(96,5,'2019-01-22 12:20:51','2019-01-22 12:20:51','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":95,\"width\":472,\"height\":309} -->\n<figure class=\"wp-block-image is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-22-at-12.04.25.png\" alt=\"\" class=\"wp-image-95\" width=\"472\" height=\"309\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>In “<a href=\"https://press.princeton.edu/titles/9436.html\">Delete : The Virtue of Forgetting in the Digital Age</a>”, <a href=\"https://www.oii.ox.ac.uk/people/viktor-ms/\">Viktor Mayer-Schonberger</a> from the <a href=\"https://cyber.harvard.edu/\">Berkman Klein Centre of Internet and Society</a>, exposes the permanent shadow that follows us online for ever. The issues of privacy and freedom that results and his suggested solution : auto-delete files or information expiry date.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Changing back the default setting from remembering to forgetting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The crumbs of information left behind, get aggregated and build a picture, sometimes distorted, that follows us.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to the theory of conservation of energy, data does have a deceptively long lifespan.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Nothing gets deleted.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Viktor Mayer-Schonberger points out, the German Stasi genocide project would have taken a whole different apocalyptic dimension had Google storage and data indexing existed at the time.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He mentions the case of the Dutch Citizens register put in place in the 1930s. To ensure the administration of social securities, it included religious and ethnicity. Once the nazi had occupied the Netherland, they exploited the register to identify jews to be deported and sent to concentration camps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Another major Privacy scholar, Professor Daniel Solove, has been actively raising awareness on privacy and the future of reputation online.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>His paper,&nbsp;<a href=\"http://ssrn.com/abstract=998565\" target=\"_blank\" rel=\"noreferrer noopener\">“I’ve Got Nothing to Hide,” and Other Misunderstandings of Privacy</a>,&nbsp;explains why privacy matters.&nbsp;He later expanded his ideas in the essay into a book:&nbsp;<a href=\"http://www.amazon.com/gp/product/0300172338\" target=\"_blank\" rel=\"noreferrer noopener\">Nothing to Hide: The False Tradeoff Between Privacy and Security</a>.&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you think The only people who should worry are those who are doing something immoral or illegal, you should read his essays and books. With the mass of omni-veillance data, the situation is not just Orwellian, but Kafkaesque.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a series of YouTube videos and conferences, Daniel Solove brings public attention to cases of online harassement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Dog Pooh girl is the story of an unlucky girl. She is with her dog in a suburban tube of South Korea. The dog poop on the train, she is on a hurry, she leaves the train refusing to clean up behind. In the old days, that would have been the end of it. Today, when face-to-face persuasion fails, there’s a fallback plan : anonymous Internet humiliation.&nbsp;The witness who recorded her with his smartphone, posted the shaming video online. Within days, her identity and her past were revealed. The video gets viral all around the world. Posters and all kinds of jokes were made. Media wrote about her.&nbsp;Even the US Washington Post wrote about her story.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>She eventually reached a fame she wished she did never achieved. For ever, the image will follow her. This girl will be called the Dog Pooh Girl.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Another illustration, The sad story of the the Star Wars Kid. A young chubby boy in Canada. He&nbsp;posted a video of himself online in his rather unsuccessful attempt to imitate George Lucas, the famous movie star. His video was watched by tens of millions of internautes who commented, and widely mocked his gesture. He was teased by the whole world.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A childhood incident that will follow him forever.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Daniel Solove questions the Future of Reputation in the digital age and how data can track you back.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He wrote : “<em>If the Empire in Star Wars Had Big Data, the Empire would have won. A search of records would have revealed where Luke Skywalker was living on Tatooine.&nbsp;A more efficient collection and aggregation of Jawa records would have located the droids immediately.&nbsp;Simple data analysis would have revealed that Ben Kenobi was really Obi Wan Kenobi. A search of birth records would have revealed that Princess Leia was Luke\'s sister. Had the Empire had anything like the NSA, it would have had all the data it needed, and it could have sweptup the droids and everyone else, and that would have been that.</em>&nbsp;“</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So, Is more information stored any better?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is an information taken out of context.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is individuals freedom and autonomy when we can’t escape from our past?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During an interview with the Wall Street Journal, Google’s CEO, Eric Schmidt, suggested that young people should be entitled to change their identity once achieved 21 years of age to escape their youth mistakes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He adds : ”<em>I don\'t believe society understands what happens when everything is available, knowable and recorded by everyone all the time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>So, is taking a new identity a realistic option?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is one other place where users are encouraged to share their day to day stories, their feelings and their believes. Users profiles were exploited by Cambridge Analytica to manipulate electoral votes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More worrying, Facebook does not respect the multi layers of our personality by storing all in one place. No more free speech nor modular language between levels of relationships.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the past, people will write diaries. Today, it’s been replaced by online blogs or social media platforms where people reveal most intimates details of their life.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And incidentally the live of their family, friends, co-workers, everyone, posted online for the eternity.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>50% of blogs are from children under&nbsp;the age of 18.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The generation Google, as Daniel Solove calls it , has its memories engaged for ever.&nbsp;A childhood that will follow them for ever, for the leisure of Google to bring back every piece of memories.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Forgetting is not forgiving. It’s a salutatory purge of our brain. it’s mostly random purge.</strong>&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe have you heard of Neuralink, a revolutionary project funded by Elon Musk.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Elon Musk&nbsp;is the American multibillionaire CEO of Tesla electric cars, the inventor of the fabulous solar roof tiles. He even projects to colonise the Planet Mars.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The richest man in the world according to Forbes magazine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>His Neuralink project aims to reduce social inequalities by boosting cognitive capacities.&nbsp;A project to implant Computer interfaces in the brain of disadvantage populations, as he believes they lack intelligence. A theory supported by the French Dr Laurent Alexandre believing high IQ is key to success. A whole utopia of transhumanism.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Give them extra brain processing and you’ll resolve the issues of poverty!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Adding memory :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Now, lets look at a little story told by Jean-Gabriel Ganascia :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A little girl, Adele, asks her grand mother Juliette :&nbsp;<em>Grand’ma, what does it mean a ‘recitation’&nbsp;</em>? The Grand’ma vaguely remembers that early Twenty-One century, people had to read and read again to memorise poetry or other texts. Adele lives in 2075. She has no idea of that.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Neuralink has resolved the memory issue.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, Elon Musk, has borrowed his idea from NEURALIFE in ‘<em>Tomorrow and Beyond</em>’, Science fiction book by Ian Bronx.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The little girl is curious to know if this learning by heart process was any painful. The grand’ma says : ‘<em>no, we just had to read and read again to memorise, not to forget.</em>&nbsp;‘&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The little girl has no idea what forget means.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Jean-Gabriel Ganascia, who tells this science fiction story, is a professor of Computer Science and a French Philosopher. He is the President of the Ethics committee at the French Research Center, CNRS. His research is particularly focused on Ethics and Artificial Intelligence.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In France, patients are already treated by deep electronic simulations of the brain to treat the symptoms of Parkinson disease.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Now, imagine having an astonishing memory to record and remember everything, including every dream, every single detail of your life.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Well, near 80 people around the world today have&nbsp;naturally this biological capability.