imposed on the act, including negligently, of carrying out or having carried out a processing which has been the subject of one of the measures provided for in 3 ° of III of Article 20 of Law No. 78-17 of 6 January 1978 relating to data processing, files and freedoms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16-1</strong> The fact, except in cases where the processing has been authorized under the conditions provided for by Law No. 78-17 of 6 January 1978 cited above, of carrying out or having carried out a processing of personal data including among the data on which it relates the registration number of persons in the national register of identification of natural persons is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17</strong> The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17-1</strong> The fact that a provider of electronic communications services or a controller does not notify a personal data breach to the Commission nationale de l\'informatique et des libertés or to the interested party, in breach of Articles 33 and 34 of Regulation (EU) 2016/679 of 27 April 2016 or the provisions of II of Article 83 and Article 102 of Law No. 78-17 of 6 January 1978, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply to a processor failing to notify the controller of this breach in breach of Article 33 of Regulation (EU) 2016/679 of 27 April 2016 or Article 102 of The aforementioned Law No 78-17 of 6 January 1978.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18</strong> Collecting personal data by fraudulent, unfair or unlawful means is punishable by five years\' imprisonment and a fine of €300,000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18-1</strong> The fact of processing personal data concerning a natural person despite the opposition of this person, when this processing meets prospecting purposes, in particular commercial, or when this opposition is based on legitimate reasons, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19</strong> The fact, except in the cases provided for by law, of placing or storing in computerized memory, without the express consent of the person concerned, personal data which, directly or indirectly, reveal the racial or ethnic origins, political, philosophical or religious opinions, or trade union memberships of the persons, or which relate to their health or sexual orientation or gender identity, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply, except in the cases provided for by law, to placing or storing in computerized memory personal data concerning offences, convictions or security measures. The provisions of this Article shall apply to non-automated processing of personal data the implementation of which is not limited to the exercise of exclusively personal activities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19-1 </strong>In the event of the processing of personal data for the purpose of research in the field of health, the following is punishable by five years\' imprisonment and a fine of 300,000 euros: 1 ° Without having previously informed individually the persons on whose account personal data are collected or transmitted of their right of access, rectification and opposition, the nature of the data transmitted and the recipients thereof; (2) Despite the objection of the person concerned or, where provided for by law, in the absence of the informed and express consent of the person, or in the case of a deceased person, despite the refusal expressed by the latter during his lifetime.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-20</strong> The fact of keeping personal data beyond the period provided for by law or regulation, by the request for authorisation or opinion, or by the prior declaration addressed to the National Commission for Informatics and Freedoms, is punishable by five years\' imprisonment and a fine of 300,000 euros, unless this retention is carried out for historical purposes, statistical or scientific under the conditions provided for by law. The same penalties shall apply to the fact, except in the cases provided for by law, of processing personal data stored beyond the period mentioned in the first paragraph for purposes other than historical, statistical or scientific purposes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-21</strong> The fact, by any person holding personal data on the occasion of their registration, classification, transmission or any other form of processing, of diverting this information from its purpose as defined by the legislative provision, the regulatory act or the decision of the National Commission for Informatics and Freedoms authorising automated processing, or by the declarations prior to the implementation of this treatment, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22</strong> The fact, by any person who has collected, on the occasion of their registration, classification, transmission or other form of processing, personal data the disclosure of which would have the effect of undermining the consideration of the interested party or the intimacy of his private life, to carry, without authorisation of the interested party, these data to the knowledge of a third party who does not have standing to receive them is punishable by five years\' imprisonment and a fine of 300,000 euros. The disclosure provided for in the preceding paragraph is punishable by three years\' imprisonment and a fine of 100,000 euros when committed by recklessness or negligence. In the cases provided for in the two preceding paragraphs, prosecution may be brought only on the basis of a complaint by the victim, his legal representative or his successors in title.