INSERT INTO `wp_posts` (`ID`, `post_author`, `post_date`, `post_date_gmt`, `post_content`, `post_title`, `post_excerpt`, `post_status`, `comment_status`, `ping_status`, `post_password`, `post_name`, `to_ping`, `pinged`, `post_modified`, `post_modified_gmt`, `post_content_filtered`, `post_parent`, `guid`, `menu_order`, `post_type`, `post_mime_type`, `comment_count`) VALUES (2349,1,'2022-02-11 14:35:41','2022-02-11 14:35:41','<!-- wp:paragraph -->\n<p>Non compliance with the GDPR has three series of legal consequences : We\'ve extensively heard of the administrative enforcement by national Data Protection Authorities. We have less heard of Criminal liabilities for non compliance, especially for the absence of measures of security. The third level is civil liability as set by the <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\">Article 82 GDPR</a>. This article establishes a right to compensation and liability to \'<em>Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.</em>\' Action can be taken individually or in a class action. This is a serious threat while we are witnessing high rise of data breach incidents with increase cyber attacks and ransomware. When a controller has neglected to take appropriate security measures, it has to be liable for compensation. The difficulty here is that often the damage caused is not measurable or not imminent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its recent enforcement against an online payment company Slimpay, the French Data Protection CNIL clearly states that non compliance with the obligations of security in <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 32 GDPR</a> is sufficient without the need to prove access to the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>La formation restreinte considère que l’absence de preuve d’une utilisation frauduleuse des données est sans incidence sur la caractérisation du manquement à l’obligation de sécurité. En effet, le risque d’utilisation frauduleuse des données à caractère personnel était réel, indépendamment des cas de fraude, dans la mesure où les données de nombreuses personnes ont été rendues accessibles à des tiers non autorisés. L’absence de dommage avéré pour les personnes concernées n’a pas d’incidence sur l’existence du défaut de sécurité, qui constitue le manquement à l’article 32 du RGPD.</em>\"</p><p>The restricted panel considers that the absence of evidence of fraudulent use of the data has no bearing on the characterisation of the breach of the security obligation. <strong>The risk of fraudulent use of personal data was real, irrespective of the cases of fraud, in so far as the data of many persons were made accessible to unauthorised third parties. The absence of proven damage to the data subjects does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.</strong></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Several recent data breaches, British Airways, EASYJET, MARRIOTT, TICKET MASTER, ETC... have been hurt by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/class-actions/id43827607\" target=\"_blank\">class actions</a>. In The UK, the case raised by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/richard-lloyd-v-google-copy/id50888527\" target=\"_blank\">Mr Lloyd against unlawful data access by Google</a> was ultimately rejected by the Supreme Court base to the fact that not all class members had suffers identical harm. When could that ever be the case? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Loss of control and distress have been the criteria in civil compensation following a data breach. Several German and Austrian courts have recognised the liability for non-material damages caused by data subjects. Three referrals for clarification have been made to the <a href=\"https://www.pearltrees.com/clarinettecaselaw/ecj/id43825447\" target=\"_blank\" rel=\"noreferrer noopener\">EUROPEAN COURT OF JUSTICE</a>. If interested by this important subject, you can have a deeper read on all relevant cases we could curate <a href=\"https://www.linkedin.com/posts/taubmanbassirian_gdpr-non-material-damage-liability-ugcPost-6893517983616950272-zPr5\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Criminal liabilities, EU National legislations have introduced into their criminal laws specific incriminations. We know about the offense of <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/ukpga/1990/18/section/1\" target=\"_blank\">Computer Misuse Act</a> 1990 in the UK. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The chart below shows some of the main criminal offences introduced in the French legal system related to data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2343,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/02/Screenshot-2022-01-03-at-21.58.36-1024x654.png\" alt=\"\" class=\"wp-image-2343\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16 </strong>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years\' imprisonment and a fine of 300,000 euros. The same penalties shall be imposed on the act, including negligently, of carrying out or having carried out a processing which has been the subject of one of the measures provided for in 3 ° of III of Article 20 of Law No. 78-17 of 6 January 1978 relating to data processing, files and freedoms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16-1</strong> The fact, except in cases where the processing has been authorized under the conditions provided for by Law No. 78-17 of 6 January 1978 cited above, of carrying out or having carried out a processing of personal data including among the data on which it relates the registration number of persons in the national register of identification of natural persons is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17</strong> The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17-1</strong> The fact that a provider of electronic communications services or a controller does not notify a personal data breach to the Commission nationale de l\'informatique et des libertés or to the interested party, in breach of Articles 33 and 34 of Regulation (EU) 2016/679 of 27 April 2016 or the provisions of II of Article 83 and Article 102 of Law No. 78-17 of 6 January 1978, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply to a processor failing to notify the controller of this breach in breach of Article 33 of Regulation (EU) 2016/679 of 27 April 2016 or Article 102 of The aforementioned Law No 78-17 of 6 January 1978.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18</strong> Collecting personal data by fraudulent, unfair or unlawful means is punishable by five years\' imprisonment and a fine of €300,000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18-1</strong> The fact of processing personal data concerning a natural person despite the opposition of this person, when this processing meets prospecting purposes, in particular commercial, or when this opposition is based on legitimate reasons, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19</strong> The fact, except in the cases provided for by law, of placing or storing in computerized memory, without the express consent of the person concerned, personal data which, directly or indirectly, reveal the racial or ethnic origins, political, philosophical or religious opinions, or trade union memberships of the persons, or which relate to their health or sexual orientation or gender identity, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply, except in the cases provided for by law, to placing or storing in computerized memory personal data concerning offences, convictions or security measures. The provisions of this Article shall apply to non-automated processing of personal data the implementation of which is not limited to the exercise of exclusively personal activities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19-1 </strong>In the event of the processing of personal data for the purpose of research in the field of health, the following is punishable by five years\' imprisonment and a fine of 300,000 euros: 1 ° Without having previously informed individually the persons on whose account personal data are collected or transmitted of their right of access, rectification and opposition, the nature of the data transmitted and the recipients thereof; (2) Despite the objection of the person concerned or, where provided for by law, in the absence of the informed and express consent of the person, or in the case of a deceased person, despite the refusal expressed by the latter during his lifetime.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-20</strong> The fact of keeping personal data beyond the period provided for by law or regulation, by the request for authorisation or opinion, or by the prior declaration addressed to the National Commission for Informatics and Freedoms, is punishable by five years\' imprisonment and a fine of 300,000 euros, unless this retention is carried out for historical purposes, statistical or scientific under the conditions provided for by law. The same penalties shall apply to the fact, except in the cases provided for by law, of processing personal data stored beyond the period mentioned in the first paragraph for purposes other than historical, statistical or scientific purposes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-21</strong> The fact, by any person holding personal data on the occasion of their registration, classification, transmission or any other form of processing, of diverting this information from its purpose as defined by the legislative provision, the regulatory act or the decision of the National Commission for Informatics and Freedoms authorising automated processing, or by the declarations prior to the implementation of this treatment, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22</strong> The fact, by any person who has collected, on the occasion of their registration, classification, transmission or other form of processing, personal data the disclosure of which would have the effect of undermining the consideration of the interested party or the intimacy of his private life, to carry, without authorisation of the interested party, these data to the knowledge of a third party who does not have standing to receive them is punishable by five years\' imprisonment and a fine of 300,000 euros. The disclosure provided for in the preceding paragraph is punishable by three years\' imprisonment and a fine of 100,000 euros when committed by recklessness or negligence. In the cases provided for in the two preceding paragraphs, prosecution may be brought only on the basis of a complaint by the victim, his legal representative or his successors in title.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-1</strong> Carrying out or causing to be transferred personal data which is or is intended to be processed to a State not belonging to the European Union or to an international organisation in breach of Chapter V of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, or Articles 112 to 114 of Law No 78-17 of 6 January 1978 cited above, shall be punishable by five years\' imprisonment and a fine of EUR 300 000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-2</strong> The following are punishable by one year\'s imprisonment and a fine of €15,000 for hindering the action of the National Commission for Informatics and Liberties: 1 ° Either by opposing the exercise of the missions entrusted to its members or authorised agents pursuant to the last paragraph of Article 10 of Law No. 78-17 of 6 January 1978 aforementioned when the visit has been authorised by the judge; 2 ° Either by refusing to communicate to its members or to the agents authorised pursuant to the last paragraph of Article 10 of the same law, or to the agents of a supervisory authority of a Member State of the European Union pursuant to Article 62 of Regulation (EU) 2016/679 of 27 April 2016 cited above, the information and documents useful for their mission, or by concealing such documents or information, or by removing them; 3 ° Either by communicating information that does not conform to the content of the recordings as it was at the time when the request was made or that does not present this content in a directly accessible form. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-23</strong> In the cases provided for in Articles 226-16 to 226-22-2, the erasure of all or part of the personal data subject to the processing that gave rise to the offence may be ordered. The members and agents of the National Commission for Informatics and Liberties are entitled to note the erasure of this data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-24</strong> Legal persons declared criminally liable, under the conditions provided for in Article 121-2, for the offences defined in this section shall incur, in addition to the fine in accordance with the procedures laid down in Article 131-38, the penalties provided for in 2 ° to 5 ° and 7 ° to 9 ° of Article 131-39. The prohibition mentioned in 2 ° of article 131-39 relates to the activity in the exercise or in the course of the exercise of which the offence was committed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are few of the French incriminations making liable the data controller or the person unlawfully accessing personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK Data Protection Act 2018 has introduced several offences: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2 id=\"offences-under-the-dpa-2018\">Offences under the DPA 2018</h2>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-119-obstructing-the-commissioner-in-inspecting-personal-data-to-discharge-an-international-obligation\"><a></a>Section 119: Obstructing the Commissioner in inspecting personal data to discharge an international obligation</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 119 is described as a ‘future-proofed’ version of s.54A DPA 1998. It is a provision that criminalises obstructing the ICO’s inspection of European information systems. The Commissioner may inspect personal data where the inspection is necessary in order to discharge an international obligation of the United Kingdom, subject to the restriction in subsection (2). Section 119 (6) states that it is an offence (a)intentionally to obstruct a person exercising the power under subsection (1), or (b)to fail without reasonable excuse to give a person exercising that power any assistance the person may reasonably require.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-132-prohibition-placed-upon-the-commissioner-or-the-commissioner-s-staff-against-disclosing-information-obtained-in-the-course-of-their-role-which-is-not-available-to-the-public\"><a></a>Section 132: Prohibition placed upon the Commissioner, or the Commissioner’s staff against disclosing information obtained in the course of their role (which is not available to the public)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 132 replaces section 59 DPA 1998 and criminalises action by former or current ICO staff who disclose data obtained during the course of their duties. Section 132 (2) clarifies the circumstances in which disclosure – with lawful authority – may be made. Section 132 (3) however confirms that it is an offence for a person knowingly or recklessly to disclose information in contravention of subsection (1).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-144-false-statement-made-in-response-to-an-information-notice\"><a></a>Section 144: False statement made in response to an information notice</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>It is an offence for a person, in response to information notice from the Commissioner, to make or recklessly make, a statement which they know to be false in a material respect.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-148-destroying-or-falsifying-information-and-documents-etc\"><a></a>Section 148: Destroying or falsifying information and documents etc</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Under Section 148 (2) (a) it is an offence for a person to destroy or otherwise dispose of, conceal, block or (where relevant) falsify all or part of the information, document, equipment or material. Section 148 (2) (b) makes to cause or permit the actions set pout in the previous subsection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-170-unlawful-obtaining-etc-of-personal-data\"><a></a>Section 170: Unlawful obtaining etc of personal data</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 170 of the Act builds on section 55 DPA 1998 which criminalised knowingly or recklessly obtaining, disclosing or procuring personal data without the consent of the data controller, and the sale or offering for sale of that data. The provision was most typically/commonly used to prosecute those who had accessed healthcare and financial records without a legitimate reason. Section 170 adds the offence of knowingly or recklessly&nbsp;<strong><em>retaining</em></strong>&nbsp;personal data (which may have been lawfully obtained) without the consent of the data controller. There are some exceptions: for example where such obtaining, disclosing, procuring or retaining was necessary for the purposes of preventing or detecting crime. Section 170 (2) and (3) set out the defences to Section 170 (1).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-171-re-identification-of-de-identified-personal-data\"><a></a>Section 171: Re-identification of de-identified personal data</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 171 - a new offence - criminalises the re-identification of personal data that has been ‘de-identified’ (de-identification being a process - such as redactions - to remove/conceal personal data). Section (5) states that it is an offence for a person knowingly or recklessly to process personal data that is information that has been re-identified. Sections 171 (3) and (4) set out the defences to Section 171 (1) – for example, the re-identification was necessary for the purposes of preventing or detecting crime. Sections 171 (6) and (7) set out the defences to Section 171 (5).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-173-alteration-etc-of-personal-data-to-prevent-disclosure-to-data-subject\"><a></a>Section 173: Alteration etc of personal data to prevent disclosure to data subject</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 173 relates to the processing of requests for data from individuals for their personal data. Section 173 (3) makes it a criminal offence for organisations (persons listed in Section 173 (4)) to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure. It builds on an offence under the Freedom of Information Act 2000. Possible defences to an offence under section 173 (3) are set out in Section 173 (5).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-184-prohibition-of-requirement-to-produce-relevant-records\"><a></a>Section 184: Prohibition of requirement to produce relevant records</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 184 (1) makes it an offence for a person to require another to provide them with or give them access to a relevant record linked to the employment, continued employment of one of their employees or a contract for the provisions of services to them. Section 184 (2) makes it an offence for a person to require another to provide them with or access to a relevant record if the requestor is involved in the provision of goods, facilities or services to the public or the requirement is a condition of providing or offering to provide goods, facilities or services to the other person or a third party. Section 184 (3) details the possible defences to offences under subsection 184 (1) or (2).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"schedule-15-paragraph-15-powers-of-entry-and-inspection\"><a></a>Schedule 15, Paragraph 15. Powers of Entry and Inspection</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>It is an offence under paragraph 15 (1) for a person to intentionally obstruct a person in the execution of a warrant issued under this Schedule or to fail without reasonable excuse to give a person executing the warrant such assistance as may be required. Under paragraph 15 (2) it is an offence for a person to make a statement in response to a requirement under paragraph 5(2(c) or (d) or 3(c) or (d) which the person knows to be false in a material respect or recklessly make such a statement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There are no custodial sentences in respect of offences under DPA 2018 and no powers of arrest; all offences are punishable only by a fine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Schedule 15 – Powers of entry and inspection, sets out the circumstances in which the Information Commissioner may apply for a search warrant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The DPA 2018 removed Section 77 (power to alter penalty for unlawfully obtaining etc personal data) of the Criminal Justice and Immigration Act 2008.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"///Users/New/Downloads/122558_49907c6f-a2e5-4c9e-8ee0-953315da668c.pdf\" target=\"_blank\">Irish Data Protection 2018</a> has introduced in Section 144 et all a series of offences :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"start\":144} -->\n<ol start=\"144\"><li>Unauthorised disclosure by processor</li><li>Disclosure of personal data obtained without authority</li><li>Offences by directors, etc., of bodies corporate</li><li>Prosecution of summary offences by Commission</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:embed /-->','Non-Material Damage Compensation','Non compliance with the GDPR has three series of legal consequences : We\'ve extensively heard of the administrative enforcement by national Data Protection Authorities. We have less heard of Criminal liabilities for non compliance, especially for the absence of measures of security. The third level is civil liability as set by the Article 82 GDPR.','inherit','closed','closed','','2341-revision-v1','','','2022-02-11 14:35:41','2022-02-11 14:35:41','',2341,'https://www.datarainbow.eu/?p=2349',0,'revision','',0),(2358,1,'2022-04-04 16:06:48','2022-04-04 16:06:48','Celine the runner, photography by Geoff Lowe','A80A9645-BCF3-4454-B4B2-A726A03DAA89','','inherit','open','closed','','a80a9645-bcf3-4454-b4b2-a726a03daa89','','','2022-04-04 16:07:19','2022-04-04 16:07:19','',2357,'https://www.datarainbow.eu/wp-content/uploads/2022/04/A80A9645-BCF3-4454-B4B2-A726A03DAA89.jpg',0,'attachment','image/jpeg',0),(2359,1,'2022-04-04 16:08:57','2022-04-04 16:08:57','<!-- wp:paragraph -->\n<p><strong>Reading and analysing in the world of Internet regulation, a fast pace marathon :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>European Commission and United States Joint Statement on&nbsp;<a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_22_2087\">Trans-Atlantic Data Privacy Framework</a>&nbsp;- The European Commission and the United States announce that they have agreed in principle on a new Trans-Atlantic Data Privacy Framework, which will foster trans-Atlantic data flows and address the concerns raised by the Court of Justice of the European Union in the&nbsp;<em>Schrems II</em>&nbsp;decision of July 2020.&nbsp;&nbsp;<a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074\">A new step towards free data flow between the EU and the US.</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>-&nbsp;</strong><a href=\"https://noyb.eu/en/privacy-shield-20-first-reaction-max-schrems\"><strong>\"Privacy Shield 2.0\"? - First Reaction by Max Schrems</strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.whitehouse.gov/briefing-room/statements-releases/2022/03/25/fact-sheet-united-states-and-european-commission-announce-trans-atlantic-data-privacy-framework/\">FACT SHEET:</a>&nbsp;United&nbsp;States and European Commission Announce Trans-Atlantic Data Privacy&nbsp;Framework</li><li><a href=\"https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/\">UK the international data transfer agreement (IDTA)</a>, the international data transfer addendum to the European Commission’s standard contractual clauses for international data transfers (Addendum) and a document setting out transitional provisions.</li><li><a href=\"https://edpb.europa.eu/our-work-tools/documents/public-consultations/2022/guidelines-32022-dark-patterns-social-media_en\">Guidelines 3/2022 on Dark patterns in social media platform interfaces:</a>&nbsp;How to recognise and avoid them. T<em>he European Data Protection Board welcomes comments on the&nbsp;\"Guidelines 3/2022 on Dark patterns in social media platform interfaces: How to recognise and avoid them\".</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>Such comments should be sent&nbsp;May 2nd 2022 at the latest&nbsp;u</em>&nbsp;https://edpb.europa.eu/our-work-tools/documents/public-consultations/2022/guidelines-32022-dark-patterns-social-media_en</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.pearltrees.com/idigital2/digital-market-act/id52208289\">The Digital Markets Act</a>: ensuring fair and open digital markets - \"The European Union has opened a new chapter in antitrust enforcement for the digital economy, adopting a raft of new rules designed to clamp down on abuses by some of the world’s largest tech firms.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In a deal brokered Thursday evening, officials from the European Parliament, Council and Commission concluded 15 months of intense negotiations on a new rulebook for Big Tech giants operating in the European market, the&nbsp;<a href=\"https://oeil.secure.europarl.europa.eu/oeil/popups/ficheprocedure.do?reference=2020/0374(COD)&amp;l=en\">Digital Markets Act</a>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Shaping Europe’s digital future - The&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/library/data-act-factsheet\">Data Act</a>&nbsp;is a proposed Regulation harmonising rules on fair access to and use of data. It will play a key role in the digital decade, helping to shape the rules for the digital economy and society.&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The Data Act is part of the overall&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/policies/strategy-data\">European strategy for data,</a>&nbsp;and complements the&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/policies/data-governance-act\">Data Governance Regulation</a>&nbsp;of November 2020 by clarifying who can create value from data and under which conditions. It will also introduce rules concerning the use of data generated by devices connected to the Internet of Things.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Scientific research and pharmacovigilance: the first Code of Conduct approved by AEPD&nbsp;<a href=\"https://lnkd.in/eNYe5xGB\">https://lnkd.in/eNYe5xGB</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":5} -->\n<h5>Related topics&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/related-content?topic=73\">Cloud Computing</a>&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/related-content?topic=69\">Data</a>&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/related-content?topic=50\">Advanced and Cloud Computing</a></h5>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>Subject:&nbsp;<a href=\"https://www.europarl.europa.eu/doceo/document/P-9-2022-000840_EN.html\">US Customs and Border Protection gaining access to EU biometric databases</a>&nbsp;- The US administration plans to subject travellers entering on the Visa Waiver Program (VWP) to new biometric data requirements. Under a \'comprehensive secure travel partnership’, VWP partners will give the relevant US border security authorities access to EU databases containing fingerprints and/or facial images. In return, the authorities of those countries will also be allowed to access US databases.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>1.&nbsp;What organisational and legal issues does the Council think Member States could encounter as a result of the comprehensive secure travel partnership, and what conclusion has it come to after examining these?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2.&nbsp;As things stand, which EU databases (such as the common biometric database) or networked information systems (such as the Prüm Decision or ‘Prüm II’) would the US authorities be allowed to access to consult biometric data under the comprehensive secure travel partnership, and to what extent would the ‘hit/no hit’ principle apply?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3.&nbsp;Which US databases would EU authorities gain access to under the comprehensive secure travel partnership?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>UK online safety bill - The&nbsp;<a href=\"https://bills.parliament.uk/bills/3137/publications\">Online Safety Bill</a>&nbsp;delivers the government’s manifesto commitment to make the UK the safest place in the world to be online while defending free expression. The Bill has been strengthened and clarified since it was published in draft in May 2021, and reflects the outcome of extensive Parliamentary scrutiny.</li><li>Much to catch on the subject of&nbsp;<a href=\"https://www.pearltrees.com/idigital2/adtech/id48624700\">Ad Tech, RTBF and IAB</a>, following Johnny Ryan suit.&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAB4rr0BpmYBFs2FENw30wRqHPRdbzCcB98\">Johnny Ryan</a>&nbsp;from the Council for Civil Liberties just&nbsp;<a href=\"https://www.linkedin.com/posts/taubmanbassirian_adtech-and-rtbf-under-gdpr-activity-6909193712916959234-pae9?utm_source=linkedin_share&amp;utm_medium=member_desktop_web\">announced taking the Irish DPC into court for inaction against Google RTBF.</a></li><li><a href=\"https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/13410-Cyber-resilience-act-new-cybersecurity-rules-for-digital-products-and-ancillary-services_en\">Cyber resilience act – new cybersecurity rules for digital products and ancillary services</a>&nbsp;- Digital products and ancillary services create opportunities for EU economies and societies. But they also lead to new challenges – when everything is connected, a cybersecurity incident can affect an entire system, disrupting economic and social activities.</li><li>More on&nbsp;<a href=\"https://www.pearltrees.com/t/facial-recognition/clearview/id29503451\">ClearviewAI</a>, its use by law enforcement and EU DPA fines.&nbsp;<a href=\"https://www.gamingtechlaw.com/2022/03/privacy-clearview-facial-recognition-system-italy.html\">€ 20 million privacy fine against Clearview AI facial recognition system in Italy</a></li><li>A new&nbsp;<a href=\"https://www.pearltrees.com/clarinettecaselaw/class-actions/id43827607\">class action</a>&nbsp;in the UK, this time against TikTok :&nbsp;<a href=\"https://www.farrer.co.uk/news-and-insights/english-court-allows-gdpr-representative-action-to-proceed/\">Data class actions in the spotlight again: English Court allows GDPR opt-out Representative Action to proceed</a></li><li><a href=\"https://verfassungsblog.de/roa-our-minds/\">Our Minds, Monitored and Manipulated - How AI Impacts Public Discourse and Democracy</a></li><li><a href=\"https://www-pymnts-com.cdn.ampproject.org/c/s/www.pymnts.com/antitrust/2022/frances-ovhcloud-files-antitrust-complaint-against-microsofts-cloud-services/amp/\">France’s OVHcloud Files Antitrust Complaint Against Microsoft’s Cloud Services</a></li><li><a href=\"https://www.nist.gov/news-events/news/2022/03/theres-more-ai-bias-biased-data-nist-report-highlights\">There’s More to AI Bias Than Biased Data, NIST Report Highlights</a>&nbsp;Rooting out bias in artificial intelligence will require addressing human and systemic biases as well.&nbsp;<a href=\"https://www.pearltrees.com/t/artificial-intelligence/human-ai-bias/id39339037\">Further read on AI and bias</a>&nbsp;&nbsp;</li><li>UK ICO fined&nbsp;<a href=\"https://ico.org.uk/action-weve-taken/enforcement/smith-law-shepherds-ifa-ltd-en/\">Smith Law &amp; Shepherds IFA Ltd has contravened Chapter 3, Article 15 of the GDPR.</a></li><li>In its decision to&nbsp;<a href=\"https://www.linkedin.com/posts/taubmanbassirian_ico-fine-tuckers-llp-solicitor-activity-6907974558822088704-fnaI?utm_source=linkedin_share&amp;utm_medium=member_desktop_web\">fine the law firm Tuckers LLP</a>, \"the Commissioner has considered, in the context of \"state of the art\", relevant industry standards of good practice including the ISO27000 series, the National Institutes of Standards and Technology (\"NIST\"), the various guidance from the ICO itself, the National Cyber Security Centre (\"NCSC\"), the Solicitors Regulatory Authority (\"SRA\"), Lexcel and \'NCSC Cyber Essentials\'.&nbsp;and the low cost of encryption.</li></ul>\n<!-- /wp:list -->','','Reading and analysing in the world of Internet regulation, a fast pace marathon','inherit','closed','closed','','2357-revision-v1','','','2022-04-04 16:08:57','2022-04-04 16:08:57','',2357,'https://www.datarainbow.eu/?p=2359',0,'revision','',0),(2360,1,'2022-04-04 16:13:48','2022-04-04 16:13:48','<!-- wp:paragraph -->\n<p><strong>Reading and analysing in the world of Internet regulation, a fast pace marathon :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>European Commission and United States Joint Statement on&nbsp;<a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_22_2087\">Trans-Atlantic Data Privacy Framework</a>&nbsp;- The European Commission and the United States announce that they have agreed in principle on a new Trans-Atlantic Data Privacy Framework, which will foster trans-Atlantic data flows and address the concerns raised by the Court of Justice of the European Union in the&nbsp;<em>Schrems II</em>&nbsp;decision of July 2020.&nbsp;&nbsp;<a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074\">A new step towards free data flow between the EU and the US.</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>-&nbsp;</strong><a href=\"https://noyb.eu/en/privacy-shield-20-first-reaction-max-schrems\"><strong>\"Privacy Shield 2.0\"? - First Reaction by Max Schrems</strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.whitehouse.gov/briefing-room/statements-releases/2022/03/25/fact-sheet-united-states-and-european-commission-announce-trans-atlantic-data-privacy-framework/\">FACT SHEET:</a>&nbsp;United&nbsp;States and European Commission Announce Trans-Atlantic Data Privacy&nbsp;Framework</li><li><a href=\"https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/\">UK the international data transfer agreement (IDTA)</a>, the international data transfer addendum to the European Commission’s standard contractual clauses for international data transfers (Addendum) and a document setting out transitional provisions.</li><li><a href=\"https://edpb.europa.eu/our-work-tools/documents/public-consultations/2022/guidelines-32022-dark-patterns-social-media_en\">Guidelines 3/2022 on Dark patterns in social media platform interfaces:</a>&nbsp;How to recognise and avoid them. T<em>he European Data Protection Board welcomes comments on the&nbsp;\"Guidelines 3/2022 on Dark patterns in social media platform interfaces: How to recognise and avoid them\".</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>Such comments should be sent&nbsp;May 2nd 2022 at the latest&nbsp;u</em>&nbsp;https://edpb.europa.eu/our-work-tools/documents/public-consultations/2022/guidelines-32022-dark-patterns-social-media_en</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.pearltrees.com/idigital2/digital-market-act/id52208289\">The Digital Markets Act</a>: ensuring fair and open digital markets - \"The European Union has opened a new chapter in antitrust enforcement for the digital economy, adopting a raft of new rules designed to clamp down on abuses by some of the world’s largest tech firms.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In a deal brokered Thursday evening, officials from the European Parliament, Council and Commission concluded 15 months of intense negotiations on a new rulebook for Big Tech giants operating in the European market, the&nbsp;<a href=\"https://oeil.secure.europarl.europa.eu/oeil/popups/ficheprocedure.do?reference=2020/0374(COD)&amp;l=en\">Digital Markets Act</a>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Shaping Europe’s digital future - The&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/library/data-act-factsheet\">Data Act</a>&nbsp;is a proposed Regulation harmonising rules on fair access to and use of data. It will play a key role in the digital decade, helping to shape the rules for the digital economy and society.&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The Data Act is part of the overall&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/policies/strategy-data\">European strategy for data,</a>&nbsp;and complements the&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/policies/data-governance-act\">Data Governance Regulation</a>&nbsp;of November 2020 by clarifying who can create value from data and under which conditions. It will also introduce rules concerning the use of data generated by devices connected to the Internet of Things.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Scientific research and pharmacovigilance: the first Code of Conduct approved by AEPD&nbsp;<a href=\"https://lnkd.in/eNYe5xGB\">https://lnkd.in/eNYe5xGB</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":5} -->\n<h5>Related topics&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/related-content?topic=73\">Cloud Computing</a>&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/related-content?topic=69\">Data</a>&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/related-content?topic=50\">Advanced and Cloud Computing</a></h5>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>Subject:&nbsp;<a href=\"https://www.europarl.europa.eu/doceo/document/P-9-2022-000840_EN.html\">US Customs and Border Protection gaining access to EU biometric databases</a>&nbsp;- The US administration plans to subject travellers entering on the Visa Waiver Program (VWP) to new biometric data requirements. Under a \'comprehensive secure travel partnership’, VWP partners will give the relevant US border security authorities access to EU databases containing fingerprints and/or facial images. In return, the authorities of those countries will also be allowed to access US databases.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>1.&nbsp;What organisational and legal issues does the Council think Member States could encounter as a result of the comprehensive secure travel partnership, and what conclusion has it come to after examining these?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2.&nbsp;As things stand, which EU databases (such as the common biometric database) or networked information systems (such as the Prüm Decision or ‘Prüm II’) would the US authorities be allowed to access to consult biometric data under the comprehensive secure travel partnership, and to what extent would the ‘hit/no hit’ principle apply?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3.&nbsp;Which US databases would EU authorities gain access to under the comprehensive secure travel partnership?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>UK online safety bill - The&nbsp;<a href=\"https://bills.parliament.uk/bills/3137/publications\">Online Safety Bill</a>&nbsp;delivers the government’s manifesto commitment to make the UK the safest place in the world to be online while defending free expression. The Bill has been strengthened and clarified since it was published in draft in May 2021, and reflects the outcome of extensive Parliamentary scrutiny.</li><li>Much to catch on the subject of&nbsp;<a href=\"https://www.pearltrees.com/idigital2/adtech/id48624700\">Ad Tech, RTBF and IAB</a>, following Johnny Ryan suit.&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAB4rr0BpmYBFs2FENw30wRqHPRdbzCcB98\">Johnny Ryan</a>&nbsp;from the Council for Civil Liberties just&nbsp;<a href=\"https://www.linkedin.com/posts/taubmanbassirian_adtech-and-rtbf-under-gdpr-activity-6909193712916959234-pae9?utm_source=linkedin_share&amp;utm_medium=member_desktop_web\">announced taking the Irish DPC into court for inaction against Google RTBF.</a></li><li><a href=\"https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/13410-Cyber-resilience-act-new-cybersecurity-rules-for-digital-products-and-ancillary-services_en\">Cyber resilience act – new cybersecurity rules for digital products and ancillary services</a>&nbsp;- Digital products and ancillary services create opportunities for EU economies and societies. But they also lead to new challenges – when everything is connected, a cybersecurity incident can affect an entire system, disrupting economic and social activities.</li><li>More on&nbsp;<a href=\"https://www.pearltrees.com/t/facial-recognition/clearview/id29503451\">ClearviewAI</a>, its use by law enforcement and EU DPA fines.&nbsp;<a href=\"https://www.gamingtechlaw.com/2022/03/privacy-clearview-facial-recognition-system-italy.html\">€ 20 million privacy fine against Clearview AI facial recognition system in Italy</a></li><li>A new&nbsp;<a href=\"https://www.pearltrees.com/clarinettecaselaw/class-actions/id43827607\">class action</a>&nbsp;in the UK, this time against TikTok :&nbsp;<a href=\"https://www.farrer.co.uk/news-and-insights/english-court-allows-gdpr-representative-action-to-proceed/\">Data class actions in the spotlight again: English Court allows GDPR opt-out Representative Action to proceed</a></li><li><a href=\"https://verfassungsblog.de/roa-our-minds/\">Our Minds, Monitored and Manipulated - How AI Impacts Public Discourse and Democracy</a></li><li><a href=\"https://www-pymnts-com.cdn.ampproject.org/c/s/www.pymnts.com/antitrust/2022/frances-ovhcloud-files-antitrust-complaint-against-microsofts-cloud-services/amp/\">France’s OVHcloud Files Antitrust Complaint Against Microsoft’s Cloud Services</a></li><li><a href=\"https://www.nist.gov/news-events/news/2022/03/theres-more-ai-bias-biased-data-nist-report-highlights\">There’s More to AI Bias Than Biased Data, NIST Report Highlights</a>&nbsp;Rooting out bias in artificial intelligence will require addressing human and systemic biases as well.&nbsp;<a href=\"https://www.pearltrees.com/t/artificial-intelligence/human-ai-bias/id39339037\">Further read on AI and bias</a>&nbsp;&nbsp;</li><li>UK ICO fined&nbsp;<a href=\"https://ico.org.uk/action-weve-taken/enforcement/smith-law-shepherds-ifa-ltd-en/\">Smith Law &amp; Shepherds IFA Ltd has contravened Chapter 3, Article 15 of the GDPR.</a></li><li>In its decision to&nbsp;<a href=\"https://www.linkedin.com/posts/taubmanbassirian_ico-fine-tuckers-llp-solicitor-activity-6907974558822088704-fnaI?utm_source=linkedin_share&amp;utm_medium=member_desktop_web\">fine the law firm Tuckers LLP</a>, \"the Commissioner has considered, in the context of \"state of the art\", relevant industry standards of good practice including the ISO27000 series, the National Institutes of Standards and Technology (\"NIST\"), the various guidance from the ICO itself, the National Cyber Security Centre (\"NCSC\"), the Solicitors Regulatory Authority (\"SRA\"), Lexcel and \'NCSC Cyber Essentials\'.&nbsp;and the low cost of encryption.</li></ul>\n<!-- /wp:list -->','Latest Developments in The World of Data Protection and Internet Regulation','Reading and analysing in the world of Internet regulation, a fast pace marathon','inherit','closed','closed','','2357-revision-v1','','','2022-04-04 16:13:48','2022-04-04 16:13:48','',2357,'https://www.datarainbow.eu/?p=2360',0,'revision','',0),(2352,1,'2022-02-12 14:30:19','2022-02-12 14:30:19','<!-- wp:paragraph -->\n<p>Non compliance with the GDPR has three series of legal consequences : We\'ve extensively heard of the administrative enforcement by national Data Protection Authorities. We have less heard of Criminal liabilities for non compliance, especially for the absence of measures of security. The third level is civil liability as set by the <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\">Article 82 GDPR</a>. This article establishes a right to compensation and liability to \'<em>Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.</em>\' Action can be taken individually or in a class action. This is a serious threat while we are witnessing high rise of data breach incidents with increase cyber attacks and ransomware. When a controller has neglected to take appropriate security measures, it has to be liable for compensation. The difficulty here is that often the damage caused is not measurable or not imminent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its recent enforcement against an online payment company Slimpay, the French Data Protection CNIL clearly states that non compliance with the obligations of security in <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 32 GDPR</a> is sufficient without the need to prove access to the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>La formation restreinte considère que l’absence de preuve d’une utilisation frauduleuse des données est sans incidence sur la caractérisation du manquement à l’obligation de sécurité. En effet, le risque d’utilisation frauduleuse des données à caractère personnel était réel, indépendamment des cas de fraude, dans la mesure où les données de nombreuses personnes ont été rendues accessibles à des tiers non autorisés. L’absence de dommage avéré pour les personnes concernées n’a pas d’incidence sur l’existence du défaut de sécurité, qui constitue le manquement à l’article 32 du RGPD.</em>\"</p><p>The restricted panel considers that the absence of evidence of fraudulent use of the data has no bearing on the characterisation of the breach of the security obligation. <strong>The risk of fraudulent use of personal data was real, irrespective of the cases of fraud, in so far as the data of many persons were made accessible to unauthorised third parties. The absence of proven damage to the data subjects does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.</strong></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The Recital 146 goes more into detail on the indemnity:  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The controller or processor should compensate any damage which a person may suffer as a result of processing that infringes this Regulation. The controller or processor should be exempt from liability if it proves that it is not in any way responsible for the damage. <strong>The concept of damage should be broadly interpreted in the light of the case-law of the Court of Justice in a manner which fully reflects the objectives of this Regulation</strong>. This is without prejudice to any claims for damage deriving from the violation of other rules in Union or Member State law. Processing that infringes this Regulation also includes processing that infringes delegated and implementing acts adopted in accordance with this Regulation and Member State law specifying rules of this Regulation. <strong>Data subjects should receive full and effective compensation for the damage they have suffered</strong>. Where controllers or processors are involved in the same processing, <strong>each controller or processor should be held liable for the entire damage.</strong> However, where they are joined to the same judicial proceedings, in accordance with Member State law, compensation may be apportioned according to the responsibility of each controller or processor for the damage caused by the processing, provided that full and effective compensation of the data subject who suffered the damage is ensured. Any controller or processor which has paid full compensation may subsequently institute recourse proceedings against other controllers or processors involved in the same processing.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Several recent data breaches, British Airways, EASYJET, MARRIOTT, TICKET MASTER, ETC... have been hurt by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/class-actions/id43827607\" target=\"_blank\">class actions</a>. In The UK, the case raised by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/richard-lloyd-v-google-copy/id50888527\" target=\"_blank\">Mr Lloyd against unlawful data access by Google</a> was ultimately rejected by the Supreme Court base to the fact that not all class members had suffers identical harm. When could that ever be the case? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Loss of control and distress have been the criteria in civil compensation following a data breach. Several German and Austrian courts have recognised the liability for non-material damages caused by data subjects. Three referrals for clarification have been made to the <a href=\"https://www.pearltrees.com/clarinettecaselaw/ecj/id43825447\" target=\"_blank\" rel=\"noreferrer noopener\">EUROPEAN COURT OF JUSTICE</a>. If interested by this important subject, you can have a deeper read on all relevant cases we could curate <a href=\"https://www.linkedin.com/posts/taubmanbassirian_gdpr-non-material-damage-liability-ugcPost-6893517983616950272-zPr5\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Criminal liabilities, EU National legislations have introduced into their criminal laws specific incriminations. We know about the offense of <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/ukpga/1990/18/section/1\" target=\"_blank\">Computer Misuse Act</a> 1990 in the UK. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The chart below shows some of the main criminal offences introduced in the French legal system related to data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2343,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/02/Screenshot-2022-01-03-at-21.58.36-1024x654.png\" alt=\"\" class=\"wp-image-2343\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16 </strong>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years\' imprisonment and a fine of 300,000 euros. The same penalties shall be imposed on the act, including negligently, of carrying out or having carried out a processing which has been the subject of one of the measures provided for in 3 ° of III of Article 20 of Law No. 78-17 of 6 January 1978 relating to data processing, files and freedoms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16-1</strong> The fact, except in cases where the processing has been authorized under the conditions provided for by Law No. 78-17 of 6 January 1978 cited above, of carrying out or having carried out a processing of personal data including among the data on which it relates the registration number of persons in the national register of identification of natural persons is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17</strong> The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17-1</strong> The fact that a provider of electronic communications services or a controller does not notify a personal data breach to the Commission nationale de l\'informatique et des libertés or to the interested party, in breach of Articles 33 and 34 of Regulation (EU) 2016/679 of 27 April 2016 or the provisions of II of Article 83 and Article 102 of Law No. 78-17 of 6 January 1978, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply to a processor failing to notify the controller of this breach in breach of Article 33 of Regulation (EU) 2016/679 of 27 April 2016 or Article 102 of The aforementioned Law No 78-17 of 6 January 1978.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18</strong> Collecting personal data by fraudulent, unfair or unlawful means is punishable by five years\' imprisonment and a fine of €300,000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18-1</strong> The fact of processing personal data concerning a natural person despite the opposition of this person, when this processing meets prospecting purposes, in particular commercial, or when this opposition is based on legitimate reasons, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19</strong> The fact, except in the cases provided for by law, of placing or storing in computerized memory, without the express consent of the person concerned, personal data which, directly or indirectly, reveal the racial or ethnic origins, political, philosophical or religious opinions, or trade union memberships of the persons, or which relate to their health or sexual orientation or gender identity, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply, except in the cases provided for by law, to placing or storing in computerized memory personal data concerning offences, convictions or security measures. The provisions of this Article shall apply to non-automated processing of personal data the implementation of which is not limited to the exercise of exclusively personal activities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19-1 </strong>In the event of the processing of personal data for the purpose of research in the field of health, the following is punishable by five years\' imprisonment and a fine of 300,000 euros: 1 ° Without having previously informed individually the persons on whose account personal data are collected or transmitted of their right of access, rectification and opposition, the nature of the data transmitted and the recipients thereof; (2) Despite the objection of the person concerned or, where provided for by law, in the absence of the informed and express consent of the person, or in the case of a deceased person, despite the refusal expressed by the latter during his lifetime.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-20</strong> The fact of keeping personal data beyond the period provided for by law or regulation, by the request for authorisation or opinion, or by the prior declaration addressed to the National Commission for Informatics and Freedoms, is punishable by five years\' imprisonment and a fine of 300,000 euros, unless this retention is carried out for historical purposes, statistical or scientific under the conditions provided for by law. The same penalties shall apply to the fact, except in the cases provided for by law, of processing personal data stored beyond the period mentioned in the first paragraph for purposes other than historical, statistical or scientific purposes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-21</strong> The fact, by any person holding personal data on the occasion of their registration, classification, transmission or any other form of processing, of diverting this information from its purpose as defined by the legislative provision, the regulatory act or the decision of the National Commission for Informatics and Freedoms authorising automated processing, or by the declarations prior to the implementation of this treatment, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22</strong> The fact, by any person who has collected, on the occasion of their registration, classification, transmission or other form of processing, personal data the disclosure of which would have the effect of undermining the consideration of the interested party or the intimacy of his private life, to carry, without authorisation of the interested party, these data to the knowledge of a third party who does not have standing to receive them is punishable by five years\' imprisonment and a fine of 300,000 euros. The disclosure provided for in the preceding paragraph is punishable by three years\' imprisonment and a fine of 100,000 euros when committed by recklessness or negligence. In the cases provided for in the two preceding paragraphs, prosecution may be brought only on the basis of a complaint by the victim, his legal representative or his successors in title.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-1</strong> Carrying out or causing to be transferred personal data which is or is intended to be processed to a State not belonging to the European Union or to an international organisation in breach of Chapter V of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, or Articles 112 to 114 of Law No 78-17 of 6 January 1978 cited above, shall be punishable by five years\' imprisonment and a fine of EUR 300 000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-2</strong> The following are punishable by one year\'s imprisonment and a fine of €15,000 for hindering the action of the National Commission for Informatics and Liberties: 1 ° Either by opposing the exercise of the missions entrusted to its members or authorised agents pursuant to the last paragraph of Article 10 of Law No. 78-17 of 6 January 1978 aforementioned when the visit has been authorised by the judge; 2 ° Either by refusing to communicate to its members or to the agents authorised pursuant to the last paragraph of Article 10 of the same law, or to the agents of a supervisory authority of a Member State of the European Union pursuant to Article 62 of Regulation (EU) 2016/679 of 27 April 2016 cited above, the information and documents useful for their mission, or by concealing such documents or information, or by removing them; 3 ° Either by communicating information that does not conform to the content of the recordings as it was at the time when the request was made or that does not present this content in a directly accessible form. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-23</strong> In the cases provided for in Articles 226-16 to 226-22-2, the erasure of all or part of the personal data subject to the processing that gave rise to the offence may be ordered. The members and agents of the National Commission for Informatics and Liberties are entitled to note the erasure of this data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-24</strong> Legal persons declared criminally liable, under the conditions provided for in Article 121-2, for the offences defined in this section shall incur, in addition to the fine in accordance with the procedures laid down in Article 131-38, the penalties provided for in 2 ° to 5 ° and 7 ° to 9 ° of Article 131-39. The prohibition mentioned in 2 ° of article 131-39 relates to the activity in the exercise or in the course of the exercise of which the offence was committed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are few of the French incriminations making liable the data controller or the person unlawfully accessing personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK Data Protection Act 2018 has introduced several offences: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2 id=\"offences-under-the-dpa-2018\">Offences under the DPA 2018</h2>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-119-obstructing-the-commissioner-in-inspecting-personal-data-to-discharge-an-international-obligation\"><a></a>Section 119: Obstructing the Commissioner in inspecting personal data to discharge an international obligation</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 119 is described as a ‘future-proofed’ version of s.54A DPA 1998. It is a provision that criminalises obstructing the ICO’s inspection of European information systems. The Commissioner may inspect personal data where the inspection is necessary in order to discharge an international obligation of the United Kingdom, subject to the restriction in subsection (2). Section 119 (6) states that it is an offence (a)intentionally to obstruct a person exercising the power under subsection (1), or (b)to fail without reasonable excuse to give a person exercising that power any assistance the person may reasonably require.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-132-prohibition-placed-upon-the-commissioner-or-the-commissioner-s-staff-against-disclosing-information-obtained-in-the-course-of-their-role-which-is-not-available-to-the-public\"><a></a>Section 132: Prohibition placed upon the Commissioner, or the Commissioner’s staff against disclosing information obtained in the course of their role (which is not available to the public)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 132 replaces section 59 DPA 1998 and criminalises action by former or current ICO staff who disclose data obtained during the course of their duties. Section 132 (2) clarifies the circumstances in which disclosure – with lawful authority – may be made. Section 132 (3) however confirms that it is an offence for a person knowingly or recklessly to disclose information in contravention of subsection (1).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-144-false-statement-made-in-response-to-an-information-notice\"><a></a>Section 144: False statement made in response to an information notice</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>It is an offence for a person, in response to information notice from the Commissioner, to make or recklessly make, a statement which they know to be false in a material respect.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-148-destroying-or-falsifying-information-and-documents-etc\"><a></a>Section 148: Destroying or falsifying information and documents etc</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Under Section 148 (2) (a) it is an offence for a person to destroy or otherwise dispose of, conceal, block or (where relevant) falsify all or part of the information, document, equipment or material. Section 148 (2) (b) makes to cause or permit the actions set pout in the previous subsection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-170-unlawful-obtaining-etc-of-personal-data\"><a></a>Section 170: Unlawful obtaining etc of personal data</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 170 of the Act builds on section 55 DPA 1998 which criminalised knowingly or recklessly obtaining, disclosing or procuring personal data without the consent of the data controller, and the sale or offering for sale of that data. The provision was most typically/commonly used to prosecute those who had accessed healthcare and financial records without a legitimate reason. Section 170 adds the offence of knowingly or recklessly&nbsp;<strong><em>retaining</em></strong>&nbsp;personal data (which may have been lawfully obtained) without the consent of the data controller. There are some exceptions: for example where such obtaining, disclosing, procuring or retaining was necessary for the purposes of preventing or detecting crime. Section 170 (2) and (3) set out the defences to Section 170 (1).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-171-re-identification-of-de-identified-personal-data\"><a></a>Section 171: Re-identification of de-identified personal data</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 171 - a new offence - criminalises the re-identification of personal data that has been ‘de-identified’ (de-identification being a process - such as redactions - to remove/conceal personal data). Section (5) states that it is an offence for a person knowingly or recklessly to process personal data that is information that has been re-identified. Sections 171 (3) and (4) set out the defences to Section 171 (1) – for example, the re-identification was necessary for the purposes of preventing or detecting crime. Sections 171 (6) and (7) set out the defences to Section 171 (5).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-173-alteration-etc-of-personal-data-to-prevent-disclosure-to-data-subject\"><a></a>Section 173: Alteration etc of personal data to prevent disclosure to data subject</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 173 relates to the processing of requests for data from individuals for their personal data. Section 173 (3) makes it a criminal offence for organisations (persons listed in Section 173 (4)) to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure. It builds on an offence under the Freedom of Information Act 2000. Possible defences to an offence under section 173 (3) are set out in Section 173 (5).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-184-prohibition-of-requirement-to-produce-relevant-records\"><a></a>Section 184: Prohibition of requirement to produce relevant records</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 184 (1) makes it an offence for a person to require another to provide them with or give them access to a relevant record linked to the employment, continued employment of one of their employees or a contract for the provisions of services to them. Section 184 (2) makes it an offence for a person to require another to provide them with or access to a relevant record if the requestor is involved in the provision of goods, facilities or services to the public or the requirement is a condition of providing or offering to provide goods, facilities or services to the other person or a third party. Section 184 (3) details the possible defences to offences under subsection 184 (1) or (2).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"schedule-15-paragraph-15-powers-of-entry-and-inspection\"><a></a>Schedule 15, Paragraph 15. Powers of Entry and Inspection</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>It is an offence under paragraph 15 (1) for a person to intentionally obstruct a person in the execution of a warrant issued under this Schedule or to fail without reasonable excuse to give a person executing the warrant such assistance as may be required. Under paragraph 15 (2) it is an offence for a person to make a statement in response to a requirement under paragraph 5(2(c) or (d) or 3(c) or (d) which the person knows to be false in a material respect or recklessly make such a statement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There are no custodial sentences in respect of offences under DPA 2018 and no powers of arrest; all offences are punishable only by a fine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Schedule 15 – Powers of entry and inspection, sets out the circumstances in which the Information Commissioner may apply for a search warrant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The DPA 2018 removed Section 77 (power to alter penalty for unlawfully obtaining etc personal data) of the Criminal Justice and Immigration Act 2008.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"///Users/New/Downloads/122558_49907c6f-a2e5-4c9e-8ee0-953315da668c.pdf\" target=\"_blank\">Irish Data Protection 2018</a> has introduced in Section 144 et all a series of offences :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"start\":144} -->\n<ol start=\"144\"><li>Unauthorised disclosure by processor</li><li>Disclosure of personal data obtained without authority</li><li>Offences by directors, etc., of bodies corporate</li><li>Prosecution of summary offences by Commission</li></ol>\n<!-- /wp:list -->','Non-Material Damage Compensation','Non compliance with the GDPR has three series of legal consequences : We\'ve extensively heard of the administrative enforcement by national Data Protection Authorities. We have less heard of Criminal liabilities for non compliance, especially for the absence of measures of security. The third level is civil liability as set by the Article 82 GDPR.','inherit','closed','closed','','2341-revision-v1','','','2022-02-12 14:30:19','2022-02-12 14:30:19','',2341,'https://www.datarainbow.eu/?p=2352',0,'revision','',0),(2353,1,'2022-02-12 14:56:39','2022-02-12 14:56:39','<!-- wp:paragraph -->\n<p>Non compliance with the GDPR has three series of legal consequences : We\'ve extensively heard of the administrative enforcement by national Data Protection Authorities. We have less heard of Criminal liabilities for non compliance, especially for the absence of measures of security. The third level is civil liability as set by the <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\">Article 82 GDPR</a>. This article establishes a right to compensation and liability to \'<em>Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.</em>\' Action can be taken individually or in a class action. This is a serious threat while we are witnessing high rise of data breach incidents with increase cyber attacks and ransomware. When a controller has neglected to take appropriate security measures, it has to be liable for compensation. The difficulty here is that often the damage caused is not measurable or not imminent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its recent enforcement against an online payment company Slimpay, the French Data Protection CNIL clearly states that non compliance with the obligations of security in <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 32 GDPR</a> is sufficient without the need to prove access to the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>La formation restreinte considère que l’absence de preuve d’une utilisation frauduleuse des données est sans incidence sur la caractérisation du manquement à l’obligation de sécurité. En effet, le risque d’utilisation frauduleuse des données à caractère personnel était réel, indépendamment des cas de fraude, dans la mesure où les données de nombreuses personnes ont été rendues accessibles à des tiers non autorisés. L’absence de dommage avéré pour les personnes concernées n’a pas d’incidence sur l’existence du défaut de sécurité, qui constitue le manquement à l’article 32 du RGPD.</em>\"</p><p>The restricted panel considers that the absence of evidence of fraudulent use of the data has no bearing on the characterisation of the breach of the security obligation. <strong>The risk of fraudulent use of personal data was real, irrespective of the cases of fraud, in so far as the data of many persons were made accessible to unauthorised third parties. The absence of proven damage to the data subjects does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.</strong></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The Recital 146 goes more into detail on the indemnity:  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The controller or processor should compensate any damage which a person may suffer as a result of processing that infringes this Regulation. The controller or processor should be exempt from liability if it proves that it is not in any way responsible for the damage. <strong>The concept of damage should be broadly interpreted in the light of the case-law of the Court of Justice in a manner which fully reflects the objectives of this Regulation</strong>. This is without prejudice to any claims for damage deriving from the violation of other rules in Union or Member State law. Processing that infringes this Regulation also includes processing that infringes delegated and implementing acts adopted in accordance with this Regulation and Member State law specifying rules of this Regulation. <strong>Data subjects should receive full and effective compensation for the damage they have suffered</strong>. Where controllers or processors are involved in the same processing, <strong>each controller or processor should be held liable for the entire damage.</strong> However, where they are joined to the same judicial proceedings, in accordance with Member State law, compensation may be apportioned according to the responsibility of each controller or processor for the damage caused by the processing, provided that full and effective compensation of the data subject who suffered the damage is ensured. Any controller or processor which has paid full compensation may subsequently institute recourse proceedings against other controllers or processors involved in the same processing.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Recital 85 in the context of a data breach states that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned. </em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Several recent data breaches, British Airways, EASYJET, MARRIOTT, TICKET MASTER, ETC... have been hurt by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/class-actions/id43827607\" target=\"_blank\">class actions</a>. In The UK, the case raised by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/richard-lloyd-v-google-copy/id50888527\" target=\"_blank\">Mr Lloyd against unlawful data access by Google</a> was ultimately rejected by the Supreme Court base to the fact that not all class members had suffers identical harm. When could that ever be the case? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Loss of control and distress have been the criteria in civil compensation following a data breach. Several German and Austrian courts have recognised the liability for non-material damages caused by data subjects. Three referrals for clarification have been made to the <a href=\"https://www.pearltrees.com/clarinettecaselaw/ecj/id43825447\" target=\"_blank\" rel=\"noreferrer noopener\">EUROPEAN COURT OF JUSTICE</a>. If interested by this important subject, you can have a deeper read on all relevant cases we could curate <a href=\"https://www.linkedin.com/posts/taubmanbassirian_gdpr-non-material-damage-liability-ugcPost-6893517983616950272-zPr5\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Criminal liabilities, EU National legislations have introduced into their criminal laws specific incriminations. We know about the offense of <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/ukpga/1990/18/section/1\" target=\"_blank\">Computer Misuse Act</a> 1990 in the UK. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The chart below shows some of the main criminal offences introduced in the French legal system related to data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2343,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/02/Screenshot-2022-01-03-at-21.58.36-1024x654.png\" alt=\"\" class=\"wp-image-2343\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16 </strong>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years\' imprisonment and a fine of 300,000 euros. The same penalties shall be imposed on the act, including negligently, of carrying out or having carried out a processing which has been the subject of one of the measures provided for in 3 ° of III of Article 20 of Law No. 78-17 of 6 January 1978 relating to data processing, files and freedoms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16-1</strong> The fact, except in cases where the processing has been authorized under the conditions provided for by Law No. 78-17 of 6 January 1978 cited above, of carrying out or having carried out a processing of personal data including among the data on which it relates the registration number of persons in the national register of identification of natural persons is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17</strong> The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17-1</strong> The fact that a provider of electronic communications services or a controller does not notify a personal data breach to the Commission nationale de l\'informatique et des libertés or to the interested party, in breach of Articles 33 and 34 of Regulation (EU) 2016/679 of 27 April 2016 or the provisions of II of Article 83 and Article 102 of Law No. 78-17 of 6 January 1978, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply to a processor failing to notify the controller of this breach in breach of Article 33 of Regulation (EU) 2016/679 of 27 April 2016 or Article 102 of The aforementioned Law No 78-17 of 6 January 1978.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18</strong> Collecting personal data by fraudulent, unfair or unlawful means is punishable by five years\' imprisonment and a fine of €300,000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18-1</strong> The fact of processing personal data concerning a natural person despite the opposition of this person, when this processing meets prospecting purposes, in particular commercial, or when this opposition is based on legitimate reasons, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19</strong> The fact, except in the cases provided for by law, of placing or storing in computerized memory, without the express consent of the person concerned, personal data which, directly or indirectly, reveal the racial or ethnic origins, political, philosophical or religious opinions, or trade union memberships of the persons, or which relate to their health or sexual orientation or gender identity, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply, except in the cases provided for by law, to placing or storing in computerized memory personal data concerning offences, convictions or security measures. The provisions of this Article shall apply to non-automated processing of personal data the implementation of which is not limited to the exercise of exclusively personal activities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19-1 </strong>In the event of the processing of personal data for the purpose of research in the field of health, the following is punishable by five years\' imprisonment and a fine of 300,000 euros: 1 ° Without having previously informed individually the persons on whose account personal data are collected or transmitted of their right of access, rectification and opposition, the nature of the data transmitted and the recipients thereof; (2) Despite the objection of the person concerned or, where provided for by law, in the absence of the informed and express consent of the person, or in the case of a deceased person, despite the refusal expressed by the latter during his lifetime.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-20</strong> The fact of keeping personal data beyond the period provided for by law or regulation, by the request for authorisation or opinion, or by the prior declaration addressed to the National Commission for Informatics and Freedoms, is punishable by five years\' imprisonment and a fine of 300,000 euros, unless this retention is carried out for historical purposes, statistical or scientific under the conditions provided for by law. The same penalties shall apply to the fact, except in the cases provided for by law, of processing personal data stored beyond the period mentioned in the first paragraph for purposes other than historical, statistical or scientific purposes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-21</strong> The fact, by any person holding personal data on the occasion of their registration, classification, transmission or any other form of processing, of diverting this information from its purpose as defined by the legislative provision, the regulatory act or the decision of the National Commission for Informatics and Freedoms authorising automated processing, or by the declarations prior to the implementation of this treatment, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22</strong> The fact, by any person who has collected, on the occasion of their registration, classification, transmission or other form of processing, personal data the disclosure of which would have the effect of undermining the consideration of the interested party or the intimacy of his private life, to carry, without authorisation of the interested party, these data to the knowledge of a third party who does not have standing to receive them is punishable by five years\' imprisonment and a fine of 300,000 euros. The disclosure provided for in the preceding paragraph is punishable by three years\' imprisonment and a fine of 100,000 euros when committed by recklessness or negligence. In the cases provided for in the two preceding paragraphs, prosecution may be brought only on the basis of a complaint by the victim, his legal representative or his successors in title.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-1</strong> Carrying out or causing to be transferred personal data which is or is intended to be processed to a State not belonging to the European Union or to an international organisation in breach of Chapter V of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, or Articles 112 to 114 of Law No 78-17 of 6 January 1978 cited above, shall be punishable by five years\' imprisonment and a fine of EUR 300 000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-2</strong> The following are punishable by one year\'s imprisonment and a fine of €15,000 for hindering the action of the National Commission for Informatics and Liberties: 1 ° Either by opposing the exercise of the missions entrusted to its members or authorised agents pursuant to the last paragraph of Article 10 of Law No. 78-17 of 6 January 1978 aforementioned when the visit has been authorised by the judge; 2 ° Either by refusing to communicate to its members or to the agents authorised pursuant to the last paragraph of Article 10 of the same law, or to the agents of a supervisory authority of a Member State of the European Union pursuant to Article 62 of Regulation (EU) 2016/679 of 27 April 2016 cited above, the information and documents useful for their mission, or by concealing such documents or information, or by removing them; 3 ° Either by communicating information that does not conform to the content of the recordings as it was at the time when the request was made or that does not present this content in a directly accessible form. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-23</strong> In the cases provided for in Articles 226-16 to 226-22-2, the erasure of all or part of the personal data subject to the processing that gave rise to the offence may be ordered. The members and agents of the National Commission for Informatics and Liberties are entitled to note the erasure of this data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-24</strong> Legal persons declared criminally liable, under the conditions provided for in Article 121-2, for the offences defined in this section shall incur, in addition to the fine in accordance with the procedures laid down in Article 131-38, the penalties provided for in 2 ° to 5 ° and 7 ° to 9 ° of Article 131-39. The prohibition mentioned in 2 ° of article 131-39 relates to the activity in the exercise or in the course of the exercise of which the offence was committed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are few of the French incriminations making liable the data controller or the person unlawfully accessing personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK Data Protection Act 2018 has introduced several offences: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2 id=\"offences-under-the-dpa-2018\">Offences under the DPA 2018</h2>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-119-obstructing-the-commissioner-in-inspecting-personal-data-to-discharge-an-international-obligation\"><a></a>Section 119: Obstructing the Commissioner in inspecting personal data to discharge an international obligation</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 119 is described as a ‘future-proofed’ version of s.54A DPA 1998. It is a provision that criminalises obstructing the ICO’s inspection of European information systems. The Commissioner may inspect personal data where the inspection is necessary in order to discharge an international obligation of the United Kingdom, subject to the restriction in subsection (2). Section 119 (6) states that it is an offence (a)intentionally to obstruct a person exercising the power under subsection (1), or (b)to fail without reasonable excuse to give a person exercising that power any assistance the person may reasonably require.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-132-prohibition-placed-upon-the-commissioner-or-the-commissioner-s-staff-against-disclosing-information-obtained-in-the-course-of-their-role-which-is-not-available-to-the-public\"><a></a>Section 132: Prohibition placed upon the Commissioner, or the Commissioner’s staff against disclosing information obtained in the course of their role (which is not available to the public)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 132 replaces section 59 DPA 1998 and criminalises action by former or current ICO staff who disclose data obtained during the course of their duties. Section 132 (2) clarifies the circumstances in which disclosure – with lawful authority – may be made. Section 132 (3) however confirms that it is an offence for a person knowingly or recklessly to disclose information in contravention of subsection (1).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-144-false-statement-made-in-response-to-an-information-notice\"><a></a>Section 144: False statement made in response to an information notice</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>It is an offence for a person, in response to information notice from the Commissioner, to make or recklessly make, a statement which they know to be false in a material respect.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-148-destroying-or-falsifying-information-and-documents-etc\"><a></a>Section 148: Destroying or falsifying information and documents etc</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Under Section 148 (2) (a) it is an offence for a person to destroy or otherwise dispose of, conceal, block or (where relevant) falsify all or part of the information, document, equipment or material. Section 148 (2) (b) makes to cause or permit the actions set pout in the previous subsection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-170-unlawful-obtaining-etc-of-personal-data\"><a></a>Section 170: Unlawful obtaining etc of personal data</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 170 of the Act builds on section 55 DPA 1998 which criminalised knowingly or recklessly obtaining, disclosing or procuring personal data without the consent of the data controller, and the sale or offering for sale of that data. The provision was most typically/commonly used to prosecute those who had accessed healthcare and financial records without a legitimate reason. Section 170 adds the offence of knowingly or recklessly&nbsp;<strong><em>retaining</em></strong>&nbsp;personal data (which may have been lawfully obtained) without the consent of the data controller. There are some exceptions: for example where such obtaining, disclosing, procuring or retaining was necessary for the purposes of preventing or detecting crime. Section 170 (2) and (3) set out the defences to Section 170 (1).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-171-re-identification-of-de-identified-personal-data\"><a></a>Section 171: Re-identification of de-identified personal data</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 171 - a new offence - criminalises the re-identification of personal data that has been ‘de-identified’ (de-identification being a process - such as redactions - to remove/conceal personal data). Section (5) states that it is an offence for a person knowingly or recklessly to process personal data that is information that has been re-identified. Sections 171 (3) and (4) set out the defences to Section 171 (1) – for example, the re-identification was necessary for the purposes of preventing or detecting crime. Sections 171 (6) and (7) set out the defences to Section 171 (5).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-173-alteration-etc-of-personal-data-to-prevent-disclosure-to-data-subject\"><a></a>Section 173: Alteration etc of personal data to prevent disclosure to data subject</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 173 relates to the processing of requests for data from individuals for their personal data. Section 173 (3) makes it a criminal offence for organisations (persons listed in Section 173 (4)) to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure. It builds on an offence under the Freedom of Information Act 2000. Possible defences to an offence under section 173 (3) are set out in Section 173 (5).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-184-prohibition-of-requirement-to-produce-relevant-records\"><a></a>Section 184: Prohibition of requirement to produce relevant records</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 184 (1) makes it an offence for a person to require another to provide them with or give them access to a relevant record linked to the employment, continued employment of one of their employees or a contract for the provisions of services to them. Section 184 (2) makes it an offence for a person to require another to provide them with or access to a relevant record if the requestor is involved in the provision of goods, facilities or services to the public or the requirement is a condition of providing or offering to provide goods, facilities or services to the other person or a third party. Section 184 (3) details the possible defences to offences under subsection 184 (1) or (2).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"schedule-15-paragraph-15-powers-of-entry-and-inspection\"><a></a>Schedule 15, Paragraph 15. Powers of Entry and Inspection</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>It is an offence under paragraph 15 (1) for a person to intentionally obstruct a person in the execution of a warrant issued under this Schedule or to fail without reasonable excuse to give a person executing the warrant such assistance as may be required. Under paragraph 15 (2) it is an offence for a person to make a statement in response to a requirement under paragraph 5(2(c) or (d) or 3(c) or (d) which the person knows to be false in a material respect or recklessly make such a statement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There are no custodial sentences in respect of offences under DPA 2018 and no powers of arrest; all offences are punishable only by a fine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Schedule 15 – Powers of entry and inspection, sets out the circumstances in which the Information Commissioner may apply for a search warrant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The DPA 2018 removed Section 77 (power to alter penalty for unlawfully obtaining etc personal data) of the Criminal Justice and Immigration Act 2008.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"///Users/New/Downloads/122558_49907c6f-a2e5-4c9e-8ee0-953315da668c.pdf\" target=\"_blank\">Irish Data Protection 2018</a> has introduced in Section 144 et all a series of offences :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"start\":144} -->\n<ol start=\"144\"><li>Unauthorised disclosure by processor</li><li>Disclosure of personal data obtained without authority</li><li>Offences by directors, etc., of bodies corporate</li><li>Prosecution of summary offences by Commission</li></ol>\n<!-- /wp:list -->','Non-Material Damage Compensation','Non compliance with the GDPR has three series of legal consequences : We\'ve extensively heard of the administrative enforcement by national Data Protection Authorities. We have less heard of Criminal liabilities for non compliance, especially for the absence of measures of security. The third level is civil liability as set by the Article 82 GDPR.','inherit','closed','closed','','2341-revision-v1','','','2022-02-12 14:56:39','2022-02-12 14:56:39','',2341,'https://www.datarainbow.eu/?p=2353',0,'revision','',0),(2357,1,'2022-04-04 16:08:57','2022-04-04 16:08:57','<!-- wp:paragraph -->\n<p><strong>Reading and analysing in the world of Internet regulation, a fast pace marathon :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>European Commission and United States Joint Statement on&nbsp;<a href=\"https://ec.europa.eu/commission/presscorner/detail/en/ip_22_2087\">Trans-Atlantic Data Privacy Framework</a>&nbsp;- The European Commission and the United States announce that they have agreed in principle on a new Trans-Atlantic Data Privacy Framework, which will foster trans-Atlantic data flows and address the concerns raised by the Court of Justice of the European Union in the&nbsp;<em>Schrems II</em>&nbsp;decision of July 2020.&nbsp;&nbsp;<a href=\"https://www.pearltrees.com/t/data-flow-outside-the-eea/id36643074\">A new step towards free data flow between the EU and the US.</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>-&nbsp;</strong><a href=\"https://noyb.eu/en/privacy-shield-20-first-reaction-max-schrems\"><strong>\"Privacy Shield 2.0\"? - First Reaction by Max Schrems</strong></a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.whitehouse.gov/briefing-room/statements-releases/2022/03/25/fact-sheet-united-states-and-european-commission-announce-trans-atlantic-data-privacy-framework/\">FACT SHEET:</a>&nbsp;United&nbsp;States and European Commission Announce Trans-Atlantic Data Privacy&nbsp;Framework</li><li><a href=\"https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-data-transfer-agreement-and-guidance/\">UK the international data transfer agreement (IDTA)</a>, the international data transfer addendum to the European Commission’s standard contractual clauses for international data transfers (Addendum) and a document setting out transitional provisions.</li><li><a href=\"https://edpb.europa.eu/our-work-tools/documents/public-consultations/2022/guidelines-32022-dark-patterns-social-media_en\">Guidelines 3/2022 on Dark patterns in social media platform interfaces:</a>&nbsp;How to recognise and avoid them. T<em>he European Data Protection Board welcomes comments on the&nbsp;\"Guidelines 3/2022 on Dark patterns in social media platform interfaces: How to recognise and avoid them\".</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>Such comments should be sent&nbsp;May 2nd 2022 at the latest&nbsp;u</em>&nbsp;https://edpb.europa.eu/our-work-tools/documents/public-consultations/2022/guidelines-32022-dark-patterns-social-media_en</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.pearltrees.com/idigital2/digital-market-act/id52208289\">The Digital Markets Act</a>: ensuring fair and open digital markets - \"The European Union has opened a new chapter in antitrust enforcement for the digital economy, adopting a raft of new rules designed to clamp down on abuses by some of the world’s largest tech firms.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In a deal brokered Thursday evening, officials from the European Parliament, Council and Commission concluded 15 months of intense negotiations on a new rulebook for Big Tech giants operating in the European market, the&nbsp;<a href=\"https://oeil.secure.europarl.europa.eu/oeil/popups/ficheprocedure.do?reference=2020/0374(COD)&amp;l=en\">Digital Markets Act</a>.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Shaping Europe’s digital future - The&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/library/data-act-factsheet\">Data Act</a>&nbsp;is a proposed Regulation harmonising rules on fair access to and use of data. It will play a key role in the digital decade, helping to shape the rules for the digital economy and society.&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The Data Act is part of the overall&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/policies/strategy-data\">European strategy for data,</a>&nbsp;and complements the&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/policies/data-governance-act\">Data Governance Regulation</a>&nbsp;of November 2020 by clarifying who can create value from data and under which conditions. It will also introduce rules concerning the use of data generated by devices connected to the Internet of Things.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Scientific research and pharmacovigilance: the first Code of Conduct approved by AEPD&nbsp;<a href=\"https://lnkd.in/eNYe5xGB\">https://lnkd.in/eNYe5xGB</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:heading {\"level\":5} -->\n<h5>Related topics&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/related-content?topic=73\">Cloud Computing</a>&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/related-content?topic=69\">Data</a>&nbsp;<a href=\"https://digital-strategy.ec.europa.eu/en/related-content?topic=50\">Advanced and Cloud Computing</a></h5>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>Subject:&nbsp;<a href=\"https://www.europarl.europa.eu/doceo/document/P-9-2022-000840_EN.html\">US Customs and Border Protection gaining access to EU biometric databases</a>&nbsp;- The US administration plans to subject travellers entering on the Visa Waiver Program (VWP) to new biometric data requirements. Under a \'comprehensive secure travel partnership’, VWP partners will give the relevant US border security authorities access to EU databases containing fingerprints and/or facial images. In return, the authorities of those countries will also be allowed to access US databases.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>1.&nbsp;What organisational and legal issues does the Council think Member States could encounter as a result of the comprehensive secure travel partnership, and what conclusion has it come to after examining these?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2.&nbsp;As things stand, which EU databases (such as the common biometric database) or networked information systems (such as the Prüm Decision or ‘Prüm II’) would the US authorities be allowed to access to consult biometric data under the comprehensive secure travel partnership, and to what extent would the ‘hit/no hit’ principle apply?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3.&nbsp;Which US databases would EU authorities gain access to under the comprehensive secure travel partnership?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>UK online safety bill - The&nbsp;<a href=\"https://bills.parliament.uk/bills/3137/publications\">Online Safety Bill</a>&nbsp;delivers the government’s manifesto commitment to make the UK the safest place in the world to be online while defending free expression. The Bill has been strengthened and clarified since it was published in draft in May 2021, and reflects the outcome of extensive Parliamentary scrutiny.</li><li>Much to catch on the subject of&nbsp;<a href=\"https://www.pearltrees.com/idigital2/adtech/id48624700\">Ad Tech, RTBF and IAB</a>, following Johnny Ryan suit.&nbsp;<a href=\"https://www.linkedin.com/in/ACoAAAB4rr0BpmYBFs2FENw30wRqHPRdbzCcB98\">Johnny Ryan</a>&nbsp;from the Council for Civil Liberties just&nbsp;<a href=\"https://www.linkedin.com/posts/taubmanbassirian_adtech-and-rtbf-under-gdpr-activity-6909193712916959234-pae9?utm_source=linkedin_share&amp;utm_medium=member_desktop_web\">announced taking the Irish DPC into court for inaction against Google RTBF.</a></li><li><a href=\"https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/13410-Cyber-resilience-act-new-cybersecurity-rules-for-digital-products-and-ancillary-services_en\">Cyber resilience act – new cybersecurity rules for digital products and ancillary services</a>&nbsp;- Digital products and ancillary services create opportunities for EU economies and societies. But they also lead to new challenges – when everything is connected, a cybersecurity incident can affect an entire system, disrupting economic and social activities.</li><li>More on&nbsp;<a href=\"https://www.pearltrees.com/t/facial-recognition/clearview/id29503451\">ClearviewAI</a>, its use by law enforcement and EU DPA fines.&nbsp;<a href=\"https://www.gamingtechlaw.com/2022/03/privacy-clearview-facial-recognition-system-italy.html\">€ 20 million privacy fine against Clearview AI facial recognition system in Italy</a></li><li>A new&nbsp;<a href=\"https://www.pearltrees.com/clarinettecaselaw/class-actions/id43827607\">class action</a>&nbsp;in the UK, this time against TikTok :&nbsp;<a href=\"https://www.farrer.co.uk/news-and-insights/english-court-allows-gdpr-representative-action-to-proceed/\">Data class actions in the spotlight again: English Court allows GDPR opt-out Representative Action to proceed</a></li><li><a href=\"https://verfassungsblog.de/roa-our-minds/\">Our Minds, Monitored and Manipulated - How AI Impacts Public Discourse and Democracy</a></li><li><a href=\"https://www-pymnts-com.cdn.ampproject.org/c/s/www.pymnts.com/antitrust/2022/frances-ovhcloud-files-antitrust-complaint-against-microsofts-cloud-services/amp/\">France’s OVHcloud Files Antitrust Complaint Against Microsoft’s Cloud Services</a></li><li><a href=\"https://www.nist.gov/news-events/news/2022/03/theres-more-ai-bias-biased-data-nist-report-highlights\">There’s More to AI Bias Than Biased Data, NIST Report Highlights</a>&nbsp;Rooting out bias in artificial intelligence will require addressing human and systemic biases as well.&nbsp;<a href=\"https://www.pearltrees.com/t/artificial-intelligence/human-ai-bias/id39339037\">Further read on AI and bias</a>&nbsp;&nbsp;</li><li>UK ICO fined&nbsp;<a href=\"https://ico.org.uk/action-weve-taken/enforcement/smith-law-shepherds-ifa-ltd-en/\">Smith Law &amp; Shepherds IFA Ltd has contravened Chapter 3, Article 15 of the GDPR.</a></li><li>In its decision to&nbsp;<a href=\"https://www.linkedin.com/posts/taubmanbassirian_ico-fine-tuckers-llp-solicitor-activity-6907974558822088704-fnaI?utm_source=linkedin_share&amp;utm_medium=member_desktop_web\">fine the law firm Tuckers LLP</a>, \"the Commissioner has considered, in the context of \"state of the art\", relevant industry standards of good practice including the ISO27000 series, the National Institutes of Standards and Technology (\"NIST\"), the various guidance from the ICO itself, the National Cyber Security Centre (\"NCSC\"), the Solicitors Regulatory Authority (\"SRA\"), Lexcel and \'NCSC Cyber Essentials\'.&nbsp;and the low cost of encryption.</li></ul>\n<!-- /wp:list -->','Latest Developments in The World of Data Protection and Internet Regulation','Reading and analysing in the world of Internet regulation, a fast pace marathon','publish','open','open','','2357-2','','','2022-04-04 17:35:34','2022-04-04 17:35:34','',0,'https://www.datarainbow.eu/?p=2357',0,'post','',0),(2354,1,'2022-02-12 15:10:03','2022-02-12 15:10:03','<!-- wp:paragraph -->\n<p>Non compliance with the GDPR has three series of legal consequences : We\'ve extensively heard of the administrative enforcement by national Data Protection Authorities. We have less heard of Criminal liabilities for non compliance, especially for the absence of measures of security. The third level is civil liability as set by the <a rel=\"noreferrer noopener\" href=\"https://ukgdpr.fieldfisher.com/chapter-8/article-82-gdpr/\" target=\"_blank\">Article 82 GDPR</a>. This article establishes a right to compensation and liability to \'<em>Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.</em>\' Action can be taken individually or in a class action. This is a serious threat while we are witnessing high rise of data breach incidents with increase cyber attacks and ransomware. When a controller has neglected to take appropriate security measures, it has to be liable for compensation. The difficulty here is that often the damage caused is not measurable or not imminent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its recent enforcement against an online payment company Slimpay, the French Data Protection CNIL clearly states that non compliance with the obligations of security in <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 32 GDPR</a> is sufficient without the need to prove access to the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"<em>La formation restreinte considère que l’absence de preuve d’une utilisation frauduleuse des données est sans incidence sur la caractérisation du manquement à l’obligation de sécurité. En effet, le risque d’utilisation frauduleuse des données à caractère personnel était réel, indépendamment des cas de fraude, dans la mesure où les données de nombreuses personnes ont été rendues accessibles à des tiers non autorisés. L’absence de dommage avéré pour les personnes concernées n’a pas d’incidence sur l’existence du défaut de sécurité, qui constitue le manquement à l’article 32 du RGPD.</em>\"</p><p>The restricted panel considers that the absence of evidence of fraudulent use of the data has no bearing on the characterisation of the breach of the security obligation. <strong>The risk of fraudulent use of personal data was real, irrespective of the cases of fraud, in so far as the data of many persons were made accessible to unauthorised third parties. The absence of proven damage to the data subjects does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.</strong></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>The Recital 146 goes more into detail on the indemnity:  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>The controller or processor should compensate any damage which a person may suffer as a result of processing that infringes this Regulation. The controller or processor should be exempt from liability if it proves that it is not in any way responsible for the damage. <strong>The concept of damage should be broadly interpreted in the light of the case-law of the Court of Justice in a manner which fully reflects the objectives of this Regulation</strong>. This is without prejudice to any claims for damage deriving from the violation of other rules in Union or Member State law. Processing that infringes this Regulation also includes processing that infringes delegated and implementing acts adopted in accordance with this Regulation and Member State law specifying rules of this Regulation. <strong>Data subjects should receive full and effective compensation for the damage they have suffered</strong>. Where controllers or processors are involved in the same processing, <strong>each controller or processor should be held liable for the entire damage.</strong> However, where they are joined to the same judicial proceedings, in accordance with Member State law, compensation may be apportioned according to the responsibility of each controller or processor for the damage caused by the processing, provided that full and effective compensation of the data subject who suffered the damage is ensured. Any controller or processor which has paid full compensation may subsequently institute recourse proceedings against other controllers or processors involved in the same processing.</em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Recital 85 in the context of a data breach states that :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p><em>A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, <strong>material or non-material damage</strong> to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy <strong>or any other significant economic or social disadvantage</strong> to the natural person concerned. </em></p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Several recent data breaches, British Airways, EASYJET, MARRIOTT, TICKET MASTER, ETC... have been hurt by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/class-actions/id43827607\" target=\"_blank\">class actions</a>. In The UK, the case raised by <a rel=\"noreferrer noopener\" href=\"https://www.pearltrees.com/clarinettecaselaw/richard-lloyd-v-google-copy/id50888527\" target=\"_blank\">Mr Lloyd against unlawful data access by Google</a> was ultimately rejected by the Supreme Court base to the fact that not all class members had suffers identical harm. When could that ever be the case? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Loss of control and distress have been the criteria in civil compensation following a data breach. Several German and Austrian courts have recognised the liability for non-material damages caused by data subjects. Three referrals for clarification have been made to the <a href=\"https://www.pearltrees.com/clarinettecaselaw/ecj/id43825447\" target=\"_blank\" rel=\"noreferrer noopener\">EUROPEAN COURT OF JUSTICE</a>. If interested by this important subject, you can have a deeper read on all relevant cases we could curate <a href=\"https://www.linkedin.com/posts/taubmanbassirian_gdpr-non-material-damage-liability-ugcPost-6893517983616950272-zPr5\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As for the Criminal liabilities, EU National legislations have introduced into their criminal laws specific incriminations. We know about the offense of <a rel=\"noreferrer noopener\" href=\"https://www.legislation.gov.uk/ukpga/1990/18/section/1\" target=\"_blank\">Computer Misuse Act</a> 1990 in the UK. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The chart below shows some of the main criminal offences introduced in the French legal system related to data protection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2343,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/02/Screenshot-2022-01-03-at-21.58.36-1024x654.png\" alt=\"\" class=\"wp-image-2343\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16 </strong>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years\' imprisonment and a fine of 300,000 euros. The same penalties shall be imposed on the act, including negligently, of carrying out or having carried out a processing which has been the subject of one of the measures provided for in 3 ° of III of Article 20 of Law No. 78-17 of 6 January 1978 relating to data processing, files and freedoms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16-1</strong> The fact, except in cases where the processing has been authorized under the conditions provided for by Law No. 78-17 of 6 January 1978 cited above, of carrying out or having carried out a processing of personal data including among the data on which it relates the registration number of persons in the national register of identification of natural persons is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17</strong> The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17-1</strong> The fact that a provider of electronic communications services or a controller does not notify a personal data breach to the Commission nationale de l\'informatique et des libertés or to the interested party, in breach of Articles 33 and 34 of Regulation (EU) 2016/679 of 27 April 2016 or the provisions of II of Article 83 and Article 102 of Law No. 78-17 of 6 January 1978, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply to a processor failing to notify the controller of this breach in breach of Article 33 of Regulation (EU) 2016/679 of 27 April 2016 or Article 102 of The aforementioned Law No 78-17 of 6 January 1978.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18</strong> Collecting personal data by fraudulent, unfair or unlawful means is punishable by five years\' imprisonment and a fine of €300,000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-18-1</strong> The fact of processing personal data concerning a natural person despite the opposition of this person, when this processing meets prospecting purposes, in particular commercial, or when this opposition is based on legitimate reasons, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19</strong> The fact, except in the cases provided for by law, of placing or storing in computerized memory, without the express consent of the person concerned, personal data which, directly or indirectly, reveal the racial or ethnic origins, political, philosophical or religious opinions, or trade union memberships of the persons, or which relate to their health or sexual orientation or gender identity, is punishable by five years\' imprisonment and a fine of €300,000. The same penalties shall apply, except in the cases provided for by law, to placing or storing in computerized memory personal data concerning offences, convictions or security measures. The provisions of this Article shall apply to non-automated processing of personal data the implementation of which is not limited to the exercise of exclusively personal activities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-19-1 </strong>In the event of the processing of personal data for the purpose of research in the field of health, the following is punishable by five years\' imprisonment and a fine of 300,000 euros: 1 ° Without having previously informed individually the persons on whose account personal data are collected or transmitted of their right of access, rectification and opposition, the nature of the data transmitted and the recipients thereof; (2) Despite the objection of the person concerned or, where provided for by law, in the absence of the informed and express consent of the person, or in the case of a deceased person, despite the refusal expressed by the latter during his lifetime.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-20</strong> The fact of keeping personal data beyond the period provided for by law or regulation, by the request for authorisation or opinion, or by the prior declaration addressed to the National Commission for Informatics and Freedoms, is punishable by five years\' imprisonment and a fine of 300,000 euros, unless this retention is carried out for historical purposes, statistical or scientific under the conditions provided for by law. The same penalties shall apply to the fact, except in the cases provided for by law, of processing personal data stored beyond the period mentioned in the first paragraph for purposes other than historical, statistical or scientific purposes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-21</strong> The fact, by any person holding personal data on the occasion of their registration, classification, transmission or any other form of processing, of diverting this information from its purpose as defined by the legislative provision, the regulatory act or the decision of the National Commission for Informatics and Freedoms authorising automated processing, or by the declarations prior to the implementation of this treatment, is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22</strong> The fact, by any person who has collected, on the occasion of their registration, classification, transmission or other form of processing, personal data the disclosure of which would have the effect of undermining the consideration of the interested party or the intimacy of his private life, to carry, without authorisation of the interested party, these data to the knowledge of a third party who does not have standing to receive them is punishable by five years\' imprisonment and a fine of 300,000 euros. The disclosure provided for in the preceding paragraph is punishable by three years\' imprisonment and a fine of 100,000 euros when committed by recklessness or negligence. In the cases provided for in the two preceding paragraphs, prosecution may be brought only on the basis of a complaint by the victim, his legal representative or his successors in title.