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Actually, they suffer, they suffer from Hypermnesia disorder. They permanently keep a perfect memory of their life. They virtually remember every minor event most people would forget within days.&nbsp;The memory for them is so vivid, they can feel the pain for ever once recorded. Every painful image they see remains engraved in their brain.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Imagine the nightmare they live.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Without forgetting, we are haunted by the past without the ability to forgive or decide in present</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If Neuralink project was to go ahead, it needed a delete button.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And here is the big question : Who can decide to select and delete one’s memories ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Before Neuralink, we are the first generations to have big parts of our lives permanently, digitally recorded.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google aggregate and bring up in a click all crumbs of information to re-compose the puzzle of our life.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What the right to be forgotten can do?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The so called Right to be Forgotten created by the European Court of Justice is not deleting the information but only de-linking the content by the search engine Google.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Under specific circumstances a right to delete has been introduced by the the recent European Regulation for the protection of personal data. But that is for a very small parcel of our sparse available information.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Since its creation 20 years ago, Google has been collecting a mass of data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google knows more about each of us than we know ourself.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The new global&nbsp;Panoptican society of invisible surveillance is treat to human freedom and dignity.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remembering has long been human’s dream. However, forgetting is a biological capacity. Today there is a shift. From biological forgetting we have moved to digital remembering.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Naturally, Memory is the exception, forgetting the default</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Digitally, Remembering has become the default, forgetting the exception.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Human health and wellness is based on the balance between memory and forgetfulness.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Leaves on trees take the colours of the autumn to fall. Gradually, they join the soil to enrich its nutrients. This putrefaction is what later allows the birth of new lives.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A transmutation the epigenetic is starting to see in human DNA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We need to forget to better remember.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Awareness gives the ability to balance the pros and cons. To be aware is not being scared.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the risk to post it online for the eternity ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>How best to protect our privacy?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>How to bring transparency and control for better privacy ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are the options of our future, the future of our children.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Which kind of society we want for them ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To protect against unforeseen future, it’s better to store less than more.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Let us remember to forget, to borrow VMS words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further reading :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">Life Under Digits</a></li><li><a href=\"http://keeping%20an%20eye/\" target=\"_blank\" rel=\"noreferrer noopener\">Keeping an Eye</a></li><li><a href=\"https://www.linkedin.com/pulse/drones-autonomus-cars-ethics-regulation-tara-taubman-bassirian/\" target=\"_blank\" rel=\"noreferrer noopener\">Drones, Autonomous Cars Ethics and Regulation</a></li><li><a href=\"https://www.linkedin.com/pulse/challenges-artificial-intelligence-france-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">France Initiatives to Tackle the Challenges of Artificial Intelligence</a></li><li><a href=\"https://www.linkedin.com/pulse/video-surveillance-technology-tara-taubman-bassirian/\" target=\"_blank\" rel=\"noreferrer noopener\">Wearable Cameras</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->','Why Privacy Matters','','inherit','closed','closed','','14-revision-v1','','','2019-01-22 12:20:51','2019-01-22 12:20:51','',14,'http://datarainbow.eu/2019/01/22/14-revision-v1/',0,'revision','',0),(98,5,'2019-01-22 12:38:35','2019-01-22 12:38:35','','Screenshot 2019-01-22 at 12.34.53','','inherit','open','closed','','screenshot-2019-01-22-at-12-34-53','','','2019-01-22 12:38:35','2019-01-22 12:38:35','',29,'/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-22-at-12.34.53.png',0,'attachment','image/png',0),(99,5,'2019-01-22 12:39:31','2019-01-22 12:39:31','<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/privacyday\">A curation of various resources </a> to give a whole picture of Privacy and Data Protection that goes far above the GDPR. The Pearltrees are a work in progress with links, notes and editorials.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":98} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-22-at-12.34.53-1024x591.png\" alt=\"\" class=\"wp-image-98\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>WARNING</strong> : this is an external link  to a free App that collects personal data. Do adjust your privacy settings and clear your cookies history.</p>\n<!-- /wp:paragraph -->','Privacy Day Pearltrees','','inherit','closed','closed','','29-revision-v1','','','2019-01-22 12:39:31','2019-01-22 12:39:31','',29,'http://datarainbow.eu/2019/01/22/29-revision-v1/',0,'revision','',0),(101,5,'2019-01-22 12:48:08','2019-01-22 12:48:08','{{unknown}}','','','publish','closed','closed','','5fd99927d555709760dffaf307965c07','','','2019-01-22 12:48:08','2019-01-22 12:48:08','',0,'http://datarainbow.eu/2019/01/22/5fd99927d555709760dffaf307965c07/',0,'oembed_cache','',0),(102,5,'2019-01-22 12:58:03','2019-01-22 12:58:03','<!-- wp:paragraph -->\n<p>by MC PÉROUX, LL. M January 14, 2019 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> <strong>WHY PRIVACY BY DESIGN UNDER THE GDPR IS IMPORTANT FOR COMPANIES 1 </strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A QUICK RECAP OF THE 7 FOUNDATIONAL PRINCIPLES 2<br>\nThey have been developed and conceptualised since the 90’s by Ann Cavoukian, Ph.D., and\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>for the first time, a mandatory legal text has included its tenets, the GDPR.\n1. Proactive not Reactive; Preventative not Remedial\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>è purpose limitation (GDPR, art 5-1 b), data minimisation (GDPR, art 5-1 c))\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. PrivacyastheDefaultSetting\n3. Privacy Embedded into Design\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>è GDPR, art 25\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>4. FullFunctionality-Positive-Sum,notZero-Sum<br> “Privacy by Design avoids the pretense of false dichotomies, such as privacy vs. security, demonstrating that it is possible to have both. “ 3 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>è See the current discussions on different business models of free information services\naccessibility without a paywall (personal information given of exchange of free\ninformation) 4\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1 More details on PBD “Privacy and security by design, data security, and GDPR compliance “,\nMC Péroux, dec.12, 2018 on LinkedIn\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“ https://www.linkedin.com/pulse/privacy-security-design-data-gdpr-compliance-marie-\nclaire-p%C3%A9roux/<br>\n2 Privacy By Design The 7 Foundational Principles- January 2011 https://www.ipc.on.ca/wp-\ncontent/uploads/resources/7foundationalprinciples.pdf<br>\n3 Ibid.<br>\n4 “Austrian DPA Issues Decision on Validity of Cookie Consent Solution“ , Hunton Andrews\nKurth LLP, Posted on January 7, 2019,\nhttps://www.huntonprivacyblog.com/2019/01/07/austrian-dpa-issues-decision-on-validity-\nof-cookie-consent-solution/<br>\n“The differing approaches taken by the Austrian DPA and the UK ICO demonstrates a\nlack of alignment on this issue, and it remains to be seen how other DPAs will decide\non the issue “\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>5. End-to-End Security - Full Lifecycle Protection<br>\nè GDPR: art 5-1 f), art 25 and art 32 (“ level of security appropriate to the risk “)\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>6. VisibilityandTransparency-KeepitOpen\nè Accountability, GDPR art 5-2, art12\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>7. RespectforUserPrivacy-KeepitUser-Centric<br>\nè Accuracy GDPR art 5-1 d), Rights of the Data Subjects, GDPR Chapter III\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>WHY SHOULD COMPANIES REALISE THE IMPORTANCE OF PRIVACY BY DESIGN ?\nThe GDPR introduces a change in paradigm.\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is not centered on the processors but on the individuals’ fundamental rights. 5<br>\nThe gauge to assess an envisaged personal treatment remains the risk it represents to the\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>data subjects’ fundamental rights, the right to privacy being one of them.\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>NO RIGHT IS ABSOLUTE AND THE GDPR IS A BALANCING ACT BETWEEN THE RIGHT TO\nPRIVACY AND OTHER RIGHTS\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the current issue on the right to erasure (art 17) where the CJEU Attorney General, M.