<!-- wp:paragraph -->
<p>by Tara Taubman-Bassirian LLM</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Much has been said and complained about data protection regulations. Lots of criticism, its cost, resources consumption, business killer,….</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>What's been forgotten is that the&nbsp;<a rel="noreferrer noopener" href="https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/" target="_blank">General Data Protection Regulation (GDPR)</a>&nbsp;is not against data processing when done in respect with the data subject rights. The amount of electronically available data and curation and storage tools, justify a better protection. Privacy is a&nbsp;<a rel="noreferrer noopener" href="https://rightsinfo.org/the-rights-in-the-european-convention/" target="_blank">Fundamental Human Right</a>, for dignity and freedom.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The equation is simple : Privacy = Transparency + Control</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>A balance of rights and freedom of data subjects with respect to the interest of the business.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Before the GDPR, data protection directive lacked uniformity and the necessary certainty throughout the EU. The new Regulation is based on harmonisation and the&nbsp;<a href="https://rightsinfo.org/the-rights-in-the-european-convention/" target="_blank" rel="noreferrer noopener">European Data Protection Board (EDPB)</a>&nbsp;is the authority in charge of the&nbsp;<a href="https://gdpr-info.eu/art-63-gdpr/" target="_blank" rel="noreferrer noopener">consistency mechanism - Article 63</a>&nbsp;- to make sure the regulation and its enforcement are harmoniously applied by all national Data Protection Authorities (DPAs).</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>One of the more pro-active DPAs has been the French&nbsp;<a href="https://www.cnil.fr/en/home" target="_blank" rel="noreferrer noopener">Commission Nationale de l'Informatique et des Libertes (CNIL)</a>&nbsp;producing many guidelines in both French and English, including a very useful&nbsp;<a href="https://www.cnil.fr/en/pia-software-20-available-and-growth-pia-ecosystem" target="_blank" rel="noreferrer noopener">Privacy Impact Assessment (PIA) tool</a>. So, I would like to think French companies have benefited from all necessary guidances to comply after two years period of preparation and 6 months after the GDPR entered into effect.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>In two previous article, I wrote about the&nbsp;<a href="https://www.linkedin.com/pulse/cnil-published-first-review-6-months-gdpr-tara-taubman-bassirian-llm/" target="_blank" rel="noreferrer noopener">CNIL’s report after 6 months of activities</a>&nbsp;and&nbsp;<a href="https://www.linkedin.com/pulse/six-months-gdpr-tara-taubman-bassirian-llm/" target="_blank" rel="noreferrer noopener">some of their main cases.</a>&nbsp;While The UK ICO has been more focusing on fining nuisance calls and clarifying data subject's access after investigating Facebook Analytica case, The French CNIL focus has been :</p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li>clarifying criteria of consent in four cases of Mobile App data collection,</li><li>clarifying CCTV monitoring and biometrics in work place</li><li>clarifying cookie compliance.</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>What are cookies?</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Better than me,&nbsp;<a href="https://termly.io/resources/articles/cookies-comprehensive-guide/" target="_blank" rel="noreferrer noopener">KJ Kearie has a Comprehensive Guide&nbsp;</a>on cookies, I recommend you read.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>“A cookie is&nbsp;<a href="https://www.theguardian.com/technology/2012/apr/23/cookies-and-web-tracking-intro" target="_blank" rel="noreferrer noopener">a tiny bit of plain text</a>&nbsp;that a website downloads to a computer when that user’s browser opens a new webpage. They are used to remember useful pieces of data from the users they encounter, acting as an<strong>invisible liaison between a domain’s owner and visitors</strong>.</p></blockquote>
<!-- /wp:quote -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>A cookie can identify both the user and the browser, and can be left on the user’s device indefinitely. When the user’s browser returns to that website, the cookie connects with the domain and shares with it the data it has collected or stored about that user.</p></blockquote>
<!-- /wp:quote -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>There are two main types of cookies –&nbsp;<a href="http://www.allaboutcookies.org/cookies/session-cookies-used-for.html" target="_blank" rel="noreferrer noopener">session cookies</a>&nbsp;only collect details from a single browsing sessions, while&nbsp;<a href="https://www.techopedia.com/definition/4901/persistent-cookie" target="_blank" rel="noreferrer noopener">persistent cookies</a>remain on the user’s device and collect information over time."</p></blockquote>
<!-- /wp:quote -->

<!-- wp:paragraph -->