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-1</strong> Carrying out or causing to be transferred personal data which is or is intended to be processed to a State not belonging to the European Union or to an international organisation in breach of Chapter V of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, or Articles 112 to 114 of Law No 78-17 of 6 January 1978 cited above, shall be punishable by five years\' imprisonment and a fine of EUR 300 000.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-22-2</strong> The following are punishable by one year\'s imprisonment and a fine of €15,000 for hindering the action of the National Commission for Informatics and Liberties: 1 ° Either by opposing the exercise of the missions entrusted to its members or authorised agents pursuant to the last paragraph of Article 10 of Law No. 78-17 of 6 January 1978 aforementioned when the visit has been authorised by the judge; 2 ° Either by refusing to communicate to its members or to the agents authorised pursuant to the last paragraph of Article 10 of the same law, or to the agents of a supervisory authority of a Member State of the European Union pursuant to Article 62 of Regulation (EU) 2016/679 of 27 April 2016 cited above, the information and documents useful for their mission, or by concealing such documents or information, or by removing them; 3 ° Either by communicating information that does not conform to the content of the recordings as it was at the time when the request was made or that does not present this content in a directly accessible form. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-23</strong> In the cases provided for in Articles 226-16 to 226-22-2, the erasure of all or part of the personal data subject to the processing that gave rise to the offence may be ordered. The members and agents of the National Commission for Informatics and Liberties are entitled to note the erasure of this data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-24</strong> Legal persons declared criminally liable, under the conditions provided for in Article 121-2, for the offences defined in this section shall incur, in addition to the fine in accordance with the procedures laid down in Article 131-38, the penalties provided for in 2 ° to 5 ° and 7 ° to 9 ° of Article 131-39. The prohibition mentioned in 2 ° of article 131-39 relates to the activity in the exercise or in the course of the exercise of which the offence was committed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are few of the French incriminations making liable the data controller or the person unlawfully accessing personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK Data Protection Act 2018 has introduced several offences: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2 id=\"offences-under-the-dpa-2018\">Offences under the DPA 2018</h2>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-119-obstructing-the-commissioner-in-inspecting-personal-data-to-discharge-an-international-obligation\"><a></a>Section 119: Obstructing the Commissioner in inspecting personal data to discharge an international obligation</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 119 is described as a ‘future-proofed’ version of s.54A DPA 1998. It is a provision that criminalises obstructing the ICO’s inspection of European information systems. The Commissioner may inspect personal data where the inspection is necessary in order to discharge an international obligation of the United Kingdom, subject to the restriction in subsection (2). Section 119 (6) states that it is an offence (a)intentionally to obstruct a person exercising the power under subsection (1), or (b)to fail without reasonable excuse to give a person exercising that power any assistance the person may reasonably require.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-132-prohibition-placed-upon-the-commissioner-or-the-commissioner-s-staff-against-disclosing-information-obtained-in-the-course-of-their-role-which-is-not-available-to-the-public\"><a></a>Section 132: Prohibition placed upon the Commissioner, or the Commissioner’s staff against disclosing information obtained in the course of their role (which is not available to the public)</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 132 replaces section 59 DPA 1998 and criminalises action by former or current ICO staff who disclose data obtained during the course of their duties. Section 132 (2) clarifies the circumstances in which disclosure – with lawful authority – may be made. Section 132 (3) however confirms that it is an offence for a person knowingly or recklessly to disclose information in contravention of subsection (1).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-144-false-statement-made-in-response-to-an-information-notice\"><a></a>Section 144: False statement made in response to an information notice</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>It is an offence for a person, in response to information notice from the Commissioner, to make or recklessly make, a statement which they know to be false in a material respect.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-148-destroying-or-falsifying-information-and-documents-etc\"><a></a>Section 148: Destroying or falsifying information and documents etc</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Under Section 148 (2) (a) it is an offence for a person to destroy or otherwise dispose of, conceal, block or (where relevant) falsify all or part of the information, document, equipment or material. Section 148 (2) (b) makes to cause or permit the actions set pout in the previous subsection.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-170-unlawful-obtaining-etc-of-personal-data\"><a></a>Section 170: Unlawful obtaining etc of personal data</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 170 of the Act builds on section 55 DPA 1998 which criminalised knowingly or recklessly obtaining, disclosing or procuring personal data without the consent of the data controller, and the sale or offering for sale of that data. The provision was most typically/commonly used to prosecute those who had accessed healthcare and financial records without a legitimate reason. Section 170 adds the offence of knowingly or recklessly&nbsp;<strong><em>retaining</em></strong>&nbsp;personal data (which may have been lawfully obtained) without the consent of the data controller. There are some exceptions: for example where such obtaining, disclosing, procuring or retaining was necessary for the purposes of preventing or detecting crime. Section 170 (2) and (3) set out the defences to Section 170 (1).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-171-re-identification-of-de-identified-personal-data\"><a></a>Section 171: Re-identification of de-identified personal data</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 171 - a new offence - criminalises the re-identification of personal data that has been ‘de-identified’ (de-identification being a process - such as redactions - to remove/conceal personal data). Section (5) states that it is an offence for a person knowingly or recklessly to process personal data that is information that has been re-identified. Sections 171 (3) and (4) set out the defences to Section 171 (1) – for example, the re-identification was necessary for the purposes of preventing or detecting crime. Sections 171 (6) and (7) set out the defences to Section 171 (5).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-173-alteration-etc-of-personal-data-to-prevent-disclosure-to-data-subject\"><a></a>Section 173: Alteration etc of personal data to prevent disclosure to data subject</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 173 relates to the processing of requests for data from individuals for their personal data. Section 173 (3) makes it a criminal offence for organisations (persons listed in Section 173 (4)) to alter, deface, block, erase, destroy or conceal information with the intention of preventing disclosure. It builds on an offence under the Freedom of Information Act 2000. Possible defences to an offence under section 173 (3) are set out in Section 173 (5).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"section-184-prohibition-of-requirement-to-produce-relevant-records\"><a></a>Section 184: Prohibition of requirement to produce relevant records</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Section 184 (1) makes it an offence for a person to require another to provide them with or give them access to a relevant record linked to the employment, continued employment of one of their employees or a contract for the provisions of services to them. Section 184 (2) makes it an offence for a person to require another to provide them with or access to a relevant record if the requestor is involved in the provision of goods, facilities or services to the public or the requirement is a condition of providing or offering to provide goods, facilities or services to the other person or a third party. Section 184 (3) details the possible defences to offences under subsection 184 (1) or (2).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading {\"level\":3} -->\n<h3 id=\"schedule-15-paragraph-15-powers-of-entry-and-inspection\"><a></a>Schedule 15, Paragraph 15. Powers of Entry and Inspection</h3>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>It is an offence under paragraph 15 (1) for a person to intentionally obstruct a person in the execution of a warrant issued under this Schedule or to fail without reasonable excuse to give a person executing the warrant such assistance as may be required. Under paragraph 15 (2) it is an offence for a person to make a statement in response to a requirement under paragraph 5(2(c) or (d) or 3(c) or (d) which the person knows to be false in a material respect or recklessly make such a statement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There are no custodial sentences in respect of offences under DPA 2018 and no powers of arrest; all offences are punishable only by a fine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Schedule 15 – Powers of entry and inspection, sets out the circumstances in which the Information Commissioner may apply for a search warrant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The DPA 2018 removed Section 77 (power to alter penalty for unlawfully obtaining etc personal data) of the Criminal Justice and Immigration Act 2008.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a rel=\"noreferrer noopener\" href=\"///Users/New/Downloads/122558_49907c6f-a2e5-4c9e-8ee0-953315da668c.pdf\" target=\"_blank\">Irish Data Protection 2018</a> has introduced in Section 144 et all a series of offences :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"start\":144} -->\n<ol start=\"144\"><li>Unauthorised disclosure by processor</li><li>Disclosure of personal data obtained without authority</li><li>Offences by directors, etc., of bodies corporate</li><li>Prosecution of summary offences by Commission</li></ol>\n<!-- /wp:list -->','Non-Material Damage Compensation','Non compliance with the GDPR has three series of legal consequences : We\'ve extensively heard of the administrative enforcement by national Data Protection Authorities. We have less heard of Criminal liabilities for non compliance, especially for the absence of measures of security. The third level is civil liability as set by the Article 82 GDPR.','inherit','closed','closed','','2341-revision-v1','','','2022-02-12 15:10:03','2022-02-12 15:10:03','',2341,'https://www.datarainbow.eu/?p=2354',0,'revision','',0),(2364,1,'2022-05-25 13:21:11','2022-05-25 13:21:11','<!-- wp:paragraph -->\n<p>I have been watching legal professionals disseminating personal data around the world. Feel my pain ? Why it especially matters? Because they are the ones advising others. They are the role model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the GDPR has now celebrating its 6th year and 4 years of enforcement, here is an exhaustive practical case law analysis on the importance of taking appropriate security measures and how things can go wrong.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you don\'t have time to read this in full detail, here are the questions at sake : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>can legal professionals, bound by confidentiality, handling sensitive data, afford to miss appropriate measures of security as required by the article 32 GDPR, starting by encryption? CNIL is not chocked by years of exchange of data via simple attachment.</li><li>Is this OK for these professionnels to use third party processors without checking their GDPR compliance and security measures? Especially, is free WeTransfer appropriate for legals to exchange documents? What about art 28 GDPR ? CNIL is OK with that.</li><li>Can these professionnels export data outside the EU without any security measure? CNIL agrees that exchanging multiple data during a long period of over a decade with a client based in China using his professional email, admitting his employer access his devices, is OK as there would be no transfer in sense of GDPR.</li><li>When victim of phishing, how to demonstrate who leak what? what are the rights of the victims? The French CNIL does not care about the victim.</li><li>Data breach has administrative sanctions given by the supervisory authorities, criminal sanctions have been introduced in national legislations,  and Article 82 has introduced civil liability for non-material damages : loss of control and distress (to be developed in a future article). This could be the only hope.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>I – Appropriate measures of security and data breach</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have been warning about the need for encryption when handling sensitive data. I have contacted the law society who have confirmed my requests as legitimate. Encryption is essential and WeTransfer is not an option. More secured tools are available; they are dangerously ignored. French Data Protection Authority <a href=\"https://www.cnil.fr/fr/securite-securiser-les-echanges-avec-dautres-organismes\">CNIL has published recommendations</a> not to use email to exchange personal data. <a href=\"https://www.ssi.gouv.fr/uploads/2017/01/guide_hygiene_informatique_anssi.pdf\">ANSSI</a> has published several warnings concerning the risks related to email exchanges.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was first on Marsh 2021 that I received two separate emails, in two of my email addresses I had used with one of these French legals, a notaire (some kind of solicitor/notary). The emails as shown below, <strong>reproduced previous exchanges</strong> I had with the professional. It appears as a chain of communication, with a short sentence inviting to click on the attachment. Same kind of operations were repeated in June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2367,\"width\":553,\"height\":572,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phisihing-Watin-1-1-989x1024.png\" alt=\"\" class=\"wp-image-2367\" width=\"553\" height=\"572\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2369,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-3-780x1024.png\" alt=\"\" class=\"wp-image-2369\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2370,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-4-797x1024.png\" alt=\"\" class=\"wp-image-2370\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2383,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-2-1-839x1024.png\" alt=\"\" class=\"wp-image-2383\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong><u>What Does that mean?</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Someone has been able to access to previous emails to this professional ;</li><li>The mails were non-encrypted, despite my request to secure our exchanges ;</li><li>These emails have fallen in the hands of cyber-criminals ;</li><li>The cybercriminals have been to reproduce previous exchanges with the professional, including highly sensitive documents ;</li><li>This to me is a data breach that should have been notified with 72 hours to the CNIL and without undue delay to data subject concerned if a serious risk was detected. I can’t see how this was not the case when a IBAN numbers, ID cards etc were exposed ;</li><li>The phishing emails received contained a malicious zip file that has been analysed by an IT expert ;</li><li>The attack is very similar to what has been described as a <a href=\"https://tekdeeps.com/trojan-qbot-steals-e-mails-and-misuses-them-for-further-attacks-it-can-also-attack-in-the-czech-republic/\">Qbot attack</a> or <a href=\"https://www.gdata.fr/news/2021/05/36849-g-data-rapport-sur-les-menaces-qbot-remplace-emotet\">Emotet</a>. Several big companies such as <a href=\"https://www.lemagit.fr/actualites/252502320/Quel-est-le-point-commun-entre-Fujifilm-JPS-et-un-office-notarial-francais-Qbot\">Ikea, Fujifilm or JPS</a> have been victim of these email chain attacks designed to <a href=\"https://www.lemondeinformatique.fr/actualites/lire-le-malware-financier-qbot-reprend-du-service-74527.html\">extract financial data</a>.</li><li>Clicking on the <a href=\"https://blog.nviso.eu/2020/09/01/epic-manchego-atypical-maldoc-delivery-brings-flurry-of-infostealers/\">zip attachment</a> could infect the computer network to steal further financial information ;</li><li>The email appears on a mobile device only showing the name of the professional to gain the recipient’s trust. It’s only by looking more closely that a different email address appears. Therefore, it becomes relatively easy to be trapped ;</li><li>If I have received these 4 emails, there is a big chance I would not the only one ;</li><li>Actually, this could be a larger scale attack of the platform used by notaires. <a href=\"https://www.lemagit.fr/actualites/252502320/Quel-est-le-point-commun-entre-Fujifilm-JPS-et-un-office-notarial-francais-Qbot\">Two other cases have been brought to my attention</a>, one of them being the very respected lawyer representing me.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>After I received the first emails, I sent several emails to the notaire on a different email address to check if they knew anything. I finally called them to understand what had happened. I was told by the big boss that he had no idea, had no care and probably have they been hacked just as it happens to many….</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I then turned into the French Cyber Gendarmerie online, they told me it was a spam. But how a simple spam could reproduce my previous emails ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Anxious about the data the cybercriminals had access to, I then send a request of information to the notaire trying to understand how they secured my data. They decided they needed an extra two months without justifying it. When I asked if they had a Data Protection Officer, they remembered than indeed all ‘notaires’ have an external mutualist DPO. Only in June did they notified the CNIL (data breach have to be notified within 72 hours to the CNIL and without undue delay to data subjects. My documents contained other people’s data breached as well. To my knowledge no data subject has been notified). From a document communicated by their DPO, last year the CNIL has requested some further information from them. So maybe after all this was not a simple Spam.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With the very slow progress with the notaire, I contacted a lawyer in Paris, Maître François-René Lebatard, who urged me to file a criminal complaint before all evidence would vanish. That was around June last year. The complaint is still under investigation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, I contacted the CNIL that accepted to investigate my complaint. Here is their conclusion :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>«&nbsp;Following the intervention of the CNIL, the data protection officer (DPO) of the firm, who was reminded of the obligations in force with regard to requests for access rights and the security of personal data, indicated:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>…</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>They have, following the letter from Ms xxx of 20 March 2021 indicating that she had received fraudulent emails, questioned their IT service provider asking for a detailed expert report, investigations from which it appears that no data breach is proven, that the fraudulent emails received by Ms xxx took over emails which she was the sender, that they did not concern any email that the office would have sent to Ms xxx as a recipient and that no other office\'s client had reported having received fraudulent emails.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No further explanation on where these phishing emails came from. Case closed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When back to our business with the notaire, I had to send him a legal document. I used Protonmail encryption. Again, he expected me to send it by email simple attachment. I had to remind him his DPO had mentioned they had a secure mean of document exchange. So even after the incident, was he still convinced <a href=\"https://www.americanbar.org/groups/business_law/publications/blt/2016/06/07_borden/\">exchanging data by simple email attachment ‘as usual’ is the way to go.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Now lets talk about <strong>the law firm involved in this case</strong>. A law firm advertising their international businesses. They exchangemassive amounts of documents by email attachment before discovering the joy of the free WeTransfer. Few law firms in Paris use WeTransfer because it’s free and convenient. I have tried my best to bring to their attention the risks paused by this tool. So, lets look deeper into that free WeTransfer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong><u>What’s wrong with the use of a free WeTransfer for a law firm ?</u></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://teamdrive.com/en/how-secure-is-wetransfer/\">WeTransfer</a> is a platform where users can upload their documents, receive a link with a password to send to their recipients.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>WeTransfer has <a href=\"https://www.bleepingcomputer.com/news/security/phishing-campaign-bypasses-email-gateways-via-wetransfer-alerts/\">been attacked several times</a> <a href=\"https://wetransfer.com/corporate/178267-update-security-notice-june-26th\">in the past</a>. <a href=\"https://www.hackread.com/wetransfer-phishing-attack-spoofs-steal-credential/\">Links have been intercepted</a> or <a href=\"https://threatpost.com/popular-file-sharing-service-wetransfer-used-in-malicious-spam-campaigns/146671/\">used in malicious spam</a> ; <a href=\"https://wetransfer.pr.co/178267-security-notice\" target=\"_blank\" rel=\"noreferrer noopener\">According to WeTransfer</a>, on June 16 and 17, file transfer emails were sent to unintended email addresses</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“<em>We have learned that a transfer you sent or received was also delivered to some people it was not meant to go to. Our records show that those files have been accessed, but almost certainly by the intended recipient. Nevertheless, as a precaution we blocked the link to prevent further downloads,”</em>&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.bleepingcomputer.com/news/security/phishing-campaign-bypasses-email-gateways-via-wetransfer-alerts/\">A phishing campaign</a> observed by security researchers at the Cofense&nbsp;Phishing Defense Center targeting a wide range of high profile entities from industries such as media and banking was detected in july: <em>“using WeTransfer&nbsp;notifications as surrogates for the run-of-the-mill malicious URLs usually employed in these type of attacks&nbsp;was recently detected while successfully bypassing email gateways developed by Microsoft, Proofpoint, and Symantec.”</em></li><li>Again in August 2021, it is reported ‘<a href=\"https://www.hackread.com/wetransfer-phishing-attack-spoofs-steal-credential/\">New WeTransfer phishing attack spoofs file-sharing to steal credential</a>’</li><li>&nbsp;<a href=\"https://www.pearltrees.com/t/data-in-law-firms/wetransfer/id41633223/item366308782\">Free WeTransfer</a> does not give the <a href=\"https://wetransfer.zendesk.com/hc/en-us/articles/360000905623-GDPR-Requesting-a-Data-Processing-Agreement\">option of a Data Processing Agreement (DPA)</a> required for any data processor used as by <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\">Article 28 GDPR</a> ; <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\">Art 28-3 states</a> : “<em>Processing by a processor shall be governed by a contract or other legal act under domestic law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.</em>&nbsp;“</li><li>Data at rest is not encrypted and can be accessed ‘for technical purpose’ ;</li><li>The balance of proportionality and obligations of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32 GDPR</a> - combined with <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-24-gdpr/\">Article 24</a> <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-25-gdpr/\">and 25</a>, privacy by design - require to take account of the sensitivity of the data, balanced with the state of the art and the cost of the implementation, to take appropriate security measures, starting by encryption as reminded to the<a href=\"https://ico.org.uk/action-weve-taken/enforcement/tuckers-solicitors-llp-mpn/\"> law firm</a> <a href=\"https://ico.org.uk/action-weve-taken/enforcement/tuckers-solicitors-llp-mpn/\">Tuckers LLP fined by the UK ICO</a> or by the <a href=\"https://gdprhub.eu/index.php?title=DPC_(Ireland)_-_DPC_Case_Reference:_IN-19-9-5&amp;section=6\">Irish DPC fining Bank Of I</a>reland ; [the UK ICO referred to the “<em>state of the art</em>\", as ‘<em>relevant industry standards of good practice including the ISO27000 series, the National Institutes of Standards and Technology (\"NIST\"), the various guidance from the ICO itself, the National Cyber Security Centre (\"NCSC\"), the Solicitors Regulatory Authority (\"SRA\"), Lexcel and \'NCSC Cyber Essentials\'.</em><em> </em>‘</li><li>Recital 83 on the balance of proportionality&nbsp;:</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“<em>In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing <strong>and implement measures to mitigate those risks</strong>, <strong>such as encryption.</strong>&nbsp;Those measures should ensure an <strong>appropriate level of security</strong>, including <strong>confidentiality</strong>, taking into account the <strong>state of the art</strong> and the <strong>costs of implementation </strong>in relation to the <strong>risks</strong> and the <strong>nature of the personal data</strong> to be protected.&nbsp;3In assessing data security risk, consideration should be given to the risks that are presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed which may in particular lead to physical, material or non-material damage.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It happens that the French law society (CNB) that I have contacted has informed me of the existence of a secured platform lawyers can use for the transmission of their documents. Therefore no excuse to go to an unreliable free third party ;</li><li>Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">WeTransfer uses AWS servers</a> to store data, which is not without consequences with regard to the prohibition of data transfers to the US following the invalidation of the Safe Harbour then Privacy Shield based on the well-known ECJ decision in <a href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\">Schrems-II.</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>indisputable practicality</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have to say, the insistence of the law firm to use WeTransfer was not innocent. They had been warned their WeTransfer links would not be touched. Their insistence to refuse more secure options was not innocent and certainly part of their dirty strategy. They have been trying to pretend to communicate evidence that does not exist. Fortunately, another party took care to transfer their WeTransfer linked documents. The document listed was not there. They have yet not reacted on the missing documents requests several months later.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The same way have they ignored to respond to the requests concerning their appropriate security measures hiding behind attorney/client privilege. They were not asked to reveal their communications with their client.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It happens that their client who has initiated the various legal proceedings in France is based in China and to my knowledge, he exclusively uses his professional email address. He has even warned about his employer accessing his personal devices for inspection : ... “<em>Unfortunately my personal computer has been confiscated by xxx [the employer is a major communication provider with close tights with the government] for security reasons so can’t access personal mail till Monday. Because I used it for work in xxxx they have to take everything out of it including Windows 7 ...”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facing this abusive resistance, I had to turn into the CNIL. The CNIL requested the law firm to respond to my request. It was eventually clarified they used the free version of WeTransfer with no DPA. At least, they finally discovered they could use the secured CNB platform at their disposition. However, the password, a 6 single digit figures, was sent to all parties - including the notaire above –immediately following the link, using same channels. I personally find it hard to believe they could be that dumb. (I don’t think the CNB’s platform should allow such weak passwords. <a href=\"https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-fines-transavia-poor-personal-data-security\">Dutch DPA has fined Transavia for poor personal data security allowing weak passwords</a> ; <a href=\"https://gdprhub.eu/index.php?title=CNIL_(France)_-_D%C3%A9lib%C3%A9ration_SAN-2021-020_du_28_d%C3%A9cembre_2021\">French CNIL has been itself rather strict in their security requirements from Slimpay fined 180.000 €. </a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Password strenght was highlited by ANSSI : «&nbsp;the length and complexity of a password remain basic criteria for assessing its strength.” The need for a strong password is crucial to ensure the security and confidentiality.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cnil.fr/sites/default/files/atoms/files/recommandation_passwords_en.pdf\">CNIL’s recommendations</a> : “<em>For the sake of clarity, the Restricted Committee notes that in order to ensure a sufficient level of security and satisfy the password strength requirements, when authentication relies solely on an identifier and password, the CNIL recommends, in its Decision No. 2017-012 of 19 January 2017, that the password have at least twelve characters - containing at least one upper-case letter, one lower-case letter, one number and one special character - or at least eight characters - containing three of these four characters - if it is accompanied by an additional measure such as, for example, the timing of access to the account after several failures (temporary suspension of access, the duration of which increases as attempts are made), setting up a mechanism to guard against automated and multiple attempts (e.g. a “captcha”) and/or locking the account after several failed login attempts. </em><em>“ in CNIL SAN 2022-022&nbsp;».</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-une-faq-pour-comprendre-lessentiel-en-quelques-minutes\">CNB’s recommendations</a>&nbsp;: “<em>Toutes les données envoyées par courriel ou transmises au moyen d’outils d’hébergement en ligne (Cloud) sont par conséquent vulnérables. Il s’agit donc de procéder à leur chiffrement systématique avant de les adresser à un correspondant ou de les hébergerLa transmission du secret (mot de passe, clé, etc.) permettant alors de déchiffrer les données, si elle est nécessaire, doit être effectuée via un canal de confiance ou, à défaut, un canal distinct du canal de transmission des données. Ainsi, si les données chiffrées sont transmises par courriel, une remise en main propre du mot de passe ou, à défaut, par téléphone doit être privilégiée.</em>&nbsp;:</li><li><em><a href=\"“https:/www.ssi.gouv.fr/uploads/2017/01/guide_hygiene_informatique_anssi.pdf\">ANSSI Guide de l’ hygiène informatique</a></em></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In their letter they admited exchanging regularly with their client in China. This concerns massive amount of highly personal data for more than a decade, with no appropriate security measure. Their justifications? Well, China has voted the data protection regulation PIPL, so all is good !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They admit having been non-compliant for years before recently discovering the platform they had refused to use when first suggested.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Again, this month, I received a fishing email from that law firm using a similar technic as shown below.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2372,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing_CBBC_Anonymised_08032022-1-1024x862.png\" alt=\"\" class=\"wp-image-2372\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Previously, in December 2020 I had received another suspicious email from that same law firm they never clarified if it came from them or not.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2373,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Spam-CBBC-IBP-18122020-1-808x1024.png\" alt=\"\" class=\"wp-image-2373\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>CNIL closed the case satisfied by these arguments without looking at :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>the question of long years of data transfers without any appropriate security measure ;</li><li>the use of the free version of WeTransfer without DPA art 28 while they could at least afford the professional version offering better guaranties;</li><li>use of the professional email address of the client and access by his employer</li><li>CNIL accepted there has not been a transfer as the receiver is an individual to whom GDPR does not apply.</li><li>resistance to reply to my requests, The CNIL did not care that the law firm rejected my DSAR for many years.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Here is a translation of CNIL’s decision - emphasises by me</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>Firstly, with regard to your difficulties relating to the exercise of the right of access to your personal data, XXXX, when questioned by the CNIL, indicated that this information was covered by professional secrecy. I confirm in this regard that, in accordance with the provisions of Article 23 of the General Data Protection Regulation (GDPR), the French legislator has, in Article 66-5 of Law No 71-1130 of 31 December 1971 reforming certain judicial and legal professions, provided for a limitation on the right of access. Under the above-mentioned article: \"In all matters, whether in the field of counsel or in that of defence, consultations sent by a lawyer to his client or intended for him, correspondence exchanged between the client and his lawyer, between the lawyer and his colleagues with the exception for the latter of those bearing the mention \"official\", the interview notes and, more generally, all documents in the file are covered by professional secrecy. ». [I don’t think I have ever questioned the confidentiality of their correspondences with their client]</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Secondly, with regard to the supervision of the transfers of your data made by XXXX, in particular to China where the firm\'s client resides to whom, according to your assertions [XXXX has XXXX clearly admitted doing so], your data would be sent, XXXX, questioned by the CNIL, indicates that there is no transfer strictly speaking.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>I confirm in this regard that it follows from the ongoing discussions at the level of the European Data Protection Board (EDPB) that a transfer exists only if the personal data are transmitted to an importer located in a third country. However, since the client of the firm to which you believe your data is transferred cannot be qualified as a controller, joint controller or processor, the transmission operation cannot be qualified as a transfer of personal data outside the European Union.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Thirdly, as regards the security measures implemented by XXXX to guarantee the integrity and confidentiality of your data, that firm has on the one hand specified the security measures deployed in the context of the use of the \"WeTransfer\" tool and on the other hand indicated that it now uses the e-Sharing platform, developed by the National Council of Bars, whose technical characteristics as described in the firm\'s response appear to meet the security obligations provided for in Article 5.1-f) of the GDPR. [Last WeTransfer link sent to me and other parties was last year. Before that for many years they exchanged via email attachment. They recognised I have been asking them – bothered them – to secure these exchanges due to highly sensitive data involved]</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Regarding the facts alleged in your message of May 10, 2022 according to which the XXXX firm recently sent you the password through the same channel (email) as that used to send the link to the platform, and that this password contains only 6 characters, XXXXX was reminded of the elementary precautions recalled by the CNIL on these points.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>In the light of these elements, I inform you to proceed to the closure of your complaint.&nbsp;»</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Surprisingly, neither the law firm, nor the notaire care about the fraudulent use of their email addresses or name !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although they admitted “<em>Ms. xxx obviously benefits from the right to ask the data controller for access to personal data, the rectification or erasure thereof, or a limitation of the processing relating to the person concerned, as well as the right to object to processing and the right to data portability. These rights are however limited by the very purpose of the processing of personal data, namely the recognition, exercise or defense of legal rights (Articles 16, 17, 18 and 20 of the GDPR).”</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm pretended holding data indirectly collected. However, they forget that some of the documents have been directly collected to comply with the principle of ‘<em>contradictoire</em>’ or adversarial principal.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They pretend they are under no obligation to respond to my DSAR as I would already have knowledge of the information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>- </strong>Where personal data is not collected from the data subject, any available information as to its source :they argue this information is also covered by professional secrecy. Therefore, they would not be able to reveal all of their sources [expect use of private investigators]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“Under these conditions, if Ms. xxx actually wished to request such a copy, she is asked to specify the data or the processing operations to which her request relates, as Cabinet xxx cannot decently gather all of this information in just one months as required by the GDPR. [Did they requested an extended delay?]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Their justification on the use of WeTransfer is rather enlightening:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Indeed, WeTransfer has indisputable practicality –</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They add “<em>If the firm was able to effectively use this tool to transmit documents, during a well-defined and now over period, to Ms. xxx\'s lawyer, to the notary, as well as to Ms. Xxx herself, it is recalled that the processing carried out here mainly concerned personal data relating to our client who has expressly consented to the use of this medium and has requested that it be use</em>.” This is totally untrue. A legal case obviously involves exchange of personal data concerning various parties. How did CNIL not reacted to that is a mystery.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have recognised using free WeTransfer in several occasions when they could have easily use alternative secure tools, ognoing my requests and the high sensitivity of the data: On February 3 and 20, 2020, October 14, 2020, January 14 and 22, 2021, January 29, 2021, December 9, 2021 and January 14, 2022.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They don’t despute my ‘<strong><em>numerous inquiries</em></strong><em> about WeTransfer’</em>. It had to come to the CNIL’s attention for them to make ‘<em>the necessary changes in order to comply with the GDPR and no longer use this service</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>II - On the question of regular long-term transfers to CHINA</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm is based in France. The litigation is initiated in France based on the French nationality of their client. The client is based in China. However, he travels around the world including in Europe where some of the exchanges have occurred and while in Europe, no doubt GDPR applied to these transfers. Data transfers via China where the email servers of the employer are located.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm collect personal data from their client, from me directly in respect with the principal of adversarial, from the notaire, and I suspect from their communications, from private investigators. These documents are then forwarded to their client for observation. Then sent back to them. These will be used and reproduced to draft the court documents again exchanged between all parties including the client. Therefore, the law firm is data controller (see UK ICO cases of Tuckered LLP or Smith… ). Would the client be as well a data controller of the part of data he gathers, stores and processed? Possibly. In two cases, ECJ has considered individual as data controller : in the Facebook fan page admin case and in Jeowah’s Witnesses. [in <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0040\">ECJ Fashion ID</a> “(<em>A)s the Advocate General noted, [...-] it appears that a natural or legal person may be a controller, within the meaning of Article 2(d) of Directive 95/46, jointly with others only in respect of operations involving the processing of personal data for which it determines jointly the purposes and means. By contrast, [...] that natural or legal person cannot be considered to be a controller, within the meaning of that provision, in the context of operations that precede or are subsequent in the overall chain of processing for which that person does not determine either the purposes or the means</em>”.<br>In <a href=\"https://gdprhub.eu/index.php?title=CJEU_-_C%E2%80%9125/17_-_Tietosuojavaltuutettu\">Jehovah’s witnesses, C-25/17</a>, the CJEU considered that a religious community of Jehovah’s witnesses acted as a controller, jointly with its individual members.]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm argued that ‘<em>The “transfers” in question are in no way regular and permanent but rather punctual and occasional, as much as respect for the adversarial process has made it necessary to communicate the documents in the file. Moreover, strictly speaking, there is no transfer outside the European Union at the initiative of xxx since <strong>it is the recipient of the data who imports the data</strong> because he is domiciled outside the European Union. And it should be remembered that the GDPR does not apply to natural persons not residing in the European Union.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Can we still talk<em> about ‘ponctual and occasional’</em> for something that has last 11 years ?! Massive amount of highly personal sensitive data have been exchanged refusing the special request to use encryption rejected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Their argument is that the transfers almost exclusively concerned data obtained indirectly through the lawyer., the notary or the client. This is not exact as some of the data was directly collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Knowing that several litigations initiated since 2011 involving different jurisdictions in France, it’s difficult to admit these heavy volume of data exchanges were ‘<em>ponctual</em>’ (3 court of appeals, 4 other jurisdictions, several notaires, huissiers, or Avoués were involved each time data has been sent with no care)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In any case, their communications between the law firm and the notaire are not confidential Article 14 paragraph 5, d). – in contrary I should have been in copy on all of them</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Concerning Chinese employers practice, here is </strong><a href=\"https://www.politico.eu/article/huawei-germany-court-case-privacy/\">report by Politico</a> :</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>“A case filed by one of Huawei’s former managers at its European headquarters in Düsseldorf takes aim at another pitfall for the company: Its respect of European privacy rules.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Specifically, it opens up questions about whether Huawei is putting data at risk of slipping into the hands of Chinese state surveillance and intelligence operations. It also raises questions about whether Europe will sharpen its tone with China on sensitive data privacy matters — after years of focusing its ire on Silicon Valley’s giants and U.S. state surveillance.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>A judge ruled March 5 that Huawei was in breach of European privacy law when it failed to comply with the former manager’s request to view the data the company had kept on him.” &nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Ultimately, non-compliance with GDPR is <a href=\"https://www.cnil.fr/fr/les-sanctions-penales\">a criminal offense</a></strong><strong> :</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le fait, y compris par négligence, de procéder ou de faire procéder à des traitements de données à caractère personnel sans qu\'aient été respectées les formalités préalables à leur mise en oeuvre prévues par la loi est puni de cinq ans d\'emprisonnement et de 300 000 euros d\'amende.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le fait de procéder ou de faire procéder à un traitement de données à caractère personnel sans mettre en oeuvre les mesures prescrites aux articles 24, 25, 30 et 32 du règlement (UE) 2016/679 du 27 avril 2016 précité ou au 6° de l\'article 4 et aux articles 99 à 101 de la loi n° 78-17 du 6 janvier 1978 précitée est puni de cinq ans d\'emprisonnement et de 300 000 euros d\'amende.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>Previous related CNIL’s decisions </u></strong><strong><u></u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>For reference, here are previous similar cases involving the questions of security measures</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Slimpay, lack of measures of security <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32</a>, without the need to prove any illegitimate access to the data&nbsp;:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“95. <em>The Restricted Committee then notes that the accessible data (title, surname, first name, e-mail address, postal address, telephone number, BIC/IBAN) make it possible to obtain very precise information on the persons concerned by revealing their identity and their contact information.&nbsp;In addition, specific data are in question when some relate to financial information.&nbsp;The fact in particular that the <strong>IBAN appears is not insignificant</strong>.&nbsp;As the Banque de France indicated in its book \"Payments and market infrastructures in the digital age\", <strong>IBANs are \"sensitive\" payment data</strong> (in the ordinary sense of the term) because they can be used to commit fraud. .&nbsp;The European Data Protection Board describes this type of data as \"highly personal\".&nbsp;The Restricted Committee considers that the company should have exercised particular vigilance with regard to securing such data, which may be reused by unauthorized third parties, thus harming the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining data) when their full identity, associated with their email address for many, was freely accessible.&nbsp;thus prejudicing the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining</em> <em>data) when their full identity, associated with their email address for many, was freely accessible.&nbsp;thus prejudicing the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining data) when their full identity, associated with their email address for many, was freely accessible.</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>“68. The Restricted Committee considers that the absence of proof of fraudulent use of the data has no impact on the characterization of the breach of the security obligation.&nbsp;Indeed, the risk of fraudulent use of personal data was real, independently of the cases of fraud, insofar as the data of many people were made accessible to unauthorized third parties.&nbsp;The absence of proven harm to the persons concerned does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.”</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042676787\">The French DPA (CNIL) imposes a 3,000 euros fine on a doctor</a> for failing to comply with the security obligation, due to the free access on the web of his patients\' health data. CNIL recalls its own guidelines on Personal Data Security recommending encryption as a standard security measure. Similarly, the Practical Guide for Physicians encourages physicians to encrypt their patients\' data with suitable software.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Transmitting unsecured emails: the restricted training points out that it also emerges from the hearing of December 17, 2019 that “<em>Mr. [...] had also not taken care to encrypt the data contained in his personal laptop, considering that encryption slows down the execution of applications too much (medical file, image visualization tool).</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>26. In the absence of encryption, the medical data contained in that computer\'s hard drive were readable in plain text by any person taking possession of that device (for example, as a result of its loss or theft) or by any person who unduly entered the network to which that computer was connected.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its guidance The security of personal data, the CNIL recommends providing encryption means for nomadic workstations and mobile storage media (laptop, USB keys, external hard disk, CD-R, DVD-RW, etc.), for example via the encryption of the hard disk in its entirety when the operating system offers it, file-by-file encryption or the creation of encrypted containers (file likely to contain several files). Similarly, the Practical Guide for Physicians invites physicians to encrypt their patients\' data with appropriate software.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2021-021\">The French DPA (CNIL) fined a mobile operator €300,000</a> for failing to respect customers\' right of access and right to object by not responding to their access requests in a timely manner and sending them marketing messages despite having been notified of their objection to such processing.</li><li><a href=\"https://gdprhub.eu/index.php?title=CNIL_-_SAN-2020-008\">The French DPA (CNIL) imposed a € 2250000 fine on Carrefour France</a> for several violations of the GDPR and French data protection law. These include : excessive data retention periods, incomplete and unclear information on data processes, lack of proper answer to data subjects\' requests, security breaches and illicit use of cookies.</li><li>The CNIL also referred to a&nbsp;<a href=\"https://www.legifrance.gouv.fr/ceta/id/CETATEXT000038388017/\">decision n°423559</a>&nbsp;by the French Supreme Administrative Court (Conseil d\'Etat) which allowed for such sanctions, even if the violation had been corrected. (NESTOR)</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Other cases in the EU</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://lnkd.in/dFuE5SHj\">A hospital in Sweden</a> received a fine&nbsp;of 150k EUR because it was sending medical records via email to patients and referring hospitals, unencrypted.<br>That was a&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">GDPR</a>&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">security</a>&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=issue&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">issue</a>, in direct breach of art 5 (1)(f) GDPR (principle of security) and art 32 GDPR (security of processing).<br>Email is an obsolete communication mechanism, start using encrypted document sharing solutions, with strong authentication!</li><li><a href=\"https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_Societatea_Civil%C4%83_Profesional%C4%83_de_Avoca%C8%9Bi_%E2%80%9ESabou,_Burz_%26_Cuc%E2%80%9D\">The Romanian DPA issued a fine of approximately €1000 on a law firm</a> for disclosing a case file with the personal data of one of its clients on an external WhatsApp group with other lawyers, in breach of Articles 6, 5(1)(a), 5(1)(b), 5(1)(c), 5(1)(f) and 5(2) GDPR.</li><li>Hungarian DPA fines Lawyer € 835 for unauthorized transmission of a confidential document to two unauthorized third parties.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject lodged a complaint with the DPA concerning the unlawful disclosure of his personal data.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The recipient of the fine acted as a lawyer for a company that was in litigation with the complainant.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In his complaint, the concerned party alleged that the respondent had improperly and without cause disclosed to two other parties in the case \"<em>highly confidential information\"</em>, which was a private letter to the President and Vice-President of an unnamed company.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The view that the sending of an unencrypted e-mail might violate Art. 32 GDPR is also the opinion of the Data Protection Authority of North Rhine-Westphalia (DPA NRW), which says the following on its website:</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The communication by e-mail requires at least the transport encryption, as it is offered by the considerable European providers by default. ... It must be taken into account that in the case of transport encryption the e-mails are available on the e-mail servers in plain text and can basically be viewed. In the case of particularly sensitive data (e.g. account transaction data, financing data, health status data, client data from lawyers and tax consultants, employee data), transport encryption alone may not be sufficient</em>\". (DPA NRW, Technical Requirements for Technical and Organizational Measures for E-Mail Sending,&nbsp;<a href=\"https://www.ldi.nrw.de/mainmenu_Aktuelles/Inhalt/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand.html\" target=\"_blank\" rel=\"noreferrer noopener\">available here</a>&nbsp;in German).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>With special thanks to the experts who have offered me their assistance on this matter :</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/davidflintscotland/\" target=\"_blank\">David Flint</a>, Commercial Law Consultant at Inksters; Visiting Professor at Creighton University School of Law.</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/peter-stephenson-phd-cissp-faafs-3a6788108/\" target=\"_blank\">Peter Stephenson</a>, PhD, CISSP, FAAFS Writer, researcher and educator in cyber criminology and cyber jurisprudence.