INSERT INTO `wp_posts` (`ID`, `post_author`, `post_date`, `post_date_gmt`, `post_content`, `post_title`, `post_excerpt`, `post_status`, `comment_status`, `ping_status`, `post_password`, `post_name`, `to_ping`, `pinged`, `post_modified`, `post_modified_gmt`, `post_content_filtered`, `post_parent`, `guid`, `menu_order`, `post_type`, `post_mime_type`, `comment_count`) VALUES (2009,2,'2020-12-15 00:01:32','2020-12-15 00:01:32','<!-- wp:paragraph -->\n<p>This article was previously published. It\'s being re-published here since the latest enforcements by national Data Protection authorities : After the French CNIL has fined the Supermarket Carrefour and Carrefour Bank for a total of 3 Million Euros, two new enforcements : <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">Google for 100 million euros and Amazon for 35 million Euros</a> for non-compliant use of&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#cookies</a>&nbsp;(in particular placing advertising cookies without prior consent and adequate information).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In both deliberations, the CNIL found it is materially competent to control and sanction cookies placed by companies on the computers of users residing in France. It thus underlined that the one stop shop mechanism provided by the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#GDPR</a>&nbsp;was not intended to apply in these procedures, since the operations linked to the use of cookies fall under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#ePrivacy</a>&nbsp;Directive, transposed to article 82 of the French Data Protection Act.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>Link to the attached sanctioning decision against Google:&nbsp;<a href=\"https://lnkd.in/e7Cq5SX\">https://lnkd.in/e7Cq5SX</a>.</li><li>Link to the sanctioning decision against Amazon:&nbsp;<a href=\"https://lnkd.in/exfhXES\">https://lnkd.in/exfhXES</a>.</li><li>Links to the announcements: <ul><li><a href=\"http://Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED\">Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED</a></li><li><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/eV7Byyi.\" target=\"_blank\">Cookies : sanction de 35 millions d’euros à l’encontre d’AMAZON EUROPE CORE</a></li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The same day, the <a href=\"https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/nov/ugyldigt-samtykke-paa-hjemmeside\" target=\"_blank\" rel=\"noreferrer noopener\">Danish Data Protection Authority</a> found that the consent format implemented by a website did not meet the regulatory requirements before setting cookies and any other technology.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In November, the Belgian authorities have expressed their intention to Take <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=0ee39d9b-9223-493e-8549-9c9de507aa67\" target=\"_blank\">Down Websites Infringing GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major cases by the European Court of Justice (Fashion ID (c-40-17) and Planet49 (c-673/17)) had highlighted the importance of cookie compliance in Europe, and the complex intricacies which organisations must consider. In addition, an increase in the number of enforcement actions and fines in Europe had signified a move towards stricter regulation of ePrivacy.<br>➡️ Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️ Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️ Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️ Five jurisdictions find an implicit consent to be valid</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://blogs.dlapiper.com/privacymatters/european-law-on-cookies-guide/?utm_source=dlvr.it&amp;utm_medium=linkedin\">DLAPiper have published a guide on cookie law in EU</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With this in view, and while the new Council <a href=\"https://twitter.com/hashtag/ePrivacy?src=hashtag_click\">#ePrivacy</a> deal is awaited any time soon, here is what we can say about cookies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What do we mean by cookies? </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wikipedia has a page on yummy <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/Cookie\" target=\"_blank\">cookies</a>. These are not the ones we want to talk about. What we are interested on are not yummy cookies, but the <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/HTTP_cookie\" data-type=\"URL\" data-id=\"https://en.wikipedia.org/wiki/HTTP_cookie\" target=\"_blank\">HTTP Cookies</a> also called web cookie, Internet cookie, browser cookie, or commonly cookie. A cookie is ‘<em>a small piece of data sent from a website and stored on the user\'s computer by the user\'s web browser while the user is browsing.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From a regulatory perspective, in Europe, the <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" data-type=\"URL\" data-id=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" target=\"_blank\">Directive or 2002/58/EC of the European Parliament and of the Council of 12 July 2002</a> concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) commonly called ePrivacy. Being a Directive this text required individual implantions by the 28 member states into their national legislations. This explains the various national implementations. We will look more closely at the <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" data-type=\"URL\" data-id=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" target=\"_blank\">Privacy and Electronic Communication Regulation 2003 or PECR</a> for its implementation in the UK or the French <a rel=\"noreferrer noopener\" href=\"https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978\" target=\"_blank\">article 82 of the [Loi «&nbsp;Informatique et Libertés&nbsp;»</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Commission published a study on the \"<a href=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" data-type=\"URL\" data-id=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" target=\"_blank\" rel=\"noreferrer noopener\">ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation</a>\" (SMART 2013/0071).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although we will mostly mention cookies here, the regulation actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in any ways.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This includes Flash cookies, smartphone or other electronic devices apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the Wikipedia entry mentions ‘<em>Cookies were designed to be a reliable mechanism for websites to remember stateful information (such as items added in the shopping cart in an online store) or to record the user\'s browsing activity (including clicking particular buttons, logging in, or recording which pages were visited in the past). They can also be used to remember arbitrary pieces of information that the user previously entered into form fields such as names, addresses, passwords, and credit-card numbers</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can further read on cookies from KJ Kearie who has a Comprehensive Guide on cookies: ‘<em>There are two main types of cookies – session cookies only collect details from a single browsing sessions, while persistent cookies remain on the user’s device and collect information over time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have previously wrote about pernicious access to visitors data often ignored by web owners in two previous articles :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" target=\"_blank\">WEBSITE TRANSPARENCY : COOKIES AND PRIVACY NOTICE</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\">WEBSITES SURREPTITIOUSLY TRACKING AND REPORTING ON VISITORS</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This article comes out of a frustration expressed by many privacy advocates around the EU to witness a latence to see any improvement coming .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>While the ePrivacy Directive is under reform, the European Data Protection Board on a recent guidance has further clarified how cookies implementation should comply with the requirements of transparency and consent as set by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Privacy and Electronic Communications Regulations (PECR), sits alongside the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR), imposing specific rules on electronic communications, including marketing solicitation, traffic and location data, itemised billing, line identification, directory listings, and the use of cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The consent requirement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Consent</strong> is mandatory for all cookies that are <strong>not strictly necessary</strong> for the provision of a service. It has been argued no cookie is actually necessary, browser settings are capable of replacing functional cookies. the strict necessary cookie is to be limited to a specific service requested by the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookies used for social media plugins or tracking, site personalisation, advertising, cross-device tracking, research, or product improvement purposes, will require user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/\" target=\"_blank\">UK ICO has produced guidance on the use of cookies</a> completed by a <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" data-type=\"URL\" data-id=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" target=\"_blank\">blog post by Ali Shah, Head of Technology Policy</a> clarifying that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It can no longer be relied on implied consent for the use of cookies ;</li><li>Analytics cookies aren’t strictly necessary and so require consent as they are not part of the functionality that the user requests when they use an online service so we do not need consent ;</li><li>Statements such as ‘by continuing to use this website you are agreeing to cookies’ is not valid consent under the higher GDPR standard. Further clarifications of divergence views on this point will be gathered ;</li><li>PECR always requires consent for non-essential cookies, such as those used for the purposes of marketing and advertising. Legitimate interests cannot be relied upon for these cookies.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Ali Shah concludes that Cookie compliance will be an increasing regulatory priority for the ICO in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board published a new <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" target=\"_blank\">guidelines 05/2020</a> on consent under Regulation 2016/679 in which it remind : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Meanwhile, the EDPB is aware of the review of the ePrivacy Directive (2002/58/EC). The notion of consent in the draft ePrivacy Regulation remains linked to the notion of consent in the GDPR.7 Organisations are likely to need consent under the ePrivacy instrument for most online marketing messages or marketing calls, and online tracking methods including by the use of cookies or apps or other software. The EDPB has already provided recommendations and guidance to the European legislator on the Proposal for a Regulation on ePrivacy.’</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Other requirements</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a <strong>free, informed and unambiguous consent</strong>, users must be clearly informed about what cookies are in use (including any third party cookies) and what function they perform.&nbsp; For non-essential cookies, <strong>pre-ticked boxes or equivalent default fixtures are not allowed,</strong> and user access should not be denied if they do not consent to such cookies. ICO is very specific about placement, formatting and wording of cookie information and consent request.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Prior to the EDPB, its predecessor, the Working Party article 29 had required that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:pullquote -->\n<figure class=\"wp-block-pullquote\"><blockquote><p>“Every organisation that maintains a website should publish a<strong> privacy statement/ notice</strong> on the website. A link to this privacy statement/ notice should be <strong>clearly visible</strong> <strong>on each page</strong> of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible.“</p></blockquote></figure>\n<!-- /wp:pullquote -->\n\n<!-- wp:paragraph -->\n<p>In November 2019,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://privacyinternational.org/\" target=\"_blank\">Privacy International</a> [<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">1</a>], the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/legal-action/challenge-hidden-data-ecosystem\">complaints</a> [<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-\">2</a>]&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a valid transparency, privacy notices must be <strong>concise, transparent, intelligible and easily accessible (Article 12.1)</strong>;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://www.huntonprivacyblog.com/2020/10/05/cnil-publishes-updated-cookie-guidelines-and-final-version-of-recommendations-on-how-to-get-users-consent/\" target=\"_blank\">CNIL has published updated cookies recommendations</a>. Soon reaching the CNIL’s deadline, what has changed?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Increasingly, websites have included cookie banners to require visitors consent. However, not all cookie banners are actually disabling with respect to visitors consent denial. A study published by </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Increasingly, websites have included cookie banners to require visitors consent. However, not all cookie banners are actually disabling with respect to visitors consent denial. A study published by Celestin Matte, <a href=\"https://www.linkedin.com/in/ACoAAAC-QhsB_lHI7RCVypElP9Ysu4SdRlBEVNw\">Nataliia Bielova, PhD</a>, <a href=\"https://www.linkedin.com/in/ACoAAAS2KUUBWxSWRt-qT7-Qq9FNThWTspdFWCE\">Cristiana Santos</a>  IEEE Symposium on Security and Privacy (IEEE S&amp;P 2020) question : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"http://www-sop.inria.fr/members/Nataliia.Bielova/papers/Matt-etal-20-SP.pdf\" target=\"_blank\">Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe’s Transparency and Consent Framework</a> Nataliia Bielova, Cristiana Santos. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In a second paper, the group question : \'<em>Are cookie banners indeed compliant with the law</em>?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners\'?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"In this paper, we describe how cookie banners, as a consent mechanism in web applications, should be designed and implemented to be compliant with the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#ePrivacy</a>&nbsp;Directive and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#GDPR</a>, defining 22 legal requirements.</p><p>While some are provided by legal sources, others result from the domain expertise of computer scientists.</p><p>We perform a technical assessment of whether technical (with computer science tools), manual (with a human operator) or user studies verification is needed.</p><p>We show that it is not possible to assess legal compliance for the majority of requirements because of the current architecture of the web.<br>With this approach, we aim to support policy makers assessing compliance in cookie banners, especially under the current revision of the EU ePrivacy framework\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>Cookie audit</em>. Guidance provides a detailed list of actions to be taken for new and existing cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Analytics cookies</em>. These are not exempt from the consent requirement by default, because they usually do not amount to being ‘strictly necessary’. However, “this may not always be the case where the setting of a first-party analytics cookie results in a low level of intrusiveness and low risk of harm to individuals”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Compliance deadline</em>. No fixed term is specified in the guidelines, but ICO’s Head of Technology Policy, Ali Shah, has published a&nbsp; post instructing the online service providers to “start taking steps to comply now”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Other jurisdictions</em>. French data protection authority CNIL has announced that this month it will repeal its 2013 cookie recommendation that has become outdated in some respects (in particular regarding&nbsp; what concerns the expression of consent), and publish guidelines outlining the applicable rules of law. Similar actions have been taken by the Dutch and German data protection authorities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a paper published July 2018 entitled \'<em><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/s/file/preview/181819110/1808.05096.pdf?pearlId=231196296\" target=\"_blank\">We Value Your Privacy … Now Take Some Cookies : Measuring the GDPR’s Impact on Web Privacy\'</a></em>  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Martin Degeling, Christine Utz, Christopher Lentzsch, Henry Hosseini, Florian Schaub and Thorsten Holz from the Ruhr-Universität Bochum, Germany and thr University of Michigan, Ann Arbor, MI, USA, </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>monitored and analysed the GDPR’s impact on popular websites in all 28 member states of the European Union.</li><li>They found that 84.5 % of websites had a privacy policy. </li><li>72.6 % of websites with existing privacy policies<br>updated them close to the ebtry into force of the GDPR.</li><li>62.1 % of websites displayed cookie consent notices, 16 % more than in January 2018. These notices inform users about a site’s cookie use and user tracking practices. </li><li>They observed cookie consent notices and evaluated 16 common implementations<br>with respect to their technical realisation of cookie consent.<br>This revealed that core web security mechanisms such as the same-origin policy pose problems for the implementation of consent according to GDPR rules, and opting out of third party cookies requires the third party to cooperate. In conclusion, they fond that the GDPR is making the web more transparent, while it still  lacks of both functional and usable mechanisms for users to consent to or deny processing of their personal data on the Internet.</li><li>For each country, the 500 most popular websites were examined for the presence of and updates to their privacy policy.</li></ul>\n<!-- /wp:list --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In January 2020, another study was published <em><a rel=\"noreferrer noopener\" href=\"https://arxiv.org/abs/2001.02479\" target=\"_blank\">Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence</a></em><a href=\"https://arxiv.org/search/cs?searchtype=author&amp;query=Nouwens%2C+M\"> </a>by Midas Nouwens, Ilaria Liccardi, Michael Veale, David Karger, Lalana Kagal <a href=\"https://arxiv.org/pdf/2001.02479.pdf\">suggests that many cookie consent pop-ups are flouting EU privacy laws.</a>and noticed that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"New consent management platforms (CMPs) have been introduced to the web to conform with the EU\'s General Data Protection Regulation, particularly its requirements for consent when companies collect and process users\' personal data. This work analyses how the most prevalent CMP designs affect people\'s consent choices. We scraped the designs of the five most popular CMPs on the top 10,000 websites in the UK (n=680). </p><p>We found that dark patterns and implied consent are ubiquitous; only 11.8% meet the minimal requirements that we set based on European law. Second, we conducted a field experiment with 40 participants to investigate how the eight most common designs affect consent choices. <strong>We found that notification style (banner or barrier) has no effect</strong>; removing the opt-out button from the first page increases consent by 22--23 percentage points; and providing more granular controls on the first page decreases consent by 8--20 percentage points. This study provides an empirical basis for the necessary regulatory action to enforce the GDPR, in particular the possibility of focusing on the centralised, third-party CMP services as an effective way to increase compliance.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>An illusion of control and transparency?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The French CNIL</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\" target=\"_blank\">The legal framework relating to consent has evolved, and so does the website of the CNIL</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\" target=\"_blank\">Online targeted advertisement: what action plan for the CNIL?</a> TIt was announced “<em>The CNIL has received an important number of individual and collective complaints (La Quadrature du Net, Privacy International, NOYB) relating to online marketing. In 2018, 21% of the complaints were related to marketing in the broad sense.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following&nbsp; the publication in <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=062c5802-f33e-447b-9150-0d8afb2ea6f8\" target=\"_blank\">July 2019 of an updated guidance on cookies</a>, the French data protection authority proposed a consultation on its draft recommendations on practical ways to collect website user consent for cookies and similar technologies on January 2020. The Recommendations including requirements for obtaining GDPR-standard consent, by various European data protection authorities, including the CNIL and the ICO. The CNIL has since undertaken a consultation to develop practical methods to obtain user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Olivier Proust from the Law Firm Fieldfisher has published a comparative table of what is new on the July cookie guidance to compare with the 2013 guidelines in <a rel=\"noreferrer noopener\" href=\"https://www.fieldfisher.com/en/services/privacy-security-and-information/privacy-security-and-information-law-blog/cnil-publishes-revised-guidelines-on-cookies-and-other-tracking-technology\" target=\"_blank\">CNIL publishes revised guidelines on cookies and other tracking technology</a>. A larger scope, a new legal ground now based on the Article 82 of the amended French Data Protection Act, adapting to the GDPR standard of consent. It is specifically mentioned that browser settings ‘do not provide enough information to users, and therefore, do not enable to obtain informed consent.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL takes the position that in certain conditions ‘Cookies used to measure audiences on a web site or mobile app may be exempt from consent’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>How these rules are currently&nbsp;implemented by the major websites in France?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No one better than lawyers could read and implement regulations. Lawyers handle sensitive data bound under professional confidentiality.&nbsp; Some advise other organisations they influence on their implementation of the regulation. We have been analysing the French national Bar\'s website as well as the major law society website in the Capital city avocatparis.org</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The website has a “mentions légales” for legal matters with a very succinct mention of the Loi Informatique et Libertés, “Loi n° 78-17 du 6 Janvier 1978 relative à l\'informatique, aux fichiers et aux libertés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"En regard de la loi 78-17 du 6 Janvier 1978, vous disposez d\'un droit d\'accès et de rectification aux données personnelles vous concernant.</p><p>Il suffit d\'en faire la demande à : droit_acces@avocatparis.org”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The requirements of the Article 13 GDPR are grossly missing to provide the regulatory transparency. The website lack encryption certificate as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the cookies, a banner online gives the option to accept cookies that are placed as soon as the website is accessed, So no privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the visitor wanted to know more, click the button ‘<em>en savoir plus</em>’ takes you to the CNIL’s webpage explaining the requirements they had ignored!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No privacy by design as there is no way to disable cookie dropping.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lack of transparency means visitors are in total ignorance of id collected from them. no privacy on the website inform the visitors that their web browsing, IP address and other websites they will visit will be logged and shared and made accessible to other users of their electronic devices.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No consent is requested therefore no option to modulate the drop of cookies ans part of what should be privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Being the website of the French law society, the sensitivity of the data accessed is highly concerning. The law society invites victims of domestic abuse to get information on their website trough radio advertisement. Many distressed victims will never expect surfing such a website could result in sharing their personal data for the sake of profiling and targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1993,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.22.04-1024x579.png\" alt=\"\" class=\"wp-image-1993\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Recently, a ranking website operating in France has been under attack by the law society. Ironically, the law society has produced a model of SAR letter for all lawyers to send to this web owners. This can be wrong from several angles, not mentioning GDPR compliance should not become an instrument of banning free speech.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lawyers member of the bar are invited to send the letter with a copy of their ID card. Was spreading ID card to add on the publicly available data by providing further personal data. This was possibly a mistake.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On their SAR model letter, they have included an enquiry concerning the company’s website compliance. This is where it becomes more interesting for our purpose. It is satisfying to notice that GDPR compliance, and more specifically data collection by the website is of concern for the law society whose biggest entity in Paris has a fully non-compliant website for months, resisting to make any amendment to complete with the regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The National representation, Conseil National des Barreaux, CNB, have rushed to make their website in order, using a cookie management tool [<a href=\"https://tarteaucitron.io/en/\" target=\"_blank\" rel=\"noreferrer noopener\">Tarteaucitron</a>]. However, again despite refusing tracking cookies are dropped with up to 5 years retention! Why should they need that?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1994,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.31-1024x552.png\" alt=\"\" class=\"wp-image-1994\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":1995,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.56-1024x594.png\" alt=\"\" class=\"wp-image-1995\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The Entity repenting lawyers in the Capital city Paris, remains full of cookies, java Scripts, for detention periods far above the 13 months tolerated by the French Data Protection Authority CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, data is transferred outside the US in infringement with the ECJ decision Schrems-II since the invalidation of the Privacy Shield.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many law firm\'s websites are in the same poor state.&nbsp;Despite the CNB having produced an exhaustive [<a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-telechargez-le-guide-pratique-elabore-pour-la-profession-davocat\" target=\"_blank\" rel=\"noreferrer noopener\">guidance</a>] on what should be implemented. Is this an application of the old principle “<em>do what you are told, not what we do</em>’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are the consequences of ignoring the regulation ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Shared liability for cookie compliance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In principle, the person setting the cookie is primarily responsible for compliance with the requirements of the cookie regulation. For third party cookies, both the online service provider and the third party have a responsibility for ensuring users are clearly informed about cookies and for obtaining consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&gt;&gt;&gt;The UK ICO acknowledges that this is one of the most challenging areas in which to achieve compliance with PECR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Fashion ID ruling, the European Court of Justice has set the principle of liability of a Facebook Fan page admin for data processed by Facebook for which he could not exercice any control. This ruling can be translated an obligation for any facilitator of data processing to check their data processor and provide the necessary transparency. Therefore the owner of a website cannot simply rely on the promise of their web developper to be GDPR compliant. they have a duty to check the presence of cookies in order to provide the appropriate information and request consent before any tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17)&nbsp;</a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a> ECJ decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation, not limited to personal data, prohibiting cookie walls. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have mentioned the complaint made by Privacy International and La Quadrature du Net.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the ECJ decision in Max Schrems-II, Max Schrems filed 101 complaints and stated :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">Guess What? Many Cookie Banners Ignore Your Wishes, So Max Schrems Goes On The GDPR Attack Again</a> <a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“An initial scan of 22,949 Web sites from the EU domains, as well as .org and .com, showed 1,426 that had cookie banners based on the&nbsp;<a href=\"https://iabeurope.eu/transparency-consent-framework/\"><strong>Interactive Advertising Bureau Europe Transparency and Consent Framework</strong></a>, the main industry standard for this area. Of those, the team of researchers took a close look at 560 Web sites from .uk, .fr, .it, .be, .ie and .com domains to detect possible GDPR violations. Shockingly, they found four types of violations in cookie banners, across 305 Web sites -- 54% of the sample:….</p><p><em>noyb.eu identified countless violations of European and French cookie privacy laws as CDiscount, Allociné and Vanity Fair all turn a rejection of cookies by users into a \"fake consent\". The privacy enforcement non-profit noyb.eu filed three formal [GDPR] complaints with the French Data Protection Authority (CNIL) today.</em></p><p><em>Up to 565 \"fake consents\" per user. Despite users going through the trouble of \"rejecting\" countless cookies on the French eCommerce page CDiscount, the movie guide Allocine.fr and the fashion magazine Vanity Fair, these webpages have sent digital signals to tracking companies claiming that users have agreed to being tracked online. CDiscount has sent \"fake consent\" signals to 431 tracking companies per user, Allocine to 565 and Vanity Fair to 375, as the analysis of the data flows now show.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Schrems points out that one company taking advantage of \"fake consent\" is Facebook, which is happy to place cookies after people have clearly objected to all tracking. That means the scale of the potential GDPR breach is considerable. It will be some time before CNIL hands down its decision, but based both on Schrems\' track record and on the facts of the case, it seems probable that he will prevail once more. Although the initial ruling will only apply to France, it is likely to be followed by data protection authorities in other EU countries. If any of the Web sites mentioned above challenge a result that goes against them, there may be a referral to the EU\'s top court, whose decision will be definitive and apply across the whole region. That, in its turn, is likely to influence online privacy laws around the world, as the&nbsp;<a href=\"https://qz.com/africa/1746202/kenya-has-passed-new-data-protection-laws-in-compliance-with-gdpr/\"><strong>GDPR is already doing</strong></a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of non-consistency of national DPAs</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The consistency mechanism that requires a harmonious enforcement of the regulation has not been enforced by the European Data Protection Board.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains hopes to see the reformed privacy and electronic communication regulation or more possibly individual redress or class actions as they were introduced with the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Real Time Biding and Brave browser ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Johnny Ryan has been actively advocating. On 12 September 2018 a Formal GDPR complaints, accompanied by an overview of RTB that details evidence from Google and IAB technical documentation (the ‘Ryan Report’), are submitted to Irish Data Protection Commission (DPC) and UK Information Commissioner’s Office (ICO) by Johnny Ryan of Brave, and Jim Killock of Open Rights Group and Michael Veale of UCL. <a href=\"https://brave.com/rtb-updates/\">https://brave.com/rtb-updates/</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We won\'t further develop on that subject here. You can read : <a href=\"https://www.pearltrees.com/s/file/preview/211865723/2001.02479.pdf?pearlId=284242059\">Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence</a> “<em>New consent management platforms (CMPs) have been introduced to the web to conform with the EU’s General Data Protection Regulation, particularly its requirements for consent when companies collect and process users’ personal data. This work analyses how the most prevalent CMP designs affect people’s consent choices.</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And here a great in depth article by Marie-Claire Peroux LLM : <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/death-of-3rd-party-cookies-is-privacy-protection-possible-for-the-future-adtech-in-the-eu/\" target=\"_blank\">Death of 3rd Party Cookies : Is Privacy Protection Possible For The Future AdTech In The EU ?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Time for web owners to check their websites and rethink all these third party cookies, check the retention periods, usually unlawful above 13 months maximum. Google Analytics and Facebook Connect are under the radar especially due to their Terms of use and data transfert outside the EEA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A white collar crime high profile attorney should not use a \'Not Secure\' website to invite its web users to fill in a contact form and use cookies without transparency and consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1999,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-19.42.08-1024x584.png\" alt=\"\" class=\"wp-image-1999\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Further read on the ECJ decisions Planet49 and Fashion ID :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ECJ 5 June 2018 Judgment in Case C-210/16</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2018-06/cp180081en.pdf\">Wirtschaftsakademie Schleswig-Holstein</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/pulse/facebook-fan-page-ecj-ruling-tara-taubman-bassirian-llm/\">Facebook Fan Page Admin</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The administrator of a fan page on Facebook is jointly responsible with Facebook for the processing of data of visitors to the page</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case arised from a dispute over a German Fan Page on Facebook which used the social network to store cookies on visitors’ hard drives to collect data about them. A German data protection authority ordered the operator of the fan page, an education company, to deactivate the page as visitors were not made aware of the collection of their personal data. The company argued it was not responsible for the processing of personal data by Facebook and that any action should be brought against the social network.