\nMaciej Szpunar, recommends a limitation of this rights balancing it with the right to\ninformation:\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>§57 “ En revanche, et c’est en quelque sorte le nœud de la présente affaire, le<br>\n« droit à l’oubli » doit être mis en balance avec d’autres droits fondamentaux. “ 6\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When designing any process on personal data the very first question of the processor should\nbe “do I respect and embed the fundamental rights of the persons when I use their personal\ndata? “\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>5 Charter of Fundamental Rights of the European Union, art 8(1)\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:embed {\"url\":\"http://www.europarl.europa.eu/charter/pdf/text_en.pdf\"} -->\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttp://www.europarl.europa.eu/charter/pdf/text_en.pdf\n</div></figure>\n<!-- /wp:embed -->\n\n<!-- wp:paragraph -->\n<p>6 In French, Conclusions de l’avocat général M. Maciej Szpunar présentées le 10 janvier 2019,\nAffaire C-507/17, Google LLC, venant aux droits de Google Inc. Contre Commission\nnationale de l’informatique et des libertés (CNIL),\nhttp://curia.europa.eu/juris/celex.jsf?celex=62017CC0507&amp;lang1=fr&amp;lang2=EN&amp;type=TXT\n&amp;ancre=\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I know this is still too rare an attitude especially among the internet personal data giants like\nthe (in)famous GAFAM 7.<br>\nTheir entire business model is based on the gathering of as much personal data (under the\nGDPR extensive definition) as possible with too often very deceptive opaque methods.\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>NEW TRENDS AMONG COMPANIES PROCESSING PERSONAL DATA\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some companies, more forward looking, realise that the users, real persons with real interest\nin protecting their physical life from intrusive data hogging methods, demand that something\nhas to change in the handling of their private information.\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have perhaps understood the general move towards more respect for the individuals’\nprivacy.\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Look at the legal trend towards the respect of private information from the upcoming\nCalifornian Legislation 8, the success of Convention108 in bringing privacy considerations\ninto many jurisdictions 9, even the president of Apple, Tim Cook, is asking for a legislation on\nprivacy 10\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>At the recent 2019 edition of the CES, privacy made an entrance but it remains to be seen\nwhether the companies do really apply Privacy By Design or if they are just surfing on the\ntrends.\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>7 GOOGLE, AMAZON, FACEBOOK, APPLE, MICROSOFT<br>\n8 AB-375 Privacy: personal information: businesses. (2017-2018), Assembly Bill No. 375\nCHAPTER 55, An act to add Title 1.81.5 (commencing with Section 1798.100) to Part 4 of\nDivision 3 of the Civil Code, relating to privacy. [Approved by Governor June 28, 2018. Filed\nwith Secretary of State June 28, 2018.]\nhttps://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375<br>\n9 Convention for the Protection of Individuals with regard to Automatic Processing of\nPersonal Data, Strasbourg, 28.I.1981, “This Convention is the first binding international\ninstrument which protects the individual against abuses which may accompany the collection\nand processing of personal data and which seeks to regulate at the same time the\ntransfrontier flow of personal data. “ https://www.coe.int/fr/web/conventions/full-list/-\n/conventions/rms/0900001680078b37<br>\n10 “This Is Surveillance.\' Apple CEO Tim Cook Slams Tech Rivals Over Data Collection“ “\nCook also reiterated calls for federal privacy laws in the U.S., similar to those unveiled in\nEurope, called the General Data Protection Regulation.“ Natalia Drozdiak and Stephanie\nBodoni / Bloomberg October 24, 2018 via TIME, http://time.com/5433499/tim-cook-\napple-data-privacy/\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Too often, companies with a business model based on processing personal data or selling\nsoftware allowing it, announce that they are “100% GDPR compliant “ but when one looks\nmore into the process they use, it is clear that the GDPR principles have been overlooked or\ninterpreted wrongly... 11\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the other end of the spectrum, one finds even some American companies that\ncommunicate on privacy as a feature embedded from the start in their business model.\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example:<br>\nInfo: I have no affiliation, no interest in the companies, I do not endorse their products\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>èHUMU12<br>\nAlthough I do not like behavioural analysis in general, finding it extremely invasive on privacy,\nthis company’s communication seems ahead of others on Privacy By Design<br>\n“That’s why we built with the GDPR in mind from day one, and we extend the rights from the\nGDPR to every user no matter where in the world they live. This includes transparency,\ncontrol, and data portability. “ 13\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>èSNIPS14<br>\n“Snips Global Communications Director Genia Shipova said the focus on privacy by design is\nwhat makes Snips a GDPR-friendly solution. » She said Snips wants to avoid data-centric\nbusiness models used by larger tech companies by focusing on contracts with its\ncustomers.“ 15\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>èQ-BranchLabs16 andtheirVektor17 product<br>\n\" We start with the assumption that everything we send out of this device has to be GDPR-\ncleared. We just don\'t want to deal with the problems. All of the logs and security alerts that\nwe send out, we still rip out all of the private information.\" Says the founder Jim McCoy 18\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>11 An example among many “How did we get here? “Twitter feed @_gaeel_\nhttps://twitter.com/_gaeel_/status/1082702284746883072<br>\n12 https://humu.com/<br>\n13 “Data Privacy at Humu: Building Systems for Trust to Make Work Better “, January 9,\n2019, Bryan Zimmer https://humu.com/2019/01/09/humu-data-privacy-trust-iso-soc/\n14 https://snips.ai/\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>15 “CES 2019: GDPR talk fills halls of Eureka Park “, Ryan Chiavetta, CIPP/US, Jan.9, 2019,\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>https://iapp.org/news/a/ces-2019-gdpr-talk-fills-halls-of-eureka-park/\n16 https://www.q-branch.net/index_d/<br>\n17 https://getvektor.com/<br>\n18 Above note 15\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>4\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>è OEKON SAS and its device ASK-HARROLD 19 developed in France\nBased on an AI that searches for you information on Internet\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CONCLUSION\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I hope that companies realise how important it is to understand the principles to protect and\nrespect the ever-growing mass of personal data they handle. They could start reading Art 5\nof the GDPR relating to its founding principles.\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To respect Privacy By Design is just to respect the persons at the end of the process.\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>\n							Maybe by showing respect, some companies could even gain trust from their\ncustomers.\n\n						</li><li>\n							Place yourself in the shoes of the person when you design any personal data\ntreatment.\n\n						</li><li>\n							Imagine that this person is someone important to you and see how it really feels to\nyou that her personal data, her life, is processed by your envisaged treatment.\n\n						</li><li>\n							Educate the developers to the values of privacy during their studies.\n\n						</li><li>\n							Hire people who understand the value of their own privacy to develop your processes.\n\n							Yes business is important but ethics, respect should not be lost.\n\n							A person who trusts a company’s handling of her data will give the information needed, it is\na trust that companies should gain, not steel away by opaque processes and algorithms.\n\n							MC PÉROUX, LL. M<br>\nBlog in French to SMB’s to understand privacy https://mementosafe.com/\nLinkedIn<br>\nTwitter\n\n						</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>19 http://minim-e.com/ and https://play.google.com/store/apps/details?id=fr.oekon.harold\nhttps://itunes.apple.com/us/app/ask-harold/id1332599364\n</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>5\n</p>\n<!-- /wp:paragraph -->','PRIVACY BY DESIGN AND BY DEFAULT UNDER THE GDPR','','inherit','closed','closed','','16-revision-v1','','','2019-01-22 12:58:03','2019-01-22 12:58:03','',16,'http://datarainbow.eu/2019/01/22/16-revision-v1/',0,'revision','',0),(103,5,'2019-01-22 13:18:12','2019-01-22 13:18:12','<!-- wp:paragraph -->\n<p>While this site is under construction, the big news of the French Data Protection Authority, CNIL, <a href=\"https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc\">fining Google 50 Million Euros </a> came.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://edpb.europa.eu/news/national-news/2019/cnils-restricted-committee-imposes-financial-penalty-50-million-euros_en\">European Data Protection Board summary </a>explains how the CNIL has played the role of the lead authority to investigate the class actions filed by the Austrian <a href=\"https://noyb.eu/\">Non Of Your Business, NOYB</a>, and the French <a href=\"https://www.laquadrature.net/en/personnal-data/\">La Quadrature Du Net</a>. \'L\'Europe est en marche\' - Europe is leading - and the Union is enforcing its capabilities. Britain will be missed after Brexit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Today, January the 22nd is the day the <a href=\"https://www.voiceamerica.com/promo/episode/112620\">Radio interview of Tara Taubman-Bassirian</a>, voted Privacy Hero 2018, is being broadcasted by Voice of America Business, so tune in.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><a target=\"_blank\" href=\"https://www.voiceamerica.com/guest/42903/tara-taubman-bassirian\" rel=\"noreferrer noopener\">Tara Taubman-Bassirian</a></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>Episode Description</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><em>2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, with Rebecca.