<p>In terms of functionality, some cookies aim to a better browsing experience such as remembering the language of their visitor, others, more pernicious, track the users habits, profiling users for targeted advertising. Data collected has fuelled a huge business of data brokage raising privacy and security concerns. In November,&nbsp;<a href="https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found" target="_blank" rel="noreferrer noopener">Privacy International</a>, the UK based organisation, has filed&nbsp;<a href="https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-and" target="_blank" rel="noreferrer noopener">complaints</a>&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>If you think online tracking and profiling are legitimate? Watch&nbsp;<a href="https://www.youtube.com/watch?v=xYZtHIPktQg&amp;feature=youtu.be" target="_blank" rel="noreferrer noopener">this video</a>&nbsp;it's eloquent.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Online customers deserve the same privacy as offline.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Cookie law, known as the ePrivacy Directive, has long been misunderstood. It is not a useless banner asking you to confirm you agree for your personal data to be collected in order to access the website. Just in case, you have forgotten, an IP address or any identifiable information is considered a personal data.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>What are website owners duties exactly ?</strong>&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>To provide clear transparency to inform their visitors about the personal data they collect, how long it is kept, with whom they share the data and data subjects rights of access, right to delete, amend or the right of portability. These informations should be provided at the time of data collection, made accessible on each webpage, in clear language.&nbsp;<a href="https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227" target="_blank" rel="noreferrer noopener">The WP art 29&nbsp;</a>requires that</p>
<!-- /wp:paragraph -->

<!-- wp:quote -->
<blockquote class="wp-block-quote"><p>“Every organisation that maintains a website should publish a privacy statement/ notice on the website. A link to this privacy statement/ notice should be clearly visible on each page of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible. “</p></blockquote>
<!-- /wp:quote -->

<!-- wp:list -->
<ul><li>it must be concise, transparent, intelligible and easily accessible (Article 12.1);</li><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>In short, a privacy notice is required to provide “<em>Concise, transparent, intelligible and easily accessible</em>” information about the data collected from visitors.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Alined with the WP guidance, the&nbsp;<a href="https://www.linkedin.com/pulse/six-months-gdpr-tara-taubman-bassirian-llm/" target="_blank" rel="noreferrer noopener">French DPA CNIL</a>&nbsp;has required clear information for visitors, and for non exclusively technical cookies, consent is required. AND - that is very important - opting out of cookie tracking should not be detrimental to the use of the service. This goes with the clear position of the Working Party Art 29, replaced by the EDPB.&nbsp;For more on Privacy by Design, you might want to follow&nbsp;<a href="https://www.ryerson.ca/pbdce/about/ann-cavoukian/" target="_blank" rel="noreferrer noopener">Ann Cavoukian</a>, Leading the Privacy by Design Centre of Excellence at Ryerson University.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>So, remember, privacy = transparency + control. that means an obligation to tell visitors what is collected, with whom is shared, users rights and clear opt out.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Despite all clear guidance, too many websites are non compliant.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>You’d expect lawyers would have it right, for being well aware of the regulation. The French association of lawyers, the CNB, has done a good job informing their members by producing ample&nbsp;<a href="https://www.cnb.avocat.fr/sites/default/files/documents/guide_rgpd_avocats-2018.pdf" target="_blank" rel="noreferrer noopener">guidance</a>&nbsp;to follow.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Additionally law firms handle sensitive data of clients, so they should be the ones showing the good example.&nbsp;<a href="https://twitter.com/clarinette02/status/1071025796767236097" target="_blank" rel="noreferrer noopener">Recently</a>, I have looked at&nbsp;<a href="http://www.cbbc-avocats.com/cbbc/lequipe" target="_blank" rel="noreferrer noopener">few websites</a>&nbsp;from some of&nbsp;<a href="http://www.hleclerc-avocats.fr/alain-weber" target="_blank" rel="noreferrer noopener">the top law firms</a>&nbsp;in Paris. It is outraging to see they are mostly ignoring their obligations. Lack of information about cookies, no privacy notice or insufficient information. Too many are even&nbsp;<a href="https://www.theverge.com/2018/7/24/17603126/google-chrome-unencrypted-not-secure" target="_blank" rel="noreferrer noopener">tagged as ‘Not Secure’ by Google Chrome web browser&nbsp;</a>lacking encryption. [This is when the lock does not show next to the URL ‘http’ instead of https. unencrypted transmission means that data can be intercepted.] Some of the websites I visited have visitors contact forms or candidates applications online with CV upload.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>I raised the issue few weeks ago, two of the law firms amended the security certification to https. One specialised DPO did not considered a cookie banner or&nbsp;<a href="http://www.jacobavocats.com/mentions-legales/" target="_blank" rel="noreferrer noopener">more comprehensive privacy notice was needed</a>. It is painful to see members of the law society or big law firms could have so little consideration for privacy and data protection of clients and web visitors. I see too many exchange documents via un-encrypted email attachments. These big law firms have opulent clients around the world including outside the EU. How do they comply with data flow regulation to countries of non adequate data protection, not just China, that includes the USA as well. I have brought the CNIL's attention to this issue. Knowing that a website is the vitrine of a business, it worth the effort.