</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/alexandre-blanc-cyber-security-88569022/\" target=\"_blank\">Alexandre Blanc</a> Cyber Security - vCISO - ISO/IEC 27001 and 27701 Lead Implementer - best Cyber Risk Communicator of 2019 and 2020 - MCNA - MITRE ATT&amp;CK - LinkedIn Top Voice 2020 in Technology - Cyber Sentinel Award 2020-21 – Speaker</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/valerymarchive/\" target=\"_blank\">Valery Rieß-Marchive</a> Rédacteur-en-chef, LeMagITTalks about malware, offrecyber, ransomware, cyberattaque, and threatintelligence</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>A special thank to <a href=\"https://twitter.com/alexislintS\" target=\"_blank\" rel=\"noreferrer noopener\">Lord\'Aliosha</a> for his breathaking photo reproduced with his special permission</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And Fieldfisher for their useful links to GDPR articles, <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a></p>\n<!-- /wp:paragraph -->','Advocating Privacy and Data Protection for More Than a Decade And Still Fighting Resistance','<!-- wp:paragraph -->\n<p>I have been watching legal professionals disseminating personal data around the world. Feel my pain ? Why it especially matters? Because they are the ones advising others. They are the role model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the GDPR has now celebrating it’s 6 years and 4 years of enforcement, Here an exhaustive practical case law analysis of the importance of taking appropriate security measures and how things can go wrong.</p>\n<!-- /wp:paragraph -->','publish','open','open','','advocating-privacy-and-data-protection-for-more-than-a-decade-and-still-fighting-resistance','','\nhttps://blog.nviso.eu/2020/09/01/epic-manchego-atypical-maldoc-delivery-brings-flurry-of-infostealers/','2022-05-25 21:12:33','2022-05-25 21:12:33','',0,'https://www.datarainbow.eu/?p=2364',0,'post','',0),(2365,1,'2022-05-25 13:09:03','2022-05-25 13:09:03','','Phisihing-Watin-1','','inherit','open','closed','','phisihing-watin-1','','','2022-05-25 13:09:03','2022-05-25 13:09:03','',2364,'https://www.datarainbow.eu/wp-content/uploads/2022/05/Phisihing-Watin-1.png',0,'attachment','image/png',0),(2366,1,'2022-05-25 13:10:17','2022-05-25 13:10:17','','Spam-CBBC-IBP-18122020','','inherit','open','closed','','spam-cbbc-ibp-18122020','','','2022-05-25 13:10:17','2022-05-25 13:10:17','',2364,'https://www.datarainbow.eu/wp-content/uploads/2022/05/Spam-CBBC-IBP-18122020.png',0,'attachment','image/png',0),(2367,1,'2022-05-25 13:11:32','2022-05-25 13:11:32','','Phisihing-Watin-1-1','','inherit','open','closed','','phisihing-watin-1-1','','','2022-05-25 13:11:32','2022-05-25 13:11:32','',2364,'https://www.datarainbow.eu/wp-content/uploads/2022/05/Phisihing-Watin-1-1.png',0,'attachment','image/png',0),(2368,1,'2022-05-25 13:11:58','2022-05-25 13:11:58','','Phishing-Watin-2','','inherit','open','closed','','phishing-watin-2','','','2022-05-25 13:11:58','2022-05-25 13:11:58','',2364,'https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-2.png',0,'attachment','image/png',0),(2369,1,'2022-05-25 13:12:15','2022-05-25 13:12:15','','Phishing-Watin-3','','inherit','open','closed','','phishing-watin-3','','','2022-05-25 13:12:15','2022-05-25 13:12:15','',2364,'https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-3.png',0,'attachment','image/png',0),(2370,1,'2022-05-25 13:12:31','2022-05-25 13:12:31','','Phishing-Watin-4','','inherit','open','closed','','phishing-watin-4','','','2022-05-25 13:12:31','2022-05-25 13:12:31','',2364,'https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-4.png',0,'attachment','image/png',0),(2371,1,'2022-05-25 13:14:23','2022-05-25 13:14:23','','Phishing_CBBC_Anonymised_08032022','','inherit','open','closed','','phishing_cbbc_anonymised_08032022','','','2022-05-25 13:14:23','2022-05-25 13:14:23','',2364,'https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing_CBBC_Anonymised_08032022.png',0,'attachment','image/png',0),(2372,1,'2022-05-25 13:15:34','2022-05-25 13:15:34','','Phishing_CBBC_Anonymised_08032022-1','','inherit','open','closed','','phishing_cbbc_anonymised_08032022-1','','','2022-05-25 13:15:34','2022-05-25 13:15:34','',2364,'https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing_CBBC_Anonymised_08032022-1.png',0,'attachment','image/png',0),(2373,1,'2022-05-25 13:17:42','2022-05-25 13:17:42','','Spam-CBBC-IBP-18122020-1','','inherit','open','closed','','spam-cbbc-ibp-18122020-1','','','2022-05-25 13:17:42','2022-05-25 13:17:42','',2364,'https://www.datarainbow.eu/wp-content/uploads/2022/05/Spam-CBBC-IBP-18122020-1.png',0,'attachment','image/png',0),(2374,1,'2022-05-25 13:18:45','2022-05-25 13:18:45','','Sky orage','','inherit','open','closed','','sky-orage','','','2022-05-25 13:18:45','2022-05-25 13:18:45','',2364,'https://www.datarainbow.eu/wp-content/uploads/2022/05/Sky-orage.jpeg',0,'attachment','image/jpeg',0),(2375,1,'2022-05-25 13:21:11','2022-05-25 13:21:11','<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have been watching legal professionals disseminating personal data around the world. Feel my pain ? Why it especially matters? Because they are the ones advising others. They are the role model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the GDPR has now celebrating it’s 6 years and 4 years of enforcement, Here an exhaustive practical case law analysis of the importance of taking appropriate security measures and how things can go wrong.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I – Appropriate measures of security and data breach</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have been warning about the need for encryption when handling sensitive data. I have contacted the law society who have confirmed my requests as legitimate. Encryption is essential and WeTransfer is not an option. More secured tools are available; they are dangerously ignored. French Data Protection Authority <a href=\"https://www.cnil.fr/fr/securite-securiser-les-echanges-avec-dautres-organismes\">CNIL has published recommendations</a> not to use email to exchange personal data. <a href=\"https://www.ssi.gouv.fr/uploads/2017/01/guide_hygiene_informatique_anssi.pdf\">ANSSI</a> has published several warnings concerning the risks related to email exchanges.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was first on Marsh 2021 that I received two separate emails, in two of my email addresses I had used with one of these French legals, a notaire (some kind of solicitor/notary). The emails as shown below, <strong>reproduced previous exchanges</strong> I had with the professional. It appears as a chain of communication, with a short sentence inviting to click on the attachment. Same kind of operations were repeated in June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2367,\"width\":553,\"height\":572,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phisihing-Watin-1-1-989x1024.png\" alt=\"\" class=\"wp-image-2367\" width=\"553\" height=\"572\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2368,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-2-839x1024.png\" alt=\"\" class=\"wp-image-2368\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2369,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-3-780x1024.png\" alt=\"\" class=\"wp-image-2369\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2370,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-4-797x1024.png\" alt=\"\" class=\"wp-image-2370\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong><u>What Does that mean?</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Someone has been able to access to previous emails to this professional ;</li><li>The mails were non-encrypted, despite my request to secure our exchanges ;</li><li>These emails have fallen in the hands of cyber-criminals ;</li><li>The cybercriminals have been to reproduce previous exchanges with the professional, including highly sensitive documents ;</li><li>This to me is a data breach that should have been notified with 72 hours to the CNIL and without undue delay to data subject concerned if a serious risk was detected. I can’t see how this was not the case when a IBAN numbers, ID cards etc were exposed ;</li><li>The phishing emails received contained a malicious zip file that has been analysed by an IT expert ;</li><li>The attack is very similar to what has been described as a <a href=\"https://tekdeeps.com/trojan-qbot-steals-e-mails-and-misuses-them-for-further-attacks-it-can-also-attack-in-the-czech-republic/\">Qbot attack</a> or <a href=\"https://www.gdata.fr/news/2021/05/36849-g-data-rapport-sur-les-menaces-qbot-remplace-emotet\">Emotet</a>. Several big companies such as <a href=\"https://www.lemagit.fr/actualites/252502320/Quel-est-le-point-commun-entre-Fujifilm-JPS-et-un-office-notarial-francais-Qbot\">Ikea, Fujifilm or JPS</a> have been victim of these email chain attacks designed to <a href=\"https://www.lemondeinformatique.fr/actualites/lire-le-malware-financier-qbot-reprend-du-service-74527.html\">extract financial data</a>.</li><li>Clicking on the <a href=\"https://blog.nviso.eu/2020/09/01/epic-manchego-atypical-maldoc-delivery-brings-flurry-of-infostealers/\">zip attachment</a> could infect the computer network to steal further financial information ;</li><li>The email appears on a mobile device only showing the name of the professional to gain the recipient’s trust. It’s only by looking more closely that a different email address appears. Therefore, it becomes relatively easy to be trapped ;</li><li>If I have received these 4 emails, there is a big chance I would not the only one ;</li><li>Actually, this could be a larger scale attack of the platform used by notaires. <a href=\"https://www.lemagit.fr/actualites/252502320/Quel-est-le-point-commun-entre-Fujifilm-JPS-et-un-office-notarial-francais-Qbot\">Two other cases have been brought to my attention</a>, one of them being the very respected lawyer representing me.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>After I received the first emails, I sent several emails to the notaire on a different email address to check if they knew anything. I finally called them to understand what had happened. I was told by the big boss that he had no idea, had no care and probably have they been hacked just as it happens to many….</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I then turned into the French Cyber Gendarmerie online, they told me it was a spam. But how a simple spam could reproduce my previous emails ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Anxious about the data the cybercriminals had access to, I then send a request of information to the notaire trying to understand how they secured my data. They decided they needed an extra two months without justifying it. When I asked if they had a Data Protection Officer, they remembered than indeed all ‘notaires’ have an external mutualist DPO. Only in June did they notified the CNIL (data breach have to be notified within 72 hours to the CNIL and without undue delay to data subjects. My documents contained other people’s data breached as well. To my knowledge no data subject has been notified). From a document communicated by their DPO, last year the CNIL has requested some further information from them. So maybe after all this was not a simple Spam.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With the very slow progress with the notaire, I contacted a lawyer in Paris, Maître François-René Lebatard, who urged me to file a criminal complaint before all evidence would vanish. That was around June last year. The complaint is still under investigation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, I contacted the CNIL that accepted to investigate my complaint. Here is their conclusion :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>«&nbsp;Following the intervention of the CNIL, the data protection officer (DPO) of the firm, who was reminded of the obligations in force with regard to requests for access rights and the security of personal data, indicated:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>…</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>They have, following the letter from Ms xxx of 20 March 2021 indicating that she had received fraudulent emails, questioned their IT service provider asking for a detailed expert report, investigations from which it appears that no data breach is proven, that the fraudulent emails received by Ms xxx took over emails which she was the sender, that they did not concern any email that the office would have sent to Ms xxx as a recipient and that no other office\'s client had reported having received fraudulent emails.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No further explanation on where these phishing emails came from. Case closed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When back to our business with the notaire, I had to send him a legal document. I used Protonmail encryption. Again, he expected me to send it by email simple attachment. I had to remind him his DPO had mentioned they had a secure mean of document exchange. So even after the incident, was he still convinced <a href=\"https://www.americanbar.org/groups/business_law/publications/blt/2016/06/07_borden/\">exchanging data by simple email attachment ‘as usual’ is the way to go.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Now lets talk about <strong>the law firm involved in this case</strong>. A law firm advertising their international businesses. They exchangemassive amounts of documents by email attachment before discovering the joy of the free WeTransfer. Few law firms in Paris use WeTransfer because it’s free and convenient. I have tried my best to bring to their attention the risks paused by this tool. So, lets look deeper into that free WeTransfer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong><u>What’s wrong with the use of a free WeTransfer for a law firm ?</u></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://teamdrive.com/en/how-secure-is-wetransfer/\">WeTransfer</a> is a platform where users can upload their documents, receive a link with a password to send to their recipients.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>WeTransfer has <a href=\"https://www.bleepingcomputer.com/news/security/phishing-campaign-bypasses-email-gateways-via-wetransfer-alerts/\">been attacked several times</a> <a href=\"https://wetransfer.com/corporate/178267-update-security-notice-june-26th\">in the past</a>. <a href=\"https://www.hackread.com/wetransfer-phishing-attack-spoofs-steal-credential/\">Links have been intercepted</a> or <a href=\"https://threatpost.com/popular-file-sharing-service-wetransfer-used-in-malicious-spam-campaigns/146671/\">used in malicious spam</a> ; <a href=\"https://wetransfer.pr.co/178267-security-notice\" target=\"_blank\" rel=\"noreferrer noopener\">According to WeTransfer</a>, on June 16 and 17, file transfer emails were sent to unintended email addresses</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“<em>We have learned that a transfer you sent or received was also delivered to some people it was not meant to go to. Our records show that those files have been accessed, but almost certainly by the intended recipient. Nevertheless, as a precaution we blocked the link to prevent further downloads,”</em>&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.bleepingcomputer.com/news/security/phishing-campaign-bypasses-email-gateways-via-wetransfer-alerts/\">A phishing campaign</a> observed by security researchers at the Cofense&nbsp;Phishing Defense Center targeting a wide range of high profile entities from industries such as media and banking was detected in july: <em>“using WeTransfer&nbsp;notifications as surrogates for the run-of-the-mill malicious URLs usually employed in these type of attacks&nbsp;was recently detected while successfully bypassing email gateways developed by Microsoft, Proofpoint, and Symantec.”</em></li><li>Again in August 2021, it is reported ‘<a href=\"https://www.hackread.com/wetransfer-phishing-attack-spoofs-steal-credential/\">New WeTransfer phishing attack spoofs file-sharing to steal credential</a>’</li><li>&nbsp;<a href=\"https://www.pearltrees.com/t/data-in-law-firms/wetransfer/id41633223/item366308782\">Free WeTransfer</a> does not give the <a href=\"https://wetransfer.zendesk.com/hc/en-us/articles/360000905623-GDPR-Requesting-a-Data-Processing-Agreement\">option of a Data Processing Agreement (DPA)</a> required for any data processor used as by <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\">Article 28 GDPR</a> ; <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\">Art 28-3 states</a> : “<em>Processing by a processor shall be governed by a contract or other legal act under domestic law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.</em>&nbsp;“</li><li>Data at rest is not encrypted and can be accessed ‘for technical purpose’ ;</li><li>The balance of proportionality and obligations of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32 GDPR</a> - combined with <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-24-gdpr/\">Article 24</a> <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-25-gdpr/\">and 25</a>, privacy by design - require to take account of the sensitivity of the data, balanced with the state of the art and the cost of the implementation, to take appropriate security measures, starting by encryption as reminded to the<a href=\"https://ico.org.uk/action-weve-taken/enforcement/tuckers-solicitors-llp-mpn/\"> law firm</a> <a href=\"https://ico.org.uk/action-weve-taken/enforcement/tuckers-solicitors-llp-mpn/\">Tuckers LLP fined by the UK ICO</a> or by the <a href=\"https://gdprhub.eu/index.php?title=DPC_(Ireland)_-_DPC_Case_Reference:_IN-19-9-5&amp;section=6\">Irish DPC fining Bank Of I</a>reland ; [the UK ICO referred to the “<em>state of the art</em>\", as ‘<em>relevant industry standards of good practice including the ISO27000 series, the National Institutes of Standards and Technology (\"NIST\"), the various guidance from the ICO itself, the National Cyber Security Centre (\"NCSC\"), the Solicitors Regulatory Authority (\"SRA\"), Lexcel and \'NCSC Cyber Essentials\'.</em><em> </em>‘</li><li>Recital 83 on the balance of proportionality&nbsp;:</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“<em>In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing <strong>and implement measures to mitigate those risks</strong>, <strong>such as encryption.</strong>&nbsp;Those measures should ensure an <strong>appropriate level of security</strong>, including <strong>confidentiality</strong>, taking into account the <strong>state of the art</strong> and the <strong>costs of implementation </strong>in relation to the <strong>risks</strong> and the <strong>nature of the personal data</strong> to be protected.&nbsp;3In assessing data security risk, consideration should be given to the risks that are presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed which may in particular lead to physical, material or non-material damage.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It happens that the French law society (CNB) that I have contacted has informed me of the existence of a secured platform lawyers can use for the transmission of their documents. Therefore no excuse to go to an unreliable free third party ;</li><li>Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">WeTransfer uses AWS servers</a> to store data, which is not without consequences with regard to the prohibition of data transfers to the US following the invalidation of the Safe Harbour then Privacy Shield based on the well-known ECJ decision in <a href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\">Schrems-II.</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>indisputable practicality</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have to say, the insistence of the law firm to use WeTransfer was not innocent. They had been warned their WeTransfer links would not be touched. Their insistence to refuse more secure options was not innocent and certainly part of their dirty strategy. They have been trying to pretend to communicate evidence that does not exist. Fortunately, another party took care to transfer their WeTransfer linked documents. The document listed was not there. They have yet not reacted on the missing documents requests several months later.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The same way have they ignored to respond to the requests concerning their appropriate security measures hiding behind attorney/client privilege. They were not asked to reveal their communications with their client.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It happens that their client who has initiated the various legal proceedings in France is based in China and to my knowledge, he exclusively uses his professional email address. He has even warned about his employer accessing his personal devices for inspection : ... “<em>Unfortunately my personal computer has been confiscated by xxx [the employer is a major communication provider with close tights with the government] for security reasons so can’t access personal mail till Monday. Because I used it for work in xxxx they have to take everything out of it including Windows 7 ...”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facing this abusive resistance, I had to turn into the CNIL. The CNIL requested the law firm to respond to my request. It was eventually clarified they used the free version of WeTransfer with no DPA. At least, they finally discovered they could use the secured CNB platform at their disposition. However, the password, a 6 single digit figures, was sent to all parties - including the notaire above –immediately following the link, using same channels. I personally find it hard to believe they could be that dumb. (I don’t think the CNB’s platform should allow such weak passwords. <a href=\"https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-fines-transavia-poor-personal-data-security\">Dutch DPA has fined Transavia for poor personal data security allowing weak passwords</a> ; <a href=\"https://gdprhub.eu/index.php?title=CNIL_(France)_-_D%C3%A9lib%C3%A9ration_SAN-2021-020_du_28_d%C3%A9cembre_2021\">French CNIL has been itself rather strict in their security requirements from Slimpay fined 180.000 €. </a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Password strenght was highlited by ANSSI : «&nbsp;the length and complexity of a password remain basic criteria for assessing its strength.” The need for a strong password is crucial to ensure the security and confidentiality.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cnil.fr/sites/default/files/atoms/files/recommandation_passwords_en.pdf\">CNIL’s recommendations</a> : “<em>For the sake of clarity, the Restricted Committee notes that in order to ensure a sufficient level of security and satisfy the password strength requirements, when authentication relies solely on an identifier and password, the CNIL recommends, in its Decision No. 2017-012 of 19 January 2017, that the password have at least twelve characters - containing at least one upper-case letter, one lower-case letter, one number and one special character - or at least eight characters - containing three of these four characters - if it is accompanied by an additional measure such as, for example, the timing of access to the account after several failures (temporary suspension of access, the duration of which increases as attempts are made), setting up a mechanism to guard against automated and multiple attempts (e.g. a “captcha”) and/or locking the account after several failed login attempts. </em><em>“ in CNIL SAN 2022-022&nbsp;».</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-une-faq-pour-comprendre-lessentiel-en-quelques-minutes\">CNB’s recommendations</a>&nbsp;: “<em>Toutes les données envoyées par courriel ou transmises au moyen d’outils d’hébergement en ligne (Cloud) sont par conséquent vulnérables. Il s’agit donc de procéder à leur chiffrement systématique avant de les adresser à un correspondant ou de les hébergerLa transmission du secret (mot de passe, clé, etc.) permettant alors de déchiffrer les données, si elle est nécessaire, doit être effectuée via un canal de confiance ou, à défaut, un canal distinct du canal de transmission des données. Ainsi, si les données chiffrées sont transmises par courriel, une remise en main propre du mot de passe ou, à défaut, par téléphone doit être privilégiée.</em>&nbsp;:</li><li><em><a href=\"“https:/www.ssi.gouv.fr/uploads/2017/01/guide_hygiene_informatique_anssi.pdf\">ANSSI Guide de l’ hygiène informatique</a></em></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In their letter they admited exchanging regularly with their client in China. This concerns massive amount of highly personal data for more than a decade, with no appropriate security measure. Their justifications? Well, China has voted the data protection regulation PIPL, so all is good !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They admit having been non-compliant for years before recently discovering the platform they had refused to use when first suggested.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Again, this month, I received a fishing email from that law firm using a similar technic as shown below.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2372,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing_CBBC_Anonymised_08032022-1-1024x862.png\" alt=\"\" class=\"wp-image-2372\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Previously, in December 2020 I had received another suspicious email from that same law firm they never clarified if it came from them or not.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2373,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Spam-CBBC-IBP-18122020-1-808x1024.png\" alt=\"\" class=\"wp-image-2373\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>CNIL closed the case satisfied by these arguments without looking at :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>the question of long years of data transfers without any appropriate security measure ;</li><li>the use of the free version of WeTransfer without DPA art 28 while they could at least afford the professional version offering better guaranties;</li><li>use of the professional email address of the client and access by his employer</li><li>CNIL accepted there has not been a transfer as the receiver is an individual to whom GDPR does not apply.</li><li>resistance to reply to my requests, The CNIL did not care that the law firm rejected my DSAR for many years.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Here is a translation of CNIL’s decision - emphasises by me</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>Firstly, with regard to your difficulties relating to the exercise of the right of access to your personal data, XXXX, when questioned by the CNIL, indicated that this information was covered by professional secrecy. I confirm in this regard that, in accordance with the provisions of Article 23 of the General Data Protection Regulation (GDPR), the French legislator has, in Article 66-5 of Law No 71-1130 of 31 December 1971 reforming certain judicial and legal professions, provided for a limitation on the right of access. Under the above-mentioned article: \"In all matters, whether in the field of counsel or in that of defence, consultations sent by a lawyer to his client or intended for him, correspondence exchanged between the client and his lawyer, between the lawyer and his colleagues with the exception for the latter of those bearing the mention \"official\", the interview notes and, more generally, all documents in the file are covered by professional secrecy. ». [I don’t think I have ever questioned the confidentiality of their correspondences with their client]</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Secondly, with regard to the supervision of the transfers of your data made by XXXX, in particular to China where the firm\'s client resides to whom, according to your assertions [XXXX has XXXX clearly admitted doing so], your data would be sent, XXXX, questioned by the CNIL, indicates that there is no transfer strictly speaking.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>I confirm in this regard that it follows from the ongoing discussions at the level of the European Data Protection Board (EDPB) that a transfer exists only if the personal data are transmitted to an importer located in a third country. However, since the client of the firm to which you believe your data is transferred cannot be qualified as a controller, joint controller or processor, the transmission operation cannot be qualified as a transfer of personal data outside the European Union.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Thirdly, as regards the security measures implemented by XXXX to guarantee the integrity and confidentiality of your data, that firm has on the one hand specified the security measures deployed in the context of the use of the \"WeTransfer\" tool and on the other hand indicated that it now uses the e-Sharing platform, developed by the National Council of Bars, whose technical characteristics as described in the firm\'s response appear to meet the security obligations provided for in Article 5.1-f) of the GDPR. [Last WeTransfer link sent to me and other parties was last year. Before that for many years they exchanged via email attachment. They recognised I have been asking them – bothered them – to secure these exchanges due to highly sensitive data involved]</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Regarding the facts alleged in your message of May 10, 2022 according to which the XXXX firm recently sent you the password through the same channel (email) as that used to send the link to the platform, and that this password contains only 6 characters, XXXXX was reminded of the elementary precautions recalled by the CNIL on these points.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>In the light of these elements, I inform you to proceed to the closure of your complaint.&nbsp;»</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Surprisingly, neither the law firm, nor the notaire care about the fraudulent use of their email addresses or name !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although they admitted “<em>Ms. xxx obviously benefits from the right to ask the data controller for access to personal data, the rectification or erasure thereof, or a limitation of the processing relating to the person concerned, as well as the right to object to processing and the right to data portability. These rights are however limited by the very purpose of the processing of personal data, namely the recognition, exercise or defense of legal rights (Articles 16, 17, 18 and 20 of the GDPR).”</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm pretended holding data indirectly collected. However, they forget that some of the documents have been directly collected to comply with the principle of ‘<em>contradictoire</em>’ or adversarial principal.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They pretend they are under no obligation to respond to my DSAR as I would already have knowledge of the information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>- </strong>Where personal data is not collected from the data subject, any available information as to its source :they argue this information is also covered by professional secrecy. Therefore, they would not be able to reveal all of their sources [expect use of private investigators]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“Under these conditions, if Ms. xxx actually wished to request such a copy, she is asked to specify the data or the processing operations to which her request relates, as Cabinet xxx cannot decently gather all of this information in just one months as required by the GDPR. [Did they requested an extended delay?]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Their justification on the use of WeTransfer is rather enlightening:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Indeed, WeTransfer has indisputable practicality –</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They add “<em>If the firm was able to effectively use this tool to transmit documents, during a well-defined and now over period, to Ms. xxx\'s lawyer, to the notary, as well as to Ms. Xxx herself, it is recalled that the processing carried out here mainly concerned personal data relating to our client who has expressly consented to the use of this medium and has requested that it be use</em>.” This is totally untrue. A legal case obviously involves exchange of personal data concerning various parties. How did CNIL not reacted to that is a mystery.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have recognised using free WeTransfer in several occasions when they could have easily use alternative secure tools, ognoing my requests and the high sensitivity of the data: On February 3 and 20, 2020, October 14, 2020, January 14 and 22, 2021, January 29, 2021, December 9, 2021 and January 14, 2022.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They don’t despute my ‘<strong><em>numerous inquiries</em></strong><em> about WeTransfer’</em>. It had to come to the CNIL’s attention for them to make ‘<em>the necessary changes in order to comply with the GDPR and no longer use this service</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>II - On the question of regular long-term transfers to CHINA</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm is based in France. The litigation is initiated in France based on the French nationality of their client. The client is based in China. However, he travels around the world including in Europe where some of the exchanges have occurred and while in Europe, no doubt GDPR applied to these transfers. Data transfers via China where the email servers of the employer are located.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm collect personal data from their client, from me directly in respect with the principal of adversarial, from the notaire, and I suspect from their communications, from private investigators. These documents are then forwarded to their client for observation. Then sent back to them. These will be used and reproduced to draft the court documents again exchanged between all parties including the client. Therefore, the law firm is data controller (see UK ICO cases of Tuckered LLP or Smith… ). Would the client be as well a data controller of the part of data he gathers, stores and processed? Possibly. In two cases, ECJ has considered individual as data controller : in the Facebook fan page admin case and in Jeowah’s Witnesses. [in <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0040\">ECJ Fashion ID</a> “(<em>A)s the Advocate General noted, [...-] it appears that a natural or legal person may be a controller, within the meaning of Article 2(d) of Directive 95/46, jointly with others only in respect of operations involving the processing of personal data for which it determines jointly the purposes and means. By contrast, [...] that natural or legal person cannot be considered to be a controller, within the meaning of that provision, in the context of operations that precede or are subsequent in the overall chain of processing for which that person does not determine either the purposes or the means</em>”.<br>In <a href=\"https://gdprhub.eu/index.php?title=CJEU_-_C%E2%80%9125/17_-_Tietosuojavaltuutettu\">Jehovah’s witnesses, C-25/17</a>, the CJEU considered that a religious community of Jehovah’s witnesses acted as a controller, jointly with its individual members.]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm argued that ‘<em>The “transfers” in question are in no way regular and permanent but rather punctual and occasional, as much as respect for the adversarial process has made it necessary to communicate the documents in the file. Moreover, strictly speaking, there is no transfer outside the European Union at the initiative of xxx since <strong>it is the recipient of the data who imports the data</strong> because he is domiciled outside the European Union. And it should be remembered that the GDPR does not apply to natural persons not residing in the European Union.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Can we still talk<em> about ‘ponctual and occasional’</em> for something that has last 11 years ?! Massive amount of highly personal sensitive data have been exchanged refusing the special request to use encryption rejected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Their argument is that the transfers almost exclusively concerned data obtained indirectly through the lawyer., the notary or the client. This is not exact as some of the data was directly collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Knowing that several litigations initiated since 2011 involving different jurisdictions in France, it’s difficult to admit these heavy volume of data exchanges were ‘<em>ponctual</em>’ (3 court of appeals, 4 other jurisdictions, several notaires, huissiers, or Avoués were involved each time data has been sent with no care)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In any case, their communications between the law firm and the notaire are not confidential Article 14 paragraph 5, d). – in contrary I should have been in copy on all of them</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Concerning Chinese employers practice, here is </strong><a href=\"https://www.politico.eu/article/huawei-germany-court-case-privacy/\">report by Politico</a> :</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>“A case filed by one of Huawei’s former managers at its European headquarters in Düsseldorf takes aim at another pitfall for the company: Its respect of European privacy rules.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Specifically, it opens up questions about whether Huawei is putting data at risk of slipping into the hands of Chinese state surveillance and intelligence operations. It also raises questions about whether Europe will sharpen its tone with China on sensitive data privacy matters — after years of focusing its ire on Silicon Valley’s giants and U.S. state surveillance.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>A judge ruled March 5 that Huawei was in breach of European privacy law when it failed to comply with the former manager’s request to view the data the company had kept on him.” &nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Ultimately, non-compliance with GDPR is <a href=\"https://www.cnil.fr/fr/les-sanctions-penales\">a criminal offense</a></strong><strong> :</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le fait, y compris par négligence, de procéder ou de faire procéder à des traitements de données à caractère personnel sans qu\'aient été respectées les formalités préalables à leur mise en oeuvre prévues par la loi est puni de cinq ans d\'emprisonnement et de 300 000 euros d\'amende.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le fait de procéder ou de faire procéder à un traitement de données à caractère personnel sans mettre en oeuvre les mesures prescrites aux articles 24, 25, 30 et 32 du règlement (UE) 2016/679 du 27 avril 2016 précité ou au 6° de l\'article 4 et aux articles 99 à 101 de la loi n° 78-17 du 6 janvier 1978 précitée est puni de cinq ans d\'emprisonnement et de 300 000 euros d\'amende.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>Previous related CNIL’s decisions </u></strong><strong><u></u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>For reference, here are previous similar cases involving the questions of security measures</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Slimpay, lack of measures of security <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32</a>, without the need to prove any illegitimate access to the data&nbsp;:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“95. <em>The Restricted Committee then notes that the accessible data (title, surname, first name, e-mail address, postal address, telephone number, BIC/IBAN) make it possible to obtain very precise information on the persons concerned by revealing their identity and their contact information.&nbsp;In addition, specific data are in question when some relate to financial information.&nbsp;The fact in particular that the <strong>IBAN appears is not insignificant</strong>.&nbsp;As the Banque de France indicated in its book \"Payments and market infrastructures in the digital age\", <strong>IBANs are \"sensitive\" payment data</strong> (in the ordinary sense of the term) because they can be used to commit fraud. .&nbsp;The European Data Protection Board describes this type of data as \"highly personal\".&nbsp;The Restricted Committee considers that the company should have exercised particular vigilance with regard to securing such data, which may be reused by unauthorized third parties, thus harming the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining data) when their full identity, associated with their email address for many, was freely accessible.&nbsp;thus prejudicing the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining</em> <em>data) when their full identity, associated with their email address for many, was freely accessible.&nbsp;thus prejudicing the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining data) when their full identity, associated with their email address for many, was freely accessible.</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>“68. The Restricted Committee considers that the absence of proof of fraudulent use of the data has no impact on the characterization of the breach of the security obligation.&nbsp;Indeed, the risk of fraudulent use of personal data was real, independently of the cases of fraud, insofar as the data of many people were made accessible to unauthorized third parties.&nbsp;The absence of proven harm to the persons concerned does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.”</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042676787\">The French DPA (CNIL) imposes a 3,000 euros fine on a doctor</a> for failing to comply with the security obligation, due to the free access on the web of his patients\' health data. CNIL recalls its own guidelines on Personal Data Security recommending encryption as a standard security measure. Similarly, the Practical Guide for Physicians encourages physicians to encrypt their patients\' data with suitable software.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Transmitting unsecured emails: the restricted training points out that it also emerges from the hearing of December 17, 2019 that “<em>Mr. [...] had also not taken care to encrypt the data contained in his personal laptop, considering that encryption slows down the execution of applications too much (medical file, image visualization tool).</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>26. In the absence of encryption, the medical data contained in that computer\'s hard drive were readable in plain text by any person taking possession of that device (for example, as a result of its loss or theft) or by any person who unduly entered the network to which that computer was connected.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its guidance The security of personal data, the CNIL recommends providing encryption means for nomadic workstations and mobile storage media (laptop, USB keys, external hard disk, CD-R, DVD-RW, etc.), for example via the encryption of the hard disk in its entirety when the operating system offers it, file-by-file encryption or the creation of encrypted containers (file likely to contain several files). Similarly, the Practical Guide for Physicians invites physicians to encrypt their patients\' data with appropriate software.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2021-021\">The French DPA (CNIL) fined a mobile operator €300,000</a> for failing to respect customers\' right of access and right to object by not responding to their access requests in a timely manner and sending them marketing messages despite having been notified of their objection to such processing.</li><li><a href=\"https://gdprhub.eu/index.php?title=CNIL_-_SAN-2020-008\">The French DPA (CNIL) imposed a € 2250000 fine on Carrefour France</a> for several violations of the GDPR and French data protection law. These include : excessive data retention periods, incomplete and unclear information on data processes, lack of proper answer to data subjects\' requests, security breaches and illicit use of cookies.</li><li>The CNIL also referred to a&nbsp;<a href=\"https://www.legifrance.gouv.fr/ceta/id/CETATEXT000038388017/\">decision n°423559</a>&nbsp;by the French Supreme Administrative Court (Conseil d\'Etat) which allowed for such sanctions, even if the violation had been corrected. (NESTOR)</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Other cases in the EU</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://lnkd.in/dFuE5SHj\">A hospital in Sweden</a> received a fine&nbsp;of 150k EUR because it was sending medical records via email to patients and referring hospitals, unencrypted.<br>That was a&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">GDPR</a>&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">security</a>&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=issue&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">issue</a>, in direct breach of art 5 (1)(f) GDPR (principle of security) and art 32 GDPR (security of processing).<br>Email is an obsolete communication mechanism, start using encrypted document sharing solutions, with strong authentication!</li><li><a href=\"https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_Societatea_Civil%C4%83_Profesional%C4%83_de_Avoca%C8%9Bi_%E2%80%9ESabou,_Burz_%26_Cuc%E2%80%9D\">The Romanian DPA issued a fine of approximately €1000 on a law firm</a> for disclosing a case file with the personal data of one of its clients on an external WhatsApp group with other lawyers, in breach of Articles 6, 5(1)(a), 5(1)(b), 5(1)(c), 5(1)(f) and 5(2) GDPR.</li><li>Hungarian DPA fines Lawyer € 835 for unauthorized transmission of a confidential document to two unauthorized third parties.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject lodged a complaint with the DPA concerning the unlawful disclosure of his personal data.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The recipient of the fine acted as a lawyer for a company that was in litigation with the complainant.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In his complaint, the concerned party alleged that the respondent had improperly and without cause disclosed to two other parties in the case \"<em>highly confidential information\"</em>, which was a private letter to the President and Vice-President of an unnamed company.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The view that the sending of an unencrypted e-mail might violate Art. 32 GDPR is also the opinion of the Data Protection Authority of North Rhine-Westphalia (DPA NRW), which says the following on its website:</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The communication by e-mail requires at least the transport encryption, as it is offered by the considerable European providers by default. ... It must be taken into account that in the case of transport encryption the e-mails are available on the e-mail servers in plain text and can basically be viewed. In the case of particularly sensitive data (e.g. account transaction data, financing data, health status data, client data from lawyers and tax consultants, employee data), transport encryption alone may not be sufficient</em>\". (DPA NRW, Technical Requirements for Technical and Organizational Measures for E-Mail Sending,&nbsp;<a href=\"https://www.ldi.nrw.de/mainmenu_Aktuelles/Inhalt/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand.html\" target=\"_blank\" rel=\"noreferrer noopener\">available here</a>&nbsp;in German).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>With special thanks to the experts who have offered me their assistance on this matter :</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/davidflintscotland/\" target=\"_blank\">David Flint</a>, Commercial Law Consultant at Inksters; Visiting Professor at Creighton University School of Law.</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/peter-stephenson-phd-cissp-faafs-3a6788108/\" target=\"_blank\">Peter Stephenson</a>, PhD, CISSP, FAAFS Writer, researcher and educator in cyber criminology and cyber jurisprudence.</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/alexandre-blanc-cyber-security-88569022/\" target=\"_blank\">Alexandre Blanc</a> Cyber Security - vCISO - ISO/IEC 27001 and 27701 Lead Implementer - best Cyber Risk Communicator of 2019 and 2020 - MCNA - MITRE ATT&amp;CK - LinkedIn Top Voice 2020 in Technology - Cyber Sentinel Award 2020-21 – Speaker</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/valerymarchive/\" target=\"_blank\">Valery Rieß-Marchive</a> Rédacteur-en-chef, LeMagITTalks about malware, offrecyber, ransomware, cyberattaque, and threatintelligence</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','Advocating Privacy and Data Protection for More Than a Decade And Still Fighting Resistance','<!-- wp:paragraph -->\n<p>I have been watching legal professionals disseminating personal data around the world. Feel my pain ? Why it especially matters? Because they are the ones advising others. They are the role model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the GDPR has now celebrating it’s 6 years and 4 years of enforcement, Here an exhaustive practical case law analysis of the importance of taking appropriate security measures and how things can go wrong.</p>\n<!-- /wp:paragraph -->','inherit','closed','closed','','2364-revision-v1','','','2022-05-25 13:21:11','2022-05-25 13:21:11','',2364,'https://www.datarainbow.eu/?p=2375',0,'revision','',0),(2377,1,'2022-05-25 13:32:41','2022-05-25 13:32:41','<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have been watching legal professionals disseminating personal data around the world. Feel my pain ? Why it especially matters? Because they are the ones advising others. They are the role model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the GDPR has now celebrating it’s 6 years and 4 years of enforcement, Here an exhaustive practical case law analysis of the importance of taking appropriate security measures and how things can go wrong.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I – Appropriate measures of security and data breach</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have been warning about the need for encryption when handling sensitive data. I have contacted the law society who have confirmed my requests as legitimate. Encryption is essential and WeTransfer is not an option. More secured tools are available; they are dangerously ignored. French Data Protection Authority <a href=\"https://www.cnil.fr/fr/securite-securiser-les-echanges-avec-dautres-organismes\">CNIL has published recommendations</a> not to use email to exchange personal data. <a href=\"https://www.ssi.gouv.fr/uploads/2017/01/guide_hygiene_informatique_anssi.pdf\">ANSSI</a> has published several warnings concerning the risks related to email exchanges.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was first on Marsh 2021 that I received two separate emails, in two of my email addresses I had used with one of these French legals, a notaire (some kind of solicitor/notary). The emails as shown below, <strong>reproduced previous exchanges</strong> I had with the professional. It appears as a chain of communication, with a short sentence inviting to click on the attachment. Same kind of operations were repeated in June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2367,\"width\":553,\"height\":572,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phisihing-Watin-1-1-989x1024.png\" alt=\"\" class=\"wp-image-2367\" width=\"553\" height=\"572\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2368,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-2-839x1024.png\" alt=\"\" class=\"wp-image-2368\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2369,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-3-780x1024.png\" alt=\"\" class=\"wp-image-2369\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2370,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-4-797x1024.png\" alt=\"\" class=\"wp-image-2370\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong><u>What Does that mean?</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Someone has been able to access to previous emails to this professional ;</li><li>The mails were non-encrypted, despite my request to secure our exchanges ;</li><li>These emails have fallen in the hands of cyber-criminals ;</li><li>The cybercriminals have been to reproduce previous exchanges with the professional, including highly sensitive documents ;</li><li>This to me is a data breach that should have been notified with 72 hours to the CNIL and without undue delay to data subject concerned if a serious risk was detected. I can’t see how this was not the case when a IBAN numbers, ID cards etc were exposed ;</li><li>The phishing emails received contained a malicious zip file that has been analysed by an IT expert ;</li><li>The attack is very similar to what has been described as a <a href=\"https://tekdeeps.com/trojan-qbot-steals-e-mails-and-misuses-them-for-further-attacks-it-can-also-attack-in-the-czech-republic/\">Qbot attack</a> or <a href=\"https://www.gdata.fr/news/2021/05/36849-g-data-rapport-sur-les-menaces-qbot-remplace-emotet\">Emotet</a>. Several big companies such as <a href=\"https://www.lemagit.fr/actualites/252502320/Quel-est-le-point-commun-entre-Fujifilm-JPS-et-un-office-notarial-francais-Qbot\">Ikea, Fujifilm or JPS</a> have been victim of these email chain attacks designed to <a href=\"https://www.lemondeinformatique.fr/actualites/lire-le-malware-financier-qbot-reprend-du-service-74527.html\">extract financial data</a>.</li><li>Clicking on the <a href=\"https://blog.nviso.eu/2020/09/01/epic-manchego-atypical-maldoc-delivery-brings-flurry-of-infostealers/\">zip attachment</a> could infect the computer network to steal further financial information ;</li><li>The email appears on a mobile device only showing the name of the professional to gain the recipient’s trust. It’s only by looking more closely that a different email address appears. Therefore, it becomes relatively easy to be trapped ;</li><li>If I have received these 4 emails, there is a big chance I would not the only one ;</li><li>Actually, this could be a larger scale attack of the platform used by notaires. <a href=\"https://www.lemagit.fr/actualites/252502320/Quel-est-le-point-commun-entre-Fujifilm-JPS-et-un-office-notarial-francais-Qbot\">Two other cases have been brought to my attention</a>, one of them being the very respected lawyer representing me.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>After I received the first emails, I sent several emails to the notaire on a different email address to check if they knew anything. I finally called them to understand what had happened. I was told by the big boss that he had no idea, had no care and probably have they been hacked just as it happens to many….</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I then turned into the French Cyber Gendarmerie online, they told me it was a spam. But how a simple spam could reproduce my previous emails ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Anxious about the data the cybercriminals had access to, I then send a request of information to the notaire trying to understand how they secured my data. They decided they needed an extra two months without justifying it. When I asked if they had a Data Protection Officer, they remembered than indeed all ‘notaires’ have an external mutualist DPO. Only in June did they notified the CNIL (data breach have to be notified within 72 hours to the CNIL and without undue delay to data subjects. My documents contained other people’s data breached as well. To my knowledge no data subject has been notified). From a document communicated by their DPO, last year the CNIL has requested some further information from them. So maybe after all this was not a simple Spam.