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This ECJ ruling establish a joint controller liability between Facebook and the page\'s Admin meaning that owners of Facebook Fan Pages who fall within the scope of the GDPR might have to make joint controllership arrangements with Facebook to establish who is responsible for what. You can&nbsp;<a href=\"https://panopticonblog.com/2018/06/05/the-facebook-fan-page-judgment-joint-data-controllers-cookies-and-targeted-advertising/\" target=\"_blank\" rel=\"noreferrer noopener\">read more</a>&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECJ considered that the administrator takes part in deciding what data to collect and how to process it, for example by defining a target audience and asking for demographic data or information on the lifestyles and interests of visitors to the page. Therefore it has to be held responsible for protecting visitors’ personal data and cannot hide behind the social network.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The admin liability as a joint controller is engaged despite its lack of control over the data processed by Facebook,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ECJ 1&nbsp;October 2019 (request for a preliminary ruling from the Bundesgerichtshof&nbsp;— Germany)&nbsp;— Bundesverband der Verbraucherzentralen und Verbraucherverbände&nbsp;— Verbraucherzentrale Bundesverband eV v Planet49 GmbH</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17)&nbsp;</a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>[Planet49]</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lottery competition was organised requiring users to tick a box or a pre-ticked box allowing Planet49 to set cookies to track the user\'s behaviour online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The German Federation of Consumer Organisations (the \'Federation\') claimed that these two check-boxes did not satisfy German law requirements, and sought an injunction requiring Planet49 to cease using them. The case ultimately reached the German Federal Court of Justice (the \'Bundesgerichtshof\') , which in turn referred the case to the CJEU for preliminary ruling.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Pre-ticked check-boxes authorising the use of cookies and similar technologies do not constitute valid consent under the e-Privacy Directive.<br><br>2. Where consent is required for cookies under the e-Privacy Directive, the GDPR standard of consent applies.<br><br>3. It does not matter whether the cookies constitute personal data or not - Article 5(3) of the e-Privacy Directive (i.e. the cookie consent rule) applies to any information installed or accessed from an individual\'s device.<br><br>4. Website users must be provided with information on the duration of the cookies, and whether third parties will have access to the cookies.</li></ol>\n<!-- /wp:list --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:list -->\n<ul><li>The ePrivacy Directive requires users to&nbsp;give active consent before cookies can be dropped on their devices, preselected tick in a box are not a “<em>statement or clear affirmative action</em>” as required by the General Data Protection Regulation (“GDPR”).</li><li>With regard to Recital 17 of the ePrivacy Directive, combined with Recital 32 of the GDPR, “<em>silence, pre-ticked boxes or inactivity</em>” from being taken to constitute consent.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>**Photography kindly shared by <a href=\"https://www.linkedin.com/in/vanja-munerati-a72195?originalSubdomain=uk\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Vanja Munerati</strong> </a>who is a regulatory economist passionate about outdoors and keen nature photographer. **</em></p>\n<!-- /wp:paragraph -->','Cookies Are Not Yummies','Cookies collect visitors data shared with third parties. They require transparency and prior consent.','inherit','closed','closed','','1983-revision-v1','','','2020-12-15 00:01:32','2020-12-15 00:01:32','',1983,'https://www.datarainbow.eu/1983-revision-v1/',0,'revision','',0),(2010,2,'2020-12-15 00:13:45','2020-12-15 00:13:45','<!-- wp:paragraph -->\n<p>This article was previously published. It\'s being re-published here since the latest enforcements by national Data Protection authorities : After the French CNIL has fined the Supermarket Carrefour and Carrefour Bank for a total of 3 Million Euros, two new enforcements : <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">Google for 100 million euros and Amazon for 35 million Euros</a> for non-compliant use of&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#cookies</a>&nbsp;(in particular placing advertising cookies without prior consent and adequate information).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In both deliberations, the CNIL found it is materially competent to control and sanction cookies placed by companies on the computers of users residing in France. It thus underlined that the one stop shop mechanism provided by the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#GDPR</a>&nbsp;was not intended to apply in these procedures, since the operations linked to the use of cookies fall under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#ePrivacy</a>&nbsp;Directive, transposed to article 82 of the French Data Protection Act.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>Link to the attached sanctioning decision against Google:&nbsp;<a href=\"https://lnkd.in/e7Cq5SX\">https://lnkd.in/e7Cq5SX</a>.</li><li>Link to the sanctioning decision against Amazon:&nbsp;<a href=\"https://lnkd.in/exfhXES\">https://lnkd.in/exfhXES</a>.</li><li>Links to the announcements: <ul><li><a href=\"http://Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED\">Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED</a></li><li><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/eV7Byyi.\" target=\"_blank\">Cookies : sanction de 35 millions d’euros à l’encontre d’AMAZON EUROPE CORE</a></li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The same day, the <a href=\"https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/nov/ugyldigt-samtykke-paa-hjemmeside\" target=\"_blank\" rel=\"noreferrer noopener\">Danish Data Protection Authority</a> found that the consent format implemented by a website did not meet the regulatory requirements before setting cookies and any other technology.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In November, the Belgian authorities have expressed their intention to Take <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=0ee39d9b-9223-493e-8549-9c9de507aa67\" target=\"_blank\">Down Websites Infringing GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major cases by the European Court of Justice (Fashion ID (c-40-17) and Planet49 (c-673/17)) had highlighted the importance of cookie compliance in Europe, and the complex intricacies which organisations must consider. In addition, an increase in the number of enforcement actions and fines in Europe had signified a move towards stricter regulation of ePrivacy.<br>➡️ Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️ Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️ Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️ Five jurisdictions find an implicit consent to be valid</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://blogs.dlapiper.com/privacymatters/european-law-on-cookies-guide/?utm_source=dlvr.it&amp;utm_medium=linkedin\">DLAPiper have published a guide on cookie law in EU</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With this in view, and while the new Council <a href=\"https://twitter.com/hashtag/ePrivacy?src=hashtag_click\">#ePrivacy</a> deal is awaited any time soon, here is what we can say about cookies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What do we mean by cookies? </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wikipedia has a page on yummy <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/Cookie\" target=\"_blank\">cookies</a>. These are not the ones we want to talk about. What we are interested on are not yummy cookies, but the <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/HTTP_cookie\" data-type=\"URL\" data-id=\"https://en.wikipedia.org/wiki/HTTP_cookie\" target=\"_blank\">HTTP Cookies</a> also called web cookie, Internet cookie, browser cookie, or commonly cookie. A cookie is ‘<em>a small piece of data sent from a website and stored on the user\'s computer by the user\'s web browser while the user is browsing.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From a regulatory perspective, in Europe, the <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" data-type=\"URL\" data-id=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" target=\"_blank\">Directive or 2002/58/EC of the European Parliament and of the Council of 12 July 2002</a> concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) commonly called ePrivacy. Being a Directive this text required individual implantions by the 28 member states into their national legislations. This explains the various national implementations. We will look more closely at the <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" data-type=\"URL\" data-id=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" target=\"_blank\">Privacy and Electronic Communication Regulation 2003 or PECR</a> for its implementation in the UK or the French <a rel=\"noreferrer noopener\" href=\"https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978\" target=\"_blank\">article 82 of the [Loi «&nbsp;Informatique et Libertés&nbsp;»</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Commission published a study on the \"<a href=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" data-type=\"URL\" data-id=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" target=\"_blank\" rel=\"noreferrer noopener\">ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation</a>\" (SMART 2013/0071).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although we will mostly mention cookies here, the regulation actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in any ways.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This includes Flash cookies, smartphone or other electronic devices apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the Wikipedia entry mentions ‘<em>Cookies were designed to be a reliable mechanism for websites to remember stateful information (such as items added in the shopping cart in an online store) or to record the user\'s browsing activity (including clicking particular buttons, logging in, or recording which pages were visited in the past). They can also be used to remember arbitrary pieces of information that the user previously entered into form fields such as names, addresses, passwords, and credit-card numbers</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can further read on cookies from KJ Kearie who has a Comprehensive Guide on cookies: ‘<em>There are two main types of cookies – session cookies only collect details from a single browsing sessions, while persistent cookies remain on the user’s device and collect information over time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have previously wrote about pernicious access to visitors data often ignored by web owners in two previous articles :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" target=\"_blank\">WEBSITE TRANSPARENCY : COOKIES AND PRIVACY NOTICE</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\">WEBSITES SURREPTITIOUSLY TRACKING AND REPORTING ON VISITORS</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This article comes out of a frustration expressed by many privacy advocates around the EU to witness a latence to see any improvement coming .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>While the ePrivacy Directive is under reform, the European Data Protection Board on a recent guidance has further clarified how cookies implementation should comply with the requirements of transparency and consent as set by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Privacy and Electronic Communications Regulations (PECR), sits alongside the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR), imposing specific rules on electronic communications, including marketing solicitation, traffic and location data, itemised billing, line identification, directory listings, and the use of cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The consent requirement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Consent</strong> is mandatory for all cookies that are <strong>not strictly necessary</strong> for the provision of a service. It has been argued no cookie is actually necessary, browser settings are capable of replacing functional cookies. the strict necessary cookie is to be limited to a specific service requested by the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookies used for social media plugins or tracking, site personalisation, advertising, cross-device tracking, research, or product improvement purposes, will require user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/\" target=\"_blank\">UK ICO has produced guidance on the use of cookies</a> completed by a <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" data-type=\"URL\" data-id=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" target=\"_blank\">blog post by Ali Shah, Head of Technology Policy</a> clarifying that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It can no longer be relied on implied consent for the use of cookies ;</li><li>Analytics cookies aren’t strictly necessary and so require consent as they are not part of the functionality that the user requests when they use an online service so we do not need consent ;</li><li>Statements such as ‘by continuing to use this website you are agreeing to cookies’ is not valid consent under the higher GDPR standard. Further clarifications of divergence views on this point will be gathered ;</li><li>PECR always requires consent for non-essential cookies, such as those used for the purposes of marketing and advertising. Legitimate interests cannot be relied upon for these cookies.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Ali Shah concludes that Cookie compliance will be an increasing regulatory priority for the ICO in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board published a new <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" target=\"_blank\">guidelines 05/2020</a> on consent under Regulation 2016/679 in which it remind : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Meanwhile, the EDPB is aware of the review of the ePrivacy Directive (2002/58/EC). The notion of consent in the draft ePrivacy Regulation remains linked to the notion of consent in the GDPR.7 Organisations are likely to need consent under the ePrivacy instrument for most online marketing messages or marketing calls, and online tracking methods including by the use of cookies or apps or other software. The EDPB has already provided recommendations and guidance to the European legislator on the Proposal for a Regulation on ePrivacy.’</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Other requirements</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a <strong>free, informed and unambiguous consent</strong>, users must be clearly informed about what cookies are in use (including any third party cookies) and what function they perform.&nbsp; For non-essential cookies, <strong>pre-ticked boxes or equivalent default fixtures are not allowed,</strong> and user access should not be denied if they do not consent to such cookies. ICO is very specific about placement, formatting and wording of cookie information and consent request.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Prior to the EDPB, its predecessor, the Working Party article 29 had required that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:pullquote -->\n<figure class=\"wp-block-pullquote\"><blockquote><p>“Every organisation that maintains a website should publish a<strong> privacy statement/ notice</strong> on the website. A link to this privacy statement/ notice should be <strong>clearly visible</strong> <strong>on each page</strong> of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible.“</p></blockquote></figure>\n<!-- /wp:pullquote -->\n\n<!-- wp:paragraph -->\n<p>In November 2019,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://privacyinternational.org/\" target=\"_blank\">Privacy International</a> [<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">1</a>], the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/legal-action/challenge-hidden-data-ecosystem\">complaints</a> [<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-\">2</a>]&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a valid transparency, privacy notices must be <strong>concise, transparent, intelligible and easily accessible (Article 12.1)</strong>;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://www.huntonprivacyblog.com/2020/10/05/cnil-publishes-updated-cookie-guidelines-and-final-version-of-recommendations-on-how-to-get-users-consent/\" target=\"_blank\">CNIL has published updated cookies recommendations</a>. Soon reaching the CNIL’s deadline, what has changed?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Increasingly, websites have included cookie banners to require visitors consent. However, not all cookie banners are actually disabling with respect to visitors consent denial. A study published by </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Increasingly, websites have included cookie banners to require visitors consent. However, not all cookie banners are actually disabling with respect to visitors consent denial. A study published by Celestin Matte, <a href=\"https://www.linkedin.com/in/ACoAAAC-QhsB_lHI7RCVypElP9Ysu4SdRlBEVNw\">Nataliia Bielova, PhD</a>, <a href=\"https://www.linkedin.com/in/ACoAAAS2KUUBWxSWRt-qT7-Qq9FNThWTspdFWCE\">Cristiana Santos</a>  IEEE Symposium on Security and Privacy (IEEE S&amp;P 2020) question : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"http://www-sop.inria.fr/members/Nataliia.Bielova/papers/Matt-etal-20-SP.pdf\" target=\"_blank\">Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe’s Transparency and Consent Framework</a> Nataliia Bielova, Cristiana Santos. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In a second paper, submited in September 2020, the group question : \'<a href=\"https://hal.inria.fr/hal-02875447#:~:text=We%20perform%20a%20technical%20assessment,current%20architecture%20of%20the%20web.\"><em>Are cookie banners indeed compliant with the law</em>?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners\'?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"In this paper, we describe how cookie banners, as a consent mechanism in web applications, should be designed and implemented to be compliant with the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#ePrivacy</a>&nbsp;Directive and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#GDPR</a>, defining 22 legal requirements.</p><p>While some are provided by legal sources, others result from the domain expertise of computer scientists.</p><p>We perform a technical assessment of whether technical (with computer science tools), manual (with a human operator) or user studies verification is needed.</p><p>We show that it is not possible to assess legal compliance for the majority of requirements because of the current architecture of the web.<br>With this approach, we aim to support policy makers assessing compliance in cookie banners, especially under the current revision of the EU ePrivacy framework\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>Cookie audit</em>. Guidance provides a detailed list of actions to be taken for new and existing cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Analytics cookies</em>. These are not exempt from the consent requirement by default, because they usually do not amount to being ‘strictly necessary’. However, “this may not always be the case where the setting of a first-party analytics cookie results in a low level of intrusiveness and low risk of harm to individuals”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Compliance deadline</em>. No fixed term is specified in the guidelines, but ICO’s Head of Technology Policy, Ali Shah, has published a&nbsp; post instructing the online service providers to “start taking steps to comply now”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Other jurisdictions</em>. French data protection authority CNIL has announced that this month it will repeal its 2013 cookie recommendation that has become outdated in some respects (in particular regarding&nbsp; what concerns the expression of consent), and publish guidelines outlining the applicable rules of law. Similar actions have been taken by the Dutch and German data protection authorities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a paper submited July 2018 entitled \'<em><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/s/file/preview/181819110/1808.05096.pdf?pearlId=231196296\" target=\"_blank\">We Value Your Privacy … Now Take Some Cookies : Measuring the GDPR’s Impact on Web Privacy\'</a></em>  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Martin Degeling, Christine Utz, Christopher Lentzsch, Henry Hosseini, Florian Schaub and Thorsten Holz from the Ruhr-Universität Bochum, Germany and thr University of Michigan, Ann Arbor, MI, USA, </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>monitored and analysed the GDPR’s impact on popular websites in all 28 member states of the European Union.</li><li>They found that 84.5 % of websites had a privacy policy. </li><li>72.6 % of websites with existing privacy policies<br>updated them close to the ebtry into force of the GDPR.</li><li>62.1 % of websites displayed cookie consent notices, 16 % more than in January 2018. These notices inform users about a site’s cookie use and user tracking practices. </li><li>They observed cookie consent notices and evaluated 16 common implementations<br>with respect to their technical realisation of cookie consent.<br>This revealed that core web security mechanisms such as the same-origin policy pose problems for the implementation of consent according to GDPR rules, and opting out of third party cookies requires the third party to cooperate. In conclusion, they fond that the GDPR is making the web more transparent, while it still  lacks of both functional and usable mechanisms for users to consent to or deny processing of their personal data on the Internet.</li><li>For each country, the 500 most popular websites were examined for the presence of and updates to their privacy policy.</li></ul>\n<!-- /wp:list --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In January 2020, another study was published <em><a rel=\"noreferrer noopener\" href=\"https://arxiv.org/abs/2001.02479\" target=\"_blank\">Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence</a></em><a href=\"https://arxiv.org/search/cs?searchtype=author&amp;query=Nouwens%2C+M\"> </a>by Midas Nouwens, Ilaria Liccardi, Michael Veale, David Karger, Lalana Kagal (UCL, MIT and Aarhus University), suggests that many cookie consent pop-ups are flouting EU privacy laws. and noticed that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"New consent management platforms (CMPs) have been introduced to the web to conform with the EU\'s General Data Protection Regulation, particularly its requirements for consent when companies collect and process users\' personal data. This work analyses how the most prevalent CMP designs affect people\'s consent choices. We scraped the designs of the five most popular CMPs on the top 10,000 websites in the UK (n=680). </p><p>We found that dark patterns and implied consent are ubiquitous; only 11.8% meet the minimal requirements that we set based on European law. Second, we conducted a field experiment with 40 participants to investigate how the eight most common designs affect consent choices. <strong>We found that notification style (banner or barrier) has no effect</strong>; removing the opt-out button from the first page increases consent by 22--23 percentage points; and providing more granular controls on the first page decreases consent by 8--20 percentage points. This study provides an empirical basis for the necessary regulatory action to enforce the GDPR, in particular the possibility of focusing on the centralised, third-party CMP services as an effective way to increase compliance.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>An illusion of control and transparency?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The French CNIL</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\" target=\"_blank\">The legal framework relating to consent has evolved, and so does the website of the CNIL</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\" target=\"_blank\">Online targeted advertisement: what action plan for the CNIL?</a> TIt was announced “<em>The CNIL has received an important number of individual and collective complaints (La Quadrature du Net, Privacy International, NOYB) relating to online marketing. In 2018, 21% of the complaints were related to marketing in the broad sense.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following&nbsp; the publication in <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=062c5802-f33e-447b-9150-0d8afb2ea6f8\" target=\"_blank\">July 2019 of an updated guidance on cookies</a>, the French data protection authority proposed a consultation on its draft recommendations on practical ways to collect website user consent for cookies and similar technologies on January 2020. The Recommendations including requirements for obtaining GDPR-standard consent, by various European data protection authorities, including the CNIL and the ICO. The CNIL has since undertaken a consultation to develop practical methods to obtain user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Olivier Proust from the Law Firm Fieldfisher has published a comparative table of what is new on the July cookie guidance to compare with the 2013 guidelines in <a rel=\"noreferrer noopener\" href=\"https://www.fieldfisher.com/en/services/privacy-security-and-information/privacy-security-and-information-law-blog/cnil-publishes-revised-guidelines-on-cookies-and-other-tracking-technology\" target=\"_blank\">CNIL publishes revised guidelines on cookies and other tracking technology</a>. A larger scope, a new legal ground now based on the Article 82 of the amended French Data Protection Act, adapting to the GDPR standard of consent. It is specifically mentioned that browser settings ‘do not provide enough information to users, and therefore, do not enable to obtain informed consent.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL takes the position that in certain conditions ‘Cookies used to measure audiences on a web site or mobile app may be exempt from consent’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>How these rules are currently&nbsp;implemented by the major websites in France?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No one better than lawyers could read and implement regulations. Lawyers handle sensitive data bound under professional confidentiality.&nbsp; Some advise other organisations they influence on their implementation of the regulation. We have been analysing the French national Bar\'s website as well as the major law society website in the Capital city avocatparis.org</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The website has a “mentions légales” for legal matters with a very succinct mention of the Loi Informatique et Libertés, “Loi n° 78-17 du 6 Janvier 1978 relative à l\'informatique, aux fichiers et aux libertés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"En regard de la loi 78-17 du 6 Janvier 1978, vous disposez d\'un droit d\'accès et de rectification aux données personnelles vous concernant.</p><p>Il suffit d\'en faire la demande à : droit_acces@avocatparis.org”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The requirements of the Article 13 GDPR are grossly missing to provide the regulatory transparency. The website lack encryption certificate as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the cookies, a banner online gives the option to accept cookies that are placed as soon as the website is accessed, So no privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the visitor wanted to know more, click the button ‘<em>en savoir plus</em>’ takes you to the CNIL’s webpage explaining the requirements they had ignored!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No privacy by design as there is no way to disable cookie dropping.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lack of transparency means visitors are in total ignorance of id collected from them. no privacy on the website inform the visitors that their web browsing, IP address and other websites they will visit will be logged and shared and made accessible to other users of their electronic devices.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No consent is requested therefore no option to modulate the drop of cookies ans part of what should be privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Being the website of the French law society, the sensitivity of the data accessed is highly concerning. The law society invites victims of domestic abuse to get information on their website trough radio advertisement. Many distressed victims will never expect surfing such a website could result in sharing their personal data for the sake of profiling and targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1993,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.22.04-1024x579.png\" alt=\"\" class=\"wp-image-1993\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Recently, a ranking website operating in France has been under attack by the law society. Ironically, the law society has produced a model of SAR letter for all lawyers to send to this web owners. This can be wrong from several angles, not mentioning GDPR compliance should not become an instrument of banning free speech.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lawyers member of the bar are invited to send the letter with a copy of their ID card. Was spreading ID card to add on the publicly available data by providing further personal data. This was possibly a mistake.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On their SAR model letter, they have included an enquiry concerning the company’s website compliance. This is where it becomes more interesting for our purpose. It is satisfying to notice that GDPR compliance, and more specifically data collection by the website is of concern for the law society whose biggest entity in Paris has a fully non-compliant website for months, resisting to make any amendment to complete with the regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The National representation, Conseil National des Barreaux, CNB, have rushed to make their website in order, using a cookie management tool [<a href=\"https://tarteaucitron.io/en/\" target=\"_blank\" rel=\"noreferrer noopener\">Tarteaucitron</a>]. However, again despite refusing tracking cookies are dropped with up to 5 years retention! Why should they need that?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1994,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.31-1024x552.png\" alt=\"\" class=\"wp-image-1994\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":1995,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.56-1024x594.png\" alt=\"\" class=\"wp-image-1995\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The Entity repenting lawyers in the Capital city Paris, remains full of cookies, java Scripts, for detention periods far above the 13 months tolerated by the French Data Protection Authority CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, data is transferred outside the US in infringement with the ECJ decision Schrems-II since the invalidation of the Privacy Shield.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many law firm\'s websites are in the same poor state.&nbsp;Despite the CNB having produced an exhaustive [<a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-telechargez-le-guide-pratique-elabore-pour-la-profession-davocat\" target=\"_blank\" rel=\"noreferrer noopener\">guidance</a>] on what should be implemented. Is this an application of the old principle “<em>do what you are told, not what we do</em>’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are the consequences of ignoring the regulation ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Shared liability for cookie compliance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In principle, the person setting the cookie is primarily responsible for compliance with the requirements of the cookie regulation. For third party cookies, both the online service provider and the third party have a responsibility for ensuring users are clearly informed about cookies and for obtaining consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&gt;&gt;&gt;The UK ICO acknowledges that this is one of the most challenging areas in which to achieve compliance with PECR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Fashion ID ruling, the European Court of Justice has set the principle of liability of a Facebook Fan page admin for data processed by Facebook for which he could not exercice any control. This ruling can be translated an obligation for any facilitator of data processing to check their data processor and provide the necessary transparency. Therefore the owner of a website cannot simply rely on the promise of their web developper to be GDPR compliant. they have a duty to check the presence of cookies in order to provide the appropriate information and request consent before any tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17)&nbsp;</a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a> ECJ decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation, not limited to personal data, prohibiting cookie walls. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have mentioned the complaint made by Privacy International and La Quadrature du Net.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the ECJ decision in Max Schrems-II, Max Schrems filed 101 complaints and stated :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">Guess What? Many Cookie Banners Ignore Your Wishes, So Max Schrems Goes On The GDPR Attack Again</a> <a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“An initial scan of 22,949 Web sites from the EU domains, as well as .org and .com, showed 1,426 that had cookie banners based on the&nbsp;<a href=\"https://iabeurope.eu/transparency-consent-framework/\"><strong>Interactive Advertising Bureau Europe Transparency and Consent Framework</strong></a>, the main industry standard for this area. Of those, the team of researchers took a close look at 560 Web sites from .uk, .fr, .it, .be, .ie and .com domains to detect possible GDPR violations. Shockingly, they found four types of violations in cookie banners, across 305 Web sites -- 54% of the sample:….</p><p><em>noyb.eu identified countless violations of European and French cookie privacy laws as CDiscount, Allociné and Vanity Fair all turn a rejection of cookies by users into a \"fake consent\". The privacy enforcement non-profit noyb.eu filed three formal [GDPR] complaints with the French Data Protection Authority (CNIL) today.</em></p><p><em>Up to 565 \"fake consents\" per user. Despite users going through the trouble of \"rejecting\" countless cookies on the French eCommerce page CDiscount, the movie guide Allocine.fr and the fashion magazine Vanity Fair, these webpages have sent digital signals to tracking companies claiming that users have agreed to being tracked online. CDiscount has sent \"fake consent\" signals to 431 tracking companies per user, Allocine to 565 and Vanity Fair to 375, as the analysis of the data flows now show.