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the <strong>International Privacy Day</strong> on January the 28th. A <strong>TwitterChat at 3pm Eas</strong>t using the hashtag <strong>#PrivacyAware</strong> with help of Kingston Technology. A <strong>drink in a pub in London</strong> from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','NEWS','','inherit','closed','closed','','65-revision-v1','','','2019-01-22 13:18:12','2019-01-22 13:18:12','',65,'http://datarainbow.eu/2019/01/22/65-revision-v1/',0,'revision','',0),(104,5,'2019-01-22 13:20:17','2019-01-22 13:20:17','<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/privacyday\">A curation of various resources </a> to give a whole picture of Privacy and Data Protection that goes far above the GDPR, from a global perspective. The Pearltrees are a work in progress with links, notes and editorials.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":98} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-22-at-12.34.53-1024x591.png\" alt=\"\" class=\"wp-image-98\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>WARNING</strong> : this is an external link  to a free App that collects personal data. Do adjust your privacy settings and clear your cookies history.</p>\n<!-- /wp:paragraph -->','Privacy Day Pearltrees','','inherit','closed','closed','','29-revision-v1','','','2019-01-22 13:20:17','2019-01-22 13:20:17','',29,'http://datarainbow.eu/2019/01/22/29-revision-v1/',0,'revision','',0),(106,5,'2019-01-22 13:23:31','2019-01-22 13:23:31','','Screenshot 2019-01-22 at 13.22.25','','inherit','open','closed','','screenshot-2019-01-22-at-13-22-25','','','2019-01-22 13:23:31','2019-01-22 13:23:31','',29,'/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-22-at-13.22.25.png',0,'attachment','image/png',0),(107,5,'2019-01-22 13:23:53','2019-01-22 13:23:53','<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/privacyday\">A curation of various resources </a> to give a whole picture of Privacy and Data Protection that goes far above the GDPR, from a global perspective. The Pearltrees are a work in progress with links, notes and editorials.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":106} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-22-at-13.22.25-1024x607.png\" alt=\"\" class=\"wp-image-106\" /><figcaption>PrivacyDay Pearltrees</figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>WARNING</strong> : this is an external link  to a free App that collects personal data. Do adjust your privacy settings and clear your cookies history.</p>\n<!-- /wp:paragraph -->','Privacy Day Pearltrees','','inherit','closed','closed','','29-revision-v1','','','2019-01-22 13:23:53','2019-01-22 13:23:53','',29,'http://datarainbow.eu/2019/01/22/29-revision-v1/',0,'revision','',0),(109,5,'2019-01-22 14:24:01','2019-01-22 14:24:01','<!-- wp:paragraph -->\n<p>While this site is under construction, the big news of the French Data Protection Authority, CNIL, <a href=\"https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc\">fining Google 50 Million Euros </a> came.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://edpb.europa.eu/news/national-news/2019/cnils-restricted-committee-imposes-financial-penalty-50-million-euros_en\">European Data Protection Board summary </a>explains how the CNIL has played the role of the lead authority to investigate the class actions filed by the Austrian <a href=\"https://noyb.eu/\">Non Of Your Business, NOYB</a>, and the French <a href=\"https://www.laquadrature.net/en/personnal-data/\">La Quadrature Du Net</a>. \'L\'Europe est en marche\' - Europe is leading - and the Union is enforcing its capabilities. Britain will be missed after Brexit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>After Google, here comes Facebook : <a href=\"https://www.lesoir.be/140480/article/2018-02-16/protection-des-donnees-privees-la-belgique-fait-plier-facebook\">A Belgian court injonction to Facebook</a> to stop his illegal collect of personal data in an 80 pages decision. 250.000 € maximum de 100 millions d’euros for everyday they dont comply. Things are acceleration. If you havent yet seen the French CNIL Google fine, have a look and make sure your organisation is compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Today, January the 22nd is the day the <a href=\"https://www.voiceamerica.com/promo/episode/112620\">Radio interview of Tara Taubman-Bassirian</a>, voted Privacy Hero 2018, is being broadcasted by Voice of America Business, so tune in.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><a target=\"_blank\" href=\"https://www.voiceamerica.com/guest/42903/tara-taubman-bassirian\" rel=\"noreferrer noopener\">Tara Taubman-Bassirian</a></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>Episode Description</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><em>2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, with Rebecca.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the <strong>International Privacy Day</strong> on January the 28th. A <strong>TwitterChat at 3pm Eas</strong>t using the hashtag <strong>#PrivacyAware</strong> with help of Kingston Technology. A <strong>drink in a pub in London</strong> from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','NEWS','','inherit','closed','closed','','65-revision-v1','','','2019-01-22 14:24:01','2019-01-22 14:24:01','',65,'http://datarainbow.eu/2019/01/22/65-revision-v1/',0,'revision','',0),(111,5,'2019-01-22 14:43:29','2019-01-22 14:43:29','<!-- wp:paragraph -->\n<p>Why DATARAINBOW ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":83,\"width\":688,\"height\":439} -->\n<figure class=\"wp-block-image is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-1.png\" alt=\"\" class=\"wp-image-83\" width=\"688\" height=\"439\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ....</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Who created DATARAINBOW ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, is a French Lawyer based in the UK who has studied private law at the prestigious Paris University Pantheon Assas, before specialising on Computer and Communication Law at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN\'s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group <a href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a> with <a href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->','About','','inherit','closed','closed','','31-revision-v1','','','2019-01-22 14:43:29','2019-01-22 14:43:29','',31,'http://datarainbow.eu/2019/01/22/31-revision-v1/',0,'revision','',0),(112,5,'2019-01-22 14:52:47','2019-01-22 14:52:47','<!-- wp:paragraph -->\n<p>We are working on building a privacy compliant website. The SSL security certificate is soon to come.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So far we have not used many tracking cookies. we are trying our best to not allow third parties to track our visitors by cookies or by Java Script embeded code. It\'s hard job. We might lose traffic and SEO. Help us by spreading the word. If you see anything suspicious, lets us know.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We believe our visitors deserve protection and privacy. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want your trust.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":78} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-22-at-11.16.16-1024x415.png\" alt=\"\" class=\"wp-image-78\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>This website has been built with the support and help of <a href=\"https://baycloud.com/\">BayCloud.&nbsp;</a> They exceptionally provided the WordPress template and the hosting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We are very grateful for their hosting of this website. Here is what you can find on BayCloud website :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Back in May 2011 Baycloud Systems introduced the original tool for helping websites comply with Do-Not-Track and the Data Protection and ePrivacy Directives, backed by a cost-effective and exhaustive website auditing service.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Fast track to 2017 and we are now the leading provider to multi-national companies of multi-language and multi-compliance systems, capable of actively managing the users\'s terminal storage in a secure way, not only to protect website visitors’ personal data but also clearly giving them control over its collection and use.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The Baycloud Consent Platform manages the consent request process, presenting information on usage commitments and user benefits in any language, with a per-site customised user experience and ensuring their choice is continuously available. We ensure that tracking and storage consent policies are properly adhered to, with users\' consent capable of being revoked at any time and automatically after a configurable \"sunset\" period.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Baycloud was the first universal ePrivacy consent platform, and has, since 2011, focused on real user choice, actively managing first-party cookies and tracking third-parties. This means our technology has been honed and further developed through continuous use on thousands of major brand websites over many years, giving us an unquestioned lead in this space.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>We believe that publishers and brands that respect and offer a straightforward choice to their customers will earn their trust and loyalty.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":75} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-22-at-11.14.49-1024x429.png\" alt=\"\" class=\"wp-image-75\" /></figure>\n<!-- /wp:image -->','Privacy Notice','','inherit','closed','closed','','33-revision-v1','','','2019-01-22 14:52:47','2019-01-22 14:52:47','',33,'http://datarainbow.eu/2019/01/22/33-revision-v1/',0,'revision','',0),(114,5,'2019-01-22 15:13:13','2019-01-22 15:13:13','','Screenshot 2019-01-22 at 12.04.25','','inherit','open','closed','','screenshot-2019-01-22-at-12-04-25-2','','','2019-01-22 15:13:13','2019-01-22 15:13:13','',33,'/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-22-at-12.04.25-1.png',0,'attachment','image/png',0),(116,5,'2019-01-22 15:14:24','2019-01-22 15:14:24','','Screenshot 2019-01-21 at 14.52.01','','inherit','open','closed','','screenshot-2019-01-21-at-14-52-01-3','','','2019-01-22 15:14:24','2019-01-22 15:14:24','',33,'/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-2.png',0,'attachment','image/png',0),(117,5,'2019-01-22 15:15:15','2019-01-22 15:15:15','<!