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-1</strong> Carrying out or causing to be transferred personal data which is or is intended to be processed to a State not belonging to the European Union or to an international organisation in breach of Chapter V of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, or Articles 112 to 114 of Law No 78-17 of 6 January 1978 cited above, shall be punishable by five years\' imprisonment and a fine of EUR 300 000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-2</strong> The following are punishable by one year\'s imprisonment and a fine of €15,000 for hindering the action of the National Commission for Informatics and Liberties: 1 ° Either by opposing the exercise of the missions entrusted to its members or authorised agents pursuant to the last paragraph of Article 10 of Law No. 78-17 of 6 January 1978 aforementioned when the visit has been authorised by the judge; 2 ° Either by refusing to communicate to its members or to the agents authorised pursuant to the last paragraph of Article 10 of the same law, or to the agents of a supervisory authority of a Member State of the European Union pursuant to Article 62 of Regulation (EU) 2016/679 of 27 April 2016 cited above, the information and documents useful for their mission, or by concealing such documents or information, or by removing them; 3 ° Either by communicating information that does not conform to the content of the recordings as it was at the time when the request was made or that does not present this content in a directly accessible form. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-23</strong> In the cases provided for in Articles 226-16 to 226-22-2, the erasure of all or part of the personal data subject to the processing that gave rise to the offence may be ordered. The members and agents of the National Commission for Informatics and Liberties are entitled to note the erasure of this data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-24</strong> Legal persons declared criminally liable, under the conditions provided for in Article 121-2, for the offences defined in this section shall incur, in addition to the fine in accordance with the procedures laid down in Article 131-38, the penalties provided for in 2 ° to 5 ° and 7 ° to 9 ° of Article 131-39. The prohibition mentioned in 2 ° of article 131-39 relates to the activity in the exercise or in the course of the exercise of which the offence was committed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are few of the French incriminations making liable the data controller or the person unlawfully accessing personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK Data Protection Act 2018 has introduced several offences: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2 id=\"offences-under-the-dpa-2018\">Offences under the DPA 2018</h2>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-119-obstructing-the-commissioner-in-inspecting-personal-data-to-discharge-an-international-obligation\"><a></a>Section 119: Obstructing the Commissioner in inspecting personal data to discharge an international obligation</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 119 is described as a ‘future-proofed’ version of s.54A DPA 1998. It is a provision that criminalises obstructing the ICO’s inspection of European information systems. The Commissioner may inspect personal data where the inspection is necessary in order to discharge an international obligation of the United Kingdom, subject to the restriction in subsection (2). Section 119 (6) states that it is an offence (a)intentionally to obstruct a person exercising the power under subsection (1), or (b)to fail without reasonable excuse to give a person exercising that power any assistance the person may reasonably require.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-132-prohibition-placed-upon-the-commissioner-or-the-commissioner-s-staff-against-disclosing-information-obtained-in-the-course-of-their-role-which-is-not-available-to-the-public\"><a></a>Section 132: Prohibition placed upon the Commissioner, or the Commissioner’s staff against disclosing information obtained in the course of their role (which is not available to the public)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 132 replaces section 59 DPA 1998 and criminalises action by former or current ICO staff who disclose data obtained during the course of their duties. Section 132 (2) clarifies the circumstances in which disclosure – with lawful authority – may be made. Section 132 (3) however confirms that it is an offence for a person knowingly or recklessly to disclose information in contravention of subsection (1).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-144-false-statement-made-in-response-to-an-information-notice\"><a></a>Section 144: False statement made in response to an information notice</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>It is an offence for a person, in response to information notice from the Commissioner, to make or recklessly make, a statement which they know to be false in a material respect.