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Max Schrems with his team used the INRIA\'s research group tool \"<em>Cookie Glasses</em>\" to validate their findings and to file complaints to the CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Schrems points out that one company taking advantage of \"fake consent\" is Facebook, which is happy to place cookies after people have clearly objected to all tracking. That means the scale of the potential GDPR breach is considerable. It will be some time before CNIL hands down its decision, but based both on Schrems\' track record and on the facts of the case, it seems probable that he will prevail once more. Although the initial ruling will only apply to France, it is likely to be followed by data protection authorities in other EU countries. If any of the Web sites mentioned above challenge a result that goes against them, there may be a referral to the EU\'s top court, whose decision will be definitive and apply across the whole region. That, in its turn, is likely to influence online privacy laws around the world, as the <a href=\"https://qz.com/africa/1746202/kenya-has-passed-new-data-protection-laws-in-compliance-with-gdpr/\"><strong>GDPR is already doing</strong></a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of non-consistency of national DPAs</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The consistency mechanism that requires a harmonious enforcement of the regulation has not been enforced by the European Data Protection Board.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains hopes to see the reformed privacy and electronic communication regulation or more possibly individual redress or class actions as they were introduced with the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Real Time Biding and Brave browser ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Johnny Ryan has been actively advocating. On 12 September 2018 a Formal GDPR complaints, accompanied by an overview of RTB that details evidence from Google and IAB technical documentation (the ‘Ryan Report’), are submitted to Irish Data Protection Commission (DPC) and UK Information Commissioner’s Office (ICO) by Johnny Ryan of Brave, and Jim Killock of Open Rights Group and Michael Veale of UCL. <a href=\"https://brave.com/rtb-updates/\">https://brave.com/rtb-updates/</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We won\'t further develop on that subject here. You can read : <a href=\"https://www.pearltrees.com/s/file/preview/211865723/2001.02479.pdf?pearlId=284242059\">Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence</a> “<em>New consent management platforms (CMPs) have been introduced to the web to conform with the EU’s General Data Protection Regulation, particularly its requirements for consent when companies collect and process users’ personal data. This work analyses how the most prevalent CMP designs affect people’s consent choices.</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And here a great in depth article by Marie-Claire Peroux LLM : <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/death-of-3rd-party-cookies-is-privacy-protection-possible-for-the-future-adtech-in-the-eu/\" target=\"_blank\">Death of 3rd Party Cookies : Is Privacy Protection Possible For The Future AdTech In The EU ?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Time for web owners to check their websites and rethink all these third party cookies, check the retention periods, usually unlawful above 13 months maximum. Google Analytics and Facebook Connect are under the radar especially due to their Terms of use and data transfert outside the EEA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A white collar crime high profile attorney should not use a \'Not Secure\' website to invite its web users to fill in a contact form and use cookies without transparency and consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1999,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-19.42.08-1024x584.png\" alt=\"\" class=\"wp-image-1999\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Further read on the ECJ decisions Planet49 and Fashion ID :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ECJ 5 June 2018 Judgment in Case C-210/16</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2018-06/cp180081en.pdf\">Wirtschaftsakademie Schleswig-Holstein</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/pulse/facebook-fan-page-ecj-ruling-tara-taubman-bassirian-llm/\">Facebook Fan Page Admin</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The administrator of a fan page on Facebook is jointly responsible with Facebook for the processing of data of visitors to the page</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case arised from a dispute over a German Fan Page on Facebook which used the social network to store cookies on visitors’ hard drives to collect data about them. A German data protection authority ordered the operator of the fan page, an education company, to deactivate the page as visitors were not made aware of the collection of their personal data. The company argued it was not responsible for the processing of personal data by Facebook and that any action should be brought against the social network.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This ECJ ruling establish a joint controller liability between Facebook and the page\'s Admin meaning that owners of Facebook Fan Pages who fall within the scope of the GDPR might have to make joint controllership arrangements with Facebook to establish who is responsible for what. You can&nbsp;<a href=\"https://panopticonblog.com/2018/06/05/the-facebook-fan-page-judgment-joint-data-controllers-cookies-and-targeted-advertising/\" target=\"_blank\" rel=\"noreferrer noopener\">read more</a>&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECJ considered that the administrator takes part in deciding what data to collect and how to process it, for example by defining a target audience and asking for demographic data or information on the lifestyles and interests of visitors to the page. Therefore it has to be held responsible for protecting visitors’ personal data and cannot hide behind the social network.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The admin liability as a joint controller is engaged despite its lack of control over the data processed by Facebook,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ECJ 1&nbsp;October 2019 (request for a preliminary ruling from the Bundesgerichtshof&nbsp;— Germany)&nbsp;— Bundesverband der Verbraucherzentralen und Verbraucherverbände&nbsp;— Verbraucherzentrale Bundesverband eV v Planet49 GmbH</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17)&nbsp;</a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>[Planet49]</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lottery competition was organised requiring users to tick a box or a pre-ticked box allowing Planet49 to set cookies to track the user\'s behaviour online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The German Federation of Consumer Organisations (the \'Federation\') claimed that these two check-boxes did not satisfy German law requirements, and sought an injunction requiring Planet49 to cease using them. The case ultimately reached the German Federal Court of Justice (the \'Bundesgerichtshof\') , which in turn referred the case to the CJEU for preliminary ruling.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Pre-ticked check-boxes authorising the use of cookies and similar technologies do not constitute valid consent under the e-Privacy Directive.<br><br>2. Where consent is required for cookies under the e-Privacy Directive, the GDPR standard of consent applies.<br><br>3. It does not matter whether the cookies constitute personal data or not - Article 5(3) of the e-Privacy Directive (i.e. the cookie consent rule) applies to any information installed or accessed from an individual\'s device.<br><br>4. Website users must be provided with information on the duration of the cookies, and whether third parties will have access to the cookies.</li></ol>\n<!-- /wp:list --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:list -->\n<ul><li>The ePrivacy Directive requires users to&nbsp;give active consent before cookies can be dropped on their devices, preselected tick in a box are not a “<em>statement or clear affirmative action</em>” as required by the General Data Protection Regulation (“GDPR”).</li><li>With regard to Recital 17 of the ePrivacy Directive, combined with Recital 32 of the GDPR, “<em>silence, pre-ticked boxes or inactivity</em>” from being taken to constitute consent.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>**Photography kindly shared by <a href=\"https://www.linkedin.com/in/vanja-munerati-a72195?originalSubdomain=uk\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Vanja Munerati</strong> </a>who is a regulatory economist passionate about outdoors and keen nature photographer. **</em></p>\n<!-- /wp:paragraph -->','Cookies Are Not Yummies','Cookies collect visitors data shared with third parties. They require transparency and prior consent.','inherit','closed','closed','','1983-revision-v1','','','2020-12-15 00:13:45','2020-12-15 00:13:45','',1983,'https://www.datarainbow.eu/1983-revision-v1/',0,'revision','',0),(2011,2,'2020-12-15 00:16:48','2020-12-15 00:16:48','<!-- wp:paragraph -->\n<p>As a privacy and data protection advocate, we do occasionally monitor major websites compliance with data protection regulations. <a href=\"https://datarainbow.eu/2019/01/27/website-transparency-cookies-and-privacy-notice/\">We have previously wrote</a> about website compliance and cookies requirements of information, transparency and consent request where applicable. The French Data Protection Authority, CNIL, has played a lead role in <a href=\"https://datarainbow.eu/2019/01/27/french-cnils-six-first-month-of-gdpr/\">clarifying the regulation</a>. The expectation would be that French websites would have benefited from the guidances produced, using the two years of preparation and the first year of GDPR application to comply. Sadly, this has not always been the case. Even pointing the issues to some web owners has not had much effect. Compliance with cookie laws should not be that hard : a cookie banner based on opt in giving visitors the option of accepting tracking, a privacy notice with required information to offer full transparency. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure our observations on the website were correct, we requested several IT and security experts to double check the reports found. One particular recognised expert, Allen Woods, retired today, kindly accepted to have a look to further analyse one of these websites. The result is eye opening. We knew about website tracking but this website analysis threw the light to a whole different dimension on the depth of tracking, profiling and fingerprinting, data sharing with third parties not only via cookies but Java Script codes used by the web developers. We invite anyone involved with data protection, IT security and cybersecurity to carefully <a href=\"http://www.jitsoftware.co.uk/downloads/pagereview.pdf\">read this document </a>with full attention. Please share your views and observations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Initially Allen Woods confirmed that \'the use, by second, third and fourth parties of cookies constitutes an extension of the organisation boundary of site owners tracking the movements of devices and therefore their owners, with a considerable degree of accuracy\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Allen Woods then proceed to further scrutiny to add into his report : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'with the sample URL taken from an apparently autogenerated module with the file name : “7D1mEqsUJEn.js. Both beacon and file name appear to be automatically generated at run time on a basis similar to GUID identifiers. The direct impact of the module is an embedded call back to the react.js CDN web site (part of the Facebook estate) with the effect of forcing a regular Facebook monitoring presence on any page using or calling the react.js sub components or code functions concerned.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You wonder how many lawyers, even IT lawyers advising Data Protection compliance, or website owners understand what this means. Let\'s be honest, We are just starting to pierce the mystery of coding thanks to Allen and few other security experts around.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It\'s important to note that for Allen the hidden JavaScript codes on the website \'represents a multiple risk in that source and components can be inserted for tracking or any other purpose malicious or otherwise but without making the client side users aware.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'In the authors opinion, the owners of the site under review have lost control of data flow into and out of the site concerned and should consider a complete rebuild using components that have been vetted in terms of their functionality and capabilities with a view to reversing that loss of control. \'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, a review of the reasoning behind the need to collect and analyse visitor traffic should be carried out and an alternative to the use of Google Analytics should be seriously considered.\' This is important as many many websites use Google Analytics to measure their web traffic trough the IP address. IP address, identification number entering the definition of \'personal data\' as in the Article 4 GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'As a matter of due diligence, when commissioning a site, site owners should take an active role in approving which components are going to be used by whoever it is that is commissioned to build their web site. If the author was asked to approve any of the components provided by major platforms generally, but particularly social media platforms like Twitter, Google and Facebook and external template platforms like WORDPRESS, that those suggesting the use of such components should guarantee site owners as to the reliability and robustness of the code in respect of compliance and furthermore prove that the code concerned had been forensically reviewed to confirm reliability and robust compliance.\'</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Disclaimer here : this DataRainbow website itself is build on a Wordpress template, and uses Google\'s Gutenberg\'s font but no analytics, we are looking to change this.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Knowing how much users\' behaviour is tracked gives a tough burden and liability to website owners as data controller unless there is a certification assuring web developers real competences and not simply a \'lego block\' assembler expert. Increasingly web developer use templates such as Wordpress that comes out of users control tracking behaviour and location. Based on the GDPR, they are two level of liability. One for the data controller, basically whoever decides the means and purposes of the data processing, and the data processor, acting under the guidance and on behalf of the data controller. The European Court of Justice Advocate General opinion in the FashionID case where embedded Facebook \'like\' button capable of gathering data such as IP addresses and browser identification where Facebook is considered data controller, held that the hosting websites should be considered as joint data controller sharing proportional liability. The Facebook Fanpage decision had already created co-controllership between Facebook and the admin of the Facebook page. The website owner which receives anonymous statistics is deemed to be data controller by permitting third party scripts as the data they allow to be collected is not anonymous from the perspective of the analytics providers. A detailed picture of users is build to target advertising to users. ECJ in the&nbsp;Jehovan todistajat held that in order to have joint control and joint responsibility, it is not required that each of the controllers must have access to (all of) the personal data concerned. Many web owners are in total ignorance of such a shared liability.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is in close competition with Google, Amazon, Microsoft or Twitter. A privacy regulation might find challenging to combat this kind of behaviour as it’ has become an anti-trust issue of over grown corporations. GAFAM\'s seems to have become too big to any regulator to combat.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://facebook%20users%20cannot%20avoid%20location-based%20ads%2C%20investigation%20finds/\">Facebook users cannot avoid location-based ads, investigation finds. Facebook&nbsp;</a> \'There is no combination of settings that users can enable to prevent their location data from being used by advertisers to target them, according to the privacy researcher Aleksandra Korolova. “Taken together,” Korolova says, “Facebook creates an illusion of control rather than giving actual control over location-related ad targeting, which can lead to real harm.”. In reality, users tracking goes above simple users geolocation. Many websites using free Facebook codes librairies track users geolocation and browsing on all kind of websites.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Helen Dixon, The Irish Data Protection Commissionner, in <a href=\"https://www.thestar.com.my/tech/tech-news/2019/06/13/us-tech-giants-risk-hefty-fines-irish-privacy-chief-warns/\">a recent interview</a> announced potential first fines in the next few weeks : “It would be a most surprising outcome if, of the 20 big tech investigations we have underway, fines were not a feature of the process,” Dixon said in an interview in London, after speaking at Bloomberg’s Sooner Than You Think technology conference. Simply fining GAFAMs wont stop them, there need to be combined by injunction to stop the fingerprinting and delete all data illegitimately collected. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3mtPtL9AYGjdJtmCICdIBBCEH1pbXazM-ID-RLBHzxVoQkzXJWAG31chY\">Ad Tech GDPR complaint is extended to four more European regulators</a>. Complainants consider Real-Time Bidding a “vast scale personal data leakage by Google and other major companies” in the behavioural advertising industry. \'GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.&nbsp; The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.&nbsp;    The new complaints have been filed by&nbsp;<a href=\"https://www.eticasconsulting.com/en/people-2018/\">Gemma Galdon Clavell</a>&nbsp;(Eticas Foundation) and&nbsp;<a href=\"https://www.finchabogados.com/es/equipo-abogados/diego-fanjul-martinez/\">Diego Fanjul</a>&nbsp;(Finch),&nbsp;<a href=\"https://www.bitsoffreedom.nl/mensen/david-korteweg/\">David Korteweg</a>&nbsp;(Bits of Freedom),&nbsp;<a href=\"https://www.law.kuleuven.be/citip/en/staff-members/staff/00083103\">Jef Ausloos</a>&nbsp;(University of Amsterdam),&nbsp;<a href=\"https://www.kuleuven.be/wieiswie/nl/person/00117807\">Pierre Dewitte</a>&nbsp;(University of Leuven),&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://iapp.org/about/person/0011a00000gqgtUAAQ/\" target=\"_blank\">Jose Belo</a>&nbsp;(Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.   <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">&nbsp;</a>Read more <a href=\"https://www.gdprtoday.org/ad-tech-gdpr-complaint-is-extended-to-four-more-european-regulators/?fbclid=IwAR3DDXFuMfMhSU62kLtoEgsG7TyjgRmN7kseUOuOMER86VxGOmrqiEcK70s\">here</a>&nbsp;and&nbsp;<a href=\"http://GDPR complaints about Real-Time Bidding (RTB) in the online advertising industry were filed today with Data Protection Authorities in Spain, the Netherlands, Belgium, and Luxembourg.  The complaints detail the vast scale of personal data leakage by Google and other major companies in the “Ad Tech” industry. This week marks one year since the introduction of the GDPR.   The new complaints have been filed by Gemma Galdon Clavell (Eticas Foundation) and Diego Fanjul (Finch), David Korteweg (Bits of Freedom), Jef Ausloos (University of Amsterdam), Pierre Dewitte (University of Leuven), and Jose Belo (Exigo Luxembourg). Today’s filings extend the complaints initially filed in Ireland, the UK and Poland, to a total of seven EU countries. This week marks one year since the GDPR.\">here</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Somehow, we can imagine the gathering of information on each individual internet user to profile their personality in order to predict needs and wishes to be sold to Ad bidders. <a href=\"https://medium.com/analytics-for-humans/google-wants-you-to-rethink-your-customer-journey-98e9d231d096\">Google\'s wish</a> is to predict your needs before you realise. Young people get offered Apple \'smart\' watch with their Vitality insurance and health club that monitor their heart beats and exercises. This is all OK until an illness is detected. Women won\'t anymore need to knock at the HR door to announce their pregnancy. Probably their employer will be informed before they even notice it. Consequently, new businesses have been created : <a href=\"https://www.ibtimes.com/unfitbits-how-trick-your-fitbit-thinking-youre-working-out-youre-not-1920366\">dog Fitbit walker to simulate exercise to trick the insurance company</a>. Would that be sufficient? Probably not enough to hide actual sickness that your insurance company love to be the first to know about.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And if you wondered <a href=\"https://datarainbow.eu/2019/01/22/why-privacy-matters/\">why all that matters</a>, think of the past, not that long ago, what the Stasi could have done had they had access to Google or Facebook. Think of totalitarian regimes. Think of the US democracy asking social media passwords from visitors. you think you have nothing to hide, think twice. Think of over-reliance on technology and the margin of error. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fine, a demonstration of what happened <a href=\"https://youtu.be/xYZtHIPktQg\">if your shop assistant was an App.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Further read</em> : <a href=\"https://www.businessinsider.com/facebook-google-amazon-dominate-digital-economy-chart-2019-6?r=US&amp;IR=T\">“More than two of out every three dollars spent on digital ads in the US goes to one of the three companies.”</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://geomarketing.com/beacon-marketing-platform-inmarket-introduces-predictive-targeting-program\">Beacon Marketing Platform inMarket Introduces Predictive Targeting Program</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>in 2009 <a href=\"https://www.telegraph.co.uk/technology/facebook/6214370/Facebook-shuts-down-Beacon.html\">Facebook shuts down Beacon</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://policyreview.info/articles/news/data-subjects-data-controllers-fashionable-concept/1400\">On the expanding notion of data controller </a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','Websites surreptitiously tracking and reporting on visitors','Website tracking and monetizing website visitors. What liability for web owners?\n','inherit','closed','closed','','428-autosave-v1','','','2020-12-15 00:16:48','2020-12-15 00:16:48','',428,'https://www.datarainbow.eu/428-autosave-v1/',0,'revision','',0),(2013,2,'2020-12-15 00:23:55','2020-12-15 00:23:55','<!-- wp:paragraph -->\n<p>This article was previously published. It\'s being re-published here since the latest enforcements by national Data Protection authorities : After the French CNIL has fined the Supermarket Carrefour and Carrefour Bank for a total of 3 Million Euros, two new enforcements : <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">Google for 100 million euros and Amazon for 35 million Euros</a> for non-compliant use of <a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#cookies</a> (in particular placing advertising cookies without prior consent and adequate information). An injunction to delete unlawfully collected and processed data was not ordered.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In both deliberations, the CNIL found it is materially competent to control and sanction cookies placed by companies on the computers of users residing in France. It thus underlined that the one stop shop mechanism provided by the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#GDPR</a>&nbsp;was not intended to apply in these procedures, since the operations linked to the use of cookies fall under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#ePrivacy</a>&nbsp;Directive, transposed to article 82 of the French Data Protection Act.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>Link to the attached sanctioning decision against Google:&nbsp;<a href=\"https://lnkd.in/e7Cq5SX\">https://lnkd.in/e7Cq5SX</a>.</li><li>Link to the sanctioning decision against Amazon:&nbsp;<a href=\"https://lnkd.in/exfhXES\">https://lnkd.in/exfhXES</a>.</li><li>Links to the announcements: <ul><li><a href=\"http://Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED\">Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED</a></li><li><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/eV7Byyi.\" target=\"_blank\">Cookies : sanction de 35 millions d’euros à l’encontre d’AMAZON EUROPE CORE</a></li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The same day, the <a href=\"https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/nov/ugyldigt-samtykke-paa-hjemmeside\" target=\"_blank\" rel=\"noreferrer noopener\">Danish Data Protection Authority</a> found that the consent format implemented by a website did not meet the regulatory requirements before setting cookies and any other technology.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In November, the Belgian authorities have expressed their intention to Take <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=0ee39d9b-9223-493e-8549-9c9de507aa67\" target=\"_blank\">Down Websites Infringing GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major cases by the European Court of Justice (Fashion ID (c-40-17) and Planet49 (c-673/17)) had highlighted the importance of cookie compliance in Europe, and the complex intricacies which organisations must consider. In addition, an increase in the number of enforcement actions and fines in Europe had signified a move towards stricter regulation of ePrivacy.<br>➡️ Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️ Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️ Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️ Five jurisdictions find an implicit consent to be valid</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://blogs.dlapiper.com/privacymatters/european-law-on-cookies-guide/?utm_source=dlvr.it&amp;utm_medium=linkedin\">DLAPiper have published a guide on cookie law in EU</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With this in view, and while the new Council <a href=\"https://twitter.com/hashtag/ePrivacy?src=hashtag_click\">#ePrivacy</a> deal is awaited any time soon, here is what we can say about cookies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What do we mean by cookies? </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wikipedia has a page on yummy <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/Cookie\" target=\"_blank\">cookies</a>. These are not the ones we want to talk about. What we are interested on are not yummy cookies, but the <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/HTTP_cookie\" data-type=\"URL\" data-id=\"https://en.wikipedia.org/wiki/HTTP_cookie\" target=\"_blank\">HTTP Cookies</a> also called web cookie, Internet cookie, browser cookie, or commonly cookie. A cookie is ‘<em>a small piece of data sent from a website and stored on the user\'s computer by the user\'s web browser while the user is browsing.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From a regulatory perspective, in Europe, the <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" data-type=\"URL\" data-id=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" target=\"_blank\">Directive or 2002/58/EC of the European Parliament and of the Council of 12 July 2002</a> concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) commonly called ePrivacy. Being a Directive this text required individual implantions by the 28 member states into their national legislations. This explains the various national implementations. We will look more closely at the <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" data-type=\"URL\" data-id=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" target=\"_blank\">Privacy and Electronic Communication Regulation 2003 or PECR</a> for its implementation in the UK or the French <a rel=\"noreferrer noopener\" href=\"https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978\" target=\"_blank\">article 82 of the [Loi «&nbsp;Informatique et Libertés&nbsp;»</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Commission published a study on the \"<a href=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" data-type=\"URL\" data-id=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" target=\"_blank\" rel=\"noreferrer noopener\">ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation</a>\" (SMART 2013/0071).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although we will mostly mention cookies here, the regulation actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in any ways.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This includes Flash cookies, smartphone or other electronic devices apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the Wikipedia entry mentions ‘<em>Cookies were designed to be a reliable mechanism for websites to remember stateful information (such as items added in the shopping cart in an online store) or to record the user\'s browsing activity (including clicking particular buttons, logging in, or recording which pages were visited in the past). They can also be used to remember arbitrary pieces of information that the user previously entered into form fields such as names, addresses, passwords, and credit-card numbers</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can further read on cookies from KJ Kearie who has a Comprehensive Guide on cookies: ‘<em>There are two main types of cookies – session cookies only collect details from a single browsing sessions, while persistent cookies remain on the user’s device and collect information over time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This article comes out of a frustration expressed by many privacy advocates around the EU to witness a latence to see any improvement coming .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>While the ePrivacy Directive is under reform, the European Data Protection Board on a recent guidance has further clarified how cookies implementation should comply with the requirements of transparency and consent as set by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Privacy and Electronic Communications Regulations (PECR), sits alongside the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR), imposing specific rules on electronic communications, including marketing solicitation, traffic and location data, itemised billing, line identification, directory listings, and the use of cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The consent requirement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Consent</strong> is mandatory for all cookies that are <strong>not strictly necessary</strong> for the provision of a service. It has been argued no cookie is actually necessary, browser settings are capable of replacing functional cookies. the strict necessary cookie is to be limited to a specific service requested by the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookies used for social media plugins or tracking, site personalisation, advertising, cross-device tracking, research, or product improvement purposes, will require user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/\" target=\"_blank\">UK ICO has produced guidance on the use of cookies</a> completed by a <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" data-type=\"URL\" data-id=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" target=\"_blank\">blog post by Ali Shah, Head of Technology Policy</a> clarifying that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It can no longer be relied on implied consent for the use of cookies ;</li><li>Analytics cookies aren’t strictly necessary and so require consent as they are not part of the functionality that the user requests when they use an online service so we do not need consent ;</li><li>Statements such as ‘by continuing to use this website you are agreeing to cookies’ is not valid consent under the higher GDPR standard. Further clarifications of divergence views on this point will be gathered ;</li><li>PECR always requires consent for non-essential cookies, such as those used for the purposes of marketing and advertising. Legitimate interests cannot be relied upon for these cookies.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Ali Shah concludes that Cookie compliance will be an increasing regulatory priority for the ICO in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board published a new <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" target=\"_blank\">guidelines 05/2020</a> on consent under Regulation 2016/679 in which it remind : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Meanwhile, the EDPB is aware of the review of the ePrivacy Directive (2002/58/EC). The notion of consent in the draft ePrivacy Regulation remains linked to the notion of consent in the GDPR.7 Organisations are likely to need consent under the ePrivacy instrument for most online marketing messages or marketing calls, and online tracking methods including by the use of cookies or apps or other software. The EDPB has already provided recommendations and guidance to the European legislator on the Proposal for a Regulation on ePrivacy.’</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Other requirements</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a <strong>free, informed and unambiguous consent</strong>, users must be clearly informed about what cookies are in use (including any third party cookies) and what function they perform.&nbsp; For non-essential cookies, <strong>pre-ticked boxes or equivalent default fixtures are not allowed,</strong> and user access should not be denied if they do not consent to such cookies. ICO is very specific about placement, formatting and wording of cookie information and consent request.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Prior to the EDPB, its predecessor, the Working Party article 29 had required that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:pullquote -->\n<figure class=\"wp-block-pullquote\"><blockquote><p>“Every organisation that maintains a website should publish a<strong> privacy statement/ notice</strong> on the website. A link to this privacy statement/ notice should be <strong>clearly visible</strong> <strong>on each page</strong> of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible.“</p></blockquote></figure>\n<!-- /wp:pullquote -->\n\n<!-- wp:paragraph -->\n<p>In November 2019,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://privacyinternational.org/\" target=\"_blank\">Privacy International</a> [<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">1</a>], the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/legal-action/challenge-hidden-data-ecosystem\">complaints</a> [<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-\">2</a>]&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a valid transparency, privacy notices must be <strong>concise, transparent, intelligible and easily accessible (Article 12.1)</strong>;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://www.huntonprivacyblog.com/2020/10/05/cnil-publishes-updated-cookie-guidelines-and-final-version-of-recommendations-on-how-to-get-users-consent/\" target=\"_blank\">CNIL has published updated cookies recommendations</a>. Soon reaching the CNIL’s deadline, what has changed?