-- wp:paragraph -->\n<p>We are working on building a privacy compliant website. The SSL security certificate is soon to come.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":116,\"align\":\"left\",\"width\":360,\"height\":230} -->\n<div class=\"wp-block-image\"><figure class=\"alignleft is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-2.png\" alt=\"\" class=\"wp-image-116\" width=\"360\" height=\"230\" /></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>So far we have not used many tracking cookies. we are trying our best to not allow third parties to track our visitors by cookies or by Java Script embeded code. It\'s hard job. We might lose traffic and SEO. Help us by spreading the word. If you see anything suspicious, lets us know.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We believe our visitors deserve protection and privacy. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want your trust.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":78} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-22-at-11.16.16-1024x415.png\" alt=\"\" class=\"wp-image-78\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>This website has been built with the support and help of <a href=\"https://baycloud.com/\">BayCloud.&nbsp;</a> They exceptionally provided the WordPress template and the hosting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We are very grateful for their hosting of this website. Here is what you can find on BayCloud website :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Back in May 2011 Baycloud Systems introduced the original tool for helping websites comply with Do-Not-Track and the Data Protection and ePrivacy Directives, backed by a cost-effective and exhaustive website auditing service.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Fast track to 2017 and we are now the leading provider to multi-national companies of multi-language and multi-compliance systems, capable of actively managing the users\'s terminal storage in a secure way, not only to protect website visitors’ personal data but also clearly giving them control over its collection and use.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The Baycloud Consent Platform manages the consent request process, presenting information on usage commitments and user benefits in any language, with a per-site customised user experience and ensuring their choice is continuously available. We ensure that tracking and storage consent policies are properly adhered to, with users\' consent capable of being revoked at any time and automatically after a configurable \"sunset\" period.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Baycloud was the first universal ePrivacy consent platform, and has, since 2011, focused on real user choice, actively managing first-party cookies and tracking third-parties. This means our technology has been honed and further developed through continuous use on thousands of major brand websites over many years, giving us an unquestioned lead in this space.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>We believe that publishers and brands that respect and offer a straightforward choice to their customers will earn their trust and loyalty.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":75} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-22-at-11.14.49-1024x429.png\" alt=\"\" class=\"wp-image-75\" /></figure>\n<!-- /wp:image -->','Privacy Notice','','inherit','closed','closed','','33-revision-v1','','','2019-01-22 15:15:15','2019-01-22 15:15:15','',33,'http://datarainbow.eu/2019/01/22/33-revision-v1/',0,'revision','',0),(120,5,'2019-01-22 15:16:46','2019-01-22 15:16:46','<!-- wp:paragraph -->\n<p>While this site is under construction, the big news of the French Data Protection Authority, CNIL, <a href=\"https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc\">fining Google 50 Million Euros </a> came.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":118,\"align\":\"left\",\"width\":416,\"height\":266} -->\n<div class=\"wp-block-image\"><figure class=\"alignleft is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-3.png\" alt=\"\" class=\"wp-image-118\" width=\"416\" height=\"266\" /></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://edpb.europa.eu/news/national-news/2019/cnils-restricted-committee-imposes-financial-penalty-50-million-euros_en\">European Data Protection Board summary </a>explains how the CNIL has played the role of the lead authority to investigate the class actions filed by the Austrian <a href=\"https://noyb.eu/\">Non Of Your Business, NOYB</a>, and the French <a href=\"https://www.laquadrature.net/en/personnal-data/\">La Quadrature Du Net</a>. \'L\'Europe est en marche\' - Europe is leading - and the Union is enforcing its capabilities. Britain will be missed after Brexit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>After Google, here comes Facebook : <a href=\"https://www.lesoir.be/140480/article/2018-02-16/protection-des-donnees-privees-la-belgique-fait-plier-facebook\">A Belgian court injonction to Facebook</a> to stop his illegal collect of personal data in an 80 pages decision. 250.000 € maximum de 100 millions d’euros for everyday they dont comply. Things are acceleration. If you havent yet seen the French CNIL Google fine, have a look and make sure your organisation is compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Today, January the 22nd is the day the <a href=\"https://www.voiceamerica.com/promo/episode/112620\">Radio interview of Tara Taubman-Bassirian</a>, voted Privacy Hero 2018, is being broadcasted by Voice of America Business, so tune in.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><a target=\"_blank\" href=\"https://www.voiceamerica.com/guest/42903/tara-taubman-bassirian\" rel=\"noreferrer noopener\">Tara Taubman-Bassirian</a></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>Episode Description</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><em>2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, with Rebecca.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the <strong>International Privacy Day</strong> on January the 28th. A <strong>TwitterChat at 3pm Eas</strong>t using the hashtag <strong>#PrivacyAware</strong> with help of Kingston Technology. A <strong>drink in a pub in London</strong> from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->','NEWS','','inherit','closed','closed','','65-revision-v1','','','2019-01-22 15:16:46','2019-01-22 15:16:46','',65,'http://datarainbow.eu/2019/01/22/65-revision-v1/',0,'revision','',0),(121,5,'2019-01-22 15:17:30','2019-01-22 15:17:30','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":95,\"align\":\"left\",\"width\":439,\"height\":287} -->\n<div class=\"wp-block-image\"><figure class=\"alignleft is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-22-at-12.04.25.png\" alt=\"\" class=\"wp-image-95\" width=\"439\" height=\"287\" /></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>In “<a href=\"https://press.princeton.edu/titles/9436.html\">Delete : The Virtue of Forgetting in the Digital Age</a>”, <a href=\"https://www.oii.ox.ac.uk/people/viktor-ms/\">Viktor Mayer-Schonberger</a> from the <a href=\"https://cyber.harvard.edu/\">Berkman Klein Centre of Internet and Society</a>, exposes the permanent shadow that follows us online for ever. The issues of privacy and freedom that results and his suggested solution : auto-delete files or information expiry date.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Changing back the default setting from remembering to forgetting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The crumbs of information left behind, get aggregated and build a picture, sometimes distorted, that follows us.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to the theory of conservation of energy, data does have a deceptively long lifespan.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Nothing gets deleted.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Viktor Mayer-Schonberger points out, the German Stasi genocide project would have taken a whole different apocalyptic dimension had Google storage and data indexing existed at the time.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He mentions the case of the Dutch Citizens register put in place in the 1930s. To ensure the administration of social securities, it included religious and ethnicity. Once the nazi had occupied the Netherland, they exploited the register to identify jews to be deported and sent to concentration camps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Another major Privacy scholar, Professor Daniel Solove, has been actively raising awareness on privacy and the future of reputation online.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>His paper,&nbsp;<a href=\"http://ssrn.com/abstract=998565\" target=\"_blank\" rel=\"noreferrer noopener\">“I’ve Got Nothing to Hide,” and Other Misunderstandings of Privacy</a>,&nbsp;explains why privacy matters.&nbsp;He later expanded his ideas in the essay into a book:&nbsp;<a href=\"http://www.amazon.com/gp/product/0300172338\" target=\"_blank\" rel=\"noreferrer noopener\">Nothing to Hide: The False Tradeoff Between Privacy and Security</a>.&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you think The only people who should worry are those who are doing something immoral or illegal, you should read his essays and books. With the mass of omni-veillance data, the situation is not just Orwellian, but Kafkaesque.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a series of YouTube videos and conferences, Daniel Solove brings public attention to cases of online harassement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Dog Pooh girl is the story of an unlucky girl. She is with her dog in a suburban tube of South Korea. The dog poop on the train, she is on a hurry, she leaves the train refusing to clean up behind. In the old days, that would have been the end of it. Today, when face-to-face persuasion fails, there’s a fallback plan : anonymous Internet humiliation.