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With the very slow progress with the notaire, I contacted a lawyer in Paris, Maître François-René Lebatard, who urged me to file a criminal complaint before all evidence would vanish. That was around June last year. The complaint is still under investigation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, I contacted the CNIL that accepted to investigate my complaint. Here is their conclusion :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>«&nbsp;Following the intervention of the CNIL, the data protection officer (DPO) of the firm, who was reminded of the obligations in force with regard to requests for access rights and the security of personal data, indicated:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>…</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>They have, following the letter from Ms xxx of 20 March 2021 indicating that she had received fraudulent emails, questioned their IT service provider asking for a detailed expert report, investigations from which it appears that no data breach is proven, that the fraudulent emails received by Ms xxx took over emails which she was the sender, that they did not concern any email that the office would have sent to Ms xxx as a recipient and that no other office\'s client had reported having received fraudulent emails.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No further explanation on where these phishing emails came from. Case closed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When back to our business with the notaire, I had to send him a legal document. I used Protonmail encryption. Again, he expected me to send it by email simple attachment. I had to remind him his DPO had mentioned they had a secure mean of document exchange. So even after the incident, was he still convinced <a href=\"https://www.americanbar.org/groups/business_law/publications/blt/2016/06/07_borden/\">exchanging data by simple email attachment ‘as usual’ is the way to go.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Now lets talk about <strong>the law firm involved in this case</strong>. A law firm advertising their international businesses. They exchangemassive amounts of documents by email attachment before discovering the joy of the free WeTransfer. Few law firms in Paris use WeTransfer because it’s free and convenient. I have tried my best to bring to their attention the risks paused by this tool. So, lets look deeper into that free WeTransfer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong><u>What’s wrong with the use of a free WeTransfer for a law firm ?</u></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://teamdrive.com/en/how-secure-is-wetransfer/\">WeTransfer</a> is a platform where users can upload their documents, receive a link with a password to send to their recipients.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>WeTransfer has <a href=\"https://www.bleepingcomputer.com/news/security/phishing-campaign-bypasses-email-gateways-via-wetransfer-alerts/\">been attacked several times</a> <a href=\"https://wetransfer.com/corporate/178267-update-security-notice-june-26th\">in the past</a>. <a href=\"https://www.hackread.com/wetransfer-phishing-attack-spoofs-steal-credential/\">Links have been intercepted</a> or <a href=\"https://threatpost.com/popular-file-sharing-service-wetransfer-used-in-malicious-spam-campaigns/146671/\">used in malicious spam</a> ; <a href=\"https://wetransfer.pr.co/178267-security-notice\" target=\"_blank\" rel=\"noreferrer noopener\">According to WeTransfer</a>, on June 16 and 17, file transfer emails were sent to unintended email addresses</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“<em>We have learned that a transfer you sent or received was also delivered to some people it was not meant to go to. Our records show that those files have been accessed, but almost certainly by the intended recipient. Nevertheless, as a precaution we blocked the link to prevent further downloads,”</em>&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.bleepingcomputer.com/news/security/phishing-campaign-bypasses-email-gateways-via-wetransfer-alerts/\">A phishing campaign</a> observed by security researchers at the Cofense&nbsp;Phishing Defense Center targeting a wide range of high profile entities from industries such as media and banking was detected in july: <em>“using WeTransfer&nbsp;notifications as surrogates for the run-of-the-mill malicious URLs usually employed in these type of attacks&nbsp;was recently detected while successfully bypassing email gateways developed by Microsoft, Proofpoint, and Symantec.”</em></li><li>Again in August 2021, it is reported ‘<a href=\"https://www.hackread.com/wetransfer-phishing-attack-spoofs-steal-credential/\">New WeTransfer phishing attack spoofs file-sharing to steal credential</a>’</li><li>&nbsp;<a href=\"https://www.pearltrees.com/t/data-in-law-firms/wetransfer/id41633223/item366308782\">Free WeTransfer</a> does not give the <a href=\"https://wetransfer.zendesk.com/hc/en-us/articles/360000905623-GDPR-Requesting-a-Data-Processing-Agreement\">option of a Data Processing Agreement (DPA)</a> required for any data processor used as by <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\">Article 28 GDPR</a> ; <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\">Art 28-3 states</a> : “<em>Processing by a processor shall be governed by a contract or other legal act under domestic law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.</em>&nbsp;“</li><li>Data at rest is not encrypted and can be accessed ‘for technical purpose’ ;</li><li>The balance of proportionality and obligations of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32 GDPR</a> - combined with <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-24-gdpr/\">Article 24</a> <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-25-gdpr/\">and 25</a>, privacy by design - require to take account of the sensitivity of the data, balanced with the state of the art and the cost of the implementation, to take appropriate security measures, starting by encryption as reminded to the<a href=\"https://ico.org.uk/action-weve-taken/enforcement/tuckers-solicitors-llp-mpn/\"> law firm</a> <a href=\"https://ico.org.uk/action-weve-taken/enforcement/tuckers-solicitors-llp-mpn/\">Tuckers LLP fined by the UK ICO</a> or by the <a href=\"https://gdprhub.eu/index.php?title=DPC_(Ireland)_-_DPC_Case_Reference:_IN-19-9-5&amp;section=6\">Irish DPC fining Bank Of I</a>reland ; [the UK ICO referred to the “<em>state of the art</em>\", as ‘<em>relevant industry standards of good practice including the ISO27000 series, the National Institutes of Standards and Technology (\"NIST\"), the various guidance from the ICO itself, the National Cyber Security Centre (\"NCSC\"), the Solicitors Regulatory Authority (\"SRA\"), Lexcel and \'NCSC Cyber Essentials\'.</em><em> </em>‘</li><li>Recital 83 on the balance of proportionality&nbsp;:</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“<em>In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing <strong>and implement measures to mitigate those risks</strong>, <strong>such as encryption.</strong>&nbsp;Those measures should ensure an <strong>appropriate level of security</strong>, including <strong>confidentiality</strong>, taking into account the <strong>state of the art</strong> and the <strong>costs of implementation </strong>in relation to the <strong>risks</strong> and the <strong>nature of the personal data</strong> to be protected.&nbsp;3In assessing data security risk, consideration should be given to the risks that are presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed which may in particular lead to physical, material or non-material damage.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It happens that the French law society (CNB) that I have contacted has informed me of the existence of a secured platform lawyers can use for the transmission of their documents. Therefore no excuse to go to an unreliable free third party ;</li><li>Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">WeTransfer uses AWS servers</a> to store data, which is not without consequences with regard to the prohibition of data transfers to the US following the invalidation of the Safe Harbour then Privacy Shield based on the well-known ECJ decision in <a href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\">Schrems-II.</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>indisputable practicality</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have to say, the insistence of the law firm to use WeTransfer was not innocent. They had been warned their WeTransfer links would not be touched. Their insistence to refuse more secure options was not innocent and certainly part of their dirty strategy. They have been trying to pretend to communicate evidence that does not exist. Fortunately, another party took care to transfer their WeTransfer linked documents. The document listed was not there. They have yet not reacted on the missing documents requests several months later.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The same way have they ignored to respond to the requests concerning their appropriate security measures hiding behind attorney/client privilege. They were not asked to reveal their communications with their client.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It happens that their client who has initiated the various legal proceedings in France is based in China and to my knowledge, he exclusively uses his professional email address. He has even warned about his employer accessing his personal devices for inspection : ... “<em>Unfortunately my personal computer has been confiscated by xxx [the employer is a major communication provider with close tights with the government] for security reasons so can’t access personal mail till Monday. Because I used it for work in xxxx they have to take everything out of it including Windows 7 ...”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facing this abusive resistance, I had to turn into the CNIL. The CNIL requested the law firm to respond to my request. It was eventually clarified they used the free version of WeTransfer with no DPA. At least, they finally discovered they could use the secured CNB platform at their disposition. However, the password, a 6 single digit figures, was sent to all parties - including the notaire above –immediately following the link, using same channels. I personally find it hard to believe they could be that dumb. (I don’t think the CNB’s platform should allow such weak passwords. <a href=\"https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-fines-transavia-poor-personal-data-security\">Dutch DPA has fined Transavia for poor personal data security allowing weak passwords</a> ; <a href=\"https://gdprhub.eu/index.php?title=CNIL_(France)_-_D%C3%A9lib%C3%A9ration_SAN-2021-020_du_28_d%C3%A9cembre_2021\">French CNIL has been itself rather strict in their security requirements from Slimpay fined 180.000 €. </a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Password strenght was highlited by ANSSI : «&nbsp;the length and complexity of a password remain basic criteria for assessing its strength.” The need for a strong password is crucial to ensure the security and confidentiality.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cnil.fr/sites/default/files/atoms/files/recommandation_passwords_en.pdf\">CNIL’s recommendations</a> : “<em>For the sake of clarity, the Restricted Committee notes that in order to ensure a sufficient level of security and satisfy the password strength requirements, when authentication relies solely on an identifier and password, the CNIL recommends, in its Decision No. 2017-012 of 19 January 2017, that the password have at least twelve characters - containing at least one upper-case letter, one lower-case letter, one number and one special character - or at least eight characters - containing three of these four characters - if it is accompanied by an additional measure such as, for example, the timing of access to the account after several failures (temporary suspension of access, the duration of which increases as attempts are made), setting up a mechanism to guard against automated and multiple attempts (e.g. a “captcha”) and/or locking the account after several failed login attempts. </em><em>“ in CNIL SAN 2022-022&nbsp;».</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-une-faq-pour-comprendre-lessentiel-en-quelques-minutes\">CNB’s recommendations</a>&nbsp;: “<em>Toutes les données envoyées par courriel ou transmises au moyen d’outils d’hébergement en ligne (Cloud) sont par conséquent vulnérables. Il s’agit donc de procéder à leur chiffrement systématique avant de les adresser à un correspondant ou de les hébergerLa transmission du secret (mot de passe, clé, etc.) permettant alors de déchiffrer les données, si elle est nécessaire, doit être effectuée via un canal de confiance ou, à défaut, un canal distinct du canal de transmission des données. Ainsi, si les données chiffrées sont transmises par courriel, une remise en main propre du mot de passe ou, à défaut, par téléphone doit être privilégiée.</em>&nbsp;:</li><li><em><a href=\"“https:/www.ssi.gouv.fr/uploads/2017/01/guide_hygiene_informatique_anssi.pdf\">ANSSI Guide de l’ hygiène informatique</a></em></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In their letter they admited exchanging regularly with their client in China. This concerns massive amount of highly personal data for more than a decade, with no appropriate security measure. Their justifications? Well, China has voted the data protection regulation PIPL, so all is good !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They admit having been non-compliant for years before recently discovering the platform they had refused to use when first suggested.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Again, this month, I received a fishing email from that law firm using a similar technic as shown below.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2372,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing_CBBC_Anonymised_08032022-1-1024x862.png\" alt=\"\" class=\"wp-image-2372\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Previously, in December 2020 I had received another suspicious email from that same law firm they never clarified if it came from them or not.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2373,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Spam-CBBC-IBP-18122020-1-808x1024.png\" alt=\"\" class=\"wp-image-2373\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>CNIL closed the case satisfied by these arguments without looking at :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>the question of long years of data transfers without any appropriate security measure ;</li><li>the use of the free version of WeTransfer without DPA art 28 while they could at least afford the professional version offering better guaranties;</li><li>use of the professional email address of the client and access by his employer</li><li>CNIL accepted there has not been a transfer as the receiver is an individual to whom GDPR does not apply.</li><li>resistance to reply to my requests, The CNIL did not care that the law firm rejected my DSAR for many years.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Here is a translation of CNIL’s decision - emphasises by me</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>Firstly, with regard to your difficulties relating to the exercise of the right of access to your personal data, XXXX, when questioned by the CNIL, indicated that this information was covered by professional secrecy. I confirm in this regard that, in accordance with the provisions of Article 23 of the General Data Protection Regulation (GDPR), the French legislator has, in Article 66-5 of Law No 71-1130 of 31 December 1971 reforming certain judicial and legal professions, provided for a limitation on the right of access. Under the above-mentioned article: \"In all matters, whether in the field of counsel or in that of defence, consultations sent by a lawyer to his client or intended for him, correspondence exchanged between the client and his lawyer, between the lawyer and his colleagues with the exception for the latter of those bearing the mention \"official\", the interview notes and, more generally, all documents in the file are covered by professional secrecy. ». [I don’t think I have ever questioned the confidentiality of their correspondences with their client]</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Secondly, with regard to the supervision of the transfers of your data made by XXXX, in particular to China where the firm\'s client resides to whom, according to your assertions [XXXX has XXXX clearly admitted doing so], your data would be sent, XXXX, questioned by the CNIL, indicates that there is no transfer strictly speaking.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>I confirm in this regard that it follows from the ongoing discussions at the level of the European Data Protection Board (EDPB) that a transfer exists only if the personal data are transmitted to an importer located in a third country. However, since the client of the firm to which you believe your data is transferred cannot be qualified as a controller, joint controller or processor, the transmission operation cannot be qualified as a transfer of personal data outside the European Union.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Thirdly, as regards the security measures implemented by XXXX to guarantee the integrity and confidentiality of your data, that firm has on the one hand specified the security measures deployed in the context of the use of the \"WeTransfer\" tool and on the other hand indicated that it now uses the e-Sharing platform, developed by the National Council of Bars, whose technical characteristics as described in the firm\'s response appear to meet the security obligations provided for in Article 5.1-f) of the GDPR. [Last WeTransfer link sent to me and other parties was last year. Before that for many years they exchanged via email attachment. They recognised I have been asking them – bothered them – to secure these exchanges due to highly sensitive data involved]</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Regarding the facts alleged in your message of May 10, 2022 according to which the XXXX firm recently sent you the password through the same channel (email) as that used to send the link to the platform, and that this password contains only 6 characters, XXXXX was reminded of the elementary precautions recalled by the CNIL on these points.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>In the light of these elements, I inform you to proceed to the closure of your complaint.&nbsp;»</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Surprisingly, neither the law firm, nor the notaire care about the fraudulent use of their email addresses or name !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although they admitted “<em>Ms. xxx obviously benefits from the right to ask the data controller for access to personal data, the rectification or erasure thereof, or a limitation of the processing relating to the person concerned, as well as the right to object to processing and the right to data portability. These rights are however limited by the very purpose of the processing of personal data, namely the recognition, exercise or defense of legal rights (Articles 16, 17, 18 and 20 of the GDPR).”</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm pretended holding data indirectly collected. However, they forget that some of the documents have been directly collected to comply with the principle of ‘<em>contradictoire</em>’ or adversarial principal.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They pretend they are under no obligation to respond to my DSAR as I would already have knowledge of the information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>- </strong>Where personal data is not collected from the data subject, any available information as to its source :they argue this information is also covered by professional secrecy. Therefore, they would not be able to reveal all of their sources [expect use of private investigators]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“Under these conditions, if Ms. xxx actually wished to request such a copy, she is asked to specify the data or the processing operations to which her request relates, as Cabinet xxx cannot decently gather all of this information in just one months as required by the GDPR. [Did they requested an extended delay?]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Their justification on the use of WeTransfer is rather enlightening:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Indeed, WeTransfer has indisputable practicality –</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They add “<em>If the firm was able to effectively use this tool to transmit documents, during a well-defined and now over period, to Ms. xxx\'s lawyer, to the notary, as well as to Ms. Xxx herself, it is recalled that the processing carried out here mainly concerned personal data relating to our client who has expressly consented to the use of this medium and has requested that it be use</em>.” This is totally untrue. A legal case obviously involves exchange of personal data concerning various parties. How did CNIL not reacted to that is a mystery.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have recognised using free WeTransfer in several occasions when they could have easily use alternative secure tools, ognoing my requests and the high sensitivity of the data: On February 3 and 20, 2020, October 14, 2020, January 14 and 22, 2021, January 29, 2021, December 9, 2021 and January 14, 2022.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They don’t despute my ‘<strong><em>numerous inquiries</em></strong><em> about WeTransfer’</em>. It had to come to the CNIL’s attention for them to make ‘<em>the necessary changes in order to comply with the GDPR and no longer use this service</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>II - On the question of regular long-term transfers to CHINA</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm is based in France. The litigation is initiated in France based on the French nationality of their client. The client is based in China. However, he travels around the world including in Europe where some of the exchanges have occurred and while in Europe, no doubt GDPR applied to these transfers. Data transfers via China where the email servers of the employer are located.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm collect personal data from their client, from me directly in respect with the principal of adversarial, from the notaire, and I suspect from their communications, from private investigators. These documents are then forwarded to their client for observation. Then sent back to them. These will be used and reproduced to draft the court documents again exchanged between all parties including the client. Therefore, the law firm is data controller (see UK ICO cases of Tuckered LLP or Smith… ). Would the client be as well a data controller of the part of data he gathers, stores and processed? Possibly. In two cases, ECJ has considered individual as data controller : in the Facebook fan page admin case and in Jeowah’s Witnesses. [in <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0040\">ECJ Fashion ID</a> “(<em>A)s the Advocate General noted, [...-] it appears that a natural or legal person may be a controller, within the meaning of Article 2(d) of Directive 95/46, jointly with others only in respect of operations involving the processing of personal data for which it determines jointly the purposes and means. By contrast, [...] that natural or legal person cannot be considered to be a controller, within the meaning of that provision, in the context of operations that precede or are subsequent in the overall chain of processing for which that person does not determine either the purposes or the means</em>”.<br>In <a href=\"https://gdprhub.eu/index.php?title=CJEU_-_C%E2%80%9125/17_-_Tietosuojavaltuutettu\">Jehovah’s witnesses, C-25/17</a>, the CJEU considered that a religious community of Jehovah’s witnesses acted as a controller, jointly with its individual members.]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm argued that ‘<em>The “transfers” in question are in no way regular and permanent but rather punctual and occasional, as much as respect for the adversarial process has made it necessary to communicate the documents in the file. Moreover, strictly speaking, there is no transfer outside the European Union at the initiative of xxx since <strong>it is the recipient of the data who imports the data</strong> because he is domiciled outside the European Union. And it should be remembered that the GDPR does not apply to natural persons not residing in the European Union.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Can we still talk<em> about ‘ponctual and occasional’</em> for something that has last 11 years ?! Massive amount of highly personal sensitive data have been exchanged refusing the special request to use encryption rejected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Their argument is that the transfers almost exclusively concerned data obtained indirectly through the lawyer., the notary or the client. This is not exact as some of the data was directly collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Knowing that several litigations initiated since 2011 involving different jurisdictions in France, it’s difficult to admit these heavy volume of data exchanges were ‘<em>ponctual</em>’ (3 court of appeals, 4 other jurisdictions, several notaires, huissiers, or Avoués were involved each time data has been sent with no care)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In any case, their communications between the law firm and the notaire are not confidential Article 14 paragraph 5, d). – in contrary I should have been in copy on all of them</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Concerning Chinese employers practice, here is </strong><a href=\"https://www.politico.eu/article/huawei-germany-court-case-privacy/\">report by Politico</a> :</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>“A case filed by one of Huawei’s former managers at its European headquarters in Düsseldorf takes aim at another pitfall for the company: Its respect of European privacy rules.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Specifically, it opens up questions about whether Huawei is putting data at risk of slipping into the hands of Chinese state surveillance and intelligence operations. It also raises questions about whether Europe will sharpen its tone with China on sensitive data privacy matters — after years of focusing its ire on Silicon Valley’s giants and U.S. state surveillance.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>A judge ruled March 5 that Huawei was in breach of European privacy law when it failed to comply with the former manager’s request to view the data the company had kept on him.” &nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Ultimately, non-compliance with GDPR is <a href=\"https://www.cnil.fr/fr/les-sanctions-penales\">a criminal offense</a></strong><strong> :</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le fait, y compris par négligence, de procéder ou de faire procéder à des traitements de données à caractère personnel sans qu\'aient été respectées les formalités préalables à leur mise en oeuvre prévues par la loi est puni de cinq ans d\'emprisonnement et de 300 000 euros d\'amende.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le fait de procéder ou de faire procéder à un traitement de données à caractère personnel sans mettre en oeuvre les mesures prescrites aux articles 24, 25, 30 et 32 du règlement (UE) 2016/679 du 27 avril 2016 précité ou au 6° de l\'article 4 et aux articles 99 à 101 de la loi n° 78-17 du 6 janvier 1978 précitée est puni de cinq ans d\'emprisonnement et de 300 000 euros d\'amende.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>Previous related CNIL’s decisions </u></strong><strong><u></u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>For reference, here are previous similar cases involving the questions of security measures</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Slimpay, lack of measures of security <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32</a>, without the need to prove any illegitimate access to the data&nbsp;:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“95. <em>The Restricted Committee then notes that the accessible data (title, surname, first name, e-mail address, postal address, telephone number, BIC/IBAN) make it possible to obtain very precise information on the persons concerned by revealing their identity and their contact information.&nbsp;In addition, specific data are in question when some relate to financial information.&nbsp;The fact in particular that the <strong>IBAN appears is not insignificant</strong>.&nbsp;As the Banque de France indicated in its book \"Payments and market infrastructures in the digital age\", <strong>IBANs are \"sensitive\" payment data</strong> (in the ordinary sense of the term) because they can be used to commit fraud. .&nbsp;The European Data Protection Board describes this type of data as \"highly personal\".&nbsp;The Restricted Committee considers that the company should have exercised particular vigilance with regard to securing such data, which may be reused by unauthorized third parties, thus harming the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining data) when their full identity, associated with their email address for many, was freely accessible.&nbsp;thus prejudicing the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining</em> <em>data) when their full identity, associated with their email address for many, was freely accessible.&nbsp;thus prejudicing the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining data) when their full identity, associated with their email address for many, was freely accessible.</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>“68. The Restricted Committee considers that the absence of proof of fraudulent use of the data has no impact on the characterization of the breach of the security obligation.&nbsp;Indeed, the risk of fraudulent use of personal data was real, independently of the cases of fraud, insofar as the data of many people were made accessible to unauthorized third parties.&nbsp;The absence of proven harm to the persons concerned does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.”</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042676787\">The French DPA (CNIL) imposes a 3,000 euros fine on a doctor</a> for failing to comply with the security obligation, due to the free access on the web of his patients\' health data. CNIL recalls its own guidelines on Personal Data Security recommending encryption as a standard security measure. Similarly, the Practical Guide for Physicians encourages physicians to encrypt their patients\' data with suitable software.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Transmitting unsecured emails: the restricted training points out that it also emerges from the hearing of December 17, 2019 that “<em>Mr. [...] had also not taken care to encrypt the data contained in his personal laptop, considering that encryption slows down the execution of applications too much (medical file, image visualization tool).</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>26. In the absence of encryption, the medical data contained in that computer\'s hard drive were readable in plain text by any person taking possession of that device (for example, as a result of its loss or theft) or by any person who unduly entered the network to which that computer was connected.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its guidance The security of personal data, the CNIL recommends providing encryption means for nomadic workstations and mobile storage media (laptop, USB keys, external hard disk, CD-R, DVD-RW, etc.), for example via the encryption of the hard disk in its entirety when the operating system offers it, file-by-file encryption or the creation of encrypted containers (file likely to contain several files). Similarly, the Practical Guide for Physicians invites physicians to encrypt their patients\' data with appropriate software.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2021-021\">The French DPA (CNIL) fined a mobile operator €300,000</a> for failing to respect customers\' right of access and right to object by not responding to their access requests in a timely manner and sending them marketing messages despite having been notified of their objection to such processing.</li><li><a href=\"https://gdprhub.eu/index.php?title=CNIL_-_SAN-2020-008\">The French DPA (CNIL) imposed a € 2250000 fine on Carrefour France</a> for several violations of the GDPR and French data protection law. These include : excessive data retention periods, incomplete and unclear information on data processes, lack of proper answer to data subjects\' requests, security breaches and illicit use of cookies.</li><li>The CNIL also referred to a&nbsp;<a href=\"https://www.legifrance.gouv.fr/ceta/id/CETATEXT000038388017/\">decision n°423559</a>&nbsp;by the French Supreme Administrative Court (Conseil d\'Etat) which allowed for such sanctions, even if the violation had been corrected. (NESTOR)</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Other cases in the EU</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://lnkd.in/dFuE5SHj\">A hospital in Sweden</a> received a fine&nbsp;of 150k EUR because it was sending medical records via email to patients and referring hospitals, unencrypted.<br>That was a&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">GDPR</a>&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">security</a>&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=issue&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">issue</a>, in direct breach of art 5 (1)(f) GDPR (principle of security) and art 32 GDPR (security of processing).<br>Email is an obsolete communication mechanism, start using encrypted document sharing solutions, with strong authentication!</li><li><a href=\"https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_Societatea_Civil%C4%83_Profesional%C4%83_de_Avoca%C8%9Bi_%E2%80%9ESabou,_Burz_%26_Cuc%E2%80%9D\">The Romanian DPA issued a fine of approximately €1000 on a law firm</a> for disclosing a case file with the personal data of one of its clients on an external WhatsApp group with other lawyers, in breach of Articles 6, 5(1)(a), 5(1)(b), 5(1)(c), 5(1)(f) and 5(2) GDPR.</li><li>Hungarian DPA fines Lawyer € 835 for unauthorized transmission of a confidential document to two unauthorized third parties.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject lodged a complaint with the DPA concerning the unlawful disclosure of his personal data.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The recipient of the fine acted as a lawyer for a company that was in litigation with the complainant.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In his complaint, the concerned party alleged that the respondent had improperly and without cause disclosed to two other parties in the case \"<em>highly confidential information\"</em>, which was a private letter to the President and Vice-President of an unnamed company.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The view that the sending of an unencrypted e-mail might violate Art. 32 GDPR is also the opinion of the Data Protection Authority of North Rhine-Westphalia (DPA NRW), which says the following on its website:</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The communication by e-mail requires at least the transport encryption, as it is offered by the considerable European providers by default. ... It must be taken into account that in the case of transport encryption the e-mails are available on the e-mail servers in plain text and can basically be viewed. In the case of particularly sensitive data (e.g. account transaction data, financing data, health status data, client data from lawyers and tax consultants, employee data), transport encryption alone may not be sufficient</em>\". (DPA NRW, Technical Requirements for Technical and Organizational Measures for E-Mail Sending,&nbsp;<a href=\"https://www.ldi.nrw.de/mainmenu_Aktuelles/Inhalt/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand.html\" target=\"_blank\" rel=\"noreferrer noopener\">available here</a>&nbsp;in German).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>With special thanks to the experts who have offered me their assistance on this matter :</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/davidflintscotland/\" target=\"_blank\">David Flint</a>, Commercial Law Consultant at Inksters; Visiting Professor at Creighton University School of Law.</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/peter-stephenson-phd-cissp-faafs-3a6788108/\" target=\"_blank\">Peter Stephenson</a>, PhD, CISSP, FAAFS Writer, researcher and educator in cyber criminology and cyber jurisprudence.</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/alexandre-blanc-cyber-security-88569022/\" target=\"_blank\">Alexandre Blanc</a> Cyber Security - vCISO - ISO/IEC 27001 and 27701 Lead Implementer - best Cyber Risk Communicator of 2019 and 2020 - MCNA - MITRE ATT&amp;CK - LinkedIn Top Voice 2020 in Technology - Cyber Sentinel Award 2020-21 – Speaker</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/valerymarchive/\" target=\"_blank\">Valery Rieß-Marchive</a> Rédacteur-en-chef, LeMagITTalks about malware, offrecyber, ransomware, cyberattaque, and threatintelligence</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>A special thank to <a href=\"https://twitter.com/alexislintS\" target=\"_blank\" rel=\"noreferrer noopener\">Lord\'Aliosha</a> for his breathaking photo reproduced with his special permission</p>\n<!-- /wp:paragraph -->','Advocating Privacy and Data Protection for More Than a Decade And Still Fighting Resistance','<!-- wp:paragraph -->\n<p>I have been watching legal professionals disseminating personal data around the world. Feel my pain ? Why it especially matters? Because they are the ones advising others. They are the role model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the GDPR has now celebrating it’s 6 years and 4 years of enforcement, Here an exhaustive practical case law analysis of the importance of taking appropriate security measures and how things can go wrong.</p>\n<!-- /wp:paragraph -->','inherit','closed','closed','','2364-revision-v1','','','2022-05-25 13:32:41','2022-05-25 13:32:41','',2364,'https://www.datarainbow.eu/?p=2377',0,'revision','',0),(2378,1,'2022-05-25 14:17:10','2022-05-25 14:17:10','<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have been watching legal professionals disseminating personal data around the world. Feel my pain ? Why it especially matters? Because they are the ones advising others. They are the role model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the GDPR has now celebrating it’s 6 years and 4 years of enforcement, Here an exhaustive practical case law analysis of the importance of taking appropriate security measures and how things can go wrong.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>I – Appropriate measures of security and data breach</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have been warning about the need for encryption when handling sensitive data. I have contacted the law society who have confirmed my requests as legitimate. Encryption is essential and WeTransfer is not an option. More secured tools are available; they are dangerously ignored. French Data Protection Authority <a href=\"https://www.cnil.fr/fr/securite-securiser-les-echanges-avec-dautres-organismes\">CNIL has published recommendations</a> not to use email to exchange personal data. <a href=\"https://www.ssi.gouv.fr/uploads/2017/01/guide_hygiene_informatique_anssi.pdf\">ANSSI</a> has published several warnings concerning the risks related to email exchanges.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was first on Marsh 2021 that I received two separate emails, in two of my email addresses I had used with one of these French legals, a notaire (some kind of solicitor/notary). The emails as shown below, <strong>reproduced previous exchanges</strong> I had with the professional. It appears as a chain of communication, with a short sentence inviting to click on the attachment. Same kind of operations were repeated in June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2367,\"width\":553,\"height\":572,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phisihing-Watin-1-1-989x1024.png\" alt=\"\" class=\"wp-image-2367\" width=\"553\" height=\"572\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2368,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-2-839x1024.png\" alt=\"\" class=\"wp-image-2368\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2369,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-3-780x1024.png\" alt=\"\" class=\"wp-image-2369\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2370,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-4-797x1024.png\" alt=\"\" class=\"wp-image-2370\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong><u>What Does that mean?</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Someone has been able to access to previous emails to this professional ;</li><li>The mails were non-encrypted, despite my request to secure our exchanges ;</li><li>These emails have fallen in the hands of cyber-criminals ;</li><li>The cybercriminals have been to reproduce previous exchanges with the professional, including highly sensitive documents ;</li><li>This to me is a data breach that should have been notified with 72 hours to the CNIL and without undue delay to data subject concerned if a serious risk was detected. I can’t see how this was not the case when a IBAN numbers, ID cards etc were exposed ;</li><li>The phishing emails received contained a malicious zip file that has been analysed by an IT expert ;</li><li>The attack is very similar to what has been described as a <a href=\"https://tekdeeps.com/trojan-qbot-steals-e-mails-and-misuses-them-for-further-attacks-it-can-also-attack-in-the-czech-republic/\">Qbot attack</a> or <a href=\"https://www.gdata.fr/news/2021/05/36849-g-data-rapport-sur-les-menaces-qbot-remplace-emotet\">Emotet</a>. Several big companies such as <a href=\"https://www.lemagit.fr/actualites/252502320/Quel-est-le-point-commun-entre-Fujifilm-JPS-et-un-office-notarial-francais-Qbot\">Ikea, Fujifilm or JPS</a> have been victim of these email chain attacks designed to <a href=\"https://www.lemondeinformatique.fr/actualites/lire-le-malware-financier-qbot-reprend-du-service-74527.html\">extract financial data</a>.</li><li>Clicking on the <a href=\"https://blog.nviso.eu/2020/09/01/epic-manchego-atypical-maldoc-delivery-brings-flurry-of-infostealers/\">zip attachment</a> could infect the computer network to steal further financial information ;</li><li>The email appears on a mobile device only showing the name of the professional to gain the recipient’s trust. It’s only by looking more closely that a different email address appears. Therefore, it becomes relatively easy to be trapped ;</li><li>If I have received these 4 emails, there is a big chance I would not the only one ;</li><li>Actually, this could be a larger scale attack of the platform used by notaires. <a href=\"https://www.lemagit.fr/actualites/252502320/Quel-est-le-point-commun-entre-Fujifilm-JPS-et-un-office-notarial-francais-Qbot\">Two other cases have been brought to my attention</a>, one of them being the very respected lawyer representing me.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>After I received the first emails, I sent several emails to the notaire on a different email address to check if they knew anything. I finally called them to understand what had happened. I was told by the big boss that he had no idea, had no care and probably have they been hacked just as it happens to many….</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I then turned into the French Cyber Gendarmerie online, they told me it was a spam. But how a simple spam could reproduce my previous emails ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Anxious about the data the cybercriminals had access to, I then send a request of information to the notaire trying to understand how they secured my data. They decided they needed an extra two months without justifying it. When I asked if they had a Data Protection Officer, they remembered than indeed all ‘notaires’ have an external mutualist DPO. Only in June did they notified the CNIL (data breach have to be notified within 72 hours to the CNIL and without undue delay to data subjects. My documents contained other people’s data breached as well. To my knowledge no data subject has been notified). From a document communicated by their DPO, last year the CNIL has requested some further information from them. So maybe after all this was not a simple Spam.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With the very slow progress with the notaire, I contacted a lawyer in Paris, Maître François-René Lebatard, who urged me to file a criminal complaint before all evidence would vanish. That was around June last year. The complaint is still under investigation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, I contacted the CNIL that accepted to investigate my complaint. Here is their conclusion :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>«&nbsp;Following the intervention of the CNIL, the data protection officer (DPO) of the firm, who was reminded of the obligations in force with regard to requests for access rights and the security of personal data, indicated:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>…</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>They have, following the letter from Ms xxx of 20 March 2021 indicating that she had received fraudulent emails, questioned their IT service provider asking for a detailed expert report, investigations from which it appears that no data breach is proven, that the fraudulent emails received by Ms xxx took over emails which she was the sender, that they did not concern any email that the office would have sent to Ms xxx as a recipient and that no other office\'s client had reported having received fraudulent emails.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No further explanation on where these phishing emails came from. Case closed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When back to our business with the notaire, I had to send him a legal document. I used Protonmail encryption. Again, he expected me to send it by email simple attachment. I had to remind him his DPO had mentioned they had a secure mean of document exchange. So even after the incident, was he still convinced <a href=\"https://www.americanbar.org/groups/business_law/publications/blt/2016/06/07_borden/\">exchanging data by simple email attachment ‘as usual’ is the way to go.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Now lets talk about <strong>the law firm involved in this case</strong>. A law firm advertising their international businesses. They exchangemassive amounts of documents by email attachment before discovering the joy of the free WeTransfer. Few law firms in Paris use WeTransfer because it’s free and convenient. I have tried my best to bring to their attention the risks paused by this tool. So, lets look deeper into that free WeTransfer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong><u>What’s wrong with the use of a free WeTransfer for a law firm ?</u></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://teamdrive.com/en/how-secure-is-wetransfer/\">WeTransfer</a> is a platform where users can upload their documents, receive a link with a password to send to their recipients.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>WeTransfer has <a href=\"https://www.bleepingcomputer.com/news/security/phishing-campaign-bypasses-email-gateways-via-wetransfer-alerts/\">been attacked several times</a> <a href=\"https://wetransfer.com/corporate/178267-update-security-notice-june-26th\">in the past</a>. <a href=\"https://www.hackread.com/wetransfer-phishing-attack-spoofs-steal-credential/\">Links have been intercepted</a> or <a href=\"https://threatpost.com/popular-file-sharing-service-wetransfer-used-in-malicious-spam-campaigns/146671/\">used in malicious spam</a> ; <a href=\"https://wetransfer.pr.co/178267-security-notice\" target=\"_blank\" rel=\"noreferrer noopener\">According to WeTransfer</a>, on June 16 and 17, file transfer emails were sent to unintended email addresses</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“<em>We have learned that a transfer you sent or received was also delivered to some people it was not meant to go to. Our records show that those files have been accessed, but almost certainly by the intended recipient. Nevertheless, as a precaution we blocked the link to prevent further downloads,”</em>&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.bleepingcomputer.com/news/security/phishing-campaign-bypasses-email-gateways-via-wetransfer-alerts/\">A phishing campaign</a> observed by security researchers at the Cofense&nbsp;Phishing Defense Center targeting a wide range of high profile entities from industries such as media and banking was detected in july: <em>“using WeTransfer&nbsp;notifications as surrogates for the run-of-the-mill malicious URLs usually employed in these type of attacks&nbsp;was recently detected while successfully bypassing email gateways developed by Microsoft, Proofpoint, and Symantec.”</em></li><li>Again in August 2021, it is reported ‘<a href=\"https://www.hackread.com/wetransfer-phishing-attack-spoofs-steal-credential/\">New WeTransfer phishing attack spoofs file-sharing to steal credential</a>’</li><li>&nbsp;<a href=\"https://www.pearltrees.com/t/data-in-law-firms/wetransfer/id41633223/item366308782\">Free WeTransfer</a> does not give the <a href=\"https://wetransfer.zendesk.com/hc/en-us/articles/360000905623-GDPR-Requesting-a-Data-Processing-Agreement\">option of a Data Processing Agreement (DPA)</a> required for any data processor used as by <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\">Article 28 GDPR</a> ; <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\">Art 28-3 states</a> : “<em>Processing by a processor shall be governed by a contract or other legal act under domestic law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.</em>&nbsp;“</li><li>Data at rest is not encrypted and can be accessed ‘for technical purpose’ ;</li><li>The balance of proportionality and obligations of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32 GDPR</a> - combined with <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-24-gdpr/\">Article 24</a> <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-25-gdpr/\">and 25</a>, privacy by design - require to take account of the sensitivity of the data, balanced with the state of the art and the cost of the implementation, to take appropriate security measures, starting by encryption as reminded to the<a href=\"https://ico.org.uk/action-weve-taken/enforcement/tuckers-solicitors-llp-mpn/\"> law firm</a> <a href=\"https://ico.org.uk/action-weve-taken/enforcement/tuckers-solicitors-llp-mpn/\">Tuckers LLP fined by the UK ICO</a> or by the <a href=\"https://gdprhub.eu/index.php?title=DPC_(Ireland)_-_DPC_Case_Reference:_IN-19-9-5&amp;section=6\">Irish DPC fining Bank Of I</a>reland ; [the UK ICO referred to the “<em>state of the art</em>\", as ‘<em>relevant industry standards of good practice including the ISO27000 series, the National Institutes of Standards and Technology (\"NIST\"), the various guidance from the ICO itself, the National Cyber Security Centre (\"NCSC\"), the Solicitors Regulatory Authority (\"SRA\"), Lexcel and \'NCSC Cyber Essentials\'.</em><em> </em>‘</li><li>Recital 83 on the balance of proportionality&nbsp;:</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“<em>In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing <strong>and implement measures to mitigate those risks</strong>, <strong>such as encryption.</strong>&nbsp;Those measures should ensure an <strong>appropriate level of security</strong>, including <strong>confidentiality</strong>, taking into account the <strong>state of the art</strong> and the <strong>costs of implementation </strong>in relation to the <strong>risks</strong> and the <strong>nature of the personal data</strong> to be protected.&nbsp;3In assessing data security risk, consideration should be given to the risks that are presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed which may in particular lead to physical, material or non-material damage.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It happens that the French law society (CNB) that I have contacted has informed me of the existence of a secured platform lawyers can use for the transmission of their documents. Therefore no excuse to go to an unreliable free third party ;</li><li>Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">WeTransfer uses AWS servers</a> to store data, which is not without consequences with regard to the prohibition of data transfers to the US following the invalidation of the Safe Harbour then Privacy Shield based on the well-known ECJ decision in <a href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\">Schrems-II.</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>indisputable practicality</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have to say, the insistence of the law firm to use WeTransfer was not innocent. They had been warned their WeTransfer links would not be touched. Their insistence to refuse more secure options was not innocent and certainly part of their dirty strategy. They have been trying to pretend to communicate evidence that does not exist. Fortunately, another party took care to transfer their WeTransfer linked documents. The document listed was not there. They have yet not reacted on the missing documents requests several months later.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The same way have they ignored to respond to the requests concerning their appropriate security measures hiding behind attorney/client privilege. They were not asked to reveal their communications with their client.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It happens that their client who has initiated the various legal proceedings in France is based in China and to my knowledge, he exclusively uses his professional email address. He has even warned about his employer accessing his personal devices for inspection : ... “<em>Unfortunately my personal computer has been confiscated by xxx [the employer is a major communication provider with close tights with the government] for security reasons so can’t access personal mail till Monday. Because I used it for work in xxxx they have to take everything out of it including Windows 7 ...”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facing this abusive resistance, I had to turn into the CNIL. The CNIL requested the law firm to respond to my request. It was eventually clarified they used the free version of WeTransfer with no DPA. At least, they finally discovered they could use the secured CNB platform at their disposition. However, the password, a 6 single digit figures, was sent to all parties - including the notaire above –immediately following the link, using same channels. I personally find it hard to believe they could be that dumb. (I don’t think the CNB’s platform should allow such weak passwords. <a href=\"https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-fines-transavia-poor-personal-data-security\">Dutch DPA has fined Transavia for poor personal data security allowing weak passwords</a> ; <a href=\"https://gdprhub.eu/index.php?title=CNIL_(France)_-_D%C3%A9lib%C3%A9ration_SAN-2021-020_du_28_d%C3%A9cembre_2021\">French CNIL has been itself rather strict in their security requirements from Slimpay fined 180.000 €. </a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Password strenght was highlited by ANSSI : «&nbsp;the length and complexity of a password remain basic criteria for assessing its strength.” The need for a strong password is crucial to ensure the security and confidentiality.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cnil.fr/sites/default/files/atoms/files/recommandation_passwords_en.pdf\">CNIL’s recommendations</a> : “<em>For the sake of clarity, the Restricted Committee notes that in order to ensure a sufficient level of security and satisfy the password strength requirements, when authentication relies solely on an identifier and password, the CNIL recommends, in its Decision No. 2017-012 of 19 January 2017, that the password have at least twelve characters - containing at least one upper-case letter, one lower-case letter, one number and one special character - or at least eight characters - containing three of these four characters - if it is accompanied by an additional measure such as, for example, the timing of access to the account after several failures (temporary suspension of access, the duration of which increases as attempts are made), setting up a mechanism to guard against automated and multiple attempts (e.g. a “captcha”) and/or locking the account after several failed login attempts. </em><em>“ in CNIL SAN 2022-022&nbsp;».