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Increasingly, websites have included cookie banners to require visitors consent. However, not all cookie banners are actually disabling with respect to visitors consent denial. A study published by </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:paragraph -->\n<p>We have previously wrote about pernicious access to visitors data often ignored by web owners in two previous articles :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In January 2019, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" target=\"_blank\">WEBSITE TRANSPARENCY : COOKIES AND PRIVACY NOTICE</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In June 2019, <a href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\">WEBSITES SURREPTITIOUSLY TRACKING AND REPORTING ON VISITORS</a></p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>Increasingly, websites have included cookie banners to require visitors consent. However, not all cookie banners are actually disabling with respect to visitors consent denial. A study published by Celestin Matte, <a href=\"https://www.linkedin.com/in/ACoAAAC-QhsB_lHI7RCVypElP9Ysu4SdRlBEVNw\">Nataliia Bielova, PhD</a>, <a href=\"https://www.linkedin.com/in/ACoAAAS2KUUBWxSWRt-qT7-Qq9FNThWTspdFWCE\">Cristiana Santos</a>&nbsp;&nbsp;IEEE Symposium on Security and Privacy (IEEE S&amp;P 2020) question : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"http://www-sop.inria.fr/members/Nataliia.Bielova/papers/Matt-etal-20-SP.pdf\" target=\"_blank\">Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe’s Transparency and Consent Framework</a> Nataliia Bielova, Cristiana Santos. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In a second paper, submited in September 2020, the group question : \'<a href=\"https://hal.inria.fr/hal-02875447#:~:text=We%20perform%20a%20technical%20assessment,current%20architecture%20of%20the%20web.\"><em>Are cookie banners indeed compliant with the law</em>?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners\'?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"In this paper, we describe how cookie banners, as a consent mechanism in web applications, should be designed and implemented to be compliant with the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#ePrivacy</a>&nbsp;Directive and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#GDPR</a>, defining 22 legal requirements.</p><p>While some are provided by legal sources, others result from the domain expertise of computer scientists.</p><p>We perform a technical assessment of whether technical (with computer science tools), manual (with a human operator) or user studies verification is needed.</p><p>We show that it is not possible to assess legal compliance for the majority of requirements because of the current architecture of the web.<br>With this approach, we aim to support policy makers assessing compliance in cookie banners, especially under the current revision of the EU ePrivacy framework\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>Cookie audit</em>. Guidance provides a detailed list of actions to be taken for new and existing cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Analytics cookies</em>. These are not exempt from the consent requirement by default, because they usually do not amount to being ‘strictly necessary’. However, “this may not always be the case where the setting of a first-party analytics cookie results in a low level of intrusiveness and low risk of harm to individuals”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Compliance deadline</em>. No fixed term is specified in the guidelines, but ICO’s Head of Technology Policy, Ali Shah, has published a&nbsp; post instructing the online service providers to “start taking steps to comply now”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Other jurisdictions</em>. French data protection authority CNIL has announced that this month it will repeal its 2013 cookie recommendation that has become outdated in some respects (in particular regarding&nbsp; what concerns the expression of consent), and publish guidelines outlining the applicable rules of law. Similar actions have been taken by the Dutch and German data protection authorities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a paper submited July 2018 entitled \'<em><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/s/file/preview/181819110/1808.05096.pdf?pearlId=231196296\" target=\"_blank\">We Value Your Privacy … Now Take Some Cookies : Measuring the GDPR’s Impact on Web Privacy\'</a></em>  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Martin Degeling, Christine Utz, Christopher Lentzsch, Henry Hosseini, Florian Schaub and Thorsten Holz from the Ruhr-Universität Bochum, Germany and thr University of Michigan, Ann Arbor, MI, USA, </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>monitored and analysed the GDPR’s impact on popular websites in all 28 member states of the European Union.</li><li>They found that 84.5 % of websites had a privacy policy. </li><li>72.6 % of websites with existing privacy policies<br>updated them close to the ebtry into force of the GDPR.</li><li>62.1 % of websites displayed cookie consent notices, 16 % more than in January 2018. These notices inform users about a site’s cookie use and user tracking practices. </li><li>They observed cookie consent notices and evaluated 16 common implementations<br>with respect to their technical realisation of cookie consent.<br>This revealed that core web security mechanisms such as the same-origin policy pose problems for the implementation of consent according to GDPR rules, and opting out of third party cookies requires the third party to cooperate. In conclusion, they fond that the GDPR is making the web more transparent, while it still  lacks of both functional and usable mechanisms for users to consent to or deny processing of their personal data on the Internet.</li><li>For each country, the 500 most popular websites were examined for the presence of and updates to their privacy policy.</li></ul>\n<!-- /wp:list --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In January 2020, another study was published <em><a rel=\"noreferrer noopener\" href=\"https://arxiv.org/abs/2001.02479\" target=\"_blank\">Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence</a></em><a href=\"https://arxiv.org/search/cs?searchtype=author&amp;query=Nouwens%2C+M\"> </a>by Midas Nouwens,&nbsp;Ilaria Liccardi,&nbsp;Michael Veale,&nbsp;David Karger,&nbsp;Lalana Kagal (UCL, MIT and Aarhus University), suggests that many cookie consent pop-ups are flouting EU privacy laws. and noticed that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"New consent management platforms (CMPs) have been introduced to the web to conform with the EU\'s General Data Protection Regulation, particularly its requirements for consent when companies collect and process users\' personal data. This work analyses how the most prevalent CMP designs affect people\'s consent choices. We scraped the designs of the five most popular CMPs on the top 10,000 websites in the UK (n=680). </p><p>We found that dark patterns and implied consent are ubiquitous; only 11.8% meet the minimal requirements that we set based on European law. Second, we conducted a field experiment with 40 participants to investigate how the eight most common designs affect consent choices. <strong>We found that notification style (banner or barrier) has no effect</strong>; removing the opt-out button from the first page increases consent by 22--23 percentage points; and providing more granular controls on the first page decreases consent by 8--20 percentage points. This study provides an empirical basis for the necessary regulatory action to enforce the GDPR, in particular the possibility of focusing on the centralised, third-party CMP services as an effective way to increase compliance.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>An illusion of control and transparency?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The French CNIL</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\" target=\"_blank\">The legal framework relating to consent has evolved, and so does the website of the CNIL</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\" target=\"_blank\">Online targeted advertisement: what action plan for the CNIL?</a> TIt was announced “<em>The CNIL has received an important number of individual and collective complaints (La Quadrature du Net, Privacy International, NOYB) relating to online marketing. In 2018, 21% of the complaints were related to marketing in the broad sense.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following&nbsp; the publication in <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=062c5802-f33e-447b-9150-0d8afb2ea6f8\" target=\"_blank\">July 2019 of an updated guidance on cookies</a>, the French data protection authority proposed a consultation on its draft recommendations on practical ways to collect website user consent for cookies and similar technologies on January 2020. The Recommendations including requirements for obtaining GDPR-standard consent, by various European data protection authorities, including the CNIL and the ICO. The CNIL has since undertaken a consultation to develop practical methods to obtain user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Olivier Proust from the Law Firm Fieldfisher has published a comparative table of what is new on the July cookie guidance to compare with the 2013 guidelines in <a rel=\"noreferrer noopener\" href=\"https://www.fieldfisher.com/en/services/privacy-security-and-information/privacy-security-and-information-law-blog/cnil-publishes-revised-guidelines-on-cookies-and-other-tracking-technology\" target=\"_blank\">CNIL publishes revised guidelines on cookies and other tracking technology</a>. A larger scope, a new legal ground now based on the Article 82 of the amended French Data Protection Act, adapting to the GDPR standard of consent. It is specifically mentioned that browser settings ‘do not provide enough information to users, and therefore, do not enable to obtain informed consent.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL takes the position that in certain conditions ‘Cookies used to measure audiences on a web site or mobile app may be exempt from consent’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>How these rules are currently&nbsp;implemented by the major websites in France?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No one better than lawyers could read and implement regulations. Lawyers handle sensitive data bound under professional confidentiality.&nbsp; Some advise other organisations they influence on their implementation of the regulation. We have been analysing the French national Bar\'s website as well as the major law society website in the Capital city avocatparis.org</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The website has a “mentions légales” for legal matters with a very succinct mention of the Loi Informatique et Libertés, “Loi n° 78-17 du 6 Janvier 1978 relative à l\'informatique, aux fichiers et aux libertés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"En regard de la loi 78-17 du 6 Janvier 1978, vous disposez d\'un droit d\'accès et de rectification aux données personnelles vous concernant.</p><p>Il suffit d\'en faire la demande à : droit_acces@avocatparis.org”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The requirements of the Article 13 GDPR are grossly missing to provide the regulatory transparency. The website lack encryption certificate as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the cookies, a banner online gives the option to accept cookies that are placed as soon as the website is accessed, So no privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the visitor wanted to know more, click the button ‘<em>en savoir plus</em>’ takes you to the CNIL’s webpage explaining the requirements they had ignored!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No privacy by design as there is no way to disable cookie dropping.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lack of transparency means visitors are in total ignorance of id collected from them. no privacy on the website inform the visitors that their web browsing, IP address and other websites they will visit will be logged and shared and made accessible to other users of their electronic devices.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No consent is requested therefore no option to modulate the drop of cookies ans part of what should be privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Being the website of the French law society, the sensitivity of the data accessed is highly concerning. The law society invites victims of domestic abuse to get information on their website trough radio advertisement. Many distressed victims will never expect surfing such a website could result in sharing their personal data for the sake of profiling and targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1993,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.22.04-1024x579.png\" alt=\"\" class=\"wp-image-1993\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Recently, a ranking website operating in France has been under attack by the law society. Ironically, the law society has produced a model of SAR letter for all lawyers to send to this web owners. This can be wrong from several angles, not mentioning GDPR compliance should not become an instrument of banning free speech.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lawyers member of the bar are invited to send the letter with a copy of their ID card. Was spreading ID card to add on the publicly available data by providing further personal data. This was possibly a mistake.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On their SAR model letter, they have included an enquiry concerning the company’s website compliance. This is where it becomes more interesting for our purpose. It is satisfying to notice that GDPR compliance, and more specifically data collection by the website is of concern for the law society whose biggest entity in Paris has a fully non-compliant website for months, resisting to make any amendment to complete with the regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The National representation, Conseil National des Barreaux, CNB, have rushed to make their website in order, using a cookie management tool [<a href=\"https://tarteaucitron.io/en/\" target=\"_blank\" rel=\"noreferrer noopener\">Tarteaucitron</a>]. However, again despite refusing tracking cookies are dropped with up to 5 years retention! Why should they need that?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1994,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.31-1024x552.png\" alt=\"\" class=\"wp-image-1994\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":1995,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.56-1024x594.png\" alt=\"\" class=\"wp-image-1995\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The Entity repenting lawyers in the Capital city Paris, remains full of cookies, java Scripts, for detention periods far above the 13 months tolerated by the French Data Protection Authority CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, data is transferred outside the US in infringement with the ECJ decision Schrems-II since the invalidation of the Privacy Shield.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many law firm\'s websites are in the same poor state.&nbsp;Despite the CNB having produced an exhaustive [<a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-telechargez-le-guide-pratique-elabore-pour-la-profession-davocat\" target=\"_blank\" rel=\"noreferrer noopener\">guidance</a>] on what should be implemented. Is this an application of the old principle “<em>do what you are told, not what we do</em>’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are the consequences of ignoring the regulation ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Shared liability for cookie compliance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In principle, the person setting the cookie is primarily responsible for compliance with the requirements of the cookie regulation. For third party cookies, both the online service provider and the third party have a responsibility for ensuring users are clearly informed about cookies and for obtaining consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&gt;&gt;&gt;The UK ICO acknowledges that this is one of the most challenging areas in which to achieve compliance with PECR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Fashion ID ruling, the European Court of Justice has set the principle of liability of a Facebook Fan page admin for data processed by Facebook for which he could not exercice any control. This ruling can be translated an obligation for any facilitator of data processing to check their data processor and provide the necessary transparency. Therefore the owner of a website cannot simply rely on the promise of their web developper to be GDPR compliant. they have a duty to check the presence of cookies in order to provide the appropriate information and request consent before any tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17)&nbsp;</a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a> ECJ decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation, not limited to personal data, prohibiting cookie walls. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have mentioned the complaint made by Privacy International and La Quadrature du Net.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the ECJ decision in Max Schrems-II, Max Schrems filed 101 complaints and stated :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">Guess What? Many Cookie Banners Ignore Your Wishes, So Max Schrems Goes On The GDPR Attack Again</a> <a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“An initial scan of 22,949 Web sites from the EU domains, as well as .org and .com, showed 1,426 that had cookie banners based on the&nbsp;<a href=\"https://iabeurope.eu/transparency-consent-framework/\"><strong>Interactive Advertising Bureau Europe Transparency and Consent Framework</strong></a>, the main industry standard for this area. Of those, the team of researchers took a close look at 560 Web sites from .uk, .fr, .it, .be, .ie and .com domains to detect possible GDPR violations. Shockingly, they found four types of violations in cookie banners, across 305 Web sites -- 54% of the sample:….</p><p><em>noyb.eu identified countless violations of European and French cookie privacy laws as CDiscount, Allociné and Vanity Fair all turn a rejection of cookies by users into a \"fake consent\". The privacy enforcement non-profit noyb.eu filed three formal [GDPR] complaints with the French Data Protection Authority (CNIL) today.</em></p><p><em>Up to 565 \"fake consents\" per user. Despite users going through the trouble of \"rejecting\" countless cookies on the French eCommerce page CDiscount, the movie guide Allocine.fr and the fashion magazine Vanity Fair, these webpages have sent digital signals to tracking companies claiming that users have agreed to being tracked online. CDiscount has sent \"fake consent\" signals to 431 tracking companies per user, Allocine to 565 and Vanity Fair to 375, as the analysis of the data flows now show.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Max Schrems with his team used the INRIA\'s research group tool \"<em>Cookie Glasses</em>\" to validate their findings and to file complaints to the CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Schrems points out that one company taking advantage of \"fake consent\" is Facebook, which is happy to place cookies after people have clearly objected to all tracking. That means the scale of the potential GDPR breach is considerable. It will be some time before CNIL hands down its decision, but based both on Schrems\' track record and on the facts of the case, it seems probable that he will prevail once more. Although the initial ruling will only apply to France, it is likely to be followed by data protection authorities in other EU countries. If any of the Web sites mentioned above challenge a result that goes against them, there may be a referral to the EU\'s top court, whose decision will be definitive and apply across the whole region. That, in its turn, is likely to influence online privacy laws around the world, as the&nbsp;<a href=\"https://qz.com/africa/1746202/kenya-has-passed-new-data-protection-laws-in-compliance-with-gdpr/\"><strong>GDPR is already doing</strong></a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of non-consistency of national DPAs</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The consistency mechanism that requires a harmonious enforcement of the regulation has not been enforced by the European Data Protection Board.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains hopes to see the reformed privacy and electronic communication regulation or more possibly individual redress or class actions as they were introduced with the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Real Time Biding and Brave browser ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Johnny Ryan has been actively advocating. On 12 September 2018 a Formal GDPR complaints, accompanied by an overview of RTB that details evidence from Google and IAB technical documentation (the ‘Ryan Report’), are submitted to Irish Data Protection Commission (DPC) and UK Information Commissioner’s Office (ICO) by Johnny Ryan of Brave, and Jim Killock of Open Rights Group and Michael Veale of UCL. <a href=\"https://brave.com/rtb-updates/\">https://brave.com/rtb-updates/</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We won\'t further develop on that subject here. You can read : <a href=\"https://www.pearltrees.com/s/file/preview/211865723/2001.02479.pdf?pearlId=284242059\">Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence</a> “<em>New consent management platforms (CMPs) have been introduced to the web to conform with the EU’s General Data Protection Regulation, particularly its requirements for consent when companies collect and process users’ personal data. This work analyses how the most prevalent CMP designs affect people’s consent choices.</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And here a great in depth article by Marie-Claire Peroux LLM : <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/death-of-3rd-party-cookies-is-privacy-protection-possible-for-the-future-adtech-in-the-eu/\" target=\"_blank\">Death of 3rd Party Cookies : Is Privacy Protection Possible For The Future AdTech In The EU ?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Time for web owners to check their websites and rethink all these third party cookies, check the retention periods, usually unlawful above 13 months maximum. Google Analytics and Facebook Connect are under the radar especially due to their Terms of use and data transfert outside the EEA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A white collar crime high profile attorney should not use a \'Not Secure\' website to invite its web users to fill in a contact form and use cookies without transparency and consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1999,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-19.42.08-1024x584.png\" alt=\"\" class=\"wp-image-1999\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Further read on the ECJ decisions Planet49 and Fashion ID :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ECJ 5 June 2018 Judgment in Case C-210/16</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2018-06/cp180081en.pdf\">Wirtschaftsakademie Schleswig-Holstein</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/pulse/facebook-fan-page-ecj-ruling-tara-taubman-bassirian-llm/\">Facebook Fan Page Admin</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The administrator of a fan page on Facebook is jointly responsible with Facebook for the processing of data of visitors to the page</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case arised from a dispute over a German Fan Page on Facebook which used the social network to store cookies on visitors’ hard drives to collect data about them. A German data protection authority ordered the operator of the fan page, an education company, to deactivate the page as visitors were not made aware of the collection of their personal data. The company argued it was not responsible for the processing of personal data by Facebook and that any action should be brought against the social network.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This ECJ ruling establish a joint controller liability between Facebook and the page\'s Admin meaning that owners of Facebook Fan Pages who fall within the scope of the GDPR might have to make joint controllership arrangements with Facebook to establish who is responsible for what. You can&nbsp;<a href=\"https://panopticonblog.com/2018/06/05/the-facebook-fan-page-judgment-joint-data-controllers-cookies-and-targeted-advertising/\" target=\"_blank\" rel=\"noreferrer noopener\">read more</a>&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECJ considered that the administrator takes part in deciding what data to collect and how to process it, for example by defining a target audience and asking for demographic data or information on the lifestyles and interests of visitors to the page. Therefore it has to be held responsible for protecting visitors’ personal data and cannot hide behind the social network.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The admin liability as a joint controller is engaged despite its lack of control over the data processed by Facebook,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ECJ 1&nbsp;October 2019 (request for a preliminary ruling from the Bundesgerichtshof&nbsp;— Germany)&nbsp;— Bundesverband der Verbraucherzentralen und Verbraucherverbände&nbsp;— Verbraucherzentrale Bundesverband eV v Planet49 GmbH</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17)&nbsp;</a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>[Planet49]</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lottery competition was organised requiring users to tick a box or a pre-ticked box allowing Planet49 to set cookies to track the user\'s behaviour online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The German Federation of Consumer Organisations (the \'Federation\') claimed that these two check-boxes did not satisfy German law requirements, and sought an injunction requiring Planet49 to cease using them. The case ultimately reached the German Federal Court of Justice (the \'Bundesgerichtshof\') , which in turn referred the case to the CJEU for preliminary ruling.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Pre-ticked check-boxes authorising the use of cookies and similar technologies do not constitute valid consent under the e-Privacy Directive.<br><br>2. Where consent is required for cookies under the e-Privacy Directive, the GDPR standard of consent applies.<br><br>3. It does not matter whether the cookies constitute personal data or not - Article 5(3) of the e-Privacy Directive (i.e. the cookie consent rule) applies to any information installed or accessed from an individual\'s device.<br><br>4. Website users must be provided with information on the duration of the cookies, and whether third parties will have access to the cookies.</li></ol>\n<!-- /wp:list --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:list -->\n<ul><li>The ePrivacy Directive requires users to&nbsp;give active consent before cookies can be dropped on their devices, preselected tick in a box are not a “<em>statement or clear affirmative action</em>” as required by the General Data Protection Regulation (“GDPR”).</li><li>With regard to Recital 17 of the ePrivacy Directive, combined with Recital 32 of the GDPR, “<em>silence, pre-ticked boxes or inactivity</em>” from being taken to constitute consent.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>**Photography kindly shared by <a href=\"https://www.linkedin.com/in/vanja-munerati-a72195?originalSubdomain=uk\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Vanja Munerati</strong> </a>who is a regulatory economist passionate about outdoors and keen nature photographer. **</em></p>\n<!-- /wp:paragraph -->','Cookies Are Not Yummies','Cookies collect visitors data shared with third parties. They require transparency and prior consent.','inherit','closed','closed','','1983-revision-v1','','','2020-12-15 00:23:55','2020-12-15 00:23:55','',1983,'https://www.datarainbow.eu/1983-revision-v1/',0,'revision','',0),(2012,2,'2020-12-15 00:20:34','2020-12-15 00:20:34','<!-- wp:paragraph -->\n<p>This article was previously published. It\'s being re-published here since the latest enforcements by national Data Protection authorities : After the French CNIL has fined the Supermarket Carrefour and Carrefour Bank for a total of 3 Million Euros, two new enforcements : <a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042635706\">Google for 100 million euros and Amazon for 35 million Euros</a> for non-compliant use of&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=cookies&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#cookies</a>&nbsp;(in particular placing advertising cookies without prior consent and adequate information).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In both deliberations, the CNIL found it is materially competent to control and sanction cookies placed by companies on the computers of users residing in France. It thus underlined that the one stop shop mechanism provided by the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#GDPR</a>&nbsp;was not intended to apply in these procedures, since the operations linked to the use of cookies fall under the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742759542007844864\">#ePrivacy</a>&nbsp;Directive, transposed to article 82 of the French Data Protection Act.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>Link to the attached sanctioning decision against Google:&nbsp;<a href=\"https://lnkd.in/e7Cq5SX\">https://lnkd.in/e7Cq5SX</a>.</li><li>Link to the sanctioning decision against Amazon:&nbsp;<a href=\"https://lnkd.in/exfhXES\">https://lnkd.in/exfhXES</a>.</li><li>Links to the announcements: <ul><li><a href=\"http://Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED\">Cookies : sanction de 60 millions d’euros à l’encontre de GOOGLE LLC et de 40 millions d’euros à l’encontre de GOOGLE IRELAND LIMITED</a></li><li><a rel=\"noreferrer noopener\" href=\"https://lnkd.in/eV7Byyi.\" target=\"_blank\">Cookies : sanction de 35 millions d’euros à l’encontre d’AMAZON EUROPE CORE</a></li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The same day, the <a href=\"https://www.datatilsynet.dk/tilsyn-og-afgoerelser/afgoerelser/2020/nov/ugyldigt-samtykke-paa-hjemmeside\" target=\"_blank\" rel=\"noreferrer noopener\">Danish Data Protection Authority</a> found that the consent format implemented by a website did not meet the regulatory requirements before setting cookies and any other technology.</p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In November, the Belgian authorities have expressed their intention to Take <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=0ee39d9b-9223-493e-8549-9c9de507aa67\" target=\"_blank\">Down Websites Infringing GDPR</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Two major cases by the European Court of Justice (Fashion ID (c-40-17) and Planet49 (c-673/17)) had highlighted the importance of cookie compliance in Europe, and the complex intricacies which organisations must consider. In addition, an increase in the number of enforcement actions and fines in Europe had signified a move towards stricter regulation of ePrivacy.<br>➡️ Six jurisdictions have recently enforced non-compliant use of cookies with fines.<br>➡️ Eight jurisdictions accept that a user can provide consent via browser settings<br>➡️ Only a single jurisdiction (currently) accepts the user of cookie walls<br>➡️ Five jurisdictions find an implicit consent to be valid</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://blogs.dlapiper.com/privacymatters/european-law-on-cookies-guide/?utm_source=dlvr.it&amp;utm_medium=linkedin\">DLAPiper have published a guide on cookie law in EU</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With this in view, and while the new Council <a href=\"https://twitter.com/hashtag/ePrivacy?src=hashtag_click\">#ePrivacy</a> deal is awaited any time soon, here is what we can say about cookies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What do we mean by cookies? </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Wikipedia has a page on yummy <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/Cookie\" target=\"_blank\">cookies</a>. These are not the ones we want to talk about. What we are interested on are not yummy cookies, but the <a rel=\"noreferrer noopener\" href=\"https://en.wikipedia.org/wiki/HTTP_cookie\" data-type=\"URL\" data-id=\"https://en.wikipedia.org/wiki/HTTP_cookie\" target=\"_blank\">HTTP Cookies</a> also called web cookie, Internet cookie, browser cookie, or commonly cookie. A cookie is ‘<em>a small piece of data sent from a website and stored on the user\'s computer by the user\'s web browser while the user is browsing.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>From a regulatory perspective, in Europe, the <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" data-type=\"URL\" data-id=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32002L0058\" target=\"_blank\">Directive or 2002/58/EC of the European Parliament and of the Council of 12 July 2002</a> concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) commonly called ePrivacy. Being a Directive this text required individual implantions by the 28 member states into their national legislations. This explains the various national implementations. We will look more closely at the <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" data-type=\"URL\" data-id=\"https://www.legislation.gov.uk/uksi/2003/2426/contents/made\" target=\"_blank\">Privacy and Electronic Communication Regulation 2003 or PECR</a> for its implementation in the UK or the French <a rel=\"noreferrer noopener\" href=\"https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978\" target=\"_blank\">article 82 of the [Loi «&nbsp;Informatique et Libertés&nbsp;»</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Commission published a study on the \"<a href=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" data-type=\"URL\" data-id=\"https://ec.europa.eu/digital-single-market/en/news/eprivacy-directive-assessment-transposition-effectiveness-and-compatibility-proposed-data\" target=\"_blank\" rel=\"noreferrer noopener\">ePrivacy Directive: assessment of transposition, effectiveness and compatibility with proposed Data Protection Regulation</a>\" (SMART 2013/0071).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although we will mostly mention cookies here, the regulation actually applies to anyone who stores information on a user’s device or gains access to information on a user’s device, in any ways.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This includes Flash cookies, smartphone or other electronic devices apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the Wikipedia entry mentions ‘<em>Cookies were designed to be a reliable mechanism for websites to remember stateful information (such as items added in the shopping cart in an online store) or to record the user\'s browsing activity (including clicking particular buttons, logging in, or recording which pages were visited in the past). They can also be used to remember arbitrary pieces of information that the user previously entered into form fields such as names, addresses, passwords, and credit-card numbers</em>.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You can further read on cookies from KJ Kearie who has a Comprehensive Guide on cookies: ‘<em>There are two main types of cookies – session cookies only collect details from a single browsing sessions, while persistent cookies remain on the user’s device and collect information over time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This article comes out of a frustration expressed by many privacy advocates around the EU to witness a latence to see any improvement coming .