&nbsp;The witness who recorded her with his smartphone, posted the shaming video online. Within days, her identity and her past were revealed. The video gets viral all around the world. Posters and all kinds of jokes were made. Media wrote about her.&nbsp;Even the US Washington Post wrote about her story.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>She eventually reached a fame she wished she did never achieved. For ever, the image will follow her. This girl will be called the Dog Pooh Girl.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Another illustration, The sad story of the the Star Wars Kid. A young chubby boy in Canada. He&nbsp;posted a video of himself online in his rather unsuccessful attempt to imitate George Lucas, the famous movie star. His video was watched by tens of millions of internautes who commented, and widely mocked his gesture. He was teased by the whole world.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A childhood incident that will follow him forever.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Daniel Solove questions the Future of Reputation in the digital age and how data can track you back.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He wrote : “<em>If the Empire in Star Wars Had Big Data, the Empire would have won. A search of records would have revealed where Luke Skywalker was living on Tatooine.&nbsp;A more efficient collection and aggregation of Jawa records would have located the droids immediately.&nbsp;Simple data analysis would have revealed that Ben Kenobi was really Obi Wan Kenobi. A search of birth records would have revealed that Princess Leia was Luke\'s sister. Had the Empire had anything like the NSA, it would have had all the data it needed, and it could have sweptup the droids and everyone else, and that would have been that.</em>&nbsp;“</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So, Is more information stored any better?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is an information taken out of context.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is individuals freedom and autonomy when we can’t escape from our past?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During an interview with the Wall Street Journal, Google’s CEO, Eric Schmidt, suggested that young people should be entitled to change their identity once achieved 21 years of age to escape their youth mistakes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He adds : ”<em>I don\'t believe society understands what happens when everything is available, knowable and recorded by everyone all the time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>So, is taking a new identity a realistic option?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is one other place where users are encouraged to share their day to day stories, their feelings and their believes. Users profiles were exploited by Cambridge Analytica to manipulate electoral votes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More worrying, Facebook does not respect the multi layers of our personality by storing all in one place. No more free speech nor modular language between levels of relationships.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the past, people will write diaries. Today, it’s been replaced by online blogs or social media platforms where people reveal most intimates details of their life.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And incidentally the live of their family, friends, co-workers, everyone, posted online for the eternity.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>50% of blogs are from children under&nbsp;the age of 18.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The generation Google, as Daniel Solove calls it , has its memories engaged for ever.&nbsp;A childhood that will follow them for ever, for the leisure of Google to bring back every piece of memories.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Forgetting is not forgiving. It’s a salutatory purge of our brain. it’s mostly random purge.</strong>&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe have you heard of Neuralink, a revolutionary project funded by Elon Musk.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Elon Musk&nbsp;is the American multibillionaire CEO of Tesla electric cars, the inventor of the fabulous solar roof tiles. He even projects to colonise the Planet Mars.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The richest man in the world according to Forbes magazine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>His Neuralink project aims to reduce social inequalities by boosting cognitive capacities.&nbsp;A project to implant Computer interfaces in the brain of disadvantage populations, as he believes they lack intelligence. A theory supported by the French Dr Laurent Alexandre believing high IQ is key to success. A whole utopia of transhumanism.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Give them extra brain processing and you’ll resolve the issues of poverty!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Adding memory :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Now, lets look at a little story told by Jean-Gabriel Ganascia :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A little girl, Adele, asks her grand mother Juliette :&nbsp;<em>Grand’ma, what does it mean a ‘recitation’&nbsp;</em>? The Grand’ma vaguely remembers that early Twenty-One century, people had to read and read again to memorise poetry or other texts. Adele lives in 2075. She has no idea of that.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Neuralink has resolved the memory issue.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, Elon Musk, has borrowed his idea from NEURALIFE in ‘<em>Tomorrow and Beyond</em>’, Science fiction book by Ian Bronx.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The little girl is curious to know if this learning by heart process was any painful. The grand’ma says : ‘<em>no, we just had to read and read again to memorise, not to forget.</em>&nbsp;‘&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The little girl has no idea what forget means.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Jean-Gabriel Ganascia, who tells this science fiction story, is a professor of Computer Science and a French Philosopher. He is the President of the Ethics committee at the French Research Center, CNRS. His research is particularly focused on Ethics and Artificial Intelligence.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In France, patients are already treated by deep electronic simulations of the brain to treat the symptoms of Parkinson disease.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Now, imagine having an astonishing memory to record and remember everything, including every dream, every single detail of your life.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Well, near 80 people around the world today have&nbsp;naturally this biological capability.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Actually, they suffer, they suffer from Hypermnesia disorder. They permanently keep a perfect memory of their life. They virtually remember every minor event most people would forget within days.&nbsp;The memory for them is so vivid, they can feel the pain for ever once recorded. Every painful image they see remains engraved in their brain.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Imagine the nightmare they live.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Without forgetting, we are haunted by the past without the ability to forgive or decide in present</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If Neuralink project was to go ahead, it needed a delete button.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And here is the big question : Who can decide to select and delete one’s memories ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Before Neuralink, we are the first generations to have big parts of our lives permanently, digitally recorded.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google aggregate and bring up in a click all crumbs of information to re-compose the puzzle of our life.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What the right to be forgotten can do?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The so called Right to be Forgotten created by the European Court of Justice is not deleting the information but only de-linking the content by the search engine Google.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Under specific circumstances a right to delete has been introduced by the the recent European Regulation for the protection of personal data. But that is for a very small parcel of our sparse available information.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Since its creation 20 years ago, Google has been collecting a mass of data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google knows more about each of us than we know ourself.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The new global&nbsp;Panoptican society of invisible surveillance is treat to human freedom and dignity.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remembering has long been human’s dream. However, forgetting is a biological capacity. Today there is a shift. From biological forgetting we have moved to digital remembering.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Naturally, Memory is the exception, forgetting the default</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Digitally, Remembering has become the default, forgetting the exception.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Human health and wellness is based on the balance between memory and forgetfulness.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Leaves on trees take the colours of the autumn to fall. Gradually, they join the soil to enrich its nutrients. This putrefaction is what later allows the birth of new lives.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A transmutation the epigenetic is starting to see in human DNA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We need to forget to better remember.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Awareness gives the ability to balance the pros and cons. To be aware is not being scared.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the risk to post it online for the eternity ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>How best to protect our privacy?