</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-une-faq-pour-comprendre-lessentiel-en-quelques-minutes\">CNB’s recommendations</a>&nbsp;: “<em>Toutes les données envoyées par courriel ou transmises au moyen d’outils d’hébergement en ligne (Cloud) sont par conséquent vulnérables. Il s’agit donc de procéder à leur chiffrement systématique avant de les adresser à un correspondant ou de les hébergerLa transmission du secret (mot de passe, clé, etc.) permettant alors de déchiffrer les données, si elle est nécessaire, doit être effectuée via un canal de confiance ou, à défaut, un canal distinct du canal de transmission des données. Ainsi, si les données chiffrées sont transmises par courriel, une remise en main propre du mot de passe ou, à défaut, par téléphone doit être privilégiée.</em>&nbsp;:</li><li><em><a href=\"“https:/www.ssi.gouv.fr/uploads/2017/01/guide_hygiene_informatique_anssi.pdf\">ANSSI Guide de l’ hygiène informatique</a></em></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In their letter they admited exchanging regularly with their client in China. This concerns massive amount of highly personal data for more than a decade, with no appropriate security measure. Their justifications? Well, China has voted the data protection regulation PIPL, so all is good !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They admit having been non-compliant for years before recently discovering the platform they had refused to use when first suggested.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Again, this month, I received a fishing email from that law firm using a similar technic as shown below.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2372,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing_CBBC_Anonymised_08032022-1-1024x862.png\" alt=\"\" class=\"wp-image-2372\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Previously, in December 2020 I had received another suspicious email from that same law firm they never clarified if it came from them or not.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2373,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Spam-CBBC-IBP-18122020-1-808x1024.png\" alt=\"\" class=\"wp-image-2373\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>CNIL closed the case satisfied by these arguments without looking at :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>the question of long years of data transfers without any appropriate security measure ;</li><li>the use of the free version of WeTransfer without DPA art 28 while they could at least afford the professional version offering better guaranties;</li><li>use of the professional email address of the client and access by his employer</li><li>CNIL accepted there has not been a transfer as the receiver is an individual to whom GDPR does not apply.</li><li>resistance to reply to my requests, The CNIL did not care that the law firm rejected my DSAR for many years.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Here is a translation of CNIL’s decision - emphasises by me</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>Firstly, with regard to your difficulties relating to the exercise of the right of access to your personal data, XXXX, when questioned by the CNIL, indicated that this information was covered by professional secrecy. I confirm in this regard that, in accordance with the provisions of Article 23 of the General Data Protection Regulation (GDPR), the French legislator has, in Article 66-5 of Law No 71-1130 of 31 December 1971 reforming certain judicial and legal professions, provided for a limitation on the right of access. Under the above-mentioned article: \"In all matters, whether in the field of counsel or in that of defence, consultations sent by a lawyer to his client or intended for him, correspondence exchanged between the client and his lawyer, between the lawyer and his colleagues with the exception for the latter of those bearing the mention \"official\", the interview notes and, more generally, all documents in the file are covered by professional secrecy. ». [I don’t think I have ever questioned the confidentiality of their correspondences with their client]</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Secondly, with regard to the supervision of the transfers of your data made by XXXX, in particular to China where the firm\'s client resides to whom, according to your assertions [XXXX has XXXX clearly admitted doing so], your data would be sent, XXXX, questioned by the CNIL, indicates that there is no transfer strictly speaking.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>I confirm in this regard that it follows from the ongoing discussions at the level of the European Data Protection Board (EDPB) that a transfer exists only if the personal data are transmitted to an importer located in a third country. However, since the client of the firm to which you believe your data is transferred cannot be qualified as a controller, joint controller or processor, the transmission operation cannot be qualified as a transfer of personal data outside the European Union.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Thirdly, as regards the security measures implemented by XXXX to guarantee the integrity and confidentiality of your data, that firm has on the one hand specified the security measures deployed in the context of the use of the \"WeTransfer\" tool and on the other hand indicated that it now uses the e-Sharing platform, developed by the National Council of Bars, whose technical characteristics as described in the firm\'s response appear to meet the security obligations provided for in Article 5.1-f) of the GDPR. [Last WeTransfer link sent to me and other parties was last year. Before that for many years they exchanged via email attachment. They recognised I have been asking them – bothered them – to secure these exchanges due to highly sensitive data involved]</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Regarding the facts alleged in your message of May 10, 2022 according to which the XXXX firm recently sent you the password through the same channel (email) as that used to send the link to the platform, and that this password contains only 6 characters, XXXXX was reminded of the elementary precautions recalled by the CNIL on these points.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>In the light of these elements, I inform you to proceed to the closure of your complaint.&nbsp;»</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Surprisingly, neither the law firm, nor the notaire care about the fraudulent use of their email addresses or name !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although they admitted “<em>Ms. xxx obviously benefits from the right to ask the data controller for access to personal data, the rectification or erasure thereof, or a limitation of the processing relating to the person concerned, as well as the right to object to processing and the right to data portability. These rights are however limited by the very purpose of the processing of personal data, namely the recognition, exercise or defense of legal rights (Articles 16, 17, 18 and 20 of the GDPR).”</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm pretended holding data indirectly collected. However, they forget that some of the documents have been directly collected to comply with the principle of ‘<em>contradictoire</em>’ or adversarial principal.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They pretend they are under no obligation to respond to my DSAR as I would already have knowledge of the information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>- </strong>Where personal data is not collected from the data subject, any available information as to its source :they argue this information is also covered by professional secrecy. Therefore, they would not be able to reveal all of their sources [expect use of private investigators]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“Under these conditions, if Ms. xxx actually wished to request such a copy, she is asked to specify the data or the processing operations to which her request relates, as Cabinet xxx cannot decently gather all of this information in just one months as required by the GDPR. [Did they requested an extended delay?]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Their justification on the use of WeTransfer is rather enlightening:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Indeed, WeTransfer has indisputable practicality –</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They add “<em>If the firm was able to effectively use this tool to transmit documents, during a well-defined and now over period, to Ms. xxx\'s lawyer, to the notary, as well as to Ms. Xxx herself, it is recalled that the processing carried out here mainly concerned personal data relating to our client who has expressly consented to the use of this medium and has requested that it be use</em>.” This is totally untrue. A legal case obviously involves exchange of personal data concerning various parties. How did CNIL not reacted to that is a mystery.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have recognised using free WeTransfer in several occasions when they could have easily use alternative secure tools, ognoing my requests and the high sensitivity of the data: On February 3 and 20, 2020, October 14, 2020, January 14 and 22, 2021, January 29, 2021, December 9, 2021 and January 14, 2022.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They don’t despute my ‘<strong><em>numerous inquiries</em></strong><em> about WeTransfer’</em>. It had to come to the CNIL’s attention for them to make ‘<em>the necessary changes in order to comply with the GDPR and no longer use this service</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>II - On the question of regular long-term transfers to CHINA</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm is based in France. The litigation is initiated in France based on the French nationality of their client. The client is based in China. However, he travels around the world including in Europe where some of the exchanges have occurred and while in Europe, no doubt GDPR applied to these transfers. Data transfers via China where the email servers of the employer are located.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm collect personal data from their client, from me directly in respect with the principal of adversarial, from the notaire, and I suspect from their communications, from private investigators. These documents are then forwarded to their client for observation. Then sent back to them. These will be used and reproduced to draft the court documents again exchanged between all parties including the client. Therefore, the law firm is data controller (see UK ICO cases of Tuckered LLP or Smith… ). Would the client be as well a data controller of the part of data he gathers, stores and processed? Possibly. In two cases, ECJ has considered individual as data controller : in the Facebook fan page admin case and in Jeowah’s Witnesses. [in <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0040\">ECJ Fashion ID</a> “(<em>A)s the Advocate General noted, [...-] it appears that a natural or legal person may be a controller, within the meaning of Article 2(d) of Directive 95/46, jointly with others only in respect of operations involving the processing of personal data for which it determines jointly the purposes and means. By contrast, [...] that natural or legal person cannot be considered to be a controller, within the meaning of that provision, in the context of operations that precede or are subsequent in the overall chain of processing for which that person does not determine either the purposes or the means</em>”.<br>In <a href=\"https://gdprhub.eu/index.php?title=CJEU_-_C%E2%80%9125/17_-_Tietosuojavaltuutettu\">Jehovah’s witnesses, C-25/17</a>, the CJEU considered that a religious community of Jehovah’s witnesses acted as a controller, jointly with its individual members.]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm argued that ‘<em>The “transfers” in question are in no way regular and permanent but rather punctual and occasional, as much as respect for the adversarial process has made it necessary to communicate the documents in the file. Moreover, strictly speaking, there is no transfer outside the European Union at the initiative of xxx since <strong>it is the recipient of the data who imports the data</strong> because he is domiciled outside the European Union. And it should be remembered that the GDPR does not apply to natural persons not residing in the European Union.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Can we still talk<em> about ‘ponctual and occasional’</em> for something that has last 11 years ?! Massive amount of highly personal sensitive data have been exchanged refusing the special request to use encryption rejected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Their argument is that the transfers almost exclusively concerned data obtained indirectly through the lawyer., the notary or the client. This is not exact as some of the data was directly collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Knowing that several litigations initiated since 2011 involving different jurisdictions in France, it’s difficult to admit these heavy volume of data exchanges were ‘<em>ponctual</em>’ (3 court of appeals, 4 other jurisdictions, several notaires, huissiers, or Avoués were involved each time data has been sent with no care)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In any case, their communications between the law firm and the notaire are not confidential Article 14 paragraph 5, d). – in contrary I should have been in copy on all of them</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Concerning Chinese employers practice, here is </strong><a href=\"https://www.politico.eu/article/huawei-germany-court-case-privacy/\">report by Politico</a> :</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>“A case filed by one of Huawei’s former managers at its European headquarters in Düsseldorf takes aim at another pitfall for the company: Its respect of European privacy rules.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Specifically, it opens up questions about whether Huawei is putting data at risk of slipping into the hands of Chinese state surveillance and intelligence operations. It also raises questions about whether Europe will sharpen its tone with China on sensitive data privacy matters — after years of focusing its ire on Silicon Valley’s giants and U.S. state surveillance.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>A judge ruled March 5 that Huawei was in breach of European privacy law when it failed to comply with the former manager’s request to view the data the company had kept on him.” &nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Ultimately, non-compliance with GDPR is <a href=\"https://www.cnil.fr/fr/les-sanctions-penales\">a criminal offense</a></strong><strong> :</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le fait, y compris par négligence, de procéder ou de faire procéder à des traitements de données à caractère personnel sans qu\'aient été respectées les formalités préalables à leur mise en oeuvre prévues par la loi est puni de cinq ans d\'emprisonnement et de 300 000 euros d\'amende.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le fait de procéder ou de faire procéder à un traitement de données à caractère personnel sans mettre en oeuvre les mesures prescrites aux articles 24, 25, 30 et 32 du règlement (UE) 2016/679 du 27 avril 2016 précité ou au 6° de l\'article 4 et aux articles 99 à 101 de la loi n° 78-17 du 6 janvier 1978 précitée est puni de cinq ans d\'emprisonnement et de 300 000 euros d\'amende.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>Previous related CNIL’s decisions </u></strong><strong><u></u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>For reference, here are previous similar cases involving the questions of security measures</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Slimpay, lack of measures of security <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32</a>, without the need to prove any illegitimate access to the data&nbsp;:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“95. <em>The Restricted Committee then notes that the accessible data (title, surname, first name, e-mail address, postal address, telephone number, BIC/IBAN) make it possible to obtain very precise information on the persons concerned by revealing their identity and their contact information.&nbsp;In addition, specific data are in question when some relate to financial information.&nbsp;The fact in particular that the <strong>IBAN appears is not insignificant</strong>.&nbsp;As the Banque de France indicated in its book \"Payments and market infrastructures in the digital age\", <strong>IBANs are \"sensitive\" payment data</strong> (in the ordinary sense of the term) because they can be used to commit fraud. .&nbsp;The European Data Protection Board describes this type of data as \"highly personal\".&nbsp;The Restricted Committee considers that the company should have exercised particular vigilance with regard to securing such data, which may be reused by unauthorized third parties, thus harming the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining data) when their full identity, associated with their email address for many, was freely accessible.&nbsp;thus prejudicing the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining</em> <em>data) when their full identity, associated with their email address for many, was freely accessible.&nbsp;thus prejudicing the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining data) when their full identity, associated with their email address for many, was freely accessible.</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>“68. The Restricted Committee considers that the absence of proof of fraudulent use of the data has no impact on the characterization of the breach of the security obligation.&nbsp;Indeed, the risk of fraudulent use of personal data was real, independently of the cases of fraud, insofar as the data of many people were made accessible to unauthorized third parties.&nbsp;The absence of proven harm to the persons concerned does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.”</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042676787\">The French DPA (CNIL) imposes a 3,000 euros fine on a doctor</a> for failing to comply with the security obligation, due to the free access on the web of his patients\' health data. CNIL recalls its own guidelines on Personal Data Security recommending encryption as a standard security measure. Similarly, the Practical Guide for Physicians encourages physicians to encrypt their patients\' data with suitable software.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Transmitting unsecured emails: the restricted training points out that it also emerges from the hearing of December 17, 2019 that “<em>Mr. [...] had also not taken care to encrypt the data contained in his personal laptop, considering that encryption slows down the execution of applications too much (medical file, image visualization tool).</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>26. In the absence of encryption, the medical data contained in that computer\'s hard drive were readable in plain text by any person taking possession of that device (for example, as a result of its loss or theft) or by any person who unduly entered the network to which that computer was connected.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its guidance The security of personal data, the CNIL recommends providing encryption means for nomadic workstations and mobile storage media (laptop, USB keys, external hard disk, CD-R, DVD-RW, etc.), for example via the encryption of the hard disk in its entirety when the operating system offers it, file-by-file encryption or the creation of encrypted containers (file likely to contain several files). Similarly, the Practical Guide for Physicians invites physicians to encrypt their patients\' data with appropriate software.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2021-021\">The French DPA (CNIL) fined a mobile operator €300,000</a> for failing to respect customers\' right of access and right to object by not responding to their access requests in a timely manner and sending them marketing messages despite having been notified of their objection to such processing.</li><li><a href=\"https://gdprhub.eu/index.php?title=CNIL_-_SAN-2020-008\">The French DPA (CNIL) imposed a € 2250000 fine on Carrefour France</a> for several violations of the GDPR and French data protection law. These include : excessive data retention periods, incomplete and unclear information on data processes, lack of proper answer to data subjects\' requests, security breaches and illicit use of cookies.</li><li>The CNIL also referred to a&nbsp;<a href=\"https://www.legifrance.gouv.fr/ceta/id/CETATEXT000038388017/\">decision n°423559</a>&nbsp;by the French Supreme Administrative Court (Conseil d\'Etat) which allowed for such sanctions, even if the violation had been corrected. (NESTOR)</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Other cases in the EU</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://lnkd.in/dFuE5SHj\">A hospital in Sweden</a> received a fine&nbsp;of 150k EUR because it was sending medical records via email to patients and referring hospitals, unencrypted.<br>That was a&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">GDPR</a>&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">security</a>&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=issue&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">issue</a>, in direct breach of art 5 (1)(f) GDPR (principle of security) and art 32 GDPR (security of processing).<br>Email is an obsolete communication mechanism, start using encrypted document sharing solutions, with strong authentication!</li><li><a href=\"https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_Societatea_Civil%C4%83_Profesional%C4%83_de_Avoca%C8%9Bi_%E2%80%9ESabou,_Burz_%26_Cuc%E2%80%9D\">The Romanian DPA issued a fine of approximately €1000 on a law firm</a> for disclosing a case file with the personal data of one of its clients on an external WhatsApp group with other lawyers, in breach of Articles 6, 5(1)(a), 5(1)(b), 5(1)(c), 5(1)(f) and 5(2) GDPR.</li><li>Hungarian DPA fines Lawyer € 835 for unauthorized transmission of a confidential document to two unauthorized third parties.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject lodged a complaint with the DPA concerning the unlawful disclosure of his personal data.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The recipient of the fine acted as a lawyer for a company that was in litigation with the complainant.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In his complaint, the concerned party alleged that the respondent had improperly and without cause disclosed to two other parties in the case \"<em>highly confidential information\"</em>, which was a private letter to the President and Vice-President of an unnamed company.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The view that the sending of an unencrypted e-mail might violate Art. 32 GDPR is also the opinion of the Data Protection Authority of North Rhine-Westphalia (DPA NRW), which says the following on its website:</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The communication by e-mail requires at least the transport encryption, as it is offered by the considerable European providers by default. ... It must be taken into account that in the case of transport encryption the e-mails are available on the e-mail servers in plain text and can basically be viewed. In the case of particularly sensitive data (e.g. account transaction data, financing data, health status data, client data from lawyers and tax consultants, employee data), transport encryption alone may not be sufficient</em>\". (DPA NRW, Technical Requirements for Technical and Organizational Measures for E-Mail Sending,&nbsp;<a href=\"https://www.ldi.nrw.de/mainmenu_Aktuelles/Inhalt/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand.html\" target=\"_blank\" rel=\"noreferrer noopener\">available here</a>&nbsp;in German).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>With special thanks to the experts who have offered me their assistance on this matter :</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/davidflintscotland/\" target=\"_blank\">David Flint</a>, Commercial Law Consultant at Inksters; Visiting Professor at Creighton University School of Law.</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/peter-stephenson-phd-cissp-faafs-3a6788108/\" target=\"_blank\">Peter Stephenson</a>, PhD, CISSP, FAAFS Writer, researcher and educator in cyber criminology and cyber jurisprudence.</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/alexandre-blanc-cyber-security-88569022/\" target=\"_blank\">Alexandre Blanc</a> Cyber Security - vCISO - ISO/IEC 27001 and 27701 Lead Implementer - best Cyber Risk Communicator of 2019 and 2020 - MCNA - MITRE ATT&amp;CK - LinkedIn Top Voice 2020 in Technology - Cyber Sentinel Award 2020-21 – Speaker</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/valerymarchive/\" target=\"_blank\">Valery Rieß-Marchive</a> Rédacteur-en-chef, LeMagITTalks about malware, offrecyber, ransomware, cyberattaque, and threatintelligence</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>A special thank to <a href=\"https://twitter.com/alexislintS\" target=\"_blank\" rel=\"noreferrer noopener\">Lord\'Aliosha</a> for his breathaking photo reproduced with his special permission</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And Fieldfisher for their useful links to GDPR articles, <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a></p>\n<!-- /wp:paragraph -->','Advocating Privacy and Data Protection for More Than a Decade And Still Fighting Resistance','<!-- wp:paragraph -->\n<p>I have been watching legal professionals disseminating personal data around the world. Feel my pain ? Why it especially matters? Because they are the ones advising others. They are the role model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the GDPR has now celebrating it’s 6 years and 4 years of enforcement, Here an exhaustive practical case law analysis of the importance of taking appropriate security measures and how things can go wrong.</p>\n<!-- /wp:paragraph -->','inherit','closed','closed','','2364-revision-v1','','','2022-05-25 14:17:10','2022-05-25 14:17:10','',2364,'https://www.datarainbow.eu/?p=2378',0,'revision','',0),(2379,1,'2022-05-25 16:38:09','2022-05-25 16:38:09','<!-- wp:paragraph -->\n<p>I have been watching legal professionals disseminating personal data around the world. Feel my pain ? Why it especially matters? Because they are the ones advising others. They are the role model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the GDPR has now celebrating its 6th year and 4 years of enforcement, here is an exhaustive practical case law analysis on the importance of taking appropriate security measures and how things can go wrong.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you don\'t have time to read this in full detail, here are the questions at sake : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>can legal professionals, bound by confidentiality, handling sensitive data, afford to miss appropriate measures of security as required by the article 32 GDPR, starting by encryption?</li><li>Is this OK for these professionnels to use third party processors without checking their GDPR compliance and security measures? Especially, is free WeTransfer appropriate for legals to exchange documents? What about art 28 GDPR ?</li><li>Can these professionnels export data outside the EU without any security measure?</li><li>When victim of phishing how to demonstrate who leak what? what are the rights of the victims? according to the CNIl, no right.</li><li>Data breach has administrative sanctions given by the supervisory authorities, criminal sanction introduced in national legislations and Article 82 civil liability for non-material damages : loss of control and distress (to be developed in a future article).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>I – Appropriate measures of security and data breach</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have been warning about the need for encryption when handling sensitive data. I have contacted the law society who have confirmed my requests as legitimate. Encryption is essential and WeTransfer is not an option. More secured tools are available; they are dangerously ignored. French Data Protection Authority <a href=\"https://www.cnil.fr/fr/securite-securiser-les-echanges-avec-dautres-organismes\">CNIL has published recommendations</a> not to use email to exchange personal data. <a href=\"https://www.ssi.gouv.fr/uploads/2017/01/guide_hygiene_informatique_anssi.pdf\">ANSSI</a> has published several warnings concerning the risks related to email exchanges.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was first on Marsh 2021 that I received two separate emails, in two of my email addresses I had used with one of these French legals, a notaire (some kind of solicitor/notary). The emails as shown below, <strong>reproduced previous exchanges</strong> I had with the professional. It appears as a chain of communication, with a short sentence inviting to click on the attachment. Same kind of operations were repeated in June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2367,\"width\":553,\"height\":572,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phisihing-Watin-1-1-989x1024.png\" alt=\"\" class=\"wp-image-2367\" width=\"553\" height=\"572\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2368,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-2-839x1024.png\" alt=\"\" class=\"wp-image-2368\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2369,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-3-780x1024.png\" alt=\"\" class=\"wp-image-2369\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2370,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-4-797x1024.png\" alt=\"\" class=\"wp-image-2370\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong><u>What Does that mean?</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Someone has been able to access to previous emails to this professional ;</li><li>The mails were non-encrypted, despite my request to secure our exchanges ;</li><li>These emails have fallen in the hands of cyber-criminals ;</li><li>The cybercriminals have been to reproduce previous exchanges with the professional, including highly sensitive documents ;</li><li>This to me is a data breach that should have been notified with 72 hours to the CNIL and without undue delay to data subject concerned if a serious risk was detected. I can’t see how this was not the case when a IBAN numbers, ID cards etc were exposed ;</li><li>The phishing emails received contained a malicious zip file that has been analysed by an IT expert ;</li><li>The attack is very similar to what has been described as a <a href=\"https://tekdeeps.com/trojan-qbot-steals-e-mails-and-misuses-them-for-further-attacks-it-can-also-attack-in-the-czech-republic/\">Qbot attack</a> or <a href=\"https://www.gdata.fr/news/2021/05/36849-g-data-rapport-sur-les-menaces-qbot-remplace-emotet\">Emotet</a>. Several big companies such as <a href=\"https://www.lemagit.fr/actualites/252502320/Quel-est-le-point-commun-entre-Fujifilm-JPS-et-un-office-notarial-francais-Qbot\">Ikea, Fujifilm or JPS</a> have been victim of these email chain attacks designed to <a href=\"https://www.lemondeinformatique.fr/actualites/lire-le-malware-financier-qbot-reprend-du-service-74527.html\">extract financial data</a>.</li><li>Clicking on the <a href=\"https://blog.nviso.eu/2020/09/01/epic-manchego-atypical-maldoc-delivery-brings-flurry-of-infostealers/\">zip attachment</a> could infect the computer network to steal further financial information ;</li><li>The email appears on a mobile device only showing the name of the professional to gain the recipient’s trust. It’s only by looking more closely that a different email address appears. Therefore, it becomes relatively easy to be trapped ;</li><li>If I have received these 4 emails, there is a big chance I would not the only one ;</li><li>Actually, this could be a larger scale attack of the platform used by notaires. <a href=\"https://www.lemagit.fr/actualites/252502320/Quel-est-le-point-commun-entre-Fujifilm-JPS-et-un-office-notarial-francais-Qbot\">Two other cases have been brought to my attention</a>, one of them being the very respected lawyer representing me.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>After I received the first emails, I sent several emails to the notaire on a different email address to check if they knew anything. I finally called them to understand what had happened. I was told by the big boss that he had no idea, had no care and probably have they been hacked just as it happens to many….</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I then turned into the French Cyber Gendarmerie online, they told me it was a spam. But how a simple spam could reproduce my previous emails ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Anxious about the data the cybercriminals had access to, I then send a request of information to the notaire trying to understand how they secured my data. They decided they needed an extra two months without justifying it. When I asked if they had a Data Protection Officer, they remembered than indeed all ‘notaires’ have an external mutualist DPO. Only in June did they notified the CNIL (data breach have to be notified within 72 hours to the CNIL and without undue delay to data subjects. My documents contained other people’s data breached as well. To my knowledge no data subject has been notified). From a document communicated by their DPO, last year the CNIL has requested some further information from them. So maybe after all this was not a simple Spam.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With the very slow progress with the notaire, I contacted a lawyer in Paris, Maître François-René Lebatard, who urged me to file a criminal complaint before all evidence would vanish. That was around June last year. The complaint is still under investigation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, I contacted the CNIL that accepted to investigate my complaint. Here is their conclusion :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>«&nbsp;Following the intervention of the CNIL, the data protection officer (DPO) of the firm, who was reminded of the obligations in force with regard to requests for access rights and the security of personal data, indicated:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>…</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>They have, following the letter from Ms xxx of 20 March 2021 indicating that she had received fraudulent emails, questioned their IT service provider asking for a detailed expert report, investigations from which it appears that no data breach is proven, that the fraudulent emails received by Ms xxx took over emails which she was the sender, that they did not concern any email that the office would have sent to Ms xxx as a recipient and that no other office\'s client had reported having received fraudulent emails.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No further explanation on where these phishing emails came from. Case closed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When back to our business with the notaire, I had to send him a legal document. I used Protonmail encryption. Again, he expected me to send it by email simple attachment. I had to remind him his DPO had mentioned they had a secure mean of document exchange. So even after the incident, was he still convinced <a href=\"https://www.americanbar.org/groups/business_law/publications/blt/2016/06/07_borden/\">exchanging data by simple email attachment ‘as usual’ is the way to go.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Now lets talk about <strong>the law firm involved in this case</strong>. A law firm advertising their international businesses. They exchangemassive amounts of documents by email attachment before discovering the joy of the free WeTransfer. Few law firms in Paris use WeTransfer because it’s free and convenient. I have tried my best to bring to their attention the risks paused by this tool. So, lets look deeper into that free WeTransfer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong><u>What’s wrong with the use of a free WeTransfer for a law firm ?</u></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://teamdrive.com/en/how-secure-is-wetransfer/\">WeTransfer</a> is a platform where users can upload their documents, receive a link with a password to send to their recipients.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>WeTransfer has <a href=\"https://www.bleepingcomputer.com/news/security/phishing-campaign-bypasses-email-gateways-via-wetransfer-alerts/\">been attacked several times</a> <a href=\"https://wetransfer.com/corporate/178267-update-security-notice-june-26th\">in the past</a>. <a href=\"https://www.hackread.com/wetransfer-phishing-attack-spoofs-steal-credential/\">Links have been intercepted</a> or <a href=\"https://threatpost.com/popular-file-sharing-service-wetransfer-used-in-malicious-spam-campaigns/146671/\">used in malicious spam</a> ; <a href=\"https://wetransfer.pr.co/178267-security-notice\" target=\"_blank\" rel=\"noreferrer noopener\">According to WeTransfer</a>, on June 16 and 17, file transfer emails were sent to unintended email addresses</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“<em>We have learned that a transfer you sent or received was also delivered to some people it was not meant to go to. Our records show that those files have been accessed, but almost certainly by the intended recipient. Nevertheless, as a precaution we blocked the link to prevent further downloads,”</em>&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.bleepingcomputer.com/news/security/phishing-campaign-bypasses-email-gateways-via-wetransfer-alerts/\">A phishing campaign</a> observed by security researchers at the Cofense&nbsp;Phishing Defense Center targeting a wide range of high profile entities from industries such as media and banking was detected in july: <em>“using WeTransfer&nbsp;notifications as surrogates for the run-of-the-mill malicious URLs usually employed in these type of attacks&nbsp;was recently detected while successfully bypassing email gateways developed by Microsoft, Proofpoint, and Symantec.”</em></li><li>Again in August 2021, it is reported ‘<a href=\"https://www.hackread.com/wetransfer-phishing-attack-spoofs-steal-credential/\">New WeTransfer phishing attack spoofs file-sharing to steal credential</a>’</li><li>&nbsp;<a href=\"https://www.pearltrees.com/t/data-in-law-firms/wetransfer/id41633223/item366308782\">Free WeTransfer</a> does not give the <a href=\"https://wetransfer.zendesk.com/hc/en-us/articles/360000905623-GDPR-Requesting-a-Data-Processing-Agreement\">option of a Data Processing Agreement (DPA)</a> required for any data processor used as by <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\">Article 28 GDPR</a> ; <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\">Art 28-3 states</a> : “<em>Processing by a processor shall be governed by a contract or other legal act under domestic law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.</em>&nbsp;“</li><li>Data at rest is not encrypted and can be accessed ‘for technical purpose’ ;</li><li>The balance of proportionality and obligations of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32 GDPR</a> - combined with <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-24-gdpr/\">Article 24</a> <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-25-gdpr/\">and 25</a>, privacy by design - require to take account of the sensitivity of the data, balanced with the state of the art and the cost of the implementation, to take appropriate security measures, starting by encryption as reminded to the<a href=\"https://ico.org.uk/action-weve-taken/enforcement/tuckers-solicitors-llp-mpn/\"> law firm</a> <a href=\"https://ico.org.uk/action-weve-taken/enforcement/tuckers-solicitors-llp-mpn/\">Tuckers LLP fined by the UK ICO</a> or by the <a href=\"https://gdprhub.eu/index.php?title=DPC_(Ireland)_-_DPC_Case_Reference:_IN-19-9-5&amp;section=6\">Irish DPC fining Bank Of I</a>reland ; [the UK ICO referred to the “<em>state of the art</em>\", as ‘<em>relevant industry standards of good practice including the ISO27000 series, the National Institutes of Standards and Technology (\"NIST\"), the various guidance from the ICO itself, the National Cyber Security Centre (\"NCSC\"), the Solicitors Regulatory Authority (\"SRA\"), Lexcel and \'NCSC Cyber Essentials\'.</em><em> </em>‘</li><li>Recital 83 on the balance of proportionality&nbsp;:</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“<em>In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing <strong>and implement measures to mitigate those risks</strong>, <strong>such as encryption.</strong>&nbsp;Those measures should ensure an <strong>appropriate level of security</strong>, including <strong>confidentiality</strong>, taking into account the <strong>state of the art</strong> and the <strong>costs of implementation </strong>in relation to the <strong>risks</strong> and the <strong>nature of the personal data</strong> to be protected.&nbsp;3In assessing data security risk, consideration should be given to the risks that are presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed which may in particular lead to physical, material or non-material damage.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It happens that the French law society (CNB) that I have contacted has informed me of the existence of a secured platform lawyers can use for the transmission of their documents. Therefore no excuse to go to an unreliable free third party ;</li><li>Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">WeTransfer uses AWS servers</a> to store data, which is not without consequences with regard to the prohibition of data transfers to the US following the invalidation of the Safe Harbour then Privacy Shield based on the well-known ECJ decision in <a href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\">Schrems-II.</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>indisputable practicality</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have to say, the insistence of the law firm to use WeTransfer was not innocent. They had been warned their WeTransfer links would not be touched. Their insistence to refuse more secure options was not innocent and certainly part of their dirty strategy. They have been trying to pretend to communicate evidence that does not exist. Fortunately, another party took care to transfer their WeTransfer linked documents. The document listed was not there. They have yet not reacted on the missing documents requests several months later.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The same way have they ignored to respond to the requests concerning their appropriate security measures hiding behind attorney/client privilege. They were not asked to reveal their communications with their client.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It happens that their client who has initiated the various legal proceedings in France is based in China and to my knowledge, he exclusively uses his professional email address. He has even warned about his employer accessing his personal devices for inspection : ... “<em>Unfortunately my personal computer has been confiscated by xxx [the employer is a major communication provider with close tights with the government] for security reasons so can’t access personal mail till Monday. Because I used it for work in xxxx they have to take everything out of it including Windows 7 ...”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facing this abusive resistance, I had to turn into the CNIL. The CNIL requested the law firm to respond to my request. It was eventually clarified they used the free version of WeTransfer with no DPA. At least, they finally discovered they could use the secured CNB platform at their disposition. However, the password, a 6 single digit figures, was sent to all parties - including the notaire above –immediately following the link, using same channels. I personally find it hard to believe they could be that dumb. (I don’t think the CNB’s platform should allow such weak passwords. <a href=\"https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-fines-transavia-poor-personal-data-security\">Dutch DPA has fined Transavia for poor personal data security allowing weak passwords</a> ; <a href=\"https://gdprhub.eu/index.php?title=CNIL_(France)_-_D%C3%A9lib%C3%A9ration_SAN-2021-020_du_28_d%C3%A9cembre_2021\">French CNIL has been itself rather strict in their security requirements from Slimpay fined 180.000 €. </a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Password strenght was highlited by ANSSI : «&nbsp;the length and complexity of a password remain basic criteria for assessing its strength.” The need for a strong password is crucial to ensure the security and confidentiality.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cnil.fr/sites/default/files/atoms/files/recommandation_passwords_en.pdf\">CNIL’s recommendations</a> : “<em>For the sake of clarity, the Restricted Committee notes that in order to ensure a sufficient level of security and satisfy the password strength requirements, when authentication relies solely on an identifier and password, the CNIL recommends, in its Decision No. 2017-012 of 19 January 2017, that the password have at least twelve characters - containing at least one upper-case letter, one lower-case letter, one number and one special character - or at least eight characters - containing three of these four characters - if it is accompanied by an additional measure such as, for example, the timing of access to the account after several failures (temporary suspension of access, the duration of which increases as attempts are made), setting up a mechanism to guard against automated and multiple attempts (e.g. a “captcha”) and/or locking the account after several failed login attempts. </em><em>“ in CNIL SAN 2022-022&nbsp;».</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-une-faq-pour-comprendre-lessentiel-en-quelques-minutes\">CNB’s recommendations</a>&nbsp;: “<em>Toutes les données envoyées par courriel ou transmises au moyen d’outils d’hébergement en ligne (Cloud) sont par conséquent vulnérables. Il s’agit donc de procéder à leur chiffrement systématique avant de les adresser à un correspondant ou de les hébergerLa transmission du secret (mot de passe, clé, etc.) permettant alors de déchiffrer les données, si elle est nécessaire, doit être effectuée via un canal de confiance ou, à défaut, un canal distinct du canal de transmission des données. Ainsi, si les données chiffrées sont transmises par courriel, une remise en main propre du mot de passe ou, à défaut, par téléphone doit être privilégiée.</em>&nbsp;:</li><li><em><a href=\"“https:/www.ssi.gouv.fr/uploads/2017/01/guide_hygiene_informatique_anssi.pdf\">ANSSI Guide de l’ hygiène informatique</a></em></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In their letter they admited exchanging regularly with their client in China. This concerns massive amount of highly personal data for more than a decade, with no appropriate security measure. Their justifications? Well, China has voted the data protection regulation PIPL, so all is good !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They admit having been non-compliant for years before recently discovering the platform they had refused to use when first suggested.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Again, this month, I received a fishing email from that law firm using a similar technic as shown below.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2372,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing_CBBC_Anonymised_08032022-1-1024x862.png\" alt=\"\" class=\"wp-image-2372\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Previously, in December 2020 I had received another suspicious email from that same law firm they never clarified if it came from them or not.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2373,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Spam-CBBC-IBP-18122020-1-808x1024.png\" alt=\"\" class=\"wp-image-2373\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>CNIL closed the case satisfied by these arguments without looking at :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>the question of long years of data transfers without any appropriate security measure ;</li><li>the use of the free version of WeTransfer without DPA art 28 while they could at least afford the professional version offering better guaranties;</li><li>use of the professional email address of the client and access by his employer</li><li>CNIL accepted there has not been a transfer as the receiver is an individual to whom GDPR does not apply.</li><li>resistance to reply to my requests, The CNIL did not care that the law firm rejected my DSAR for many years.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Here is a translation of CNIL’s decision - emphasises by me</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>Firstly, with regard to your difficulties relating to the exercise of the right of access to your personal data, XXXX, when questioned by the CNIL, indicated that this information was covered by professional secrecy. I confirm in this regard that, in accordance with the provisions of Article 23 of the General Data Protection Regulation (GDPR), the French legislator has, in Article 66-5 of Law No 71-1130 of 31 December 1971 reforming certain judicial and legal professions, provided for a limitation on the right of access. Under the above-mentioned article: \"In all matters, whether in the field of counsel or in that of defence, consultations sent by a lawyer to his client or intended for him, correspondence exchanged between the client and his lawyer, between the lawyer and his colleagues with the exception for the latter of those bearing the mention \"official\", the interview notes and, more generally, all documents in the file are covered by professional secrecy. ». [I don’t think I have ever questioned the confidentiality of their correspondences with their client]</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Secondly, with regard to the supervision of the transfers of your data made by XXXX, in particular to China where the firm\'s client resides to whom, according to your assertions [XXXX has XXXX clearly admitted doing so], your data would be sent, XXXX, questioned by the CNIL, indicates that there is no transfer strictly speaking.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>I confirm in this regard that it follows from the ongoing discussions at the level of the European Data Protection Board (EDPB) that a transfer exists only if the personal data are transmitted to an importer located in a third country. However, since the client of the firm to which you believe your data is transferred cannot be qualified as a controller, joint controller or processor, the transmission operation cannot be qualified as a transfer of personal data outside the European Union.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Thirdly, as regards the security measures implemented by XXXX to guarantee the integrity and confidentiality of your data, that firm has on the one hand specified the security measures deployed in the context of the use of the \"WeTransfer\" tool and on the other hand indicated that it now uses the e-Sharing platform, developed by the National Council of Bars, whose technical characteristics as described in the firm\'s response appear to meet the security obligations provided for in Article 5.1-f) of the GDPR. [Last WeTransfer link sent to me and other parties was last year. Before that for many years they exchanged via email attachment. They recognised I have been asking them – bothered them – to secure these exchanges due to highly sensitive data involved]</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Regarding the facts alleged in your message of May 10, 2022 according to which the XXXX firm recently sent you the password through the same channel (email) as that used to send the link to the platform, and that this password contains only 6 characters, XXXXX was reminded of the elementary precautions recalled by the CNIL on these points.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>In the light of these elements, I inform you to proceed to the closure of your complaint.&nbsp;»</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Surprisingly, neither the law firm, nor the notaire care about the fraudulent use of their email addresses or name !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although they admitted “<em>Ms. xxx obviously benefits from the right to ask the data controller for access to personal data, the rectification or erasure thereof, or a limitation of the processing relating to the person concerned, as well as the right to object to processing and the right to data portability. These rights are however limited by the very purpose of the processing of personal data, namely the recognition, exercise or defense of legal rights (Articles 16, 17, 18 and 20 of the GDPR).”</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm pretended holding data indirectly collected. However, they forget that some of the documents have been directly collected to comply with the principle of ‘<em>contradictoire</em>’ or adversarial principal.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They pretend they are under no obligation to respond to my DSAR as I would already have knowledge of the information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>- </strong>Where personal data is not collected from the data subject, any available information as to its source :they argue this information is also covered by professional secrecy. Therefore, they would not be able to reveal all of their sources [expect use of private investigators]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“Under these conditions, if Ms. xxx actually wished to request such a copy, she is asked to specify the data or the processing operations to which her request relates, as Cabinet xxx cannot decently gather all of this information in just one months as required by the GDPR. [Did they requested an extended delay?]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Their justification on the use of WeTransfer is rather enlightening:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Indeed, WeTransfer has indisputable practicality –</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They add “<em>If the firm was able to effectively use this tool to transmit documents, during a well-defined and now over period, to Ms. xxx\'s lawyer, to the notary, as well as to Ms. Xxx herself, it is recalled that the processing carried out here mainly concerned personal data relating to our client who has expressly consented to the use of this medium and has requested that it be use</em>.” This is totally untrue. A legal case obviously involves exchange of personal data concerning various parties. How did CNIL not reacted to that is a mystery.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have recognised using free WeTransfer in several occasions when they could have easily use alternative secure tools, ognoing my requests and the high sensitivity of the data: On February 3 and 20, 2020, October 14, 2020, January 14 and 22, 2021, January 29, 2021, December 9, 2021 and January 14, 2022.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They don’t despute my ‘<strong><em>numerous inquiries</em></strong><em> about WeTransfer’</em>. It had to come to the CNIL’s attention for them to make ‘<em>the necessary changes in order to comply with the GDPR and no longer use this service</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>II - On the question of regular long-term transfers to CHINA</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm is based in France. The litigation is initiated in France based on the French nationality of their client. The client is based in China. However, he travels around the world including in Europe where some of the exchanges have occurred and while in Europe, no doubt GDPR applied to these transfers. Data transfers via China where the email servers of the employer are located.