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>While the ePrivacy Directive is under reform, the European Data Protection Board on a recent guidance has further clarified how cookies implementation should comply with the requirements of transparency and consent as set by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Privacy and Electronic Communications Regulations (PECR), sits alongside the Data Protection Act (DPA) and the General Data Protection Regulation (GDPR), imposing specific rules on electronic communications, including marketing solicitation, traffic and location data, itemised billing, line identification, directory listings, and the use of cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The consent requirement</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Consent</strong> is mandatory for all cookies that are <strong>not strictly necessary</strong> for the provision of a service. It has been argued no cookie is actually necessary, browser settings are capable of replacing functional cookies. the strict necessary cookie is to be limited to a specific service requested by the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookies used for social media plugins or tracking, site personalisation, advertising, cross-device tracking, research, or product improvement purposes, will require user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/for-organisations/guide-to-pecr/guidance-on-the-use-of-cookies-and-similar-technologies/\" target=\"_blank\">UK ICO has produced guidance on the use of cookies</a> completed by a <a rel=\"noreferrer noopener\" href=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" data-type=\"URL\" data-id=\"https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/\" target=\"_blank\">blog post by Ali Shah, Head of Technology Policy</a> clarifying that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It can no longer be relied on implied consent for the use of cookies ;</li><li>Analytics cookies aren’t strictly necessary and so require consent as they are not part of the functionality that the user requests when they use an online service so we do not need consent ;</li><li>Statements such as ‘by continuing to use this website you are agreeing to cookies’ is not valid consent under the higher GDPR standard. Further clarifications of divergence views on this point will be gathered ;</li><li>PECR always requires consent for non-essential cookies, such as those used for the purposes of marketing and advertising. Legitimate interests cannot be relied upon for these cookies.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Ali Shah concludes that Cookie compliance will be an increasing regulatory priority for the ICO in the future.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board published a new <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_guidelines_202005_consent_en.pdf\" target=\"_blank\">guidelines 05/2020</a> on consent under Regulation 2016/679 in which it remind : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Meanwhile, the EDPB is aware of the review of the ePrivacy Directive (2002/58/EC). The notion of consent in the draft ePrivacy Regulation remains linked to the notion of consent in the GDPR.7 Organisations are likely to need consent under the ePrivacy instrument for most online marketing messages or marketing calls, and online tracking methods including by the use of cookies or apps or other software. The EDPB has already provided recommendations and guidance to the European legislator on the Proposal for a Regulation on ePrivacy.’</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Other requirements</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a <strong>free, informed and unambiguous consent</strong>, users must be clearly informed about what cookies are in use (including any third party cookies) and what function they perform.&nbsp; For non-essential cookies, <strong>pre-ticked boxes or equivalent default fixtures are not allowed,</strong> and user access should not be denied if they do not consent to such cookies. ICO is very specific about placement, formatting and wording of cookie information and consent request.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Prior to the EDPB, its predecessor, the Working Party article 29 had required that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:pullquote -->\n<figure class=\"wp-block-pullquote\"><blockquote><p>“Every organisation that maintains a website should publish a<strong> privacy statement/ notice</strong> on the website. A link to this privacy statement/ notice should be <strong>clearly visible</strong> <strong>on each page</strong> of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible.“</p></blockquote></figure>\n<!-- /wp:pullquote -->\n\n<!-- wp:paragraph -->\n<p>In November 2019,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://privacyinternational.org/\" target=\"_blank\">Privacy International</a> [<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">1</a>], the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/legal-action/challenge-hidden-data-ecosystem\">complaints</a> [<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-\">2</a>]&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To ensure a valid transparency, privacy notices must be <strong>concise, transparent, intelligible and easily accessible (Article 12.1)</strong>;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"https://www.huntonprivacyblog.com/2020/10/05/cnil-publishes-updated-cookie-guidelines-and-final-version-of-recommendations-on-how-to-get-users-consent/\" target=\"_blank\">CNIL has published updated cookies recommendations</a>. Soon reaching the CNIL’s deadline, what has changed?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Increasingly, websites have included cookie banners to require visitors consent. However, not all cookie banners are actually disabling with respect to visitors consent denial. A study published by </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:paragraph -->\n<p>We have previously wrote about pernicious access to visitors data often ignored by web owners in two previous articles :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In January 2019, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/website-transparency-cookies-and-privacy-notice/\" target=\"_blank\">WEBSITE TRANSPARENCY : COOKIES AND PRIVACY NOTICE</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In June 2019, <a href=\"https://www.datarainbow.eu/websites-surreptitiously-tracking-and-reporting-on-visitors/\">WEBSITES SURREPTITIOUSLY TRACKING AND REPORTING ON VISITORS</a></p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>Increasingly, websites have included cookie banners to require visitors consent. However, not all cookie banners are actually disabling with respect to visitors consent denial. A study published by Celestin Matte, <a href=\"https://www.linkedin.com/in/ACoAAAC-QhsB_lHI7RCVypElP9Ysu4SdRlBEVNw\">Nataliia Bielova, PhD</a>, <a href=\"https://www.linkedin.com/in/ACoAAAS2KUUBWxSWRt-qT7-Qq9FNThWTspdFWCE\">Cristiana Santos</a>  IEEE Symposium on Security and Privacy (IEEE S&amp;P 2020) question : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"http://www-sop.inria.fr/members/Nataliia.Bielova/papers/Matt-etal-20-SP.pdf\" target=\"_blank\">Do Cookie Banners Respect my Choice? Measuring Legal Compliance of Banners from IAB Europe’s Transparency and Consent Framework</a> Nataliia Bielova, Cristiana Santos. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In a second paper, submited in September 2020, the group question : \'<a href=\"https://hal.inria.fr/hal-02875447#:~:text=We%20perform%20a%20technical%20assessment,current%20architecture%20of%20the%20web.\"><em>Are cookie banners indeed compliant with the law</em>?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciphering EU legal requirements on consent and technical means to verify compliance of cookie banners\'?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"In this paper, we describe how cookie banners, as a consent mechanism in web applications, should be designed and implemented to be compliant with the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=eprivacy&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#ePrivacy</a>&nbsp;Directive and the&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6742823206958178304\">#GDPR</a>, defining 22 legal requirements.</p><p>While some are provided by legal sources, others result from the domain expertise of computer scientists.</p><p>We perform a technical assessment of whether technical (with computer science tools), manual (with a human operator) or user studies verification is needed.</p><p>We show that it is not possible to assess legal compliance for the majority of requirements because of the current architecture of the web.<br>With this approach, we aim to support policy makers assessing compliance in cookie banners, especially under the current revision of the EU ePrivacy framework\".</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><em>Cookie audit</em>. Guidance provides a detailed list of actions to be taken for new and existing cookies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Analytics cookies</em>. These are not exempt from the consent requirement by default, because they usually do not amount to being ‘strictly necessary’. However, “this may not always be the case where the setting of a first-party analytics cookie results in a low level of intrusiveness and low risk of harm to individuals”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Compliance deadline</em>. No fixed term is specified in the guidelines, but ICO’s Head of Technology Policy, Ali Shah, has published a&nbsp; post instructing the online service providers to “start taking steps to comply now”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Other jurisdictions</em>. French data protection authority CNIL has announced that this month it will repeal its 2013 cookie recommendation that has become outdated in some respects (in particular regarding&nbsp; what concerns the expression of consent), and publish guidelines outlining the applicable rules of law. Similar actions have been taken by the Dutch and German data protection authorities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a paper submited July 2018 entitled \'<em><a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/s/file/preview/181819110/1808.05096.pdf?pearlId=231196296\" target=\"_blank\">We Value Your Privacy … Now Take Some Cookies : Measuring the GDPR’s Impact on Web Privacy\'</a></em>  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Martin Degeling, Christine Utz, Christopher Lentzsch, Henry Hosseini, Florian Schaub and Thorsten Holz from the Ruhr-Universität Bochum, Germany and thr University of Michigan, Ann Arbor, MI, USA, </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list -->\n<ul><li>monitored and analysed the GDPR’s impact on popular websites in all 28 member states of the European Union.</li><li>They found that 84.5 % of websites had a privacy policy. </li><li>72.6 % of websites with existing privacy policies<br>updated them close to the ebtry into force of the GDPR.</li><li>62.1 % of websites displayed cookie consent notices, 16 % more than in January 2018. These notices inform users about a site’s cookie use and user tracking practices. </li><li>They observed cookie consent notices and evaluated 16 common implementations<br>with respect to their technical realisation of cookie consent.<br>This revealed that core web security mechanisms such as the same-origin policy pose problems for the implementation of consent according to GDPR rules, and opting out of third party cookies requires the third party to cooperate. In conclusion, they fond that the GDPR is making the web more transparent, while it still  lacks of both functional and usable mechanisms for users to consent to or deny processing of their personal data on the Internet.</li><li>For each country, the 500 most popular websites were examined for the presence of and updates to their privacy policy.</li></ul>\n<!-- /wp:list --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>In January 2020, another study was published <em><a rel=\"noreferrer noopener\" href=\"https://arxiv.org/abs/2001.02479\" target=\"_blank\">Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence</a></em><a href=\"https://arxiv.org/search/cs?searchtype=author&amp;query=Nouwens%2C+M\"> </a>by Midas Nouwens, Ilaria Liccardi, Michael Veale, David Karger, Lalana Kagal (UCL, MIT and Aarhus University), suggests that many cookie consent pop-ups are flouting EU privacy laws. and noticed that:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"New consent management platforms (CMPs) have been introduced to the web to conform with the EU\'s General Data Protection Regulation, particularly its requirements for consent when companies collect and process users\' personal data. This work analyses how the most prevalent CMP designs affect people\'s consent choices. We scraped the designs of the five most popular CMPs on the top 10,000 websites in the UK (n=680). </p><p>We found that dark patterns and implied consent are ubiquitous; only 11.8% meet the minimal requirements that we set based on European law. Second, we conducted a field experiment with 40 participants to investigate how the eight most common designs affect consent choices. <strong>We found that notification style (banner or barrier) has no effect</strong>; removing the opt-out button from the first page increases consent by 22--23 percentage points; and providing more granular controls on the first page decreases consent by 8--20 percentage points. This study provides an empirical basis for the necessary regulatory action to enforce the GDPR, in particular the possibility of focusing on the centralised, third-party CMP services as an effective way to increase compliance.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p>An illusion of control and transparency?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The French CNIL</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil\" target=\"_blank\">The legal framework relating to consent has evolved, and so does the website of the CNIL</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil\" target=\"_blank\">Online targeted advertisement: what action plan for the CNIL?</a> TIt was announced “<em>The CNIL has received an important number of individual and collective complaints (La Quadrature du Net, Privacy International, NOYB) relating to online marketing. In 2018, 21% of the complaints were related to marketing in the broad sense.</em>’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following&nbsp; the publication in <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=062c5802-f33e-447b-9150-0d8afb2ea6f8\" target=\"_blank\">July 2019 of an updated guidance on cookies</a>, the French data protection authority proposed a consultation on its draft recommendations on practical ways to collect website user consent for cookies and similar technologies on January 2020. The Recommendations including requirements for obtaining GDPR-standard consent, by various European data protection authorities, including the CNIL and the ICO. The CNIL has since undertaken a consultation to develop practical methods to obtain user consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Olivier Proust from the Law Firm Fieldfisher has published a comparative table of what is new on the July cookie guidance to compare with the 2013 guidelines in <a rel=\"noreferrer noopener\" href=\"https://www.fieldfisher.com/en/services/privacy-security-and-information/privacy-security-and-information-law-blog/cnil-publishes-revised-guidelines-on-cookies-and-other-tracking-technology\" target=\"_blank\">CNIL publishes revised guidelines on cookies and other tracking technology</a>. A larger scope, a new legal ground now based on the Article 82 of the amended French Data Protection Act, adapting to the GDPR standard of consent. It is specifically mentioned that browser settings ‘do not provide enough information to users, and therefore, do not enable to obtain informed consent.’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL takes the position that in certain conditions ‘Cookies used to measure audiences on a web site or mobile app may be exempt from consent’</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>How these rules are currently&nbsp;implemented by the major websites in France?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No one better than lawyers could read and implement regulations. Lawyers handle sensitive data bound under professional confidentiality.&nbsp; Some advise other organisations they influence on their implementation of the regulation. We have been analysing the French national Bar\'s website as well as the major law society website in the Capital city avocatparis.org</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The website has a “mentions légales” for legal matters with a very succinct mention of the Loi Informatique et Libertés, “Loi n° 78-17 du 6 Janvier 1978 relative à l\'informatique, aux fichiers et aux libertés</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"En regard de la loi 78-17 du 6 Janvier 1978, vous disposez d\'un droit d\'accès et de rectification aux données personnelles vous concernant.</p><p>Il suffit d\'en faire la demande à : droit_acces@avocatparis.org”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The requirements of the Article 13 GDPR are grossly missing to provide the regulatory transparency. The website lack encryption certificate as well.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the cookies, a banner online gives the option to accept cookies that are placed as soon as the website is accessed, So no privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If the visitor wanted to know more, click the button ‘<em>en savoir plus</em>’ takes you to the CNIL’s webpage explaining the requirements they had ignored!!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No privacy by design as there is no way to disable cookie dropping.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lack of transparency means visitors are in total ignorance of id collected from them. no privacy on the website inform the visitors that their web browsing, IP address and other websites they will visit will be logged and shared and made accessible to other users of their electronic devices.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No consent is requested therefore no option to modulate the drop of cookies ans part of what should be privacy by default.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Being the website of the French law society, the sensitivity of the data accessed is highly concerning. The law society invites victims of domestic abuse to get information on their website trough radio advertisement. Many distressed victims will never expect surfing such a website could result in sharing their personal data for the sake of profiling and targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1993,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.22.04-1024x579.png\" alt=\"\" class=\"wp-image-1993\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Recently, a ranking website operating in France has been under attack by the law society. Ironically, the law society has produced a model of SAR letter for all lawyers to send to this web owners. This can be wrong from several angles, not mentioning GDPR compliance should not become an instrument of banning free speech.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lawyers member of the bar are invited to send the letter with a copy of their ID card. Was spreading ID card to add on the publicly available data by providing further personal data. This was possibly a mistake.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On their SAR model letter, they have included an enquiry concerning the company’s website compliance. This is where it becomes more interesting for our purpose. It is satisfying to notice that GDPR compliance, and more specifically data collection by the website is of concern for the law society whose biggest entity in Paris has a fully non-compliant website for months, resisting to make any amendment to complete with the regulation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The National representation, Conseil National des Barreaux, CNB, have rushed to make their website in order, using a cookie management tool [<a href=\"https://tarteaucitron.io/en/\" target=\"_blank\" rel=\"noreferrer noopener\">Tarteaucitron</a>]. However, again despite refusing tracking cookies are dropped with up to 5 years retention! Why should they need that?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1994,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.31-1024x552.png\" alt=\"\" class=\"wp-image-1994\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":1995,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-11-at-12.33.56-1024x594.png\" alt=\"\" class=\"wp-image-1995\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The Entity repenting lawyers in the Capital city Paris, remains full of cookies, java Scripts, for detention periods far above the 13 months tolerated by the French Data Protection Authority CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, data is transferred outside the US in infringement with the ECJ decision Schrems-II since the invalidation of the Privacy Shield.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Many law firm\'s websites are in the same poor state.&nbsp;Despite the CNB having produced an exhaustive [<a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-telechargez-le-guide-pratique-elabore-pour-la-profession-davocat\" target=\"_blank\" rel=\"noreferrer noopener\">guidance</a>] on what should be implemented. Is this an application of the old principle “<em>do what you are told, not what we do</em>’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are the consequences of ignoring the regulation ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Shared liability for cookie compliance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In principle, the person setting the cookie is primarily responsible for compliance with the requirements of the cookie regulation. For third party cookies, both the online service provider and the third party have a responsibility for ensuring users are clearly informed about cookies and for obtaining consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&gt;&gt;&gt;The UK ICO acknowledges that this is one of the most challenging areas in which to achieve compliance with PECR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Fashion ID ruling, the European Court of Justice has set the principle of liability of a Facebook Fan page admin for data processed by Facebook for which he could not exercice any control. This ruling can be translated an obligation for any facilitator of data processing to check their data processor and provide the necessary transparency. Therefore the owner of a website cannot simply rely on the promise of their web developper to be GDPR compliant. they have a duty to check the presence of cookies in order to provide the appropriate information and request consent before any tracking.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 <a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17)&nbsp;</a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a> ECJ decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation, not limited to personal data, prohibiting cookie walls. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We have mentioned the complaint made by Privacy International and La Quadrature du Net.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Following the ECJ decision in Max Schrems-II, Max Schrems filed 101 complaints and stated :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">Guess What? Many Cookie Banners Ignore Your Wishes, So Max Schrems Goes On The GDPR Attack Again</a> <a href=\"https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml\">https://www.techdirt.com/articles/20191210/07425443541/guess-what-many-cookie-banners-ignore-your-wishes-so-max-schrems-goes-gdpr-attack-again.shtml</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“An initial scan of 22,949 Web sites from the EU domains, as well as .org and .com, showed 1,426 that had cookie banners based on the&nbsp;<a href=\"https://iabeurope.eu/transparency-consent-framework/\"><strong>Interactive Advertising Bureau Europe Transparency and Consent Framework</strong></a>, the main industry standard for this area. Of those, the team of researchers took a close look at 560 Web sites from .uk, .fr, .it, .be, .ie and .com domains to detect possible GDPR violations. Shockingly, they found four types of violations in cookie banners, across 305 Web sites -- 54% of the sample:….</p><p><em>noyb.eu identified countless violations of European and French cookie privacy laws as CDiscount, Allociné and Vanity Fair all turn a rejection of cookies by users into a \"fake consent\". The privacy enforcement non-profit noyb.eu filed three formal [GDPR] complaints with the French Data Protection Authority (CNIL) today.</em></p><p><em>Up to 565 \"fake consents\" per user. Despite users going through the trouble of \"rejecting\" countless cookies on the French eCommerce page CDiscount, the movie guide Allocine.fr and the fashion magazine Vanity Fair, these webpages have sent digital signals to tracking companies claiming that users have agreed to being tracked online. CDiscount has sent \"fake consent\" signals to 431 tracking companies per user, Allocine to 565 and Vanity Fair to 375, as the analysis of the data flows now show.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Max Schrems with his team used the INRIA\'s research group tool \"<em>Cookie Glasses</em>\" to validate their findings and to file complaints to the CNIL.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Schrems points out that one company taking advantage of \"fake consent\" is Facebook, which is happy to place cookies after people have clearly objected to all tracking. That means the scale of the potential GDPR breach is considerable. It will be some time before CNIL hands down its decision, but based both on Schrems\' track record and on the facts of the case, it seems probable that he will prevail once more. Although the initial ruling will only apply to France, it is likely to be followed by data protection authorities in other EU countries. If any of the Web sites mentioned above challenge a result that goes against them, there may be a referral to the EU\'s top court, whose decision will be definitive and apply across the whole region. That, in its turn, is likely to influence online privacy laws around the world, as the <a href=\"https://qz.com/africa/1746202/kenya-has-passed-new-data-protection-laws-in-compliance-with-gdpr/\"><strong>GDPR is already doing</strong></a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The issue of non-consistency of national DPAs</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The consistency mechanism that requires a harmonious enforcement of the regulation has not been enforced by the European Data Protection Board.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remains hopes to see the reformed privacy and electronic communication regulation or more possibly individual redress or class actions as they were introduced with the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Real Time Biding and Brave browser ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Johnny Ryan has been actively advocating. On 12 September 2018 a Formal GDPR complaints, accompanied by an overview of RTB that details evidence from Google and IAB technical documentation (the ‘Ryan Report’), are submitted to Irish Data Protection Commission (DPC) and UK Information Commissioner’s Office (ICO) by Johnny Ryan of Brave, and Jim Killock of Open Rights Group and Michael Veale of UCL. <a href=\"https://brave.com/rtb-updates/\">https://brave.com/rtb-updates/</a> </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We won\'t further develop on that subject here. You can read : <a href=\"https://www.pearltrees.com/s/file/preview/211865723/2001.02479.pdf?pearlId=284242059\">Dark Patterns after the GDPR: Scraping Consent Pop-ups and Demonstrating their Influence</a> “<em>New consent management platforms (CMPs) have been introduced to the web to conform with the EU’s General Data Protection Regulation, particularly its requirements for consent when companies collect and process users’ personal data. This work analyses how the most prevalent CMP designs affect people’s consent choices.</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And here a great in depth article by Marie-Claire Peroux LLM : <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/death-of-3rd-party-cookies-is-privacy-protection-possible-for-the-future-adtech-in-the-eu/\" target=\"_blank\">Death of 3rd Party Cookies : Is Privacy Protection Possible For The Future AdTech In The EU ?</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Time for web owners to check their websites and rethink all these third party cookies, check the retention periods, usually unlawful above 13 months maximum. Google Analytics and Facebook Connect are under the radar especially due to their Terms of use and data transfert outside the EEA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A white collar crime high profile attorney should not use a \'Not Secure\' website to invite its web users to fill in a contact form and use cookies without transparency and consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":1999,\"sizeSlug\":\"large\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2020/12/Screenshot-2020-12-10-at-19.42.08-1024x584.png\" alt=\"\" class=\"wp-image-1999\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Further read on the ECJ decisions Planet49 and Fashion ID :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ECJ 5 June 2018 Judgment in Case C-210/16</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2018-06/cp180081en.pdf\">Wirtschaftsakademie Schleswig-Holstein</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/pulse/facebook-fan-page-ecj-ruling-tara-taubman-bassirian-llm/\">Facebook Fan Page Admin</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The administrator of a fan page on Facebook is jointly responsible with Facebook for the processing of data of visitors to the page</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The case arised from a dispute over a German Fan Page on Facebook which used the social network to store cookies on visitors’ hard drives to collect data about them. A German data protection authority ordered the operator of the fan page, an education company, to deactivate the page as visitors were not made aware of the collection of their personal data. The company argued it was not responsible for the processing of personal data by Facebook and that any action should be brought against the social network.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This ECJ ruling establish a joint controller liability between Facebook and the page\'s Admin meaning that owners of Facebook Fan Pages who fall within the scope of the GDPR might have to make joint controllership arrangements with Facebook to establish who is responsible for what. You can&nbsp;<a href=\"https://panopticonblog.com/2018/06/05/the-facebook-fan-page-judgment-joint-data-controllers-cookies-and-targeted-advertising/\" target=\"_blank\" rel=\"noreferrer noopener\">read more</a>&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The ECJ considered that the administrator takes part in deciding what data to collect and how to process it, for example by defining a target audience and asking for demographic data or information on the lifestyles and interests of visitors to the page. Therefore it has to be held responsible for protecting visitors’ personal data and cannot hide behind the social network.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The admin liability as a joint controller is engaged despite its lack of control over the data processed by Facebook,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>ECJ 1&nbsp;October 2019 (request for a preliminary ruling from the Bundesgerichtshof&nbsp;— Germany)&nbsp;— Bundesverband der Verbraucherzentralen und Verbraucherverbände&nbsp;— Verbraucherzentrale Bundesverband eV v Planet49 GmbH</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679\">(Case C-673/17)&nbsp;</a><a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=221353&amp;pageIndex=0&amp;doclang=EN&amp;mode=req&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1200679#1\">1</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>[Planet49]</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A lottery competition was organised requiring users to tick a box or a pre-ticked box allowing Planet49 to set cookies to track the user\'s behaviour online.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The German Federation of Consumer Organisations (the \'Federation\') claimed that these two check-boxes did not satisfy German law requirements, and sought an injunction requiring Planet49 to cease using them. The case ultimately reached the German Federal Court of Justice (the \'Bundesgerichtshof\') , which in turn referred the case to the CJEU for preliminary ruling.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Pre-ticked check-boxes authorising the use of cookies and similar technologies do not constitute valid consent under the e-Privacy Directive.<br><br>2. Where consent is required for cookies under the e-Privacy Directive, the GDPR standard of consent applies.<br><br>3. It does not matter whether the cookies constitute personal data or not - Article 5(3) of the e-Privacy Directive (i.e. the cookie consent rule) applies to any information installed or accessed from an individual\'s device.<br><br>4. Website users must be provided with information on the duration of the cookies, and whether third parties will have access to the cookies.</li></ol>\n<!-- /wp:list --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:list -->\n<ul><li>The ePrivacy Directive requires users to&nbsp;give active consent before cookies can be dropped on their devices, preselected tick in a box are not a “<em>statement or clear affirmative action</em>” as required by the General Data Protection Regulation (“GDPR”).</li><li>With regard to Recital 17 of the ePrivacy Directive, combined with Recital 32 of the GDPR, “<em>silence, pre-ticked boxes or inactivity</em>” from being taken to constitute consent.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The Planet49 decision had applied a strict interpretation of obligations under ePrivacy and data protection legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Baden-Württemberg data protection authority (\'LfDI Baden-Württemberg\') issued, on 9 October 2019, a statement on cookies and consent (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/zum-einsatz-von-cookies-und-cookie-bannern-was-gilt-es-bei-einwilligungen-zu-tun-eugh-urteil-planet49/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>), following the Planet 49 Judgment. In addition, the LfDI Baden-Württemberg also&nbsp;<a href=\"https://platform.dataguidance.com/news/baden-w%C3%BCrttemberg-lfdi-baden-w%C3%BCrttemberg-releases-faqs-cookies-tracking-and-gdpr-compliance\" target=\"_blank\" rel=\"noreferrer noopener\">released</a>, on 29 April 2019, its frequently asked questions regarding cookies, tracking, and compliance with the GDPR (only available in German&nbsp;<a href=\"https://www.baden-wuerttemberg.datenschutz.de/faq-zu-cookies-und-tracking-2/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>**Photography kindly shared by <a href=\"https://www.linkedin.com/in/vanja-munerati-a72195?originalSubdomain=uk\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Vanja Munerati</strong> </a>who is a regulatory economist passionate about outdoors and keen nature photographer. **</em></p>\n<!-- /wp:paragraph -->','Cookies Are Not Yummies','Cookies collect visitors data shared with third parties. They require transparency and prior consent.','inherit','closed','closed','','1983-revision-v1','','','2020-12-15 00:20:34','2020-12-15 00:20:34','',1983,'https://www.datarainbow.eu/1983-revision-v1/',0,'revision','',0),(2077,1,'2021-06-21 23:17:33','2021-06-21 23:17:33','<!-- wp:image {\"id\":2056,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a-1024x518.jpeg\" alt=\"\" class=\"wp-image-2056\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet. The <a href=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" data-type=\"URL\" data-id=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO is to publish a new set of Standard Contractual Clauses</a>. The Commission\'s SCCs will not apply to the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, on 18 June 2021 the Commission adopted the <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">new Standard Contractual Clauses</a> long awaited, for transfers of personal data to third countries as the GDPR prohibits the transfer of personal data to a country outside the EU unless the third country has been deemed adequate by the European Commission or one of the prescribed transfer mechanisms are in place. The role of the standard contractual clauses is limited to ensuring appropriate data protection safeguards for international data transfers. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Today, the <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/edpb_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/edpb_en\" target=\"_blank\">EDPB</a> adopted its<a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data - Version 2.0.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Since Edward Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data (FISA section 702, EO 12333, US Cloud Act). The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a82\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a82\" target=\"_blank\">Art 82 GDPR</a>. However, we are still to see <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" target=\"_blank\">non-material damages</a> granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Safe Harbour agreement</a> then the <a rel=\"noreferrer noopener\" href=\"http://datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/(opens in a new tab)\" target=\"_blank\">Privacy Shield</a> being invalidated by the European Court of Justice decisions (commonly known as <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Schrems-I</a> and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the <a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" target=\"_blank\">Charter of the Fundamental Rights of the European Union</a>. With this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an <strong>equivalent level of protection</strong> for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a> a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japan and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate level of protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give it a green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EU/EEA. To allow data transfer, data exporters are required to process a <strong>transfer impact assessment</strong> to assess the level of protection in the third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus the implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – <strong>supplementary measures</strong> need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be <strong>technical, organisational and/or contractual measures</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Footnote 12 :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>the Parties have to take into <strong>account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information</strong> on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractual Clauses models adopted by the Commission pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a<strong> data mapping</strong> that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We witness the clouds leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' Binding Corporate Rules (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) that can be more appropriate, usually established within a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> applies \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only</em>\' under restrictive conditions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU Commission\'s implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations around its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers <strong>only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</strong></em>\' This is the case when the importer falls within the definition of <strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a3\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a3\" target=\"_blank\">Art 3(2)</a></strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a <strong>Data Processing Agreement </strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a28\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a28\" target=\"_blank\"><strong>Article 28</strong> </a>is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND <strong>judicial redress</strong> (EU courts competence) AND/OR <strong>arbitration</strong> will have to be provided. This is what was lacking with the Privacy Shield, an independent authority and the <strong>ombudsperson</strong> to deal with EU citizens complaints. The EDBP recommendation has not specified the exclusion of importers subject to the GDPR. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data encryption</strong> can help, when the encryption key remain in Europe. That does not solve the problem when data needs to be accessed/processed in the country of import.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden at the bottom of a drawer. The new SCCs require adaptation, and regular assessments. These assessments have to be filed as the DPAs could request to access the logs. They are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Third parties have now the \'<strong>docking option</strong>\' to join the contract. They can be adapted as long as the nature of the clauses are not modified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Emphasised by the Commission\'s document, this will not be easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy. Data subjects have the right to be informed. Is this systematic or at request?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, <strong>data subjects should be provided with a copy </strong>of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><a href=\"https://gdprinfo.info/#a13.1.f\">Article 13(1)(f)</a> and <a href=\"https://gdprinfo.info/#a14.1.f\">Article 14(1)(f)</a></p><p>Obligation of the controller to provide data subjects with information about the fact that it intends to transfer their personal data to a third country or in accordance with pursuant to </p><p><a href=\"https://gdprinfo.info/#a46\">Article 46</a> of <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679\">Regulation (EU) 2016/679</a>,</p><p>such information must include a reference to the appropriate safeguards and the means by which to obtain a copy of them or information where they have been made available</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>The data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p></blockquote>\n<!-- /wp:quote --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start as soon as possible with <strong>data mapping</strong>, <strong>data minimising</strong>, and <strong>securing access</strong>. <strong>Hold the data as a hot potato.</strong> Don’t keep it longer than necessary. Keep your <strong>archives</strong> out of the network. Limit access to data. Train your staff. Be ready for data breach that is not anymore IF but WHEN it happens.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never have reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly <strong>data heaven</strong> with the risk of opening backdoors to data transfers to the US. Adequacy decision are to be reviewed after 4 years. Meanwhile, a DPA can challenge the decision based on an individual\'s complaint.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touched at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a rel=\"noreferrer noopener\" href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" data-type=\"URL\" data-id=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" target=\"_blank\" rel=\"noreferrer noopener\">Case Law Digest 2021: Transfers of personal data to third countries</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This document is not a legal advice. Simply a fresh analyse of the recent publications.</p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 23:17:33','2021-06-21 23:17:33','',2054,'https://www.datarainbow.eu/?p=2077',0,'revision','',0),(2078,1,'2021-06-21 23:20:53','2021-06-21 23:20:53','<!-- wp:image {\"id\":2056,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a-1024x518.jpeg\" alt=\"\" class=\"wp-image-2056\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet. The <a href=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" data-type=\"URL\" data-id=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO is to publish a new set of Standard Contractual Clauses</a>. The Commission\'s SCCs will not apply to the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, on 18 June 2021 the Commission adopted the <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">new Standard Contractual Clauses</a> long awaited, for transfers of personal data to third countries as the GDPR prohibits the transfer of personal data to a country outside the EU unless the third country has been deemed adequate by the European Commission or one of the prescribed transfer mechanisms are in place. The role of the standard contractual clauses is limited to ensuring appropriate data protection safeguards for international data transfers. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Today, the <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/edpb_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/edpb_en\" target=\"_blank\">EDPB</a> adopted its<a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data - Version 2.0.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Since Edward Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data (FISA section 702, EO 12333, US Cloud Act). The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a82\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a82\" target=\"_blank\">Art 82 GDPR</a>. However, we are still to see <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" target=\"_blank\">non-material damages</a> granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Safe Harbour agreement</a> then the <a rel=\"noreferrer noopener\" href=\"http://datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/(opens in a new tab)\" target=\"_blank\">Privacy Shield</a> being invalidated by the European Court of Justice decisions (commonly known as <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Schrems-I</a> and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the <a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" target=\"_blank\">Charter of the Fundamental Rights of the European Union</a>. With this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an <strong>equivalent level of protection</strong> for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a> a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japan and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate level of protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give it a green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EU/EEA. To allow data transfer, data exporters are required to process a <strong>transfer impact assessment</strong> to assess the level of protection in the third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus the implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – <strong>supplementary measures</strong> need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be <strong>technical, organisational and/or contractual measures</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Footnote 12 :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>the Parties have to take into <strong>account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information</strong> on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractual Clauses models adopted by the Commission pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a<strong> data mapping</strong> that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We witness the clouds leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' Binding Corporate Rules (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) that can be more appropriate, usually established within a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> applies \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only</em>\' under restrictive conditions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU Commission\'s implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations around its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers <strong>only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</strong></em>\' This is the case when the importer falls within the definition of <strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a3\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a3\" target=\"_blank\">Art 3(2)</a></strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a <strong>Data Processing Agreement </strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a28\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a28\" target=\"_blank\"><strong>Article 28</strong> </a>is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND <strong>judicial redress</strong> (EU courts competence) AND/OR <strong>arbitration</strong> will have to be provided. This is what was lacking with the Privacy Shield, an independent authority and the <strong>ombudsperson</strong> to deal with EU citizens complaints. The EDBP recommendation has not specified the exclusion of importers subject to the GDPR. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data encryption</strong> can help, when the encryption key remain in Europe. That does not solve the problem when data needs to be accessed/processed in the country of import.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden at the bottom of a drawer. The new SCCs require adaptation, and regular assessments. These assessments have to be filed as the DPAs could request to access the logs. They are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Third parties have now the \'<strong>docking option</strong>\' to join the contract. They can be adapted as long as the nature of the clauses are not modified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Emphasised by the Commission\'s document, this will not be easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy. Data subjects have the right to be informed. Is this systematic or at request?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, <strong>data subjects should be provided with a copy </strong>of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><a href=\"https://gdprinfo.info/#a13.1.f\">Article 13(1)(f)</a> and <a href=\"https://gdprinfo.info/#a14.1.f\">Article 14(1)(f)</a></p><p>Obligation of the controller to provide data subjects with information about the fact that it intends to transfer their personal data to a third country or in accordance with pursuant to </p><p><a href=\"https://gdprinfo.info/#a46\">Article 46</a> of <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679\">Regulation (EU) 2016/679</a>,</p><p>such information must include a reference to the appropriate safeguards and the means by which to obtain a copy of them or information where they have been made available</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>The data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p><p>See also</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(b)</td><td><em>The data importer agrees to submit itself to <strong>the jurisdiction</strong> of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.</em></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start as soon as possible with <strong>data mapping</strong>, <strong>data minimising</strong>, and <strong>securing access</strong>. <strong>Hold the data as a hot potato.</strong> Don’t keep it longer than necessary. Keep your <strong>archives</strong> out of the network. Limit access to data. Train your staff. Be ready for data breach that is not anymore IF but WHEN it happens.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never have reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly <strong>data heaven</strong> with the risk of opening backdoors to data transfers to the US. Adequacy decision are to be reviewed after 4 years. Meanwhile, a DPA can challenge the decision based on an individual\'s complaint.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touched at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a rel=\"noreferrer noopener\" href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" data-type=\"URL\" data-id=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" target=\"_blank\" rel=\"noreferrer noopener\">Case Law Digest 2021: Transfers of personal data to third countries</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This document is not a legal advice. Simply a fresh analyse of the recent publications.</p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 23:20:53','2021-06-21 23:20:53','',2054,'https://www.datarainbow.eu/?p=2078',0,'revision','',0),(2080,1,'2021-06-21 23:29:47','2021-06-21 23:29:47','<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet. The <a href=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" data-type=\"URL\" data-id=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO is to publish a new set of Standard Contractual Clauses</a>. The Commission\'s SCCs will not apply to the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, on 18 June 2021 the Commission adopted the <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">new Standard Contractual Clauses</a> long awaited, for transfers of personal data to third countries as the GDPR prohibits the transfer of personal data to a country outside the EU unless the third country has been deemed adequate by the European Commission or one of the prescribed transfer mechanisms are in place. The role of the standard contractual clauses is limited to ensuring appropriate data protection safeguards for international data transfers. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Today, the <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/edpb_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/edpb_en\" target=\"_blank\">EDPB</a> adopted its<a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data - Version 2.0.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Since Edward Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data (FISA section 702, EO 12333, US Cloud Act). The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a82\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a82\" target=\"_blank\">Art 82 GDPR</a>. However, we are still to see <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" target=\"_blank\">non-material damages</a> granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Safe Harbour agreement</a> then the <a rel=\"noreferrer noopener\" href=\"http://datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/(opens in a new tab)\" target=\"_blank\">Privacy Shield</a> being invalidated by the European Court of Justice decisions (commonly known as <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Schrems-I</a> and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the <a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" target=\"_blank\">Charter of the Fundamental Rights of the European Union</a>. With this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an <strong>equivalent level of protection</strong> for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a> a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japan and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate level of protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give it a green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EU/EEA. To allow data transfer, data exporters are required to process a <strong>transfer impact assessment</strong> to assess the level of protection in the third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus the implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – <strong>supplementary measures</strong> need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be <strong>technical, organisational and/or contractual measures</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Footnote 12 :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>the Parties have to take into <strong>account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information</strong> on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractual Clauses models adopted by the Commission pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a<strong> data mapping</strong> that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We witness the clouds leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' Binding Corporate Rules (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) that can be more appropriate, usually established within a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> applies \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only</em>\' under restrictive conditions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU Commission\'s implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations around its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers <strong>only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</strong></em>\' This is the case when the importer falls within the definition of <strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a3\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a3\" target=\"_blank\">Art 3(2)</a></strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a <strong>Data Processing Agreement </strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a28\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a28\" target=\"_blank\"><strong>Article 28</strong> </a>is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND <strong>judicial redress</strong> (EU courts competence) AND/OR <strong>arbitration</strong> will have to be provided. This is what was lacking with the Privacy Shield, an independent authority and the <strong>ombudsperson</strong> to deal with EU citizens complaints. The EDBP recommendation has not specified the exclusion of importers subject to the GDPR. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data encryption</strong> can help, when the encryption key remain in Europe. That does not solve the problem when data needs to be accessed/processed in the country of import.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden at the bottom of a drawer. The new SCCs require adaptation, and regular assessments. These assessments have to be filed as the DPAs could request to access the logs. They are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Third parties have now the \'<strong>docking option</strong>\' to join the contract. They can be adapted as long as the nature of the clauses are not modified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Emphasised by the Commission\'s document, this will not be easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy. Data subjects have the right to be informed. Is this systematic or at request?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, <strong>data subjects should be provided with a copy </strong>of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><a href=\"https://gdprinfo.info/#a13.1.f\">Article 13(1)(f)</a> and <a href=\"https://gdprinfo.info/#a14.1.f\">Article 14(1)(f)</a></p><p>Obligation of the controller to provide data subjects with information about the fact that it intends to transfer their personal data to a third country or in accordance with pursuant to </p><p><a href=\"https://gdprinfo.info/#a46\">Article 46</a> of <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679\">Regulation (EU) 2016/679</a>,</p><p>such information must include a reference to the appropriate safeguards and the means by which to obtain a copy of them or information where they have been made available</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>The data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p><p>See also</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(b)</td><td><em>The data importer agrees to submit itself to <strong>the jurisdiction</strong> of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.</em></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start as soon as possible with <strong>data mapping</strong>, <strong>data minimising</strong>, and <strong>securing access</strong>. <strong>Hold the data as a hot potato.</strong> Don’t keep it longer than necessary. Keep your <strong>archives</strong> out of the network. Limit access to data. Train your staff. Be ready for data breach that is not anymore IF but WHEN it happens.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never have reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly <strong>data heaven</strong> with the risk of opening backdoors to data transfers to the US. Adequacy decision are to be reviewed after 4 years. Meanwhile, a DPA can challenge the decision based on an individual\'s complaint.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touched at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a rel=\"noreferrer noopener\" href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" data-type=\"URL\" data-id=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" target=\"_blank\" rel=\"noreferrer noopener\">Case Law Digest 2021: Transfers of personal data to third countries</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This document does not constitute a legal advice. Simply a fresh analyse of the recent publications.</p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 23:29:47','2021-06-21 23:29:47','',2054,'https://www.datarainbow.eu/?p=2080',0,'revision','',0),(2079,1,'2021-06-21 23:23:57','2021-06-21 23:23:57','<!-- wp:image {\"id\":2056,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2021/06/DB7BE3B6-FEA8-4C95-B109-0586DB3F5A1F_1_201_a-1024x518.jpeg\" alt=\"\" class=\"wp-image-2056\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet. The <a href=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" data-type=\"URL\" data-id=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO is to publish a new set of Standard Contractual Clauses</a>. The Commission\'s SCCs will not apply to the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, on 18 June 2021 the Commission adopted the <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">new Standard Contractual Clauses</a> long awaited, for transfers of personal data to third countries as the GDPR prohibits the transfer of personal data to a country outside the EU unless the third country has been deemed adequate by the European Commission or one of the prescribed transfer mechanisms are in place. The role of the standard contractual clauses is limited to ensuring appropriate data protection safeguards for international data transfers. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Today, the <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/edpb_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/edpb_en\" target=\"_blank\">EDPB</a> adopted its<a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data - Version 2.0.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Since Edward Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data (FISA section 702, EO 12333, US Cloud Act). The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a82\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a82\" target=\"_blank\">Art 82 GDPR</a>. However, we are still to see <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" target=\"_blank\">non-material damages</a> granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Safe Harbour agreement</a> then the <a rel=\"noreferrer noopener\" href=\"http://datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/(opens in a new tab)\" target=\"_blank\">Privacy Shield</a> being invalidated by the European Court of Justice decisions (commonly known as <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Schrems-I</a> and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the <a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" target=\"_blank\">Charter of the Fundamental Rights of the European Union</a>. With this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an <strong>equivalent level of protection</strong> for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a> a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japan and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate level of protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give it a green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EU/EEA. To allow data transfer, data exporters are required to process a <strong>transfer impact assessment</strong> to assess the level of protection in the third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus the implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – <strong>supplementary measures</strong> need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be <strong>technical, organisational and/or contractual measures</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Footnote 12 :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>the Parties have to take into <strong>account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information</strong> on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractual Clauses models adopted by the Commission pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a<strong> data mapping</strong> that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We witness the clouds leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' Binding Corporate Rules (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) that can be more appropriate, usually established within a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> applies \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only</em>\' under restrictive conditions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU Commission\'s implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations around its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers <strong>only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</strong></em>\' This is the case when the importer falls within the definition of <strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a3\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a3\" target=\"_blank\">Art 3(2)</a></strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a <strong>Data Processing Agreement </strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a28\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a28\" target=\"_blank\"><strong>Article 28</strong> </a>is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND <strong>judicial redress</strong> (EU courts competence) AND/OR <strong>arbitration</strong> will have to be provided. This is what was lacking with the Privacy Shield, an independent authority and the <strong>ombudsperson</strong> to deal with EU citizens complaints. The EDBP recommendation has not specified the exclusion of importers subject to the GDPR. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data encryption</strong> can help, when the encryption key remain in Europe. That does not solve the problem when data needs to be accessed/processed in the country of import.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden at the bottom of a drawer. The new SCCs require adaptation, and regular assessments. These assessments have to be filed as the DPAs could request to access the logs. They are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Third parties have now the \'<strong>docking option</strong>\' to join the contract. They can be adapted as long as the nature of the clauses are not modified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Emphasised by the Commission\'s document, this will not be easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy. Data subjects have the right to be informed. Is this systematic or at request?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, <strong>data subjects should be provided with a copy </strong>of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><a href=\"https://gdprinfo.info/#a13.1.f\">Article 13(1)(f)</a> and <a href=\"https://gdprinfo.info/#a14.1.f\">Article 14(1)(f)</a></p><p>Obligation of the controller to provide data subjects with information about the fact that it intends to transfer their personal data to a third country or in accordance with pursuant to </p><p><a href=\"https://gdprinfo.info/#a46\">Article 46</a> of <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679\">Regulation (EU) 2016/679</a>,</p><p>such information must include a reference to the appropriate safeguards and the means by which to obtain a copy of them or information where they have been made available</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>The data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p><p>See also</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(b)</td><td><em>The data importer agrees to submit itself to <strong>the jurisdiction</strong> of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.</em></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start as soon as possible with <strong>data mapping</strong>, <strong>data minimising</strong>, and <strong>securing access</strong>. <strong>Hold the data as a hot potato.</strong> Don’t keep it longer than necessary. Keep your <strong>archives</strong> out of the network. Limit access to data. Train your staff. Be ready for data breach that is not anymore IF but WHEN it happens.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never have reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly <strong>data heaven</strong> with the risk of opening backdoors to data transfers to the US. Adequacy decision are to be reviewed after 4 years. Meanwhile, a DPA can challenge the decision based on an individual\'s complaint.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touched at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a rel=\"noreferrer noopener\" href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" data-type=\"URL\" data-id=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" target=\"_blank\" rel=\"noreferrer noopener\">Case Law Digest 2021: Transfers of personal data to third countries</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This document does not constitute a legal advice. Simply a fresh analyse of the recent publications.</p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 23:23:57','2021-06-21 23:23:57','',2054,'https://www.datarainbow.eu/?p=2079',0,'revision','',0),(2081,1,'2021-06-21 23:34:24','2021-06-21 23:34:24','<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\" target=\"_blank\" data-type=\"URL\" data-id=\"https://ec.europa.eu/info/law/law-making-process/adopting-eu-law/implementing-and-delegated-acts/comitology_en\">Comitology</a> committee met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet. The <a href=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" data-type=\"URL\" data-id=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO is to publish a new set of Standard Contractual Clauses</a>. The Commission\'s SCCs will not apply to the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, on 18 June 2021 the Commission adopted the <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">new Standard Contractual Clauses</a> long awaited, for transfers of personal data to third countries as the GDPR prohibits the transfer of personal data to a country outside the EU unless the third country has been deemed adequate by the European Commission or one of the prescribed transfer mechanisms are in place. The role of the standard contractual clauses is limited to ensuring appropriate data protection safeguards for international data transfers. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Today, the <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/edpb_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/edpb_en\" target=\"_blank\">EDPB</a> adopted its<a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data - Version 2.0.