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>How to bring transparency and control for better privacy ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are the options of our future, the future of our children.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Which kind of society we want for them ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To protect against unforeseen future, it’s better to store less than more.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Let us remember to forget, to borrow VMS words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further reading :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">Life Under Digits</a></li><li><a href=\"http://keeping%20an%20eye/\" target=\"_blank\" rel=\"noreferrer noopener\">Keeping an Eye</a></li><li><a href=\"https://www.linkedin.com/pulse/drones-autonomus-cars-ethics-regulation-tara-taubman-bassirian/\" target=\"_blank\" rel=\"noreferrer noopener\">Drones, Autonomous Cars Ethics and Regulation</a></li><li><a href=\"https://www.linkedin.com/pulse/challenges-artificial-intelligence-france-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">France Initiatives to Tackle the Challenges of Artificial Intelligence</a></li><li><a href=\"https://www.linkedin.com/pulse/video-surveillance-technology-tara-taubman-bassirian/\" target=\"_blank\" rel=\"noreferrer noopener\">Wearable Cameras</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->','Why Privacy Matters','','inherit','closed','closed','','14-revision-v1','','','2019-01-22 15:17:30','2019-01-22 15:17:30','',14,'http://datarainbow.eu/2019/01/22/14-revision-v1/',0,'revision','',0),(123,5,'2019-01-22 16:56:15','2019-01-22 16:56:15','<!-- wp:paragraph -->\n<p><a href=\"https://www.voiceamerica.com/promo/episode/112620\">Voice of America Radio Broadcast of Tara Taubman-Bassirian, LLM</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img src=\"http://datarainbow.eu/d017e822-5368-441a-8491-55972beac40c\" alt=\"\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":91} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-VoA-1.png\" alt=\"\" class=\"wp-image-91\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4><strong><a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">GDPR, Data Privacy Day and The Need for Privacy</a></strong></h4>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":5} -->\n<h5>January 22, 2019</h5>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":5} -->\n<h5>Hosted by Rebecca Herold</h5>\n<!-- /wp:heading -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>Guest Information</h4>\n<!-- /wp:heading -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><a target=\"_blank\" href=\"https://www.voiceamerica.com/guest/42903/tara-taubman-bassirian\" rel=\"noreferrer noopener\">Tara Taubman-Bassirian</a></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>Episode Description</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, with Rebecca.</p>\n<!-- /wp:paragraph -->','Spot on','','inherit','closed','closed','','45-revision-v1','','','2019-01-22 16:56:15','2019-01-22 16:56:15','',45,'http://datarainbow.eu/2019/01/22/45-revision-v1/',0,'revision','',0),(125,5,'2019-01-22 17:11:55','2019-01-22 17:11:55','<!-- wp:paragraph -->\n<p><strong>CELEBRATING THE PRIVACY DAY 2019</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Every 28th of January, <a href=\"https://en.wikipedia.org/wiki/Member_states_of_the_Council_of_Europe\">47 European countries</a> with the <a href=\"https://en.wikipedia.org/wiki/United_States\">United States</a>, <a href=\"https://en.wikipedia.org/wiki/Canada\">Canada</a>, <a href=\"https://en.wikipedia.org/wiki/India\">India</a> and  celebrate Data Privacy Day, which is designed to raise awareness of and generate discussion about data privacy rights and practices.  The purpose of Data Privacy Day is to raise awareness and promote privacy and data protection best practices. It is currently observed in the .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This year, they are few major reason to celebrate :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The EU GDPR Regulation entered into for on May 2018</li><li>Between other International Data Protection regulations, the California Consumers Protection Act.</li><li>The ‘Privacy Hero’ of the year vote for Tara Taubman-Bassirian&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the&nbsp;<strong>International Privacy Day</strong>&nbsp;on January the 28th. A&nbsp;<strong>TwitterChat at 3pm Eas</strong>t using the hashtag&nbsp;<strong>#PrivacyAware</strong>&nbsp;with help of Kingston Technology. A&nbsp;<strong>drink in a pub in London</strong>&nbsp;from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations.</p>\n<!-- /wp:paragraph -->','Privacy Day','','inherit','closed','closed','','35-revision-v1','','','2019-01-22 17:11:55','2019-01-22 17:11:55','',35,'http://datarainbow.eu/2019/01/22/35-revision-v1/',0,'revision','',0),(126,5,'2019-01-22 21:07:56','2019-01-22 21:07:56','<!-- wp:paragraph -->\n<p>by MC PÉROUX, LL. M January 14, 2019 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>WHY PRIVACY BY DESIGN UNDER THE GDPR IS IMPORTANT FOR COMPANIES&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>MC PÉROUX, LL. M</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>January 22, 2019</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A QUICK RECAP OF THE 7 FOUNDATIONAL PRINCIPLES&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have been developed and conceptualised since the 90’s by Ann Cavoukian, Ph.D., and for the first time, a mandatory legal text has included its tenets, the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li>Proactive not Reactive; Preventative not Remedial</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>➔ purpose limitation (GDPR, art 5-1 b), data minimisation (GDPR, art 5-1 c))</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li>Privacy as the Default Setting</li><li>Privacy Embedded into Design</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>➔ GDPR, art 25</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li>Full Functionality - Positive-Sum, not Zero-Sum</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>“Privacy by Design avoids the pretense of false dichotomies, such as privacy vs. security, demonstrating that it is possible to have both. “&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ See the current discussions on different business models of free information services accessibility without a paywall (personal information given of exchange of free information)&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li>End-to-End Security - Full Lifecycle Protection</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>➔ GDPR: art 5-1 f), art 25 and art 32 (“ level of security appropriate to the risk “)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li>Visibility and Transparency - Keep it Open</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>➔ Accountability, GDPR art 5-2, art12</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li>Respect for User Privacy - Keep it User-Centric</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>➔ Accuracy GDPR art 5-1 d), Rights of the Data Subjects, GDPR Chapter III</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>WHY SHOULD COMPANIES REALISE THE IMPORTANCE OF PRIVACY BY DESIGN ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR introduces a change in paradigm.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is not centered on the processors but on the individuals’ fundamental rights.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The gauge to assess an envisaged personal treatment remains the risk it represents to the data subjects’ fundamental rights, the right to privacy being one of them.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>NO RIGHT IS ABSOLUTE AND THE GDPR IS A BALANCING ACT BETWEEN THE RIGHT TO PRIVACY AND OTHER RIGHTS</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the current issue on the right to erasure (art 17) where the CJEU Attorney General, M. Maciej Szpunar, recommends a limitation of this rights balancing it with the right to information:&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>§57 “ En revanche, et c’est en quelque sorte le nœud de la présente affaire, le</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>&nbsp;« droit à l’oubli » doit être mis en balance avec d’autres droits fondamentaux. “&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When designing any process on personal data the very first question of the processor should be “do I respect and embed the fundamental rights of the persons when I use their personal data? “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I know this is still too rare an attitude especially among the internet personal data giants like the (in)famous GAFAM .&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Their entire business model is based on the gathering of as much personal data (under the GDPR extensive definition) as possible with too often very deceptive opaque methods.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>NEW TRENDS AMONG COMPANIES PROCESSING PERSONAL DATA&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some companies, more forward looking, realise that the users, real persons with real interest in protecting their physical life from intrusive data hogging methods, demand that something has to change in the handling of their private information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have perhaps understood the general move towards more respect for the individuals’ privacy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Look at the legal trend towards the respect of private information from the upcoming Californian Legislation , the success of Convention108 in bringing privacy considerations into many jurisdictions , even the president of Apple, Tim Cook, is asking for a legislation on privacy&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>At the recent 2019 edition of the CES, privacy made an entrance but it remains to be seen whether the companies do really apply Privacy By Design or if they are just surfing on the trends.