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm collect personal data from their client, from me directly in respect with the principal of adversarial, from the notaire, and I suspect from their communications, from private investigators. These documents are then forwarded to their client for observation. Then sent back to them. These will be used and reproduced to draft the court documents again exchanged between all parties including the client. Therefore, the law firm is data controller (see UK ICO cases of Tuckered LLP or Smith… ). Would the client be as well a data controller of the part of data he gathers, stores and processed? Possibly. In two cases, ECJ has considered individual as data controller : in the Facebook fan page admin case and in Jeowah’s Witnesses. [in <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0040\">ECJ Fashion ID</a> “(<em>A)s the Advocate General noted, [...-] it appears that a natural or legal person may be a controller, within the meaning of Article 2(d) of Directive 95/46, jointly with others only in respect of operations involving the processing of personal data for which it determines jointly the purposes and means. By contrast, [...] that natural or legal person cannot be considered to be a controller, within the meaning of that provision, in the context of operations that precede or are subsequent in the overall chain of processing for which that person does not determine either the purposes or the means</em>”.<br>In <a href=\"https://gdprhub.eu/index.php?title=CJEU_-_C%E2%80%9125/17_-_Tietosuojavaltuutettu\">Jehovah’s witnesses, C-25/17</a>, the CJEU considered that a religious community of Jehovah’s witnesses acted as a controller, jointly with its individual members.]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm argued that ‘<em>The “transfers” in question are in no way regular and permanent but rather punctual and occasional, as much as respect for the adversarial process has made it necessary to communicate the documents in the file. Moreover, strictly speaking, there is no transfer outside the European Union at the initiative of xxx since <strong>it is the recipient of the data who imports the data</strong> because he is domiciled outside the European Union. And it should be remembered that the GDPR does not apply to natural persons not residing in the European Union.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Can we still talk<em> about ‘ponctual and occasional’</em> for something that has last 11 years ?! Massive amount of highly personal sensitive data have been exchanged refusing the special request to use encryption rejected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Their argument is that the transfers almost exclusively concerned data obtained indirectly through the lawyer., the notary or the client. This is not exact as some of the data was directly collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Knowing that several litigations initiated since 2011 involving different jurisdictions in France, it’s difficult to admit these heavy volume of data exchanges were ‘<em>ponctual</em>’ (3 court of appeals, 4 other jurisdictions, several notaires, huissiers, or Avoués were involved each time data has been sent with no care)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In any case, their communications between the law firm and the notaire are not confidential Article 14 paragraph 5, d). – in contrary I should have been in copy on all of them</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Concerning Chinese employers practice, here is </strong><a href=\"https://www.politico.eu/article/huawei-germany-court-case-privacy/\">report by Politico</a> :</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>“A case filed by one of Huawei’s former managers at its European headquarters in Düsseldorf takes aim at another pitfall for the company: Its respect of European privacy rules.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Specifically, it opens up questions about whether Huawei is putting data at risk of slipping into the hands of Chinese state surveillance and intelligence operations. It also raises questions about whether Europe will sharpen its tone with China on sensitive data privacy matters — after years of focusing its ire on Silicon Valley’s giants and U.S. state surveillance.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>A judge ruled March 5 that Huawei was in breach of European privacy law when it failed to comply with the former manager’s request to view the data the company had kept on him.” &nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Ultimately, non-compliance with GDPR is <a href=\"https://www.cnil.fr/fr/les-sanctions-penales\">a criminal offense</a></strong><strong> :</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le fait, y compris par négligence, de procéder ou de faire procéder à des traitements de données à caractère personnel sans qu\'aient été respectées les formalités préalables à leur mise en oeuvre prévues par la loi est puni de cinq ans d\'emprisonnement et de 300 000 euros d\'amende.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le fait de procéder ou de faire procéder à un traitement de données à caractère personnel sans mettre en oeuvre les mesures prescrites aux articles 24, 25, 30 et 32 du règlement (UE) 2016/679 du 27 avril 2016 précité ou au 6° de l\'article 4 et aux articles 99 à 101 de la loi n° 78-17 du 6 janvier 1978 précitée est puni de cinq ans d\'emprisonnement et de 300 000 euros d\'amende.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>Previous related CNIL’s decisions </u></strong><strong><u></u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>For reference, here are previous similar cases involving the questions of security measures</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Slimpay, lack of measures of security <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32</a>, without the need to prove any illegitimate access to the data&nbsp;:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“95. <em>The Restricted Committee then notes that the accessible data (title, surname, first name, e-mail address, postal address, telephone number, BIC/IBAN) make it possible to obtain very precise information on the persons concerned by revealing their identity and their contact information.&nbsp;In addition, specific data are in question when some relate to financial information.&nbsp;The fact in particular that the <strong>IBAN appears is not insignificant</strong>.&nbsp;As the Banque de France indicated in its book \"Payments and market infrastructures in the digital age\", <strong>IBANs are \"sensitive\" payment data</strong> (in the ordinary sense of the term) because they can be used to commit fraud. .&nbsp;The European Data Protection Board describes this type of data as \"highly personal\".&nbsp;The Restricted Committee considers that the company should have exercised particular vigilance with regard to securing such data, which may be reused by unauthorized third parties, thus harming the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining data) when their full identity, associated with their email address for many, was freely accessible.&nbsp;thus prejudicing the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining</em> <em>data) when their full identity, associated with their email address for many, was freely accessible.&nbsp;thus prejudicing the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining data) when their full identity, associated with their email address for many, was freely accessible.</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>“68. The Restricted Committee considers that the absence of proof of fraudulent use of the data has no impact on the characterization of the breach of the security obligation.&nbsp;Indeed, the risk of fraudulent use of personal data was real, independently of the cases of fraud, insofar as the data of many people were made accessible to unauthorized third parties.&nbsp;The absence of proven harm to the persons concerned does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.”</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042676787\">The French DPA (CNIL) imposes a 3,000 euros fine on a doctor</a> for failing to comply with the security obligation, due to the free access on the web of his patients\' health data. CNIL recalls its own guidelines on Personal Data Security recommending encryption as a standard security measure. Similarly, the Practical Guide for Physicians encourages physicians to encrypt their patients\' data with suitable software.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Transmitting unsecured emails: the restricted training points out that it also emerges from the hearing of December 17, 2019 that “<em>Mr. [...] had also not taken care to encrypt the data contained in his personal laptop, considering that encryption slows down the execution of applications too much (medical file, image visualization tool).</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>26. In the absence of encryption, the medical data contained in that computer\'s hard drive were readable in plain text by any person taking possession of that device (for example, as a result of its loss or theft) or by any person who unduly entered the network to which that computer was connected.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its guidance The security of personal data, the CNIL recommends providing encryption means for nomadic workstations and mobile storage media (laptop, USB keys, external hard disk, CD-R, DVD-RW, etc.), for example via the encryption of the hard disk in its entirety when the operating system offers it, file-by-file encryption or the creation of encrypted containers (file likely to contain several files). Similarly, the Practical Guide for Physicians invites physicians to encrypt their patients\' data with appropriate software.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2021-021\">The French DPA (CNIL) fined a mobile operator €300,000</a> for failing to respect customers\' right of access and right to object by not responding to their access requests in a timely manner and sending them marketing messages despite having been notified of their objection to such processing.</li><li><a href=\"https://gdprhub.eu/index.php?title=CNIL_-_SAN-2020-008\">The French DPA (CNIL) imposed a € 2250000 fine on Carrefour France</a> for several violations of the GDPR and French data protection law. These include : excessive data retention periods, incomplete and unclear information on data processes, lack of proper answer to data subjects\' requests, security breaches and illicit use of cookies.</li><li>The CNIL also referred to a&nbsp;<a href=\"https://www.legifrance.gouv.fr/ceta/id/CETATEXT000038388017/\">decision n°423559</a>&nbsp;by the French Supreme Administrative Court (Conseil d\'Etat) which allowed for such sanctions, even if the violation had been corrected. (NESTOR)</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Other cases in the EU</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://lnkd.in/dFuE5SHj\">A hospital in Sweden</a> received a fine&nbsp;of 150k EUR because it was sending medical records via email to patients and referring hospitals, unencrypted.<br>That was a&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">GDPR</a>&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">security</a>&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=issue&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">issue</a>, in direct breach of art 5 (1)(f) GDPR (principle of security) and art 32 GDPR (security of processing).<br>Email is an obsolete communication mechanism, start using encrypted document sharing solutions, with strong authentication!</li><li><a href=\"https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_Societatea_Civil%C4%83_Profesional%C4%83_de_Avoca%C8%9Bi_%E2%80%9ESabou,_Burz_%26_Cuc%E2%80%9D\">The Romanian DPA issued a fine of approximately €1000 on a law firm</a> for disclosing a case file with the personal data of one of its clients on an external WhatsApp group with other lawyers, in breach of Articles 6, 5(1)(a), 5(1)(b), 5(1)(c), 5(1)(f) and 5(2) GDPR.</li><li>Hungarian DPA fines Lawyer € 835 for unauthorized transmission of a confidential document to two unauthorized third parties.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject lodged a complaint with the DPA concerning the unlawful disclosure of his personal data.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The recipient of the fine acted as a lawyer for a company that was in litigation with the complainant.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In his complaint, the concerned party alleged that the respondent had improperly and without cause disclosed to two other parties in the case \"<em>highly confidential information\"</em>, which was a private letter to the President and Vice-President of an unnamed company.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The view that the sending of an unencrypted e-mail might violate Art. 32 GDPR is also the opinion of the Data Protection Authority of North Rhine-Westphalia (DPA NRW), which says the following on its website:</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The communication by e-mail requires at least the transport encryption, as it is offered by the considerable European providers by default. ... It must be taken into account that in the case of transport encryption the e-mails are available on the e-mail servers in plain text and can basically be viewed. In the case of particularly sensitive data (e.g. account transaction data, financing data, health status data, client data from lawyers and tax consultants, employee data), transport encryption alone may not be sufficient</em>\". (DPA NRW, Technical Requirements for Technical and Organizational Measures for E-Mail Sending,&nbsp;<a href=\"https://www.ldi.nrw.de/mainmenu_Aktuelles/Inhalt/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand.html\" target=\"_blank\" rel=\"noreferrer noopener\">available here</a>&nbsp;in German).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>With special thanks to the experts who have offered me their assistance on this matter :</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/davidflintscotland/\" target=\"_blank\">David Flint</a>, Commercial Law Consultant at Inksters; Visiting Professor at Creighton University School of Law.</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/peter-stephenson-phd-cissp-faafs-3a6788108/\" target=\"_blank\">Peter Stephenson</a>, PhD, CISSP, FAAFS Writer, researcher and educator in cyber criminology and cyber jurisprudence.</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/alexandre-blanc-cyber-security-88569022/\" target=\"_blank\">Alexandre Blanc</a> Cyber Security - vCISO - ISO/IEC 27001 and 27701 Lead Implementer - best Cyber Risk Communicator of 2019 and 2020 - MCNA - MITRE ATT&amp;CK - LinkedIn Top Voice 2020 in Technology - Cyber Sentinel Award 2020-21 – Speaker</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/valerymarchive/\" target=\"_blank\">Valery Rieß-Marchive</a> Rédacteur-en-chef, LeMagITTalks about malware, offrecyber, ransomware, cyberattaque, and threatintelligence</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>A special thank to <a href=\"https://twitter.com/alexislintS\" target=\"_blank\" rel=\"noreferrer noopener\">Lord\'Aliosha</a> for his breathaking photo reproduced with his special permission</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And Fieldfisher for their useful links to GDPR articles, <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a></p>\n<!-- /wp:paragraph -->','Advocating Privacy and Data Protection for More Than a Decade And Still Fighting Resistance','<!-- wp:paragraph -->\n<p>I have been watching legal professionals disseminating personal data around the world. Feel my pain ? Why it especially matters? Because they are the ones advising others. They are the role model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the GDPR has now celebrating it’s 6 years and 4 years of enforcement, Here an exhaustive practical case law analysis of the importance of taking appropriate security measures and how things can go wrong.</p>\n<!-- /wp:paragraph -->','inherit','closed','closed','','2364-revision-v1','','','2022-05-25 16:38:09','2022-05-25 16:38:09','',2364,'https://www.datarainbow.eu/?p=2379',0,'revision','',0),(2382,1,'2022-05-25 21:10:03','2022-05-25 21:10:03','<!-- wp:paragraph -->\n<p>I have been watching legal professionals disseminating personal data around the world. Feel my pain ? Why it especially matters? Because they are the ones advising others. They are the role model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the GDPR has now celebrating its 6th year and 4 years of enforcement, here is an exhaustive practical case law analysis on the importance of taking appropriate security measures and how things can go wrong.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you don\'t have time to read this in full detail, here are the questions at sake : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>can legal professionals, bound by confidentiality, handling sensitive data, afford to miss appropriate measures of security as required by the article 32 GDPR, starting by encryption? CNIL is not chocked by years of exchange of data via simple attachment.</li><li>Is this OK for these professionnels to use third party processors without checking their GDPR compliance and security measures? Especially, is free WeTransfer appropriate for legals to exchange documents? What about art 28 GDPR ? CNIL is OK with that.</li><li>Can these professionnels export data outside the EU without any security measure? CNIL agrees that exchanging multiple data during a long period of over a decade with a client based in China using his professional email, admitting his employer access his devices, is OK as there would be no transfer in sense of GDPR.</li><li>When victim of phishing, how to demonstrate who leak what? what are the rights of the victims? The French CNIL does not care about the victim.</li><li>Data breach has administrative sanctions given by the supervisory authorities, criminal sanctions have been introduced in national legislations,  and Article 82 has introduced civil liability for non-material damages : loss of control and distress (to be developed in a future article). This could be the only hope.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>I – Appropriate measures of security and data breach</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have been warning about the need for encryption when handling sensitive data. I have contacted the law society who have confirmed my requests as legitimate. Encryption is essential and WeTransfer is not an option. More secured tools are available; they are dangerously ignored. French Data Protection Authority <a href=\"https://www.cnil.fr/fr/securite-securiser-les-echanges-avec-dautres-organismes\">CNIL has published recommendations</a> not to use email to exchange personal data. <a href=\"https://www.ssi.gouv.fr/uploads/2017/01/guide_hygiene_informatique_anssi.pdf\">ANSSI</a> has published several warnings concerning the risks related to email exchanges.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was first on Marsh 2021 that I received two separate emails, in two of my email addresses I had used with one of these French legals, a notaire (some kind of solicitor/notary). The emails as shown below, <strong>reproduced previous exchanges</strong> I had with the professional. It appears as a chain of communication, with a short sentence inviting to click on the attachment. Same kind of operations were repeated in June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2367,\"width\":553,\"height\":572,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phisihing-Watin-1-1-989x1024.png\" alt=\"\" class=\"wp-image-2367\" width=\"553\" height=\"572\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2369,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-3-780x1024.png\" alt=\"\" class=\"wp-image-2369\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2370,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-4-797x1024.png\" alt=\"\" class=\"wp-image-2370\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong><u>What Does that mean?</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Someone has been able to access to previous emails to this professional ;</li><li>The mails were non-encrypted, despite my request to secure our exchanges ;</li><li>These emails have fallen in the hands of cyber-criminals ;</li><li>The cybercriminals have been to reproduce previous exchanges with the professional, including highly sensitive documents ;</li><li>This to me is a data breach that should have been notified with 72 hours to the CNIL and without undue delay to data subject concerned if a serious risk was detected. I can’t see how this was not the case when a IBAN numbers, ID cards etc were exposed ;</li><li>The phishing emails received contained a malicious zip file that has been analysed by an IT expert ;</li><li>The attack is very similar to what has been described as a <a href=\"https://tekdeeps.com/trojan-qbot-steals-e-mails-and-misuses-them-for-further-attacks-it-can-also-attack-in-the-czech-republic/\">Qbot attack</a> or <a href=\"https://www.gdata.fr/news/2021/05/36849-g-data-rapport-sur-les-menaces-qbot-remplace-emotet\">Emotet</a>. Several big companies such as <a href=\"https://www.lemagit.fr/actualites/252502320/Quel-est-le-point-commun-entre-Fujifilm-JPS-et-un-office-notarial-francais-Qbot\">Ikea, Fujifilm or JPS</a> have been victim of these email chain attacks designed to <a href=\"https://www.lemondeinformatique.fr/actualites/lire-le-malware-financier-qbot-reprend-du-service-74527.html\">extract financial data</a>.</li><li>Clicking on the <a href=\"https://blog.nviso.eu/2020/09/01/epic-manchego-atypical-maldoc-delivery-brings-flurry-of-infostealers/\">zip attachment</a> could infect the computer network to steal further financial information ;</li><li>The email appears on a mobile device only showing the name of the professional to gain the recipient’s trust. It’s only by looking more closely that a different email address appears. Therefore, it becomes relatively easy to be trapped ;</li><li>If I have received these 4 emails, there is a big chance I would not the only one ;</li><li>Actually, this could be a larger scale attack of the platform used by notaires. <a href=\"https://www.lemagit.fr/actualites/252502320/Quel-est-le-point-commun-entre-Fujifilm-JPS-et-un-office-notarial-francais-Qbot\">Two other cases have been brought to my attention</a>, one of them being the very respected lawyer representing me.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>After I received the first emails, I sent several emails to the notaire on a different email address to check if they knew anything. I finally called them to understand what had happened. I was told by the big boss that he had no idea, had no care and probably have they been hacked just as it happens to many….</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I then turned into the French Cyber Gendarmerie online, they told me it was a spam. But how a simple spam could reproduce my previous emails ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Anxious about the data the cybercriminals had access to, I then send a request of information to the notaire trying to understand how they secured my data. They decided they needed an extra two months without justifying it. When I asked if they had a Data Protection Officer, they remembered than indeed all ‘notaires’ have an external mutualist DPO. Only in June did they notified the CNIL (data breach have to be notified within 72 hours to the CNIL and without undue delay to data subjects. My documents contained other people’s data breached as well. To my knowledge no data subject has been notified). From a document communicated by their DPO, last year the CNIL has requested some further information from them. So maybe after all this was not a simple Spam.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With the very slow progress with the notaire, I contacted a lawyer in Paris, Maître François-René Lebatard, who urged me to file a criminal complaint before all evidence would vanish. That was around June last year. The complaint is still under investigation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, I contacted the CNIL that accepted to investigate my complaint. Here is their conclusion :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>«&nbsp;Following the intervention of the CNIL, the data protection officer (DPO) of the firm, who was reminded of the obligations in force with regard to requests for access rights and the security of personal data, indicated:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>…</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>They have, following the letter from Ms xxx of 20 March 2021 indicating that she had received fraudulent emails, questioned their IT service provider asking for a detailed expert report, investigations from which it appears that no data breach is proven, that the fraudulent emails received by Ms xxx took over emails which she was the sender, that they did not concern any email that the office would have sent to Ms xxx as a recipient and that no other office\'s client had reported having received fraudulent emails.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No further explanation on where these phishing emails came from. Case closed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When back to our business with the notaire, I had to send him a legal document. I used Protonmail encryption. Again, he expected me to send it by email simple attachment. I had to remind him his DPO had mentioned they had a secure mean of document exchange. So even after the incident, was he still convinced <a href=\"https://www.americanbar.org/groups/business_law/publications/blt/2016/06/07_borden/\">exchanging data by simple email attachment ‘as usual’ is the way to go.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Now lets talk about <strong>the law firm involved in this case</strong>. A law firm advertising their international businesses. They exchangemassive amounts of documents by email attachment before discovering the joy of the free WeTransfer. Few law firms in Paris use WeTransfer because it’s free and convenient. I have tried my best to bring to their attention the risks paused by this tool. So, lets look deeper into that free WeTransfer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong><u>What’s wrong with the use of a free WeTransfer for a law firm ?</u></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://teamdrive.com/en/how-secure-is-wetransfer/\">WeTransfer</a> is a platform where users can upload their documents, receive a link with a password to send to their recipients.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>WeTransfer has <a href=\"https://www.bleepingcomputer.com/news/security/phishing-campaign-bypasses-email-gateways-via-wetransfer-alerts/\">been attacked several times</a> <a href=\"https://wetransfer.com/corporate/178267-update-security-notice-june-26th\">in the past</a>. <a href=\"https://www.hackread.com/wetransfer-phishing-attack-spoofs-steal-credential/\">Links have been intercepted</a> or <a href=\"https://threatpost.com/popular-file-sharing-service-wetransfer-used-in-malicious-spam-campaigns/146671/\">used in malicious spam</a> ; <a href=\"https://wetransfer.pr.co/178267-security-notice\" target=\"_blank\" rel=\"noreferrer noopener\">According to WeTransfer</a>, on June 16 and 17, file transfer emails were sent to unintended email addresses</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“<em>We have learned that a transfer you sent or received was also delivered to some people it was not meant to go to. Our records show that those files have been accessed, but almost certainly by the intended recipient. Nevertheless, as a precaution we blocked the link to prevent further downloads,”</em>&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.bleepingcomputer.com/news/security/phishing-campaign-bypasses-email-gateways-via-wetransfer-alerts/\">A phishing campaign</a> observed by security researchers at the Cofense&nbsp;Phishing Defense Center targeting a wide range of high profile entities from industries such as media and banking was detected in july: <em>“using WeTransfer&nbsp;notifications as surrogates for the run-of-the-mill malicious URLs usually employed in these type of attacks&nbsp;was recently detected while successfully bypassing email gateways developed by Microsoft, Proofpoint, and Symantec.”</em></li><li>Again in August 2021, it is reported ‘<a href=\"https://www.hackread.com/wetransfer-phishing-attack-spoofs-steal-credential/\">New WeTransfer phishing attack spoofs file-sharing to steal credential</a>’</li><li>&nbsp;<a href=\"https://www.pearltrees.com/t/data-in-law-firms/wetransfer/id41633223/item366308782\">Free WeTransfer</a> does not give the <a href=\"https://wetransfer.zendesk.com/hc/en-us/articles/360000905623-GDPR-Requesting-a-Data-Processing-Agreement\">option of a Data Processing Agreement (DPA)</a> required for any data processor used as by <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\">Article 28 GDPR</a> ; <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\">Art 28-3 states</a> : “<em>Processing by a processor shall be governed by a contract or other legal act under domestic law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.</em>&nbsp;“</li><li>Data at rest is not encrypted and can be accessed ‘for technical purpose’ ;</li><li>The balance of proportionality and obligations of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32 GDPR</a> - combined with <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-24-gdpr/\">Article 24</a> <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-25-gdpr/\">and 25</a>, privacy by design - require to take account of the sensitivity of the data, balanced with the state of the art and the cost of the implementation, to take appropriate security measures, starting by encryption as reminded to the<a href=\"https://ico.org.uk/action-weve-taken/enforcement/tuckers-solicitors-llp-mpn/\"> law firm</a> <a href=\"https://ico.org.uk/action-weve-taken/enforcement/tuckers-solicitors-llp-mpn/\">Tuckers LLP fined by the UK ICO</a> or by the <a href=\"https://gdprhub.eu/index.php?title=DPC_(Ireland)_-_DPC_Case_Reference:_IN-19-9-5&amp;section=6\">Irish DPC fining Bank Of I</a>reland ; [the UK ICO referred to the “<em>state of the art</em>\", as ‘<em>relevant industry standards of good practice including the ISO27000 series, the National Institutes of Standards and Technology (\"NIST\"), the various guidance from the ICO itself, the National Cyber Security Centre (\"NCSC\"), the Solicitors Regulatory Authority (\"SRA\"), Lexcel and \'NCSC Cyber Essentials\'.</em><em> </em>‘</li><li>Recital 83 on the balance of proportionality&nbsp;:</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“<em>In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing <strong>and implement measures to mitigate those risks</strong>, <strong>such as encryption.</strong>&nbsp;Those measures should ensure an <strong>appropriate level of security</strong>, including <strong>confidentiality</strong>, taking into account the <strong>state of the art</strong> and the <strong>costs of implementation </strong>in relation to the <strong>risks</strong> and the <strong>nature of the personal data</strong> to be protected.&nbsp;3In assessing data security risk, consideration should be given to the risks that are presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed which may in particular lead to physical, material or non-material damage.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It happens that the French law society (CNB) that I have contacted has informed me of the existence of a secured platform lawyers can use for the transmission of their documents. Therefore no excuse to go to an unreliable free third party ;</li><li>Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">WeTransfer uses AWS servers</a> to store data, which is not without consequences with regard to the prohibition of data transfers to the US following the invalidation of the Safe Harbour then Privacy Shield based on the well-known ECJ decision in <a href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\">Schrems-II.</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>indisputable practicality</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have to say, the insistence of the law firm to use WeTransfer was not innocent. They had been warned their WeTransfer links would not be touched. Their insistence to refuse more secure options was not innocent and certainly part of their dirty strategy. They have been trying to pretend to communicate evidence that does not exist. Fortunately, another party took care to transfer their WeTransfer linked documents. The document listed was not there. They have yet not reacted on the missing documents requests several months later.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The same way have they ignored to respond to the requests concerning their appropriate security measures hiding behind attorney/client privilege. They were not asked to reveal their communications with their client.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It happens that their client who has initiated the various legal proceedings in France is based in China and to my knowledge, he exclusively uses his professional email address. He has even warned about his employer accessing his personal devices for inspection : ... “<em>Unfortunately my personal computer has been confiscated by xxx [the employer is a major communication provider with close tights with the government] for security reasons so can’t access personal mail till Monday. Because I used it for work in xxxx they have to take everything out of it including Windows 7 ...”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facing this abusive resistance, I had to turn into the CNIL. The CNIL requested the law firm to respond to my request. It was eventually clarified they used the free version of WeTransfer with no DPA. At least, they finally discovered they could use the secured CNB platform at their disposition. However, the password, a 6 single digit figures, was sent to all parties - including the notaire above –immediately following the link, using same channels. I personally find it hard to believe they could be that dumb. (I don’t think the CNB’s platform should allow such weak passwords. <a href=\"https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-fines-transavia-poor-personal-data-security\">Dutch DPA has fined Transavia for poor personal data security allowing weak passwords</a> ; <a href=\"https://gdprhub.eu/index.php?title=CNIL_(France)_-_D%C3%A9lib%C3%A9ration_SAN-2021-020_du_28_d%C3%A9cembre_2021\">French CNIL has been itself rather strict in their security requirements from Slimpay fined 180.000 €. </a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Password strenght was highlited by ANSSI : «&nbsp;the length and complexity of a password remain basic criteria for assessing its strength.” The need for a strong password is crucial to ensure the security and confidentiality.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cnil.fr/sites/default/files/atoms/files/recommandation_passwords_en.pdf\">CNIL’s recommendations</a> : “<em>For the sake of clarity, the Restricted Committee notes that in order to ensure a sufficient level of security and satisfy the password strength requirements, when authentication relies solely on an identifier and password, the CNIL recommends, in its Decision No. 2017-012 of 19 January 2017, that the password have at least twelve characters - containing at least one upper-case letter, one lower-case letter, one number and one special character - or at least eight characters - containing three of these four characters - if it is accompanied by an additional measure such as, for example, the timing of access to the account after several failures (temporary suspension of access, the duration of which increases as attempts are made), setting up a mechanism to guard against automated and multiple attempts (e.g. a “captcha”) and/or locking the account after several failed login attempts. </em><em>“ in CNIL SAN 2022-022&nbsp;».</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-une-faq-pour-comprendre-lessentiel-en-quelques-minutes\">CNB’s recommendations</a>&nbsp;: “<em>Toutes les données envoyées par courriel ou transmises au moyen d’outils d’hébergement en ligne (Cloud) sont par conséquent vulnérables. Il s’agit donc de procéder à leur chiffrement systématique avant de les adresser à un correspondant ou de les hébergerLa transmission du secret (mot de passe, clé, etc.) permettant alors de déchiffrer les données, si elle est nécessaire, doit être effectuée via un canal de confiance ou, à défaut, un canal distinct du canal de transmission des données. Ainsi, si les données chiffrées sont transmises par courriel, une remise en main propre du mot de passe ou, à défaut, par téléphone doit être privilégiée.</em>&nbsp;:</li><li><em><a href=\"“https:/www.ssi.gouv.fr/uploads/2017/01/guide_hygiene_informatique_anssi.pdf\">ANSSI Guide de l’ hygiène informatique</a></em></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In their letter they admited exchanging regularly with their client in China. This concerns massive amount of highly personal data for more than a decade, with no appropriate security measure. Their justifications? Well, China has voted the data protection regulation PIPL, so all is good !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They admit having been non-compliant for years before recently discovering the platform they had refused to use when first suggested.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Again, this month, I received a fishing email from that law firm using a similar technic as shown below.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2372,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing_CBBC_Anonymised_08032022-1-1024x862.png\" alt=\"\" class=\"wp-image-2372\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Previously, in December 2020 I had received another suspicious email from that same law firm they never clarified if it came from them or not.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2373,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Spam-CBBC-IBP-18122020-1-808x1024.png\" alt=\"\" class=\"wp-image-2373\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>CNIL closed the case satisfied by these arguments without looking at :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>the question of long years of data transfers without any appropriate security measure ;</li><li>the use of the free version of WeTransfer without DPA art 28 while they could at least afford the professional version offering better guaranties;</li><li>use of the professional email address of the client and access by his employer</li><li>CNIL accepted there has not been a transfer as the receiver is an individual to whom GDPR does not apply.</li><li>resistance to reply to my requests, The CNIL did not care that the law firm rejected my DSAR for many years.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Here is a translation of CNIL’s decision - emphasises by me</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>Firstly, with regard to your difficulties relating to the exercise of the right of access to your personal data, XXXX, when questioned by the CNIL, indicated that this information was covered by professional secrecy. I confirm in this regard that, in accordance with the provisions of Article 23 of the General Data Protection Regulation (GDPR), the French legislator has, in Article 66-5 of Law No 71-1130 of 31 December 1971 reforming certain judicial and legal professions, provided for a limitation on the right of access. Under the above-mentioned article: \"In all matters, whether in the field of counsel or in that of defence, consultations sent by a lawyer to his client or intended for him, correspondence exchanged between the client and his lawyer, between the lawyer and his colleagues with the exception for the latter of those bearing the mention \"official\", the interview notes and, more generally, all documents in the file are covered by professional secrecy. ». [I don’t think I have ever questioned the confidentiality of their correspondences with their client]</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Secondly, with regard to the supervision of the transfers of your data made by XXXX, in particular to China where the firm\'s client resides to whom, according to your assertions [XXXX has XXXX clearly admitted doing so], your data would be sent, XXXX, questioned by the CNIL, indicates that there is no transfer strictly speaking.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>I confirm in this regard that it follows from the ongoing discussions at the level of the European Data Protection Board (EDPB) that a transfer exists only if the personal data are transmitted to an importer located in a third country. However, since the client of the firm to which you believe your data is transferred cannot be qualified as a controller, joint controller or processor, the transmission operation cannot be qualified as a transfer of personal data outside the European Union.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Thirdly, as regards the security measures implemented by XXXX to guarantee the integrity and confidentiality of your data, that firm has on the one hand specified the security measures deployed in the context of the use of the \"WeTransfer\" tool and on the other hand indicated that it now uses the e-Sharing platform, developed by the National Council of Bars, whose technical characteristics as described in the firm\'s response appear to meet the security obligations provided for in Article 5.1-f) of the GDPR. [Last WeTransfer link sent to me and other parties was last year. Before that for many years they exchanged via email attachment. They recognised I have been asking them – bothered them – to secure these exchanges due to highly sensitive data involved]</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Regarding the facts alleged in your message of May 10, 2022 according to which the XXXX firm recently sent you the password through the same channel (email) as that used to send the link to the platform, and that this password contains only 6 characters, XXXXX was reminded of the elementary precautions recalled by the CNIL on these points.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>In the light of these elements, I inform you to proceed to the closure of your complaint.&nbsp;»</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Surprisingly, neither the law firm, nor the notaire care about the fraudulent use of their email addresses or name !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although they admitted “<em>Ms. xxx obviously benefits from the right to ask the data controller for access to personal data, the rectification or erasure thereof, or a limitation of the processing relating to the person concerned, as well as the right to object to processing and the right to data portability. These rights are however limited by the very purpose of the processing of personal data, namely the recognition, exercise or defense of legal rights (Articles 16, 17, 18 and 20 of the GDPR).”</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm pretended holding data indirectly collected. However, they forget that some of the documents have been directly collected to comply with the principle of ‘<em>contradictoire</em>’ or adversarial principal.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They pretend they are under no obligation to respond to my DSAR as I would already have knowledge of the information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>- </strong>Where personal data is not collected from the data subject, any available information as to its source :they argue this information is also covered by professional secrecy. Therefore, they would not be able to reveal all of their sources [expect use of private investigators]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“Under these conditions, if Ms. xxx actually wished to request such a copy, she is asked to specify the data or the processing operations to which her request relates, as Cabinet xxx cannot decently gather all of this information in just one months as required by the GDPR. [Did they requested an extended delay?]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Their justification on the use of WeTransfer is rather enlightening:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Indeed, WeTransfer has indisputable practicality –</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They add “<em>If the firm was able to effectively use this tool to transmit documents, during a well-defined and now over period, to Ms. xxx\'s lawyer, to the notary, as well as to Ms. Xxx herself, it is recalled that the processing carried out here mainly concerned personal data relating to our client who has expressly consented to the use of this medium and has requested that it be use</em>.” This is totally untrue. A legal case obviously involves exchange of personal data concerning various parties. How did CNIL not reacted to that is a mystery.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have recognised using free WeTransfer in several occasions when they could have easily use alternative secure tools, ognoing my requests and the high sensitivity of the data: On February 3 and 20, 2020, October 14, 2020, January 14 and 22, 2021, January 29, 2021, December 9, 2021 and January 14, 2022.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They don’t despute my ‘<strong><em>numerous inquiries</em></strong><em> about WeTransfer’</em>. It had to come to the CNIL’s attention for them to make ‘<em>the necessary changes in order to comply with the GDPR and no longer use this service</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>II - On the question of regular long-term transfers to CHINA</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm is based in France. The litigation is initiated in France based on the French nationality of their client. The client is based in China. However, he travels around the world including in Europe where some of the exchanges have occurred and while in Europe, no doubt GDPR applied to these transfers. Data transfers via China where the email servers of the employer are located.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm collect personal data from their client, from me directly in respect with the principal of adversarial, from the notaire, and I suspect from their communications, from private investigators. These documents are then forwarded to their client for observation. Then sent back to them. These will be used and reproduced to draft the court documents again exchanged between all parties including the client. Therefore, the law firm is data controller (see UK ICO cases of Tuckered LLP or Smith… ). Would the client be as well a data controller of the part of data he gathers, stores and processed? Possibly. In two cases, ECJ has considered individual as data controller : in the Facebook fan page admin case and in Jeowah’s Witnesses. [in <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0040\">ECJ Fashion ID</a> “(<em>A)s the Advocate General noted, [...-] it appears that a natural or legal person may be a controller, within the meaning of Article 2(d) of Directive 95/46, jointly with others only in respect of operations involving the processing of personal data for which it determines jointly the purposes and means. By contrast, [...] that natural or legal person cannot be considered to be a controller, within the meaning of that provision, in the context of operations that precede or are subsequent in the overall chain of processing for which that person does not determine either the purposes or the means</em>”.<br>In <a href=\"https://gdprhub.eu/index.php?title=CJEU_-_C%E2%80%9125/17_-_Tietosuojavaltuutettu\">Jehovah’s witnesses, C-25/17</a>, the CJEU considered that a religious community of Jehovah’s witnesses acted as a controller, jointly with its individual members.]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm argued that ‘<em>The “transfers” in question are in no way regular and permanent but rather punctual and occasional, as much as respect for the adversarial process has made it necessary to communicate the documents in the file. Moreover, strictly speaking, there is no transfer outside the European Union at the initiative of xxx since <strong>it is the recipient of the data who imports the data</strong> because he is domiciled outside the European Union. And it should be remembered that the GDPR does not apply to natural persons not residing in the European Union.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Can we still talk<em> about ‘ponctual and occasional’</em> for something that has last 11 years ?! Massive amount of highly personal sensitive data have been exchanged refusing the special request to use encryption rejected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Their argument is that the transfers almost exclusively concerned data obtained indirectly through the lawyer., the notary or the client. This is not exact as some of the data was directly collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Knowing that several litigations initiated since 2011 involving different jurisdictions in France, it’s difficult to admit these heavy volume of data exchanges were ‘<em>ponctual</em>’ (3 court of appeals, 4 other jurisdictions, several notaires, huissiers, or Avoués were involved each time data has been sent with no care)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In any case, their communications between the law firm and the notaire are not confidential Article 14 paragraph 5, d). – in contrary I should have been in copy on all of them</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Concerning Chinese employers practice, here is </strong><a href=\"https://www.politico.eu/article/huawei-germany-court-case-privacy/\">report by Politico</a> :</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>“A case filed by one of Huawei’s former managers at its European headquarters in Düsseldorf takes aim at another pitfall for the company: Its respect of European privacy rules.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Specifically, it opens up questions about whether Huawei is putting data at risk of slipping into the hands of Chinese state surveillance and intelligence operations. It also raises questions about whether Europe will sharpen its tone with China on sensitive data privacy matters — after years of focusing its ire on Silicon Valley’s giants and U.S. state surveillance.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>A judge ruled March 5 that Huawei was in breach of European privacy law when it failed to comply with the former manager’s request to view the data the company had kept on him.” &nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Ultimately, non-compliance with GDPR is <a href=\"https://www.cnil.fr/fr/les-sanctions-penales\">a criminal offense</a></strong><strong> :</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le fait, y compris par négligence, de procéder ou de faire procéder à des traitements de données à caractère personnel sans qu\'aient été respectées les formalités préalables à leur mise en oeuvre prévues par la loi est puni de cinq ans d\'emprisonnement et de 300 000 euros d\'amende.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le fait de procéder ou de faire procéder à un traitement de données à caractère personnel sans mettre en oeuvre les mesures prescrites aux articles 24, 25, 30 et 32 du règlement (UE) 2016/679 du 27 avril 2016 précité ou au 6° de l\'article 4 et aux articles 99 à 101 de la loi n° 78-17 du 6 janvier 1978 précitée est puni de cinq ans d\'emprisonnement et de 300 000 euros d\'amende.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>Previous related CNIL’s decisions </u></strong><strong><u></u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>For reference, here are previous similar cases involving the questions of security measures</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Slimpay, lack of measures of security <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32</a>, without the need to prove any illegitimate access to the data&nbsp;:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“95. <em>The Restricted Committee then notes that the accessible data (title, surname, first name, e-mail address, postal address, telephone number, BIC/IBAN) make it possible to obtain very precise information on the persons concerned by revealing their identity and their contact information.&nbsp;In addition, specific data are in question when some relate to financial information.&nbsp;The fact in particular that the <strong>IBAN appears is not insignificant</strong>.&nbsp;As the Banque de France indicated in its book \"Payments and market infrastructures in the digital age\", <strong>IBANs are \"sensitive\" payment data</strong> (in the ordinary sense of the term) because they can be used to commit fraud. .&nbsp;The European Data Protection Board describes this type of data as \"highly personal\".&nbsp;The Restricted Committee considers that the company should have exercised particular vigilance with regard to securing such data, which may be reused by unauthorized third parties, thus harming the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining data) when their full identity, associated with their email address for many, was freely accessible.&nbsp;thus prejudicing the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining</em> <em>data) when their full identity, associated with their email address for many, was freely accessible.&nbsp;thus prejudicing the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining data) when their full identity, associated with their email address for many, was freely accessible.</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>“68. The Restricted Committee considers that the absence of proof of fraudulent use of the data has no impact on the characterization of the breach of the security obligation.&nbsp;Indeed, the risk of fraudulent use of personal data was real, independently of the cases of fraud, insofar as the data of many people were made accessible to unauthorized third parties.&nbsp;The absence of proven harm to the persons concerned does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.”</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042676787\">The French DPA (CNIL) imposes a 3,000 euros fine on a doctor</a> for failing to comply with the security obligation, due to the free access on the web of his patients\' health data. CNIL recalls its own guidelines on Personal Data Security recommending encryption as a standard security measure. Similarly, the Practical Guide for Physicians encourages physicians to encrypt their patients\' data with suitable software.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Transmitting unsecured emails: the restricted training points out that it also emerges from the hearing of December 17, 2019 that “<em>Mr. [...] had also not taken care to encrypt the data contained in his personal laptop, considering that encryption slows down the execution of applications too much (medical file, image visualization tool).</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>26. In the absence of encryption, the medical data contained in that computer\'s hard drive were readable in plain text by any person taking possession of that device (for example, as a result of its loss or theft) or by any person who unduly entered the network to which that computer was connected.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its guidance The security of personal data, the CNIL recommends providing encryption means for nomadic workstations and mobile storage media (laptop, USB keys, external hard disk, CD-R, DVD-RW, etc.), for example via the encryption of the hard disk in its entirety when the operating system offers it, file-by-file encryption or the creation of encrypted containers (file likely to contain several files). Similarly, the Practical Guide for Physicians invites physicians to encrypt their patients\' data with appropriate software.