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Since Edward Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data (FISA section 702, EO 12333, US Cloud Act). The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a82\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a82\" target=\"_blank\">Art 82 GDPR</a>. However, we are still to see <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" target=\"_blank\">non-material damages</a> granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Safe Harbour agreement</a> then the <a rel=\"noreferrer noopener\" href=\"http://datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/(opens in a new tab)\" target=\"_blank\">Privacy Shield</a> being invalidated by the European Court of Justice decisions (commonly known as <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Schrems-I</a> and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the <a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" target=\"_blank\">Charter of the Fundamental Rights of the European Union</a>. With this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an <strong>equivalent level of protection</strong> for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a> a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japan and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate level of protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give it a green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EU/EEA. To allow data transfer, data exporters are required to process a <strong>transfer impact assessment</strong> to assess the level of protection in the third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus the implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – <strong>supplementary measures</strong> need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be <strong>technical, organisational and/or contractual measures</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Footnote 12 :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>the Parties have to take into <strong>account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information</strong> on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractual Clauses models adopted by the Commission pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a<strong> data mapping</strong> that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We witness the clouds leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' Binding Corporate Rules (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) that can be more appropriate, usually established within a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> applies \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only</em>\' under restrictive conditions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU Commission\'s implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations around its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers <strong>only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</strong></em>\' This is the case when the importer falls within the definition of <strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a3\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a3\" target=\"_blank\">Art 3(2)</a></strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a <strong>Data Processing Agreement </strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a28\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a28\" target=\"_blank\"><strong>Article 28</strong> </a>is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND <strong>judicial redress</strong> (EU courts competence) AND/OR <strong>arbitration</strong> will have to be provided. This is what was lacking with the Privacy Shield, an independent authority and the <strong>ombudsperson</strong> to deal with EU citizens complaints. The EDBP recommendation has not specified the exclusion of importers subject to the GDPR. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data encryption</strong> can help, when the encryption key remain in Europe. That does not solve the problem when data needs to be accessed/processed in the country of import.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden at the bottom of a drawer. The new SCCs require adaptation, and regular assessments. These assessments have to be filed as the DPAs could request to access the logs. They are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Third parties have now the \'<strong>docking option</strong>\' to join the contract. They can be adapted as long as the nature of the clauses are not modified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Emphasised by the Commission\'s document, this will not be easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy. Data subjects have the right to be informed. Is this systematic or at request?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, <strong>data subjects should be provided with a copy </strong>of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><a href=\"https://gdprinfo.info/#a13.1.f\">Article 13(1)(f)</a> and <a href=\"https://gdprinfo.info/#a14.1.f\">Article 14(1)(f)</a></p><p>Obligation of the controller to provide data subjects with information about the fact that it intends to transfer their personal data to a third country or in accordance with pursuant to </p><p><a href=\"https://gdprinfo.info/#a46\">Article 46</a> of <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679\">Regulation (EU) 2016/679</a>,</p><p>such information must include a reference to the appropriate safeguards and the means by which to obtain a copy of them or information where they have been made available</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>The data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p><p>See also</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(b)</td><td><em>The data importer agrees to submit itself to <strong>the jurisdiction</strong> of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.</em></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start as soon as possible with <strong>data mapping</strong>, <strong>data minimising</strong>, and <strong>securing access</strong>. <strong>Hold the data as a hot potato.</strong> Don’t keep it longer than necessary. Keep your <strong>archives</strong> out of the network. Limit access to data. Train your staff. Be ready for data breach that is not anymore IF but WHEN it happens.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never have reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly <strong>data heaven</strong> with the risk of opening backdoors to data transfers to the US. Adequacy decision are to be reviewed after 4 years. Meanwhile, a DPA can challenge the decision based on an individual\'s complaint.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touched at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.lexology.com/library/detail.aspx?g=ed8505f7-4093-4acd-a00a-9a95c53fc9ef\">Portugal – DPA orders suspension</a>- 27 April 2021</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Portuguese DPA investigated complaints against the national statistics institute (INE) for alleged unlawful data transfers. Census data were shared with a third party in the US. The transfer was based on SCCs, but without any supplementary safeguards put in place.The DPA concluded the INE failed to conduct a DPIA prior ti the use of the third party to process a census data (required because of large scale processing of sensitive data) and had not met the requirements for valid data transfers.The transfer of data was suspended both for transfers to the US and to any other country which does not offer an adequate level of data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a rel=\"noreferrer noopener\" href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" data-type=\"URL\" data-id=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" target=\"_blank\" rel=\"noreferrer noopener\">Case Law Digest 2021: Transfers of personal data to third countries</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This document does not constitute a legal advice. Simply a fresh analyse of the recent publications.</p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-21 23:34:24','2021-06-21 23:34:24','',2054,'https://www.datarainbow.eu/?p=2081',0,'revision','',0),(2082,1,'2021-06-22 22:47:47','2021-06-22 22:47:47','<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A webinar moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , SCOTT WILSON Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a Privsec Webinar Tuesday 22nd of June at 12 BST.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a href=\"https://ec.europa.eu/transparency/comitology-register/screen/documents/074379/1/consult?lang=en\" data-type=\"URL\" data-id=\"https://ec.europa.eu/transparency/comitology-register/screen/documents/074379/1/consult?lang=en\" target=\"_blank\" rel=\"noreferrer noopener\">Comitology committee</a> met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet. The <a href=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" data-type=\"URL\" data-id=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO is to publish a new set of Standard Contractual Clauses</a>. The Commission\'s SCCs will not apply to the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, on 18 June 2021 the Commission adopted the <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">new Standard Contractual Clauses</a> long awaited, for transfers of personal data to third countries as the GDPR prohibits the transfer of personal data to a country outside the EU unless the third country has been deemed adequate by the European Commission or one of the prescribed transfer mechanisms are in place. The role of the standard contractual clauses is limited to ensuring appropriate data protection safeguards for international data transfers. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Today, the <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/edpb_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/edpb_en\" target=\"_blank\">EDPB</a> adopted its<a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data - Version 2.0.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Since Edward Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data (FISA section 702, EO 12333, US Cloud Act). The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a82\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a82\" target=\"_blank\">Art 82 GDPR</a>. However, we are still to see <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" target=\"_blank\">non-material damages</a> granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Safe Harbour agreement</a> then the <a rel=\"noreferrer noopener\" href=\"http://datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/(opens in a new tab)\" target=\"_blank\">Privacy Shield</a> being invalidated by the European Court of Justice decisions (commonly known as <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Schrems-I</a> and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the <a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" target=\"_blank\">Charter of the Fundamental Rights of the European Union</a>. With this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an <strong>equivalent level of protection</strong> for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a> a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of <a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679 </a> from the EU commission, lately Japan and the case of South Korea is on its on its way (The European Commission has so far recognised <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a> (commercial organisations), <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>, <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a> and <a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a> as providing adequate level of protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give it a green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EU/EEA. To allow data transfer, data exporters are required to process a <strong>transfer impact assessment</strong> to assess the level of protection in the third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus the implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – <strong>supplementary measures</strong> need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be <strong>technical, organisational and/or contractual measures</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Footnote 12 :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>the Parties have to take into <strong>account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information</strong> on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractual Clauses models adopted by the Commission pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a<strong> data mapping</strong> that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We witness the clouds leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' Binding Corporate Rules (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) that can be more appropriate, usually established within a same group. They are also \'<em>approved code of conduct pursuant to <a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> applies \'<em>In the absence of an adequacy decision pursuant to <a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only</em>\' under restrictive conditions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU Commission\'s implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations around its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers <strong>only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</strong></em>\' This is the case when the importer falls within the definition of <strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a3\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a3\" target=\"_blank\">Art 3(2)</a></strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a <strong>Data Processing Agreement </strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a28\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a28\" target=\"_blank\"><strong>Article 28</strong> </a>is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND <strong>judicial redress</strong> (EU courts competence) AND/OR <strong>arbitration</strong> will have to be provided. This is what was lacking with the Privacy Shield, an independent authority and the <strong>ombudsperson</strong> to deal with EU citizens complaints. The EDBP recommendation has not specified the exclusion of importers subject to the GDPR. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data encryption</strong> can help, when the encryption key remain in Europe. That does not solve the problem when data needs to be accessed/processed in the country of import.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden at the bottom of a drawer. The new SCCs require adaptation, and regular assessments. These assessments have to be filed as the DPAs could request to access the logs. They are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Third parties have now the \'<strong>docking option</strong>\' to join the contract. They can be adapted as long as the nature of the clauses are not modified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Emphasised by the Commission\'s document, this will not be easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy. Data subjects have the right to be informed. Is this systematic or at request?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, <strong>data subjects should be provided with a copy </strong>of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><a href=\"https://gdprinfo.info/#a13.1.f\">Article 13(1)(f)</a> and <a href=\"https://gdprinfo.info/#a14.1.f\">Article 14(1)(f)</a></p><p>Obligation of the controller to provide data subjects with information about the fact that it intends to transfer their personal data to a third country or in accordance with pursuant to </p><p><a href=\"https://gdprinfo.info/#a46\">Article 46</a> of <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679\">Regulation (EU) 2016/679</a>,</p><p>such information must include a reference to the appropriate safeguards and the means by which to obtain a copy of them or information where they have been made available</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>The data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p><p>See also</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(b)</td><td><em>The data importer agrees to submit itself to <strong>the jurisdiction</strong> of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.</em></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start as soon as possible with <strong>data mapping</strong>, <strong>data minimising</strong>, and <strong>securing access</strong>. <strong>Hold the data as a hot potato.</strong> Don’t keep it longer than necessary. Keep your <strong>archives</strong> out of the network. Limit access to data. Train your staff. Be ready for data breach that is not anymore IF but WHEN it happens.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never have reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly <strong>data heaven</strong> with the risk of opening backdoors to data transfers to the US. Adequacy decision are to be reviewed after 4 years. Meanwhile, a DPA can challenge the decision based on an individual\'s complaint.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touched at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.lexology.com/library/detail.aspx?g=ed8505f7-4093-4acd-a00a-9a95c53fc9ef\">Portugal – DPA orders suspension</a>- 27 April 2021</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Portuguese DPA investigated complaints against the national statistics institute (INE) for alleged unlawful data transfers. Census data were shared with a third party in the US. The transfer was based on SCCs, but without any supplementary safeguards put in place.The DPA concluded the INE failed to conduct a DPIA prior ti the use of the third party to process a census data (required because of large scale processing of sensitive data) and had not met the requirements for valid data transfers.The transfer of data was suspended both for transfers to the US and to any other country which does not offer an adequate level of data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a rel=\"noreferrer noopener\" href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" data-type=\"URL\" data-id=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" target=\"_blank\" rel=\"noreferrer noopener\">Case Law Digest 2021: Transfers of personal data to third countries</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit. Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies. Each DPA will independently decide upon its areas of action. Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This document does not constitute a legal advice. Simply a fresh analyse of the recent publications.</p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-06-22 22:47:47','2021-06-22 22:47:47','',2054,'https://www.datarainbow.eu/?p=2082',0,'revision','',0),(2089,1,'2022-10-07 09:14:26','2021-07-06 01:18:34','','Webinar: Government by Algorithm A-Level exams self-driving cars and beyond','','publish','closed','closed','','webinar-government-by-algorithm-a-level-exams-self-driving-cars-and-beyond','','','2022-10-07 09:14:26','2022-10-07 09:14:26','',0,'https://www.datarainbow.eu/?p=2089',4,'nav_menu_item','',0),(2086,1,'2021-07-05 14:31:32','2021-07-05 14:31:32','<!-- wp:heading {\"level\":3} -->\n<h3>The Journey to a New Privacy Shield and Who is Leading the Way.</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>A panel discussion moderated by Jacob Høedt Larsen, Head of Communications at Wired Relations, Tara Taubman-Bassirian LLM , Scott Wilson Consultant and Bill Mew, Founder and CEO at Crisis Team will be speaking at a <a href=\"https://www.grcworldforums.com/global/schrems-ii-and-international-data-transfers-the-journey-to-a-new-privacy-shield-and-who-is-leading-the-way/2035.article?adredir=1\" target=\"_blank\" rel=\"noreferrer noopener\">Privsec Webinar Tuesday 22nd of June at 12 BST.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The last few weeks have been extremely busy for privacy specialists. The wait of the <a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\" rel=\"noreferrer noopener\">UK adequacy</a> decision has evidently made many nervous. \'<em><a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/news/en/press-room/20210517IPR04124/data-protection-meps-urge-the-commission-to-amend-uk-adequacy-decisions\" target=\"_blank\">In a resolution passed on Friday</a> (344 votes in favour, 311 against and 28 abstaining), MEPs ask the Commission to modify its draft decisions on whether or not UK data protection is adequate and data can safely be transferred there, bringing them in line with the latest EU court rulings and responding to concerns raised by the European Data Protection Board (EDPB) in its recent&nbsp;<a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/news/2021/edpb-opinions-draft-uk-adequacy-decisions_en\" target=\"_blank\">opinions</a>.</em>\'...\'<em>The EDPB considers that UK bulk access practices, onward transfers and its international agreements need to be clarified further. The resolution states that, if the implementing decisions are adopted without changes, national data protection authorities should suspend transfers of personal data to the UK when indiscriminate access to personal data is possible.</em>\' </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite the Parliament\'s vote and concerns about to bulk data collection and the <strong>Exemptions for national security and immigration</strong>, the <a href=\"https://ec.europa.eu/transparency/comitology-register/screen/documents/074379/1/consult?lang=en\" data-type=\"URL\" data-id=\"https://ec.europa.eu/transparency/comitology-register/screen/documents/074379/1/consult?lang=en\" target=\"_blank\" rel=\"noreferrer noopener\">Comitology committee</a> met and the decision was unanimously voted. An <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" target=\"_blank\">adequacy leaked document</a> has circulated and already <a href=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\" data-type=\"URL\" data-id=\"https://amberhawk.typepad.com/amberhawk/2021/06/adequacy-agreement-for-transfers-from-the-eu-to-the-uk-made-on-friday-unmade-by-sunday.html\">widely commented</a>. <a rel=\"noreferrer noopener\" href=\"https://amberhawk.typepad.com/amberhawk/2021/06/tigrr-eeyore-and-pooh-bear-decide-to-destroy-the-gdpr.html\" target=\"_blank\">The TIGRR document</a> announcing the desire by the UK conservatives to depart from the GDPR for a more \'pro-business\', data heaven approach did not affect EU Commission\'s to grant <a rel=\"noreferrer noopener\" href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" data-type=\"URL\" data-id=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_21_661\" target=\"_blank\">UK adequacy</a>. Or at least, not yet. The <a href=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" data-type=\"URL\" data-id=\"https://www.technologylawdispatch.com/2021/05/privacy-data-protection/ico-announces-it-is-working-on-bespoke-uk-set-of-standard-contractual-clauses/\" target=\"_blank\" rel=\"noreferrer noopener\">UK ICO is to publish a new set of Standard Contractual Clauses</a>. The Commission\'s SCCs will not apply to the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Eventually, on 18 June 2021 the Commission adopted the <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">new Standard Contractual Clauses</a> long awaited, for transfers of personal data to third countries as the GDPR prohibits the transfer of personal data to a country outside the EU unless the third country has been deemed adequate by the European Commission or one of the prescribed transfer mechanisms are in place. The role of the standard contractual clauses is limited to ensuring appropriate data protection safeguards for international data transfers. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Today, the <a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/edpb_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/edpb_en\" target=\"_blank\">EDPB</a> adopted its<a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074/item373498541\" target=\"_blank\"> Recommendations 01/2020</a> on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data - Version 2.0.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Just a short background reminder :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Since Edward Snowden’s revelations on the NSA surveillance</a>, the general public has been made more aware of the US intelligence laws intercepting and monitoring EU citizens data (FISA section 702, EO 12333, US Cloud Act). The General Data Protection Regulation (GDPR) that entered into for on May 2018, offers a higher level of protection, regardless or the nationality of the data subjects. That includes strong data subjects rights- in principle- enforced by supervisory authorities as well as a right to judicial redress guaranteed by <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a82\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a82\" target=\"_blank\">Art 82 GDPR</a>. However, we are still to see <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/non-material-damage/id40847925\" target=\"_blank\">non-material damages</a> granted as the mere fact of non compliance with the GDPR has been deemed insufficient by European national jurisdictions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If GDPR aims to facilitate the free flow of personal data within the EU/EEA (EEA, the 27 countries of the European Union plus Iceland, Liechtenstein and Norway), the flow of data outside the EU is prohibited unless measures of protection are in place. As a result of the privacy activist, Max Schrems - long hale legal actions, we saw the US <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Safe Harbour agreement</a> then the <a rel=\"noreferrer noopener\" href=\"http://datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/(opens in a new tab)\" target=\"_blank\">Privacy Shield</a> being invalidated by the European Court of Justice decisions (commonly known as <a rel=\"noreferrer noopener\" href=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" data-type=\"URL\" data-id=\"https://curia.europa.eu/jcms/upload/docs/application/pdf/2020-07/cp200091en.pdf\" target=\"_blank\">Schrems-I</a> and <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II)</a> based on the European Union regulation, read in the light of the <a rel=\"noreferrer noopener\" href=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" data-type=\"URL\" data-id=\"https://www.europarl.europa.eu/charter/pdf/text_en.pdf\" target=\"_blank\">Charter of the Fundamental Rights of the European Union</a>. With this regard, data collected or processed in the EU should not be transferred to countries of non adequate data protection, including the U.S.A (Article 46 GDPR).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a way, <a rel=\"noreferrer noopener\" href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" data-type=\"URL\" data-id=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\" target=\"_blank\">Schrems-II</a> decision, requiring an <strong>equivalent level of protection</strong> for data exported outside the EU/EEA, the decision has established a sort of bubble of protection around the data that should be maintained even when the data is exported outside the EU (<a href=\"https://gdprinfo.info/#a45.3\">Art 45-3 </a> a controller or processor may transfer personal data to a third country only if it has provided appropriate safeguards, and on the condition that enforceable rights and effective legal remedies for data subjects are available).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Several countries have received an adequacy decision on the basis of <a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a45\" target=\"_blank\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a45\">article 45</a> of&nbsp;<a rel=\"noreferrer noopener\" href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv%3AOJ.L_.2016.119.01.0001.01.ENG&amp;toc=OJ%3AL%3A2016%3A119%3ATOC\" target=\"_blank\">Regulation (EU) 2016/679&nbsp;</a> from the EU commission, lately Japan and the case of South Korea is on its on its way (The European Commission has so far recognised&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32010D0625\" target=\"_blank\">Andorra</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0490\" target=\"_blank\">Argentina</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32002D0002\" target=\"_blank\">Canada</a>&nbsp;(commercial organisations),&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/en/ALL/?uri=CELEX%3A32010D0146\" target=\"_blank\">Faroe Islands</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32003D0821\" target=\"_blank\">Guernsey</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32011D0061\" target=\"_blank\">Israel</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0411\" target=\"_blank\">Isle of Man</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=uriserv:OJ.L_.2019.076.01.0001.01.ENG&amp;toc=OJ:L:2019:076:TOC\" target=\"_blank\">Japan</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32008D0393\" target=\"_blank\">Jersey</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=CELEX%3A32013D0065\" target=\"_blank\">New Zealand</a>,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32000D0518\" target=\"_blank\">Switzerland</a>&nbsp;and&nbsp;<a rel=\"noreferrer noopener\" href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32012D0484\" target=\"_blank\">Uruguay</a>&nbsp;as providing adequate level of protection). In the case of the U.S.A., the EU commission had reviewed the Privacy Shield to give it a green light. That was not an opinion shared by the ECJ that invalidated the Privacy Shield in July 2020 with immediate effect. The Court however, said other measures of supplementary safeguard were needed to guarantee the same level of standard of data protection. In principal however, the court said Standard Contractual Clauses and <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/bcr/id42270103\" target=\"_blank\">Binding Corporate Rules </a>remained valid when supplemented with appropriate measures, in the context of massive data flow between the US and the EU/EEA. To allow data transfer, data exporters are required to process a <strong>transfer impact assessment</strong> to assess the level of protection in the third country. In a way, data exporters are required to do what the commission had failed. A case by case analysis of the protection offered by the country of the data importer plus the implementation of appropriate supplementary measures of safeguard when there are indications that legislation may impinge on the fundamental rights and freedoms of data subjects in Europe – for instance when there is a potential risk of government access or surveillance legislation – <strong>supplementary measures</strong> need to be put in place by the data importer in the third country to protect the personal data coming from Europe. These can be <strong>technical, organisational and/or contractual measures</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Footnote 12 :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>the Parties have to take into <strong>account whether their practical experience is corroborated and not contradicted by publicly available or otherwise accessible, reliable information</strong> on the existence or absence of requests within the same sector and/or the application of the law in practice, such as case law and reports by independent oversight bodies.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Standard Contractual Clauses models adopted by the Commission pre-dated the GDPR and needed some refreshment. So the new SCCs finally published by the Commission were greatly welcomed. The risk assessment operation should begin with a<strong> data mapping</strong> that was anyway required for GDPR compliance. Knowing where the data is and what data is hold. Minimising the data, making sure data is accurate, limiting access to data, especially securing the data in this terrific context of cyberattacks and ransomware pandemics. We witness the clouds leaking, data raining like dogs and cats. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As touched above, SCCs are not the only tool available. \'<em>In the absence of a decision pursuant to&nbsp;<a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.</em>\' \'<em>The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by</em>\' Binding Corporate Rules (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a47\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a47\" target=\"_blank\">Article 47</a>) that can be more appropriate, usually established within a same group. They are also \'<em>approved code of conduct pursuant to&nbsp;<a href=\"https://www.gdprinfo.info/#a40\">Article 40</a></em>\' or Code of Conducts (<a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a46\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a46\" target=\"_blank\">Article 46</a>). However, not many have yet been adopted. The French supervisory Authority, the CNIL, recently approved a code of conduct for <a rel=\"noreferrer noopener\" href=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" data-type=\"URL\" data-id=\"https://www.lexology.com/library/detail.aspx?g=9ed9aa69-9f32-40c2-88bb-dd6e1bb381bd\" target=\"_blank\">cloud infrastructure</a>s.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p id=\"a49\"><strong>Article 49 -Derogations for specific situations</strong> applies \'<em>In the absence of an adequacy decision pursuant to&nbsp;<a href=\"https://www.gdprinfo.info/#a45.3\">Article 45(3)</a>, or of appropriate safeguards pursuant to Article 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an international organisation shall take place only</em>\' under restrictive conditions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The newly published EU Commission\'s implementing decision on <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/new-scc/id36643203\" target=\"_blank\">SCC</a>s has caused many interrogations around its <strong>Recital 7</strong> \'<em>The standard contractual clauses may be used for such transfers <strong>only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679.</strong></em>\' This is the case when the importer falls within the definition of <strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a3\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a3\" target=\"_blank\">Art 3(2)</a></strong> long arm of the GDPR scope. When the organisation is targeting or selling goods and services to the EU, a <strong>Data Processing Agreement </strong><a rel=\"noreferrer noopener\" href=\"https://www.gdprinfo.info/#a28\" data-type=\"URL\" data-id=\"https://www.gdprinfo.info/#a28\" target=\"_blank\"><strong>Article 28</strong> </a>is required. In order to protect the data transfer supplementary measures of safeguard adapted in a case by case biases to the country of import AND <strong>judicial redress</strong> (EU courts competence) AND/OR <strong>arbitration</strong> will have to be provided. This is what was lacking with the Privacy Shield, an independent authority and the <strong>ombudsperson</strong> to deal with EU citizens complaints. The EDBP recommendation has not specified the exclusion of importers subject to the GDPR. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data localisation</strong>, recommended by some professionals, cannot be the escape solution as data is considered transferred as long as it can be accessed. As the EDPB notes, <em>\'remote access from a third country... and/or storage in a cloud situated outside the EEA offered by a service provider, is also considered to be a transfer. Are you using a third party using US cloud? That means transferring outside the EEA to US</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data encryption</strong> can help, when the encryption key remain in Europe. That does not solve the problem when data needs to be accessed/processed in the country of import.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The European Data Protection board recommendations in 6 steps :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em><strong>Step 1-</strong> the EDPB advises you, exporters, to know your transfers. <strong>Mapping</strong> all transfers of personal data to third countries</em></li><li><em><strong>Step 2 -</strong> verify the <strong>transfer tool</strong> your transfer relies on, amongst those listed under Chapter V GDPR.</em></li><li><em><strong>Step 3-</strong> <strong>Assess</strong> if there is anything in the law and/or practices in force of the third country that may impinge on the effectiveness of the appropriate safeguards of the transfer tools you are relying on,</em></li><li><em><strong>Step 4-</strong> Identify and adopt <strong>supplementary measures</strong> that are necessary to bring the level of protection of the data transferred up to the EU standard of essential equivalence</em></li><li><em><strong>Step 5</strong>- take any formal procedural steps the adoption of your <strong>supplementary measure</strong> may require, depending on the <strong>Article 46 GDPR</strong> transfer tool you are relying on.