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Data breach has been on everyday news. Have you heard of&nbsp;<a href="https://www.forbes.com/sites/davidvolodzko/2018/12/04/marriott-breach-exposes-far-more-than-just-data/" target="_blank" rel="noreferrer noopener">Marriott hotels breach</a>&nbsp;gone undetected for four years?&nbsp;<a href="https://www.linkedin.com/pulse/after-canada-airlines-here-comes-british-airways-tara/" target="_blank" rel="noreferrer noopener">Air Canada</a>, British Airways, Cathay Pacific, Yahoo, Equifax,,.... and many more. Fines will not give back data subjects' hassle when dealing with ID theft or financial misuse.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>It’s not anymore IF but WHEN.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Any data collection creates data breach risk.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>I invite you to read&nbsp;<a href="https://www.linkedin.com/pulse/memory-forgetfulness-privacy-tara-taubman-bassirian-llm/" target="_blank" rel="noreferrer noopener">Memory, Forgetfulness and Delete</a>&nbsp;because Privacy matters to us all,</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>and from&nbsp;<a href="https://blog.usejournal.com/is-your-web-site-breaking-eu-law-7e5b7eb33d5d?fbclid=IwAR3n5duN22qnmVk_he_EHxsg2JQA2DCeCzAzoTk9AUBUWlUvV8h4k75FoBg" target="_blank" rel="noreferrer noopener">Alexander Hanff&nbsp;</a>: "<em>Your consent notice should provide a list of all of these assets (unless covered by the “strictly necessary” exception) and provide the option for the data to refuse the loading of any or all of these assets.</em>"</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Connected read&nbsp;<a href="https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/?published=t" target="_blank" rel="noreferrer noopener">Law&nbsp;</a>Firm Internet Security and Data Protection</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/?published=t" target="_blank" rel="noreferrer noopener">Firms Data Security</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Follow ongoing&nbsp;<a rel="noreferrer noopener" href="http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736" target="_blank">Pearltrees curation</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>UPDATE : Google-Style GDPR Fines for Everyone? <a href="https://www.jdsupra.com/legalnews/google-style-gdpr-fines-for-everyone-23609/">Bavarian DPA </a>Conducts Website Cookie Practices Sweep, Announces Fines under Consideration.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>"<em>The Bavarian DPA audited 40 “large websites”. The companies audited were from the following industries</em>:</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><em>(a) Online retail ; (b) Sports; (c) Banking &amp; insurance; (d) Media; (e) Automotive &amp; electronics; (f) Home and residential; and (g) Other.</em></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>•&nbsp;<em> The sweep revealed that&nbsp;all 40&nbsp;websites had integrated cookies or other “tracking tools”. While the Bavarian DPA leaves the term “tracking tools” largely undefined, it indicates they are provided by third parties and result in data being sent to these third party providers, such as pixels, beacons, or the like.</em></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><em>The Bavarian DPA found that&nbsp;none&nbsp;of the 40 websites’ cookie practices were GDPR-compliant. It found the following violations</em>:</p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li><strong><em>Websites lacked the transparency needed for “informed” cookie consent</em></strong><em>. </em></li><li><strong><em>No “prior” consent was collected from users</em></strong><em>. </em></li><li><strong><em>The consent obtained was not sufficiently “active”</em>.</strong>&nbsp;</li></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><em>The Bavarian DPA announced it was considering GDPR fines for the website operators."</em></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>In July 2019, the UK ICO published a new guidance on the use of cookies after admitting <a href="https://www.itpro.co.uk/general-data-protection-regulation-gdpr/33850/ico-admits-its-own-cookie-policy-is-non-compliant-with">its own website was not compliant</a>. Read more <a href="https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2019/07/blog-cookies-what-does-good-look-like/?utm_source=twitter&amp;utm_medium=iconews&amp;utm_term=7704459a-682b-4360-83e2-195bbba3a4c6&amp;utm_content=&amp;utm_campaign=">here.</a></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Following the French regulator, CNIL  "<em>Online targeted advertisement: what action plan for the CNIL_en ?"</em> <a href="https://www.cnil.fr/en/online-targeted-advertisement-what-action-plan-cnil">here</a>.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The  CNIL tweeted : "<em>The legal framework relating to consent has evolved, and so does the website of the CNIL. On </em><a rel="noreferrer noopener" href="https://t.co/R3uTY6ghS5" target="_blank"><em>http://cnil.fr </em></a><em>, no more tracking devices are deposited, as long as the user has not given his active consent</em>" with the following <a href="https://www.cnil.fr/en/legal-framework-relating-consent-has-evolved-and-so-does-website-cnil">link</a>. </p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li>This work is licensed under a&nbsp;<a href="http://creativecommons.org/licenses/by/4.0/" target="_blank" rel="noreferrer noopener">Creative Commons Attribution 4.0 International License</a>.</li></ul>
<!-- /wp:list -->