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2021-021\">The French DPA (CNIL) fined a mobile operator €300,000</a> for failing to respect customers\' right of access and right to object by not responding to their access requests in a timely manner and sending them marketing messages despite having been notified of their objection to such processing.</li><li><a href=\"https://gdprhub.eu/index.php?title=CNIL_-_SAN-2020-008\">The French DPA (CNIL) imposed a € 2250000 fine on Carrefour France</a> for several violations of the GDPR and French data protection law. These include : excessive data retention periods, incomplete and unclear information on data processes, lack of proper answer to data subjects\' requests, security breaches and illicit use of cookies.</li><li>The CNIL also referred to a&nbsp;<a href=\"https://www.legifrance.gouv.fr/ceta/id/CETATEXT000038388017/\">decision n°423559</a>&nbsp;by the French Supreme Administrative Court (Conseil d\'Etat) which allowed for such sanctions, even if the violation had been corrected. (NESTOR)</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Other cases in the EU</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://lnkd.in/dFuE5SHj\">A hospital in Sweden</a> received a fine&nbsp;of 150k EUR because it was sending medical records via email to patients and referring hospitals, unencrypted.<br>That was a&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">GDPR</a>&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">security</a>&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=issue&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">issue</a>, in direct breach of art 5 (1)(f) GDPR (principle of security) and art 32 GDPR (security of processing).<br>Email is an obsolete communication mechanism, start using encrypted document sharing solutions, with strong authentication!</li><li><a href=\"https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_Societatea_Civil%C4%83_Profesional%C4%83_de_Avoca%C8%9Bi_%E2%80%9ESabou,_Burz_%26_Cuc%E2%80%9D\">The Romanian DPA issued a fine of approximately €1000 on a law firm</a> for disclosing a case file with the personal data of one of its clients on an external WhatsApp group with other lawyers, in breach of Articles 6, 5(1)(a), 5(1)(b), 5(1)(c), 5(1)(f) and 5(2) GDPR.</li><li>Hungarian DPA fines Lawyer € 835 for unauthorized transmission of a confidential document to two unauthorized third parties.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject lodged a complaint with the DPA concerning the unlawful disclosure of his personal data.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The recipient of the fine acted as a lawyer for a company that was in litigation with the complainant.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In his complaint, the concerned party alleged that the respondent had improperly and without cause disclosed to two other parties in the case \"<em>highly confidential information\"</em>, which was a private letter to the President and Vice-President of an unnamed company.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The view that the sending of an unencrypted e-mail might violate Art. 32 GDPR is also the opinion of the Data Protection Authority of North Rhine-Westphalia (DPA NRW), which says the following on its website:</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The communication by e-mail requires at least the transport encryption, as it is offered by the considerable European providers by default. ... It must be taken into account that in the case of transport encryption the e-mails are available on the e-mail servers in plain text and can basically be viewed. In the case of particularly sensitive data (e.g. account transaction data, financing data, health status data, client data from lawyers and tax consultants, employee data), transport encryption alone may not be sufficient</em>\". (DPA NRW, Technical Requirements for Technical and Organizational Measures for E-Mail Sending,&nbsp;<a href=\"https://www.ldi.nrw.de/mainmenu_Aktuelles/Inhalt/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand.html\" target=\"_blank\" rel=\"noreferrer noopener\">available here</a>&nbsp;in German).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>With special thanks to the experts who have offered me their assistance on this matter :</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/davidflintscotland/\" target=\"_blank\">David Flint</a>, Commercial Law Consultant at Inksters; Visiting Professor at Creighton University School of Law.</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/peter-stephenson-phd-cissp-faafs-3a6788108/\" target=\"_blank\">Peter Stephenson</a>, PhD, CISSP, FAAFS Writer, researcher and educator in cyber criminology and cyber jurisprudence.</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/alexandre-blanc-cyber-security-88569022/\" target=\"_blank\">Alexandre Blanc</a> Cyber Security - vCISO - ISO/IEC 27001 and 27701 Lead Implementer - best Cyber Risk Communicator of 2019 and 2020 - MCNA - MITRE ATT&amp;CK - LinkedIn Top Voice 2020 in Technology - Cyber Sentinel Award 2020-21 – Speaker</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/valerymarchive/\" target=\"_blank\">Valery Rieß-Marchive</a> Rédacteur-en-chef, LeMagITTalks about malware, offrecyber, ransomware, cyberattaque, and threatintelligence</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>A special thank to <a href=\"https://twitter.com/alexislintS\" target=\"_blank\" rel=\"noreferrer noopener\">Lord\'Aliosha</a> for his breathaking photo reproduced with his special permission</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And Fieldfisher for their useful links to GDPR articles, <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a></p>\n<!-- /wp:paragraph -->','Advocating Privacy and Data Protection for More Than a Decade And Still Fighting Resistance','<!-- wp:paragraph -->\n<p>I have been watching legal professionals disseminating personal data around the world. Feel my pain ? Why it especially matters? Because they are the ones advising others. They are the role model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the GDPR has now celebrating it’s 6 years and 4 years of enforcement, Here an exhaustive practical case law analysis of the importance of taking appropriate security measures and how things can go wrong.</p>\n<!-- /wp:paragraph -->','inherit','closed','closed','','2364-revision-v1','','','2022-05-25 21:10:03','2022-05-25 21:10:03','',2364,'https://www.datarainbow.eu/?p=2382',0,'revision','',0),(2380,1,'2022-05-25 16:42:59','2022-05-25 16:42:59','<!-- wp:paragraph -->\n<p>I have been watching legal professionals disseminating personal data around the world. Feel my pain ? Why it especially matters? Because they are the ones advising others. They are the role model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the GDPR has now celebrating its 6th year and 4 years of enforcement, here is an exhaustive practical case law analysis on the importance of taking appropriate security measures and how things can go wrong.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you don\'t have time to read this in full detail, here are the questions at sake : </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>can legal professionals, bound by confidentiality, handling sensitive data, afford to miss appropriate measures of security as required by the article 32 GDPR, starting by encryption? CNIL is not chocked by years of exchange of data via simple attachment.</li><li>Is this OK for these professionnels to use third party processors without checking their GDPR compliance and security measures? Especially, is free WeTransfer appropriate for legals to exchange documents? What about art 28 GDPR ? CNIL is OK with that.</li><li>Can these professionnels export data outside the EU without any security measure? CNIL agrees that exchanging multiple data during a long period of over a decade with a client based in China using his professional email, admitting his employer access his devices, is OK as there would be no transfer in sense of GDPR.</li><li>When victim of phishing, how to demonstrate who leak what? what are the rights of the victims? The French CNIL does not care about the victim.</li><li>Data breach has administrative sanctions given by the supervisory authorities, criminal sanctions have been introduced in national legislations,  and Article 82 has introduced civil liability for non-material damages : loss of control and distress (to be developed in a future article). This could be the only hope.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>I – Appropriate measures of security and data breach</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have been warning about the need for encryption when handling sensitive data. I have contacted the law society who have confirmed my requests as legitimate. Encryption is essential and WeTransfer is not an option. More secured tools are available; they are dangerously ignored. French Data Protection Authority <a href=\"https://www.cnil.fr/fr/securite-securiser-les-echanges-avec-dautres-organismes\">CNIL has published recommendations</a> not to use email to exchange personal data. <a href=\"https://www.ssi.gouv.fr/uploads/2017/01/guide_hygiene_informatique_anssi.pdf\">ANSSI</a> has published several warnings concerning the risks related to email exchanges.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was first on Marsh 2021 that I received two separate emails, in two of my email addresses I had used with one of these French legals, a notaire (some kind of solicitor/notary). The emails as shown below, <strong>reproduced previous exchanges</strong> I had with the professional. It appears as a chain of communication, with a short sentence inviting to click on the attachment. Same kind of operations were repeated in June 2021.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2367,\"width\":553,\"height\":572,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large is-resized\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phisihing-Watin-1-1-989x1024.png\" alt=\"\" class=\"wp-image-2367\" width=\"553\" height=\"572\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2368,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-2-839x1024.png\" alt=\"\" class=\"wp-image-2368\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2369,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-3-780x1024.png\" alt=\"\" class=\"wp-image-2369\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":2370,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-4-797x1024.png\" alt=\"\" class=\"wp-image-2370\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong><u>What Does that mean?</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Someone has been able to access to previous emails to this professional ;</li><li>The mails were non-encrypted, despite my request to secure our exchanges ;</li><li>These emails have fallen in the hands of cyber-criminals ;</li><li>The cybercriminals have been to reproduce previous exchanges with the professional, including highly sensitive documents ;</li><li>This to me is a data breach that should have been notified with 72 hours to the CNIL and without undue delay to data subject concerned if a serious risk was detected. I can’t see how this was not the case when a IBAN numbers, ID cards etc were exposed ;</li><li>The phishing emails received contained a malicious zip file that has been analysed by an IT expert ;</li><li>The attack is very similar to what has been described as a <a href=\"https://tekdeeps.com/trojan-qbot-steals-e-mails-and-misuses-them-for-further-attacks-it-can-also-attack-in-the-czech-republic/\">Qbot attack</a> or <a href=\"https://www.gdata.fr/news/2021/05/36849-g-data-rapport-sur-les-menaces-qbot-remplace-emotet\">Emotet</a>. Several big companies such as <a href=\"https://www.lemagit.fr/actualites/252502320/Quel-est-le-point-commun-entre-Fujifilm-JPS-et-un-office-notarial-francais-Qbot\">Ikea, Fujifilm or JPS</a> have been victim of these email chain attacks designed to <a href=\"https://www.lemondeinformatique.fr/actualites/lire-le-malware-financier-qbot-reprend-du-service-74527.html\">extract financial data</a>.</li><li>Clicking on the <a href=\"https://blog.nviso.eu/2020/09/01/epic-manchego-atypical-maldoc-delivery-brings-flurry-of-infostealers/\">zip attachment</a> could infect the computer network to steal further financial information ;</li><li>The email appears on a mobile device only showing the name of the professional to gain the recipient’s trust. It’s only by looking more closely that a different email address appears. Therefore, it becomes relatively easy to be trapped ;</li><li>If I have received these 4 emails, there is a big chance I would not the only one ;</li><li>Actually, this could be a larger scale attack of the platform used by notaires. <a href=\"https://www.lemagit.fr/actualites/252502320/Quel-est-le-point-commun-entre-Fujifilm-JPS-et-un-office-notarial-francais-Qbot\">Two other cases have been brought to my attention</a>, one of them being the very respected lawyer representing me.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>After I received the first emails, I sent several emails to the notaire on a different email address to check if they knew anything. I finally called them to understand what had happened. I was told by the big boss that he had no idea, had no care and probably have they been hacked just as it happens to many….</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I then turned into the French Cyber Gendarmerie online, they told me it was a spam. But how a simple spam could reproduce my previous emails ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Anxious about the data the cybercriminals had access to, I then send a request of information to the notaire trying to understand how they secured my data. They decided they needed an extra two months without justifying it. When I asked if they had a Data Protection Officer, they remembered than indeed all ‘notaires’ have an external mutualist DPO. Only in June did they notified the CNIL (data breach have to be notified within 72 hours to the CNIL and without undue delay to data subjects. My documents contained other people’s data breached as well. To my knowledge no data subject has been notified). From a document communicated by their DPO, last year the CNIL has requested some further information from them. So maybe after all this was not a simple Spam.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With the very slow progress with the notaire, I contacted a lawyer in Paris, Maître François-René Lebatard, who urged me to file a criminal complaint before all evidence would vanish. That was around June last year. The complaint is still under investigation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, I contacted the CNIL that accepted to investigate my complaint. Here is their conclusion :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>«&nbsp;Following the intervention of the CNIL, the data protection officer (DPO) of the firm, who was reminded of the obligations in force with regard to requests for access rights and the security of personal data, indicated:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>…</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>They have, following the letter from Ms xxx of 20 March 2021 indicating that she had received fraudulent emails, questioned their IT service provider asking for a detailed expert report, investigations from which it appears that no data breach is proven, that the fraudulent emails received by Ms xxx took over emails which she was the sender, that they did not concern any email that the office would have sent to Ms xxx as a recipient and that no other office\'s client had reported having received fraudulent emails.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>No further explanation on where these phishing emails came from. Case closed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When back to our business with the notaire, I had to send him a legal document. I used Protonmail encryption. Again, he expected me to send it by email simple attachment. I had to remind him his DPO had mentioned they had a secure mean of document exchange. So even after the incident, was he still convinced <a href=\"https://www.americanbar.org/groups/business_law/publications/blt/2016/06/07_borden/\">exchanging data by simple email attachment ‘as usual’ is the way to go.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Now lets talk about <strong>the law firm involved in this case</strong>. A law firm advertising their international businesses. They exchangemassive amounts of documents by email attachment before discovering the joy of the free WeTransfer. Few law firms in Paris use WeTransfer because it’s free and convenient. I have tried my best to bring to their attention the risks paused by this tool. So, lets look deeper into that free WeTransfer.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong><u>What’s wrong with the use of a free WeTransfer for a law firm ?</u></strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://teamdrive.com/en/how-secure-is-wetransfer/\">WeTransfer</a> is a platform where users can upload their documents, receive a link with a password to send to their recipients.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>WeTransfer has <a href=\"https://www.bleepingcomputer.com/news/security/phishing-campaign-bypasses-email-gateways-via-wetransfer-alerts/\">been attacked several times</a> <a href=\"https://wetransfer.com/corporate/178267-update-security-notice-june-26th\">in the past</a>. <a href=\"https://www.hackread.com/wetransfer-phishing-attack-spoofs-steal-credential/\">Links have been intercepted</a> or <a href=\"https://threatpost.com/popular-file-sharing-service-wetransfer-used-in-malicious-spam-campaigns/146671/\">used in malicious spam</a> ; <a href=\"https://wetransfer.pr.co/178267-security-notice\" target=\"_blank\" rel=\"noreferrer noopener\">According to WeTransfer</a>, on June 16 and 17, file transfer emails were sent to unintended email addresses</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“<em>We have learned that a transfer you sent or received was also delivered to some people it was not meant to go to. Our records show that those files have been accessed, but almost certainly by the intended recipient. Nevertheless, as a precaution we blocked the link to prevent further downloads,”</em>&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.bleepingcomputer.com/news/security/phishing-campaign-bypasses-email-gateways-via-wetransfer-alerts/\">A phishing campaign</a> observed by security researchers at the Cofense&nbsp;Phishing Defense Center targeting a wide range of high profile entities from industries such as media and banking was detected in july: <em>“using WeTransfer&nbsp;notifications as surrogates for the run-of-the-mill malicious URLs usually employed in these type of attacks&nbsp;was recently detected while successfully bypassing email gateways developed by Microsoft, Proofpoint, and Symantec.”</em></li><li>Again in August 2021, it is reported ‘<a href=\"https://www.hackread.com/wetransfer-phishing-attack-spoofs-steal-credential/\">New WeTransfer phishing attack spoofs file-sharing to steal credential</a>’</li><li>&nbsp;<a href=\"https://www.pearltrees.com/t/data-in-law-firms/wetransfer/id41633223/item366308782\">Free WeTransfer</a> does not give the <a href=\"https://wetransfer.zendesk.com/hc/en-us/articles/360000905623-GDPR-Requesting-a-Data-Processing-Agreement\">option of a Data Processing Agreement (DPA)</a> required for any data processor used as by <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\">Article 28 GDPR</a> ; <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-28-gdpr/\">Art 28-3 states</a> : “<em>Processing by a processor shall be governed by a contract or other legal act under domestic law, that is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the obligations and rights of the controller.</em>&nbsp;“</li><li>Data at rest is not encrypted and can be accessed ‘for technical purpose’ ;</li><li>The balance of proportionality and obligations of <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32 GDPR</a> - combined with <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-24-gdpr/\">Article 24</a> <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-25-gdpr/\">and 25</a>, privacy by design - require to take account of the sensitivity of the data, balanced with the state of the art and the cost of the implementation, to take appropriate security measures, starting by encryption as reminded to the<a href=\"https://ico.org.uk/action-weve-taken/enforcement/tuckers-solicitors-llp-mpn/\"> law firm</a> <a href=\"https://ico.org.uk/action-weve-taken/enforcement/tuckers-solicitors-llp-mpn/\">Tuckers LLP fined by the UK ICO</a> or by the <a href=\"https://gdprhub.eu/index.php?title=DPC_(Ireland)_-_DPC_Case_Reference:_IN-19-9-5&amp;section=6\">Irish DPC fining Bank Of I</a>reland ; [the UK ICO referred to the “<em>state of the art</em>\", as ‘<em>relevant industry standards of good practice including the ISO27000 series, the National Institutes of Standards and Technology (\"NIST\"), the various guidance from the ICO itself, the National Cyber Security Centre (\"NCSC\"), the Solicitors Regulatory Authority (\"SRA\"), Lexcel and \'NCSC Cyber Essentials\'.</em><em> </em>‘</li><li>Recital 83 on the balance of proportionality&nbsp;:</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“<em>In order to maintain security and to prevent processing in infringement of this Regulation, the controller or processor should evaluate the risks inherent in the processing <strong>and implement measures to mitigate those risks</strong>, <strong>such as encryption.</strong>&nbsp;Those measures should ensure an <strong>appropriate level of security</strong>, including <strong>confidentiality</strong>, taking into account the <strong>state of the art</strong> and the <strong>costs of implementation </strong>in relation to the <strong>risks</strong> and the <strong>nature of the personal data</strong> to be protected.&nbsp;3In assessing data security risk, consideration should be given to the risks that are presented by personal data processing, such as accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed which may in particular lead to physical, material or non-material damage.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It happens that the French law society (CNB) that I have contacted has informed me of the existence of a secured platform lawyers can use for the transmission of their documents. Therefore no excuse to go to an unreliable free third party ;</li><li>Additionally, <a href=\"https://aws.amazon.com/solutions/case-studies/wetransfer/\">WeTransfer uses AWS servers</a> to store data, which is not without consequences with regard to the prohibition of data transfers to the US following the invalidation of the Safe Harbour then Privacy Shield based on the well-known ECJ decision in <a href=\"https://www.datarainbow.eu/schrems-ii-invalidation-of-the-privacy-shield-by-the-ecj/\">Schrems-II.</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>indisputable practicality</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I have to say, the insistence of the law firm to use WeTransfer was not innocent. They had been warned their WeTransfer links would not be touched. Their insistence to refuse more secure options was not innocent and certainly part of their dirty strategy. They have been trying to pretend to communicate evidence that does not exist. Fortunately, another party took care to transfer their WeTransfer linked documents. The document listed was not there. They have yet not reacted on the missing documents requests several months later.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The same way have they ignored to respond to the requests concerning their appropriate security measures hiding behind attorney/client privilege. They were not asked to reveal their communications with their client.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It happens that their client who has initiated the various legal proceedings in France is based in China and to my knowledge, he exclusively uses his professional email address. He has even warned about his employer accessing his personal devices for inspection : ... “<em>Unfortunately my personal computer has been confiscated by xxx [the employer is a major communication provider with close tights with the government] for security reasons so can’t access personal mail till Monday. Because I used it for work in xxxx they have to take everything out of it including Windows 7 ...”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facing this abusive resistance, I had to turn into the CNIL. The CNIL requested the law firm to respond to my request. It was eventually clarified they used the free version of WeTransfer with no DPA. At least, they finally discovered they could use the secured CNB platform at their disposition. However, the password, a 6 single digit figures, was sent to all parties - including the notaire above –immediately following the link, using same channels. I personally find it hard to believe they could be that dumb. (I don’t think the CNB’s platform should allow such weak passwords. <a href=\"https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-fines-transavia-poor-personal-data-security\">Dutch DPA has fined Transavia for poor personal data security allowing weak passwords</a> ; <a href=\"https://gdprhub.eu/index.php?title=CNIL_(France)_-_D%C3%A9lib%C3%A9ration_SAN-2021-020_du_28_d%C3%A9cembre_2021\">French CNIL has been itself rather strict in their security requirements from Slimpay fined 180.000 €. </a>)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Password strenght was highlited by ANSSI : «&nbsp;the length and complexity of a password remain basic criteria for assessing its strength.” The need for a strong password is crucial to ensure the security and confidentiality.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.cnil.fr/sites/default/files/atoms/files/recommandation_passwords_en.pdf\">CNIL’s recommendations</a> : “<em>For the sake of clarity, the Restricted Committee notes that in order to ensure a sufficient level of security and satisfy the password strength requirements, when authentication relies solely on an identifier and password, the CNIL recommends, in its Decision No. 2017-012 of 19 January 2017, that the password have at least twelve characters - containing at least one upper-case letter, one lower-case letter, one number and one special character - or at least eight characters - containing three of these four characters - if it is accompanied by an additional measure such as, for example, the timing of access to the account after several failures (temporary suspension of access, the duration of which increases as attempts are made), setting up a mechanism to guard against automated and multiple attempts (e.g. a “captcha”) and/or locking the account after several failed login attempts. </em><em>“ in CNIL SAN 2022-022&nbsp;».</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li><a href=\"https://www.cnb.avocat.fr/fr/actualites/rgpd-une-faq-pour-comprendre-lessentiel-en-quelques-minutes\">CNB’s recommendations</a>&nbsp;: “<em>Toutes les données envoyées par courriel ou transmises au moyen d’outils d’hébergement en ligne (Cloud) sont par conséquent vulnérables. Il s’agit donc de procéder à leur chiffrement systématique avant de les adresser à un correspondant ou de les hébergerLa transmission du secret (mot de passe, clé, etc.) permettant alors de déchiffrer les données, si elle est nécessaire, doit être effectuée via un canal de confiance ou, à défaut, un canal distinct du canal de transmission des données. Ainsi, si les données chiffrées sont transmises par courriel, une remise en main propre du mot de passe ou, à défaut, par téléphone doit être privilégiée.</em>&nbsp;:</li><li><em><a href=\"“https:/www.ssi.gouv.fr/uploads/2017/01/guide_hygiene_informatique_anssi.pdf\">ANSSI Guide de l’ hygiène informatique</a></em></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In their letter they admited exchanging regularly with their client in China. This concerns massive amount of highly personal data for more than a decade, with no appropriate security measure. Their justifications? Well, China has voted the data protection regulation PIPL, so all is good !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They admit having been non-compliant for years before recently discovering the platform they had refused to use when first suggested.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Again, this month, I received a fishing email from that law firm using a similar technic as shown below.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2372,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing_CBBC_Anonymised_08032022-1-1024x862.png\" alt=\"\" class=\"wp-image-2372\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Previously, in December 2020 I had received another suspicious email from that same law firm they never clarified if it came from them or not.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":2373,\"sizeSlug\":\"large\",\"linkDestination\":\"none\"} -->\n<figure class=\"wp-block-image size-large\"><img src=\"https://www.datarainbow.eu/wp-content/uploads/2022/05/Spam-CBBC-IBP-18122020-1-808x1024.png\" alt=\"\" class=\"wp-image-2373\"/></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>CNIL closed the case satisfied by these arguments without looking at :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>the question of long years of data transfers without any appropriate security measure ;</li><li>the use of the free version of WeTransfer without DPA art 28 while they could at least afford the professional version offering better guaranties;</li><li>use of the professional email address of the client and access by his employer</li><li>CNIL accepted there has not been a transfer as the receiver is an individual to whom GDPR does not apply.</li><li>resistance to reply to my requests, The CNIL did not care that the law firm rejected my DSAR for many years.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Here is a translation of CNIL’s decision - emphasises by me</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>Firstly, with regard to your difficulties relating to the exercise of the right of access to your personal data, XXXX, when questioned by the CNIL, indicated that this information was covered by professional secrecy. I confirm in this regard that, in accordance with the provisions of Article 23 of the General Data Protection Regulation (GDPR), the French legislator has, in Article 66-5 of Law No 71-1130 of 31 December 1971 reforming certain judicial and legal professions, provided for a limitation on the right of access. Under the above-mentioned article: \"In all matters, whether in the field of counsel or in that of defence, consultations sent by a lawyer to his client or intended for him, correspondence exchanged between the client and his lawyer, between the lawyer and his colleagues with the exception for the latter of those bearing the mention \"official\", the interview notes and, more generally, all documents in the file are covered by professional secrecy. ». [I don’t think I have ever questioned the confidentiality of their correspondences with their client]</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Secondly, with regard to the supervision of the transfers of your data made by XXXX, in particular to China where the firm\'s client resides to whom, according to your assertions [XXXX has XXXX clearly admitted doing so], your data would be sent, XXXX, questioned by the CNIL, indicates that there is no transfer strictly speaking.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>I confirm in this regard that it follows from the ongoing discussions at the level of the European Data Protection Board (EDPB) that a transfer exists only if the personal data are transmitted to an importer located in a third country. However, since the client of the firm to which you believe your data is transferred cannot be qualified as a controller, joint controller or processor, the transmission operation cannot be qualified as a transfer of personal data outside the European Union.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Thirdly, as regards the security measures implemented by XXXX to guarantee the integrity and confidentiality of your data, that firm has on the one hand specified the security measures deployed in the context of the use of the \"WeTransfer\" tool and on the other hand indicated that it now uses the e-Sharing platform, developed by the National Council of Bars, whose technical characteristics as described in the firm\'s response appear to meet the security obligations provided for in Article 5.1-f) of the GDPR. [Last WeTransfer link sent to me and other parties was last year. Before that for many years they exchanged via email attachment. They recognised I have been asking them – bothered them – to secure these exchanges due to highly sensitive data involved]</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Regarding the facts alleged in your message of May 10, 2022 according to which the XXXX firm recently sent you the password through the same channel (email) as that used to send the link to the platform, and that this password contains only 6 characters, XXXXX was reminded of the elementary precautions recalled by the CNIL on these points.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>In the light of these elements, I inform you to proceed to the closure of your complaint.&nbsp;»</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> Surprisingly, neither the law firm, nor the notaire care about the fraudulent use of their email addresses or name !</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although they admitted “<em>Ms. xxx obviously benefits from the right to ask the data controller for access to personal data, the rectification or erasure thereof, or a limitation of the processing relating to the person concerned, as well as the right to object to processing and the right to data portability. These rights are however limited by the very purpose of the processing of personal data, namely the recognition, exercise or defense of legal rights (Articles 16, 17, 18 and 20 of the GDPR).”</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm pretended holding data indirectly collected. However, they forget that some of the documents have been directly collected to comply with the principle of ‘<em>contradictoire</em>’ or adversarial principal.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They pretend they are under no obligation to respond to my DSAR as I would already have knowledge of the information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>- </strong>Where personal data is not collected from the data subject, any available information as to its source :they argue this information is also covered by professional secrecy. Therefore, they would not be able to reveal all of their sources [expect use of private investigators]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“Under these conditions, if Ms. xxx actually wished to request such a copy, she is asked to specify the data or the processing operations to which her request relates, as Cabinet xxx cannot decently gather all of this information in just one months as required by the GDPR. [Did they requested an extended delay?]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Their justification on the use of WeTransfer is rather enlightening:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Indeed, WeTransfer has indisputable practicality –</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They add “<em>If the firm was able to effectively use this tool to transmit documents, during a well-defined and now over period, to Ms. xxx\'s lawyer, to the notary, as well as to Ms. Xxx herself, it is recalled that the processing carried out here mainly concerned personal data relating to our client who has expressly consented to the use of this medium and has requested that it be use</em>.” This is totally untrue. A legal case obviously involves exchange of personal data concerning various parties. How did CNIL not reacted to that is a mystery.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have recognised using free WeTransfer in several occasions when they could have easily use alternative secure tools, ognoing my requests and the high sensitivity of the data: On February 3 and 20, 2020, October 14, 2020, January 14 and 22, 2021, January 29, 2021, December 9, 2021 and January 14, 2022.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They don’t despute my ‘<strong><em>numerous inquiries</em></strong><em> about WeTransfer’</em>. It had to come to the CNIL’s attention for them to make ‘<em>the necessary changes in order to comply with the GDPR and no longer use this service</em>”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>II - On the question of regular long-term transfers to CHINA</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm is based in France. The litigation is initiated in France based on the French nationality of their client. The client is based in China. However, he travels around the world including in Europe where some of the exchanges have occurred and while in Europe, no doubt GDPR applied to these transfers. Data transfers via China where the email servers of the employer are located.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm collect personal data from their client, from me directly in respect with the principal of adversarial, from the notaire, and I suspect from their communications, from private investigators. These documents are then forwarded to their client for observation. Then sent back to them. These will be used and reproduced to draft the court documents again exchanged between all parties including the client. Therefore, the law firm is data controller (see UK ICO cases of Tuckered LLP or Smith… ). Would the client be as well a data controller of the part of data he gathers, stores and processed? Possibly. In two cases, ECJ has considered individual as data controller : in the Facebook fan page admin case and in Jeowah’s Witnesses. [in <a href=\"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0040\">ECJ Fashion ID</a> “(<em>A)s the Advocate General noted, [...-] it appears that a natural or legal person may be a controller, within the meaning of Article 2(d) of Directive 95/46, jointly with others only in respect of operations involving the processing of personal data for which it determines jointly the purposes and means. By contrast, [...] that natural or legal person cannot be considered to be a controller, within the meaning of that provision, in the context of operations that precede or are subsequent in the overall chain of processing for which that person does not determine either the purposes or the means</em>”.<br>In <a href=\"https://gdprhub.eu/index.php?title=CJEU_-_C%E2%80%9125/17_-_Tietosuojavaltuutettu\">Jehovah’s witnesses, C-25/17</a>, the CJEU considered that a religious community of Jehovah’s witnesses acted as a controller, jointly with its individual members.]</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The law firm argued that ‘<em>The “transfers” in question are in no way regular and permanent but rather punctual and occasional, as much as respect for the adversarial process has made it necessary to communicate the documents in the file. Moreover, strictly speaking, there is no transfer outside the European Union at the initiative of xxx since <strong>it is the recipient of the data who imports the data</strong> because he is domiciled outside the European Union. And it should be remembered that the GDPR does not apply to natural persons not residing in the European Union.”</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Can we still talk<em> about ‘ponctual and occasional’</em> for something that has last 11 years ?! Massive amount of highly personal sensitive data have been exchanged refusing the special request to use encryption rejected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Their argument is that the transfers almost exclusively concerned data obtained indirectly through the lawyer., the notary or the client. This is not exact as some of the data was directly collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Knowing that several litigations initiated since 2011 involving different jurisdictions in France, it’s difficult to admit these heavy volume of data exchanges were ‘<em>ponctual</em>’ (3 court of appeals, 4 other jurisdictions, several notaires, huissiers, or Avoués were involved each time data has been sent with no care)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In any case, their communications between the law firm and the notaire are not confidential Article 14 paragraph 5, d). – in contrary I should have been in copy on all of them</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Concerning Chinese employers practice, here is </strong><a href=\"https://www.politico.eu/article/huawei-germany-court-case-privacy/\">report by Politico</a> :</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><em>“A case filed by one of Huawei’s former managers at its European headquarters in Düsseldorf takes aim at another pitfall for the company: Its respect of European privacy rules.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Specifically, it opens up questions about whether Huawei is putting data at risk of slipping into the hands of Chinese state surveillance and intelligence operations. It also raises questions about whether Europe will sharpen its tone with China on sensitive data privacy matters — after years of focusing its ire on Silicon Valley’s giants and U.S. state surveillance.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>A judge ruled March 5 that Huawei was in breach of European privacy law when it failed to comply with the former manager’s request to view the data the company had kept on him.” &nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>Ultimately, non-compliance with GDPR is <a href=\"https://www.cnil.fr/fr/les-sanctions-penales\">a criminal offense</a></strong><strong> :</strong></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-16</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fact, including negligence, of carrying out or having carried out processing of personal data without having complied with the formalities prior to their implementation provided for by law is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le fait, y compris par négligence, de procéder ou de faire procéder à des traitements de données à caractère personnel sans qu\'aient été respectées les formalités préalables à leur mise en oeuvre prévues par la loi est puni de cinq ans d\'emprisonnement et de 300 000 euros d\'amende.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 226-17</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The fact of carrying out or having carried out a processing of personal data without implementing the measures prescribed in Articles 24, 25, 30 and 32 of Regulation (EU) 2016/679 of 27 April 2016 or in 6 ° of Article 4 and Articles 99 to 101 of Law No 78-17 of 6 January 1978 cited above is punishable by five years\' imprisonment and a fine of 300,000 euros.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Le fait de procéder ou de faire procéder à un traitement de données à caractère personnel sans mettre en oeuvre les mesures prescrites aux articles 24, 25, 30 et 32 du règlement (UE) 2016/679 du 27 avril 2016 précité ou au 6° de l\'article 4 et aux articles 99 à 101 de la loi n° 78-17 du 6 janvier 1978 précitée est puni de cinq ans d\'emprisonnement et de 300 000 euros d\'amende.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>Previous related CNIL’s decisions </u></strong><strong><u></u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><u>For reference, here are previous similar cases involving the questions of security measures</u></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true,\"type\":\"1\"} -->\n<ol type=\"1\"><li>Slimpay, lack of measures of security <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\">article 32</a>, without the need to prove any illegitimate access to the data&nbsp;:</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“95. <em>The Restricted Committee then notes that the accessible data (title, surname, first name, e-mail address, postal address, telephone number, BIC/IBAN) make it possible to obtain very precise information on the persons concerned by revealing their identity and their contact information.&nbsp;In addition, specific data are in question when some relate to financial information.&nbsp;The fact in particular that the <strong>IBAN appears is not insignificant</strong>.&nbsp;As the Banque de France indicated in its book \"Payments and market infrastructures in the digital age\", <strong>IBANs are \"sensitive\" payment data</strong> (in the ordinary sense of the term) because they can be used to commit fraud. .&nbsp;The European Data Protection Board describes this type of data as \"highly personal\".&nbsp;The Restricted Committee considers that the company should have exercised particular vigilance with regard to securing such data, which may be reused by unauthorized third parties, thus harming the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining data) when their full identity, associated with their email address for many, was freely accessible.&nbsp;thus prejudicing the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining</em> <em>data) when their full identity, associated with their email address for many, was freely accessible.&nbsp;thus prejudicing the persons affected by the data breach.&nbsp;These are, for example, exposed to a risk of identity theft or phishing (or \"phishing\", i.e. the sending of fraudulent letters for the purpose of obtaining data) when their full identity, associated with their email address for many, was freely accessible.</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>“68. The Restricted Committee considers that the absence of proof of fraudulent use of the data has no impact on the characterization of the breach of the security obligation.&nbsp;Indeed, the risk of fraudulent use of personal data was real, independently of the cases of fraud, insofar as the data of many people were made accessible to unauthorized third parties.&nbsp;The absence of proven harm to the persons concerned does not affect the existence of the security defect, which constitutes the breach of Article 32 of the GDPR.”</em><em></em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000042676787\">The French DPA (CNIL) imposes a 3,000 euros fine on a doctor</a> for failing to comply with the security obligation, due to the free access on the web of his patients\' health data. CNIL recalls its own guidelines on Personal Data Security recommending encryption as a standard security measure. Similarly, the Practical Guide for Physicians encourages physicians to encrypt their patients\' data with suitable software.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Transmitting unsecured emails: the restricted training points out that it also emerges from the hearing of December 17, 2019 that “<em>Mr. [...] had also not taken care to encrypt the data contained in his personal laptop, considering that encryption slows down the execution of applications too much (medical file, image visualization tool).</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>26. In the absence of encryption, the medical data contained in that computer\'s hard drive were readable in plain text by any person taking possession of that device (for example, as a result of its loss or theft) or by any person who unduly entered the network to which that computer was connected.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its guidance The security of personal data, the CNIL recommends providing encryption means for nomadic workstations and mobile storage media (laptop, USB keys, external hard disk, CD-R, DVD-RW, etc.), for example via the encryption of the hard disk in its entirety when the operating system offers it, file-by-file encryption or the creation of encrypted containers (file likely to contain several files). Similarly, the Practical Guide for Physicians invites physicians to encrypt their patients\' data with appropriate software.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2021-021\">The French DPA (CNIL) fined a mobile operator €300,000</a> for failing to respect customers\' right of access and right to object by not responding to their access requests in a timely manner and sending them marketing messages despite having been notified of their objection to such processing.</li><li><a href=\"https://gdprhub.eu/index.php?title=CNIL_-_SAN-2020-008\">The French DPA (CNIL) imposed a € 2250000 fine on Carrefour France</a> for several violations of the GDPR and French data protection law. These include : excessive data retention periods, incomplete and unclear information on data processes, lack of proper answer to data subjects\' requests, security breaches and illicit use of cookies.</li><li>The CNIL also referred to a&nbsp;<a href=\"https://www.legifrance.gouv.fr/ceta/id/CETATEXT000038388017/\">decision n°423559</a>&nbsp;by the French Supreme Administrative Court (Conseil d\'Etat) which allowed for such sanctions, even if the violation had been corrected. (NESTOR)</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>Other cases in the EU</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://lnkd.in/dFuE5SHj\">A hospital in Sweden</a> received a fine&nbsp;of 150k EUR because it was sending medical records via email to patients and referring hospitals, unencrypted.<br>That was a&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=gdpr&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">GDPR</a>&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=security&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">security</a>&nbsp;<a href=\"https://www.linkedin.com/feed/hashtag/?keywords=issue&amp;highlightedUpdateUrns=urn%3Ali%3Aactivity%3A6905436683920379904\">issue</a>, in direct breach of art 5 (1)(f) GDPR (principle of security) and art 32 GDPR (security of processing).<br>Email is an obsolete communication mechanism, start using encrypted document sharing solutions, with strong authentication!</li><li><a href=\"https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_against_Societatea_Civil%C4%83_Profesional%C4%83_de_Avoca%C8%9Bi_%E2%80%9ESabou,_Burz_%26_Cuc%E2%80%9D\">The Romanian DPA issued a fine of approximately €1000 on a law firm</a> for disclosing a case file with the personal data of one of its clients on an external WhatsApp group with other lawyers, in breach of Articles 6, 5(1)(a), 5(1)(b), 5(1)(c), 5(1)(f) and 5(2) GDPR.</li><li>Hungarian DPA fines Lawyer € 835 for unauthorized transmission of a confidential document to two unauthorized third parties.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The data subject lodged a complaint with the DPA concerning the unlawful disclosure of his personal data.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The recipient of the fine acted as a lawyer for a company that was in litigation with the complainant.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In his complaint, the concerned party alleged that the respondent had improperly and without cause disclosed to two other parties in the case \"<em>highly confidential information\"</em>, which was a private letter to the President and Vice-President of an unnamed company.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The view that the sending of an unencrypted e-mail might violate Art. 32 GDPR is also the opinion of the Data Protection Authority of North Rhine-Westphalia (DPA NRW), which says the following on its website:</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>\"<em>The communication by e-mail requires at least the transport encryption, as it is offered by the considerable European providers by default. ... It must be taken into account that in the case of transport encryption the e-mails are available on the e-mail servers in plain text and can basically be viewed. In the case of particularly sensitive data (e.g. account transaction data, financing data, health status data, client data from lawyers and tax consultants, employee data), transport encryption alone may not be sufficient</em>\". (DPA NRW, Technical Requirements for Technical and Organizational Measures for E-Mail Sending,&nbsp;<a href=\"https://www.ldi.nrw.de/mainmenu_Aktuelles/Inhalt/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand/Technische-Anforderungen-an-technische-und-organisatorische-Massnahmen-beim-E-Mail-Versand.html\" target=\"_blank\" rel=\"noreferrer noopener\">available here</a>&nbsp;in German).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>With special thanks to the experts who have offered me their assistance on this matter :</em></strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/davidflintscotland/\" target=\"_blank\">David Flint</a>, Commercial Law Consultant at Inksters; Visiting Professor at Creighton University School of Law.</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/peter-stephenson-phd-cissp-faafs-3a6788108/\" target=\"_blank\">Peter Stephenson</a>, PhD, CISSP, FAAFS Writer, researcher and educator in cyber criminology and cyber jurisprudence.</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/alexandre-blanc-cyber-security-88569022/\" target=\"_blank\">Alexandre Blanc</a> Cyber Security - vCISO - ISO/IEC 27001 and 27701 Lead Implementer - best Cyber Risk Communicator of 2019 and 2020 - MCNA - MITRE ATT&amp;CK - LinkedIn Top Voice 2020 in Technology - Cyber Sentinel Award 2020-21 – Speaker</li><li><a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/valerymarchive/\" target=\"_blank\">Valery Rieß-Marchive</a> Rédacteur-en-chef, LeMagITTalks about malware, offrecyber, ransomware, cyberattaque, and threatintelligence</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>A special thank to <a href=\"https://twitter.com/alexislintS\" target=\"_blank\" rel=\"noreferrer noopener\">Lord\'Aliosha</a> for his breathaking photo reproduced with his special permission</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And Fieldfisher for their useful links to GDPR articles, <a href=\"https://ukgdpr.fieldfisher.com/chapter-4/article-32-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a></p>\n<!-- /wp:paragraph -->','Advocating Privacy and Data Protection for More Than a Decade And Still Fighting Resistance','<!-- wp:paragraph -->\n<p>I have been watching legal professionals disseminating personal data around the world. Feel my pain ? Why it especially matters? Because they are the ones advising others. They are the role model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As the GDPR has now celebrating it’s 6 years and 4 years of enforcement, Here an exhaustive practical case law analysis of the importance of taking appropriate security measures and how things can go wrong.</p>\n<!-- /wp:paragraph -->','inherit','closed','closed','','2364-revision-v1','','','2022-05-25 16:42:59','2022-05-25 16:42:59','',2364,'https://www.datarainbow.eu/?p=2380',0,'revision','',0),(2396,1,'2022-10-07 09:14:26','2022-10-07 09:14:26','','Rendez-vous with Privacy, Data Protection and IP Expert, Tara Taubman-Bassirian (MDE478)','','publish','closed','closed','','rendez-vous-with-privacy-data-protection-and-ip-expert-tara-taubman-bassirian-mde478','','','2022-10-07 09:14:26','2022-10-07 09:14:26','',0,'https://www.datarainbow.eu/?p=2396',26,'nav_menu_item','',0),(2397,1,'2022-10-07 09:14:26','2022-10-07 09:14:26','','Medical Data, Reconciling Research and Data Protection','','publish','closed','closed','','medical-data-reconciling-research-and-data-protection','','','2022-10-07 09:14:26','2022-10-07 09:14:26','',0,'https://www.datarainbow.eu/?p=2397',38,'nav_menu_item','',0),(2398,1,'2022-10-07 09:14:26','2022-10-07 09:14:26','','Interview with Sergio Maldonado Masters of Privacy','','publish','closed','closed','','interview-with-sergio-maldonado-masters-of-privacy','','','2022-10-07 09:14:26','2022-10-07 09:14:26','',0,'https://www.datarainbow.eu/?p=2398',25,'nav_menu_item','',0),(2383,1,'2022-05-25 21:12:24','2022-05-25 21:12:24','','Phishing-Watin-2-1','','inherit','open','closed','','phishing-watin-2-1','','','2022-05-25 21:12:24','2022-05-25 21:12:24','',2364,'https://www.datarainbow.eu/wp-content/uploads/2022/05/Phishing-Watin-2-1.png',0,'attachment','image/png',0),