</em></li><li><em><strong>Step 6 Final -</strong> <strong>re-evaluate at appropriate intervals</strong> the level of protection afforded to the personal data you transfer to third countries and to monitor if there have been or there will be any Adopted 5 developments that may affect it. The principle of accountability requires continuous vigilance of the level of protection of personal data.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>SCCs Modular approach :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations transferring personal data to third countries are “<em>free to include those standard contractual clauses in a wider contract and to add other clauses or additional safeguards, provided that they do not contradict the standard contractual clauses or prejudice the rights or freedoms of data subjects</em>”.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>SCCs used to be a one of signed document hidden at the bottom of a drawer. The new SCCs require adaptation, and regular assessments. These assessments have to be filed as the DPAs could request to access the logs. They are four modules. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>MODULE ONE: Transfer controller to controller</strong></li><li><strong>MODULE TWO: Transfer controller to processor</strong></li><li><strong>MODULE THREE: Transfer processor to processor</strong></li><li><strong>MODULE FOUR : Transfer processor to controller</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Third parties have now the \'<strong>docking option</strong>\' to join the contract. They can be adapted as long as the nature of the clauses are not modified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Obligation of information and transparency</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Emphasised by the Commission\'s document, this will not be easy to implement by data importers who are not necessarily aware of the information provided at the time of the collect of data, unless they have access to the exporter\'s privacy policy. Data subjects have the right to be informed. Is this systematic or at request?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>With a view to ensuring <strong>transparency</strong> of processing, <strong>data subjects should be provided with a copy </strong>of the standard contractual clauses and <strong>be informed</strong>, in particular, of the categories of personal data processed, the right to obtain a <strong>copy of the standard contractual clauses</strong>, and any onward transfer. Onward transfers by the data importer to a third party in another third country should be allowed only if the third party accedes to the standard.</em></p><p><em>With some exceptions, in particular as regards certain obligations that exclusively concern the relationship between the data exporter and data importer, <strong>data subjects</strong> should be able to invoke, and where necessary <strong>enforce</strong>, the standard contractual clauses as third-party beneficiaries.</em></p><p><em>while the parties should be allowed to choose the law of one of the Member States as governing the standard contractual clauses, that law must allow for third-party beneficiary rights.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><a href=\"https://gdprinfo.info/#a13.1.f\">Article 13(1)(f)</a> and <a href=\"https://gdprinfo.info/#a14.1.f\">Article 14(1)(f)</a></p><p>Obligation of the controller to provide data subjects with information about the fact that it intends to transfer their personal data to a third country or in accordance with pursuant to </p><p><a href=\"https://gdprinfo.info/#a46\">Article 46</a> of <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679\">Regulation (EU) 2016/679</a>,</p><p>such information must include a reference to the appropriate safeguards and the means by which to obtain a copy of them or information where they have been made available</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Individual redress :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In order to facilitate individual redress, the standard contractual clauses should require the data importer to inform data subjects of a <strong>contact point</strong> and deal promptly with any complaints or requests.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>EU courts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:group -->\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container\"><!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The data subject should be able to lodge a <strong>complaint</strong> with the competent supervisory authority or refer the <strong>dispute to the competent courts in the EU</strong>.</em></p><p><em>The data importer should agree to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures.</em></p><p>See also</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td>(b)</td><td><em>The data importer agrees to submit itself to <strong>the jurisdiction</strong> of and cooperate with the competent supervisory authority in any procedures aimed at ensuring compliance with these Clauses. In particular, the data importer agrees to respond to enquiries, submit to audits and comply with the measures adopted by the supervisory authority, including remedial and compensatory measures. It shall provide the supervisory authority with written confirmation that the necessary actions have been taken.</em></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph --></div></div>\n<!-- /wp:group -->\n\n<!-- wp:paragraph -->\n<p><strong>ADR :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>In addition, the data importer should have the option of offering data subjects the opportunity to <strong>seek redress before an independent dispute resolution body</strong>, at no cost. In line with Article 80(1) of Regulation (EU) 2016/679, data subjects should be allowed to <strong>be represented by associations</strong> or other bodies in disputes against the data importer if they so wish</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Time scale :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>Organisations will have 18 months and 20 days to replace their current SCCs (See para 24 and article 4 in the implementing decision). This is for the organisation who have already SCCs in place. </p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>My advice, as always, is to start as soon as possible with <strong>data mapping</strong>, <strong>data minimising</strong>, and <strong>securing access</strong>. <strong>Hold the data as a hot potato.</strong> Don’t keep it longer than necessary. Keep your <strong>archives</strong> out of the network. Limit access to data. Train your staff. Be ready for data breach that is not anymore IF but WHEN it happens.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe the new Biden administration will keep its promise to finalise a new agreement with a change of the US legislation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This part is more political and diplomacy than legal. From a strictly legal point of view, UK should never have reached adequacy, especially after the negative vote of the Parliament and the TIGRR plans to depart from the GDPR to make the UK a more business friendly <strong>data heaven</strong> with the risk of opening backdoors to data transfers to the US. Adequacy decision are to be reviewed after 4 years. Meanwhile, a DPA can challenge the decision based on an individual\'s complaint.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EDPB specifically touched at this point : \'<em>However, adequacy decisions do not prevent data subjects from filing a complaint. Nor do they prevent supervisory authorities from bringing a case before a national court if they have doubts about the validity of a decision, so that a national court can make a reference</em>\'.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>These negotiations underscore our shared commitment to privacy, data protection and the rule of law and our mutual recognition of the importance of transatlantic data flows to our respective citizens, economies, and societies</em>,” U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders said in the statement released by the U.S. Commerce Department.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>A quick look to the EU national courts decision dealing with data transfers complaints :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" data-type=\"URL\" data-id=\"https://edpb.europa.eu/news/national-news/2021/bavarian-dpa-baylda-calls-german-company-cease-use-mailchimp-tool_en\" target=\"_blank\">The Bavarian court ruled that MailChimp</a> use of email addresses resulting on data transfer to the US created risks of interception and therefore the transfer is unlawful.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" data-type=\"URL\" data-id=\"https://www.pearltrees.com/datarainbow/case-law-suite/id39692843#item373441819\" target=\"_blank\" rel=\"noreferrer noopener\">A Germain court</a> ruled an employee asking compensation from his employer for sending his data for HR processing to the US had not grant for damage.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" data-type=\"URL\" data-id=\"https://www.cnil.fr/fr/le-conseil-detat-demande-au-health-data-hub-des-garanties-supplementaires\" target=\"_blank\">French Highest Administrative Court, Conseil d\'Etat</a>, was called by privacy organisations to rule against the processing of medical data DataHub by Microsoft transferring data to the US. The CNIL observations based on the unlawful transfer of data accessible as long as the data was stored on Microsoft servers even when the servers are based in EUROPE, recommended to allow a transitory period until a solution is found. Possibly by introducing an intermediary organisation to anonymised the data. The Conseil d\'Etat in an interim decision gave an injunction to Microsoft to add an addendum to its contract to offer stronger guarantees.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" data-type=\"URL\" data-id=\"https://www.fasken.com/fr/knowledge/2021/05/13-schrems-ii-and-transfers-of-personal-information\" target=\"_blank\">French Highest Administrative Court Conseil d\'Etat</a>, had another preliminary judgement case, in the context of the pandemic with a website Doctolib used as a platform of COVID vaccination appointments using Amazon AWS cloud storage. The CE referring to the Schrems II decision, reminded that before implementing a transfer of personal information with appropriate guarantees, it is necessary to ensure that \"the rights of persons whose personal data personnel are transferred to a third country on the basis of standard data protection clauses benefit from a level of protection substantially equivalent to that guaranteed within the European Union ”. To assess this level of protection, it is in particular necessary to take into account, continues the highest administrative court, (i) the contractual stipulations agreed between the exporter of personal information and the recipient of the transfer established in the third country concerned and (ii ) with regard to possible access by the public authorities of that third country to the personal information thus transferred, the relevant elements of the legal system of the country of destination. After consideration, the CE ruled that the partnership between the French State and Doctolib does not seriously and manifestly unlawful interference with the right to respect for private life and the right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.lexology.com/library/detail.aspx?g=ed8505f7-4093-4acd-a00a-9a95c53fc9ef\">Portugal – DPA orders suspension</a>- 27 April 2021</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Portuguese DPA investigated complaints against the national statistics institute (INE) for alleged unlawful data transfers. Census data were shared with a third party in the US. The transfer was based on SCCs, but without any supplementary safeguards put in place.The DPA concluded the INE failed to conduct a DPIA prior ti the use of the third party to process a census data (required because of large scale processing of sensitive data) and had not met the requirements for valid data transfers.The transfer of data was suspended both for transfers to the US and to any other country which does not offer an adequate level of data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Max Schrem\'s NGO, <a rel=\"noreferrer noopener\" href=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" data-type=\"URL\" data-id=\"https://noyb.eu/en/update-noybs-101-complaints-eu-us-data-transfers\" target=\"_blank\">NOYB has filed 101 complaints</a> including against Google and Google Analytics, Facebook Connect for unlawful data transfers to the US.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" data-type=\"URL\" data-id=\"https://edps.europa.eu/data-protection/our-work/publications/court-cases/case-law-digest-2021-transfers-personal-data_en\" target=\"_blank\" rel=\"noreferrer noopener\">Case Law Digest 2021: Transfers of personal data to third countries</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was <a href=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" data-type=\"URL\" data-id=\"https://www.datenschutz.rlp.de/de/aktuelles/detail/news/detail/News/koordinierte-pruefung-internationaler-datentransfers/\" target=\"_blank\" rel=\"noreferrer noopener\">recently reported </a>that <a href=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/taubmanbassirian_questionnaire-schrems-ii-activity-6805454331547021312-AzJs/\" target=\"_blank\" rel=\"noreferrer noopener\">German DPAs</a> are investigating international data transfers, as a part of a cross-border audit.&nbsp;Aiming to enforce the requirements of the Schrems II decision by the European Court of Justice (Case C-311/18), they have developed <a href=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" data-type=\"URL\" data-id=\"https://www.linkedin.com/posts/piracybydesign_dpa-hamburg-questionnaire-o365-schrems-activity-6768150743410065408-EGTg\" target=\"_blank\" rel=\"noreferrer noopener\">coordinated questionnaires</a>, based on which they will be reaching out to companies.&nbsp;Each DPA will independently decide upon its areas of action.&nbsp;Among the latter, they will be assessing (i) the use of email, web tracking and website hosting service providers, (ii) managing applicant data and (ii) intragroup transfers of customer and employee data.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Worth mentioning the issue of transfer of EU data to countries of non adequate data protection is not limited to the US. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://Schrems II and International Data Transfers: The Journey to a new Privacy Shield and Who Is Leading the Way\" target=\"_blank\" rel=\"noreferrer noopener\">Schrems II and International Data Transfers: The Journey to a new Privacy Shield and Who Is Leading the Way available on demand.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This document does not constitute a legal advice. Simply a fresh analyse of the recent publications.</p>\n<!-- /wp:paragraph -->','Schrems-II and International data transfers','','inherit','closed','closed','','2054-revision-v1','','','2021-07-05 14:31:32','2021-07-05 14:31:32','',2054,'https://www.datarainbow.eu/?p=2086',0,'revision','',0),(2309,1,'2022-10-07 09:14:26','2021-10-07 16:50:10','','Holyrood','','publish','closed','closed','','holyrood','','','2022-10-07 09:14:26','2022-10-07 09:14:26','',0,'https://www.datarainbow.eu/?p=2309',27,'nav_menu_item','',0),(2088,1,'2022-10-07 09:14:26','2021-07-05 23:59:19','','GDPR 3 years on','','publish','closed','closed','','gdpr-3-years-on','','','2022-10-07 09:14:26','2022-10-07 09:14:26','',0,'https://www.datarainbow.eu/?p=2088',28,'nav_menu_item','',0),(2117,1,'2021-07-08 16:07:04','2021-07-08 16:07:04','<!-- wp:list -->\n<ul><li>Co-written article published by the International Association of Privacy Practionners IAPP, Tara Taubman-Bassirian and Luis Alberto Montezuma <a rel=\"noreferrer noopener\" href=\"https://iapp.org/news/a/how-to-avoid-consent-fatigue/\" target=\"_blank\">\'How to avoid consent fatigue\'</a>.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Co-written with <a rel=\"noreferrer noopener\" href=\"https://www.researchgate.net/profile/Christine-Hilcenko\" target=\"_blank\">Dr Christine Hilcenko</a>, researcher at Cambridge UNIVERSITY, <a href=\"https://www.researchgate.net/publication/336521481_Privacy_Education_and_Human_Dignity\">Privacy, Education and Human Dignity</a>, also published by <a rel=\"noreferrer noopener\" href=\"https://www.ceeol.com/search/article-detail?id=801144\" target=\"_blank\">Wydawnictwo Oświatowe FOSZE</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li>Guest writter Tara Taubman-Bassirian in <a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/topic/tara-taubman-barissian/\" target=\"_blank\">ITSecurity</a> :</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">GDPR Material and Territorial Scopes</a><ul><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Still in Denial of the Tough New Privacy Law GDPR?</a></li></ul><ul><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Private Company CONCENTRIX Acting on Belhaf of HMRC</a></li></ul><ul><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">The New Data Protection Regulation Has Been Adopted</a></li></ul><ul><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Apple Stands To Defend Customer’s Privacy</a></li></ul><ul><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">ECJ Says Safe Harbor Is Not So Safe</a></li></ul><ul><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Ashley Madison Site Has Been Hacked And Why Should It Matter?</a></li></ul><ul><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">The Right To Be Forgotten – EU and Elsewhere</a></li></ul><ul><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Looking For The Worm in the Apple Watch?</a></li></ul><ul><li><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2018/02/gdpr-material-territorial-scopes/\" target=\"_blank\">Internet Law And Privacy</a> </li></ul></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Research written for <a rel=\"noreferrer noopener\" href=\"https://www.cutter.com/\" target=\"_blank\">Cutter Consortium</a> : <a href=\"https://www.cutter.com/article/geolocation-and-privacy-part-i-wide-choices-legal-issues-436731\" target=\"_blank\" rel=\"noreferrer noopener\">Geolocation and Privacy: Part I -- Wide Choices, Legal Issues</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Co-written research paper for the European Union Cybersecurity Agency ENISA <a rel=\"noreferrer noopener\" href=\"https://www.enisa.europa.eu/publications/archive/onlineasithappens\" target=\"_blank\">\'Online as soon as it happens (EN)\'</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Published by Global Voices \'<a rel=\"noreferrer noopener\" href=\"https://advox.globalvoices.org/2010/04/05/hhadopi-acta-digital-economy-bill-problematic-regulatory-responses/\" target=\"_blank\">HADOPI, ACTA, Digital Economy Bill: From Human Rights to Economic Rights</a>\' and translated by <a rel=\"noreferrer noopener\" href=\"https://pt.globalvoices.org/author/joaomiguel/\" target=\"_blank\">João Miguel Lima</a> in Portuguese <a rel=\"noreferrer noopener\" href=\"https://pt.globalvoices.org/2010/05/14/hadopi-acta-declaracao-da-economia-digital-dos-direitos-humanos-aos-direitos-economicos/\" target=\"_blank\">HADOPI, ACTA, Declaração da Economia Digital: dos Direitos Humanos aos Direitos Econômicos</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Published in Linkedin :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/les-professionnels-du-droit-lere-numerique-tara-taubman-bassirian-llm/\" target=\"_blank\">Les Professionnels du Droit à l\'Ère du Numérique</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/lawyer-cloud-act-quel-pour-les-cabinets-davocats-tara/\" target=\"_blank\">Lawyer Cloud Act : Quel Cloud Pour Les Cabinets d\'Avocats ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/lensauvagement-vu-par-lavokayon-tara-taubman-bassirian-llm/\" target=\"_blank\">L\'Ensauvagement Vu Par l\'Avokayon</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/how-understand-ofqual-ai-predicting-a-levels-debacle-tara-1f/\" target=\"_blank\">How To Understand the Ofqual AI Predicting A-Levels Debacle</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/schrems-ii-invalidation-privacy-shield-ecj-tara-taubman-bassirian-llm/\" target=\"_blank\">Schrems II Invalidation of the Privacy Shield by the ECJ</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/effective-gdpr-enforcement-tara-taubman-bassirian-llm/?published=t\" target=\"_blank\">An Alternative Proposition for A More Effective GDPR Enforcement</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/stop-covid-combattre-la-pand%C3%A9mie-sans-infecter-taubman-bassirian-llm/\" target=\"_blank\">STOP-COVID COMBATTRE LA PANDÉMIE SANS INFECTER LA DÉMOCRATIE</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/zoom-videoconferencing-privacy-liability-tara-taubman-bassirian-llm/\" target=\"_blank\">ZOOM VIDEOCONFERENCING PRIVACY AND LIABILITY</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/zooms-privacy-security-concerns-wake-up-call-gdpr-tara/\" target=\"_blank\">Zoom\'s Privacy and Security Concerns Is A Wake Up Call for GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/consider-personal-data-hot-potato-tara-taubman-bassirian-llm/\" target=\"_blank\">Consider Personal Data as a Hot Potato</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/french-court-said-facial-recognition-technology-tara/\" target=\"_blank\">French Court Said NO To Facial Recognition Technology</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/facial-recognition-technologies-tara-taubman-bassirian-llm/\" target=\"_blank\">FACIAL RECOGNITION TECHNOLOGIES</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/privay-glance-tara-taubman-bassirian-llm/\" target=\"_blank\">Privacy at a Glance</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/pourquoi-le-respect-de-la-vie-privee-est-important-tara/?published=t\" target=\"_blank\">POURQUOI LE RESPECT DE LA VIE PRIVEE EST IMPERATIF</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/uk-watchdog-investigation-british-airways-marriott-tara/\" target=\"_blank\">UK WATCHDOG INVESTIGATION OF BRITISH AIRWAYS AND MARRIOTT HOTELS SECURITY BREACHES</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/consent-direct-marketing-tara-taubman-bassirian-llm/\" target=\"_blank\">Consent and Direct Marketing</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/facebook-saga-tara-taubman-bassirian-llm/\" target=\"_blank\">Facebook Saga</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/happy-valentines-day-privacy-lovers-tara-taubman-bassirian-llm/\" target=\"_blank\">HAPPY VALENTINES DAY PRIVACY LOVERS</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/how-understand-gdpr-legitimate-interest-tara-taubman-bassirian-llm/\" target=\"_blank\">How to Understand the GDPR Legitimate Interest</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/google-subject-biggest-fine-under-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\">Google Subject to the Biggest Fine Under GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/2019-gdpr-privacy-best-wishes-tara-taubman-bassirian-llm/\" target=\"_blank\">2019 GDPR and Privacy Best Wishes</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/website-transparency-cookies-privacy-notice-taubman-bassirian-llm/\" target=\"_blank\">Website Transparency : Cookies and Privacy Notice</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/six-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\">CNIL - Six months of GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/cnil-published-first-review-6-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\">CNIL Published a First Review : 6 Months of the GDPR</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/privacy-design-tara-taubman-bassirian-llm/\" target=\"_blank\">Privacy And Design</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/memory-forgetfulness-privacy-tara-taubman-bassirian-llm/\" target=\"_blank\">Memory, Forgetfulness and Privacy</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/after-canada-airlines-here-comes-british-airways-tara/\" target=\"_blank\">After Air Canada Breach Here Comes British Airways</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/facebook-fan-page-ecj-ruling-tara-taubman-bassirian-llm/\" target=\"_blank\">The Facebook Fan Page ECJ ruling</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/consenting-consent-needs-tara-taubman-bassirian-llm/\" target=\"_blank\">Consenting to Consent Needs Consent?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/gdpr-shooting-messenger-tara-taubman-bassirian-llm/\" target=\"_blank\">GDPR Is Not Shooting The Messenger</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/gdpr-material-territorial-scopes-tara-taubman-bassirian-llm/\" target=\"_blank\">GDPR Material and Territorial Scopes</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/round-up-privacy-data-protection-news-tara-taubman-bassirian-llm/\" target=\"_blank\">Round up of Privacy and Data Protection News</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/end-unsollicited-emails-tara-taubman-bassirian-llm/\" target=\"_blank\">The End Of Unsollicited Emails?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/facebook-fan-page-ecj-ruling-tara-taubman-bassirian-llm/\" target=\"_blank\">The Facebook Fan Page ECJ Ruling</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/keeping-eye-tara-taubman-bassirian-llm/\" target=\"_blank\">Keeping an Eye</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/\" target=\"_blank\">Law Firm Internet Security and Data Protection</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\" target=\"_blank\">Life Under Digits</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/privacy-experts-need-career-path-tara-taubman-bassirian/\" target=\"_blank\">Privacy Experts in Need of Career Path</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/united-airlines-bad-shape-tara-taubman-bassirian-llm/\" target=\"_blank\">United Airlines In Bad Shape</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/challenges-artificial-intelligence-france-tara-taubman-bassirian-llm/\" target=\"_blank\">France Initiatives to Tackle the Challenges of Artificial Intelligence</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/\" target=\"_blank\">All You Need to Know About GDPR Compliance</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/jacqueline-sauvage-tara-taubman-bassirian/\" target=\"_blank\">Jacqueline Sauvage</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/drones-autonomus-cars-ethics-regulation-tara-taubman-bassirian/\" target=\"_blank\">Drones, Autonomus Cars, Ethics and Regulation.</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/video-surveillance-technology-tara-taubman-bassirian/\" target=\"_blank\">Wearable Cameras</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/police-3d-printed-murder-victims-finger-unlock-his-taubman-bassirian/\" target=\"_blank\">Police 3D-Printed a murder victim\'s finger to unlock his phone</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/private-company-concentrix-acting-belhaf-hmrc-raising-tara/\" target=\"_blank\">Private Company Concentrix Acting on Behalf of HMRC raising a Number of Issues</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/periscope-est-en-deuil-tara-taubman-bassirian/\" target=\"_blank\">Periscope est en deuil</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/navigating-new-eu-data-protection-rules-tara-taubman-bassirian/\" target=\"_blank\">Navigating the new EU Data Protection Rules</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/why-should-we-all-care-panamapapers-tara-taubman-bassirian/\" target=\"_blank\">Why Should We All Care About PanamaPapers ?</a></li><li><a href=\"https://www.linkedin.com/pulse/copyright-claim-deny-freedom-speech-tara-taubman-bassirian/\" data-type=\"URL\" data-id=\"https://www.linkedin.com/pulse/copyright-claim-deny-freedom-speech-tara-taubman-bassirian/\">Copyright Claim to Deny Freedom of Speech</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/welcoming-human-beings-remains-duty-tara-taubman-bassirian/\" target=\"_blank\">Welcoming Human Beings Remains a Duty</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/accueillir-les-immigr%C3%A9s-reste-un-devoir-tara-taubman-bassirian/\" target=\"_blank\">Accueillir les immigrés reste un devoir</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/right-education-tara-taubman-bassirian/\" target=\"_blank\">The Right to Education for the Right Education</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/apple-fbi-battle-security-v-privacy-tara-taubman-bassirian/\" target=\"_blank\">Apple-FBI battle of Privacy v Security</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/periscope-lawyers-tara-taubman-bassirian/\" target=\"_blank\">Periscope For Lawyers ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/periscope-tara-taubman-bassirian/\" target=\"_blank\">Periscope or not ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/ecj-says-safe-harbor-so-tara-taubman-bassirian/\" target=\"_blank\">ECJ Says Safe Harbor Is Not So Safe</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/right-forgotten-censorship-tara-taubman-bassirian/\" target=\"_blank\">The Right to be Forgotten is no Censorship</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/bigger-than-big-data-processed-information-gold-taubman-bassirian/\" target=\"_blank\">Bigger Than Big Data, Processed Information is Gold</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/20141115151647-19096867-teaching-the-skills-for-life-compassion-and-empathy/?published=t\" target=\"_blank\">Teaching The Skills For Life, Compassion And Empathy</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/20141019172647-19096867-how-an-online-negative-comment-can-be-positively-exploited/\" target=\"_blank\">How an Online Negative Review Can Be Positively Exploited</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/20140816204805-19096867-cadeau/?published=t\" target=\"_blank\">Boyhood You Said? It Was Just Motherhood That I Saw</a></li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/20140814210844-19096867-any-hope-for-a-universal-language/?published=t\" target=\"_blank\">Any Hope For a Universal Language ?</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Elsewhere on the net :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2015/06/09/the-future-of-the-digital-music/\" target=\"_blank\">The Future of the Digital&nbsp;Music</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2015/02/22/law-enforcement-and-internet-jurisdiction/\" target=\"_blank\">Law Enforcement and Internet&nbsp;Jurisdiction</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2015/02/17/to-be-or-not-to-be-anonymous-anonymyity-in-the-age-of-big-and-open-data/\" target=\"_blank\">To be or not to be (anonymous)? Anonymity in the age of big and open&nbsp;data</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2015/01/23/catching-up-with-the-annual-cdpd-conference-in-brussels/\" target=\"_blank\">Catching up with the annual CPDP conference in&nbsp;Brussels</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2014/03/01/copyright-confusion-is-madness/\" target=\"_blank\">Copyright Confusion is&nbsp;Madness</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/12/06/to-nelson-mandela-and-all-brave-men-of-his-kind/\" target=\"_blank\">To Nelson Mandela and all brave men of his&nbsp;kind</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/02/20/the-ecommerce-directive-a-shield-for-isps-or-a-stick-with-which-they-may-be-beaten/\" target=\"_blank\">The eCommerce Directive: A shield for ISPs…. Or a stick with which they may be&nbsp;beaten ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/02/06/the-interests-of-authors-february-6-700-p-m-est/\" target=\"_blank\">The Interests of Authors, February 6, 7:00 p.m.&nbsp;EST</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/01/31/the-copyright-maddness-inflames-the-relationship-between-us-and-antiguabarbuda/\" target=\"_blank\">The Copyright madness inflames the relationship between US and&nbsp;Antigua/Barbuda</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.wordpress.com/2013/01/19/humanity-connected-is-god/\" target=\"_blank\">Humanity Connected is&nbsp;God ?</a></li><li><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.blogspot.com/2010/03/what-week-weak-copyright.html\" target=\"_blank\">What a week! A weak copyright ! </a></li><li><a href=\"https://clarinettesblog.blogspot.com/2010/02/jeff-jarvis-tought-me-iomega-sucks.html\">jeff Jarvis tought me iomega sucks</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2010/01/la-lecture-de-larticle-de-yann-leroux.html\">Des yeux dans le bac a sable, paranoia ou realite. A la recherche d\'un consentement avise</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2010/01/why-should-we-all-pay-for-music.html\">Why should we all pay for the Music Industry ?</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2009/12/loi-hadopi-1-2-3.html\">Loi Hadopi 1 + 2 = 3 ?</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2009/07/amazon-burns-orwells-e-books.html\">Amazon Burns Orwell\'s E-Books</a></li><li><strong><a rel=\"noreferrer noopener\" href=\"https://clarinettesblog.blogspot.com/search?updated-max=2009-12-15T13:32:00-08:00&amp;max-results=7&amp;start=7&amp;by-date=false\" target=\"_blank\">IP Addresses and User Privacy</a></strong></li><li>T<a href=\"https://clarinettesblog.blogspot.com/2009/07/technical-explanations-on-hadopi-or-law.html\">echnical explanations on HADOPI or a law in agony</a></li><li><a href=\"https://clarinettesblog.blogspot.com/2009/05/twitter-suspended-my-account.html\">Twitter suspended my account!!!</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ....</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Who created DATARAINBOW ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, was initially trained in French Law before settling in the UK. She has a Maitrise of Private Law from the prestigious <a href=\"https://www.u-paris2.fr/fr\" target=\"_blank\" rel=\"noreferrer noopener\">University of Pantheon Assas, Paris 2</a>, before her more recent specialisation in Computer and Communication Law with a Masters at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN’s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group&nbsp;<a class=\"\" href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a>&nbsp;with&nbsp;<a class=\"\" href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTACT : Data@datarainbow.eu</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><br></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018 :&nbsp;Tara Taubman-Bassirian</a></strong><br></td></tr></tbody></table></figure>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>Privacy Hero of the Year poll, and the results are in...&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of <a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">Rebecca Herold\'s radio show</a>,&nbsp;<a href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\">Data Security and Privacy with The Privacy Professor</a>. I\'ve extended invitations to each today, so stay tuned for more details.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For keeping up with news on IT security, Privacy and Online Security, join our Facebook Group <a href=\"https://www.facebook.com/groups/167255910003191/?multi_permalinks=2203761959685899&amp;notif_id=1548347410584622&amp;notif_t=feedback_reaction_generic\">Fly A Kite</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":881} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Screenshot-2020-05-03-at-18.32.54.png\" alt=\"\" class=\"wp-image-881\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":880} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Screenshot-2020-05-03-at-18.29.42.png\" alt=\"\" class=\"wp-image-880\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":878} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2020/05/Champion-Badge.png\" alt=\"\" class=\"wp-image-878\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Seen on Twitter</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":252} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-31-at-11.22.40.png\" alt=\"\" class=\"wp-image-252\"/></figure>\n<!-- /wp:image -->','DATARAINBOW - PUBLICATIONS','','inherit','closed','closed','','84-revision-v1','','','2021-07-08 16:07:04','2021-07-08 16:07:04','',84,'https://www.datarainbow.eu/?p=2117',0,'revision','',0),