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-148-destroying-or-falsifying-information-and-documents-etc\"><a></a>Section 148: Destroying or falsifying information and documents etc</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Under Section 148 (2) (a) it is an offence for a person to destroy or otherwise dispose of, conceal, block or (where relevant) falsify all or part of the information, document, equipment or material. Section 148 (2) (b) makes to cause or permit the actions set pout in the previous subsection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-170-unlawful-obtaining-etc-of-personal-data\"><a></a>Section 170: Unlawful obtaining etc of personal data</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 170 of the Act builds on section 55 DPA 1998 which criminalised knowingly or recklessly obtaining, disclosing or procuring personal data without the consent of the data controller, and the sale or offering for sale of that data. The provision was most typically/commonly used to prosecute those who had accessed healthcare and financial records without a legitimate reason. Section 170 adds the offence of knowingly or recklessly&nbsp;<strong><em>retaining</em></strong>&nbsp;personal data (which may have been lawfully obtained) without the consent of the data controller. There are some exceptions: for example where such obtaining, disclosing, procuring or retaining was necessary for the purposes of preventing or detecting crime. Section 170 (2) and (3) set out the defences to Section 170 (1).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-171-re-identification-of-de-identified-personal-data\"><a></a>Section 171: Re-identification of de-identified personal data</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 171 - a new offence - criminalises the re-identification of personal data that has been ‘de-identified’ (de-identification being a process - such as redactions - to remove/conceal personal data). Section (5) states that it is an offence for a person knowingly or recklessly to process personal data that is information that has been re-identified. Sections 171 (3) and (4) set out the defences to Section 171 (1) – for example, the re-identification was necessary for the purposes of preventing or detecting crime. Sections 171 (6) and (7) set out the defences to Section 171 (5).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-173-alteration-etc-of-personal-data-to-prevent-disclosure-to-data-subject\"><a></a>Section 173: Alteration etc of personal data to prevent disclosure to data subject</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 173 relates to the processing of requests for data from individuals for their personal data. Section 173 (3) makes it a criminal offence for organisations (persons listed in Section 173 (4)) to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure. It builds on an offence under the Freedom of Information Act 2000. Possible defences to an offence under section 173 (3) are set out in Section 173 (5).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-184-prohibition-of-requirement-to-produce-relevant-records\"><a></a>Section 184: Prohibition of requirement to produce relevant records</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 184 (1) makes it an offence for a person to require another to provide them with or give them access to a relevant record linked to the employment, continued employment of one of their employees or a contract for the provisions of services to them. Section 184 (2) makes it an offence for a person to require another to provide them with or access to a relevant record if the requestor is involved in the provision of goods, facilities or services to the public or the requirement is a condition of providing or offering to provide goods, facilities or services to the other person or a third party. Section 184 (3) details the possible defences to offences under subsection 184 (1) or (2).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"schedule-15-paragraph-15-powers-of-entry-and-inspection\"><a></a>Schedule 15, Paragraph 15. Powers of Entry and Inspection</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>It is an offence under paragraph 15 (1) for a person to intentionally obstruct a person in the execution of a warrant issued under this Schedule or to fail without reasonable excuse to give a person executing the warrant such assistance as may be required. Under paragraph 15 (2) it is an offence for a person to make a statement in response to a requirement under paragraph 5(2(c) or (d) or 3(c) or (d) which the person knows to be false in a material respect or recklessly make such a statement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There are no custodial sentences in respect of offences under DPA 2018 and no powers of arrest; all offences are punishable only by a fine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Schedule 15 – Powers of entry and inspection, sets out the circumstances in which the Information Commissioner may apply for a search warrant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The DPA 2018 removed Section 77 (power to alter penalty for unlawfully obtaining etc personal data) of the Criminal Justice and Immigration Act 2008.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"///Users/New/Downloads/122558_49907c6f-a2e5-4c9e-8ee0-953315da668c.pdf\" target=\"_blank\">Irish Data Protection 2018</a> has introduced in Section 144 et all a series of offences :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"start\":144} -->\n<ol start=\"144\"><li>Unauthorised disclosure by processor</li><li>Disclosure of personal data obtained without authority</li><li>Offences by directors, etc., of bodies corporate</li><li>Prosecution of summary offences by Commission</li></ol>\n<!-- /wp:list -->','Non-Material Damage Compensation','Non compliance with the GDPR has three series of legal consequences : We\'ve extensively heard of the administrative enforcement by national Data Protection Authorities. We have less heard of Criminal liabilities for non compliance, especially for the absence of measures of security. The third level is civil liability as set by the Article 82 GDPR.','inherit','closed','closed','','2341-revision-v1','','','2022-02-11 16:31:06','2022-02-11 16:31:06','',2341,'https://www.datarainbow.eu/?p=2350',0,'revision','',0);