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Too often, companies with a business model based on processing personal data or selling software allowing it, announce that they are “100% GDPR compliant “ but when one looks more into the process they use, it is clear that the GDPR principles have been overlooked or interpreted wrongly…&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the other end of the spectrum, one finds even some American companies that communicate on privacy as a feature embedded from the start in their business model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example:&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Info: I have no affiliation, no interest in the companies, I do not endorse their products</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ HUMU&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although I do not like behavioural analysis in general, finding it extremely invasive on privacy, this company’s communication seems ahead of others on Privacy By Design &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“That’s why we built with the GDPR in mind from day one, and we extend the rights from the GDPR to every user no matter where in the world they live. This includes transparency, control, and data portability. “&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ SNIPS&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“Snips Global Communications Director Genia Shipova said the focus on privacy by design is what makes Snips a GDPR-friendly solution. »&nbsp; She said Snips wants to avoid data-centric business models used by larger tech companies by focusing on contracts with its customers.“&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ Q-Branch Labs&nbsp; and their Vektor&nbsp; product</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\" We start with the assumption that everything we send out of this device has to be GDPR-cleared. We just don\'t want to deal with the problems. All of the logs and security alerts that we send out, we still rip out all of the private information.\" Says the founder Jim McCoy&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ OEKON SAS and its device ASK-HARROLD&nbsp; developed in France&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on an AI that searches for you information on Internet</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CONCLUSION</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I hope that companies realise how important it is to understand the principles to protect and respect the ever-growing mass of personal data they handle. They could start reading Art 5 of the GDPR relating to its founding principles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google just learned the hard way what Privacy By Design means for the French DPA, the CNIL.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its last decision,&nbsp; the CNIL clearly states that the users are not properly informed before consenting due to the numerous steps they have to take in order to find information in the process. The decision is a lesson on what is bad and opaque design to lure the users to consent to vague descriptions of processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To respect Privacy By Design is just to respect the persons at the end of the process.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Maybe by showing respect, some companies could even gain trust from their customers.</li><li>Place yourself in the shoes of the person when you design any personal data treatment.</li><li>Imagine that this person is someone important to you and see how it really feels to you that her personal data, her life, is processed by your envisaged treatment.</li><li>Educate the developers to the values of privacy during their studies.</li><li>Hire people who understand the value of their own privacy to develop your processes.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Yes business is important but ethics, respect should not be lost.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A person who trusts a company’s handling of her data will give the information needed, it is a trust that companies should gain, not steel away by opaque processes and algorithms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>MC PÉROUX, LL. M</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Blog in French to help SMB’s to understand privacy <a href=\"https://mementosafe.com/\">https://mementosafe.com/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/in/marieclaire74/\">LinkedIn</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://twitter.com/MCPLLM\">Twitter</a></p>\n<!-- /wp:paragraph -->','PRIVACY BY DESIGN AND BY DEFAULT UNDER THE GDPR','','inherit','closed','closed','','16-revision-v1','','','2019-01-22 21:07:56','2019-01-22 21:07:56','',16,'http://datarainbow.eu/2019/01/22/16-revision-v1/',0,'revision','',0),(127,5,'2019-01-22 21:42:45','2019-01-22 21:42:45','{{unknown}}','','','publish','closed','closed','','7366185bc35dea89bf23447fe7db4293','','','2019-01-22 21:42:45','2019-01-22 21:42:45','',0,'http://datarainbow.eu/2019/01/22/7366185bc35dea89bf23447fe7db4293/',0,'oembed_cache','',0),(129,5,'2019-01-22 21:46:20','2019-01-22 21:46:20','<!-- wp:paragraph -->\n<p>Why DATARAINBOW ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":83,\"width\":688,\"height\":439} -->\n<figure class=\"wp-block-image is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-1.png\" alt=\"\" class=\"wp-image-83\" width=\"688\" height=\"439\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ....</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Who created DATARAINBOW ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, is a French Lawyer based in the UK who has studied private law at the prestigious Paris University Pantheon Assas, before specialising on Computer and Communication Law at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN\'s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group <a href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a> with <a href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:embed {\"url\":\"https://myemail.constantcontact.com/January-Tips\\u002d\\u002dData-Privacy-Day-just-around-the-corner.html?soid=1102633925835\\u0026aid=yBZYGvOtdbw#hero2\",\"type\":\"rich\",\"providerNameSlug\":\"embed-handler\",\"className\":\"\"} -->\n<figure class=\"wp-block-embed is-type-rich is-provider-embed-handler\"><div class=\"wp-block-embed__wrapper\">\nhttps://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\n</div></figure>\n<!-- /wp:embed -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018: Tara Taubman-Bassirian               </a></strong></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><strong><br></strong> Privacy Hero of the Year poll, and the results are in...  <a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/taubmanbassirian/\" target=\"_blank\">Tara Taubman-Bassirian</a> is the winner! <br>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)<br>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of my radio show, <a rel=\"noreferrer noopener\" href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\" target=\"_blank\">Data Security and Privacy with The Privacy Professor</a>. I\'ve extended invitations to each today, so stay tuned for more details. <br><em><strong>Tara Taubman-Bassirian: Early adopter learns tech so she can teach others</strong></em></td></tr></tbody></table>\n<!-- /wp:table -->','About','','inherit','closed','closed','','31-revision-v1','','','2019-01-22 21:46:20','2019-01-22 21:46:20','',31,'http://datarainbow.eu/2019/01/22/31-revision-v1/',0,'revision','',0),(134,5,'2019-01-24 14:06:32','2019-01-24 14:06:32','<!-- wp:paragraph -->\n<p>The General Data Protection Regulation applies to Personal Data. But do we know what exactly defines Personal Data? The <a href=\"https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/what-is-personal-data/what-is-personal-data/\">UK ICO </a>recently published a clarification document. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":135} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.01.53.png\" alt=\"\" class=\"wp-image-135\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>First limitation, it does not include legal personalities. Natural person, are living people in contrast with legal entities or organisation. They are technically labelled \"Data Subject\'. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'That individual must be identified or identifiable either directly or indirectly from one or more identifiers or from factors specific to the individual.\' this is where it gets more complicated and contextual.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR only applies to information which relates to an identifiable living individual. Consequently, information relating to a deceased person does not constitute personal data and therefore is not subject to the GDPR unless the EU country has opted to include them.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The processing of Personal Data covers a large variety of acts from collect, to copy to store the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The processing don\'t need to be electronically, there are two majors ways of processing:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>personal data processed wholly or partly by automated means (that is, information in electronic form); and</li><li>personal data processed in a non-automated manner which forms part of, or is intended to form part of, a ‘filing system’ (that is, manual information in a filing system).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ICO further adds : \"The GDPR does not cover information which is not, or is not intended to be, part of a ‘filing system’. However, under the Data Protection Act 2018 (DPA 2018) unstructured manual information processed only by public authorities constitutes personal data. This includes<strong> paper records </strong>that are not held as part of a filing system. While such information is personal data under the DPA 2018, it is exempted from most of the principles and obligations in the GDPR and is aimed at ensuring that it is appropriately protected for requests under the Freedom of Information Act 2000.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further guidance on the provisions of the DPA 2018 is awaited.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is more clarification from the <a href=\"https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en\">EU Commission</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2 id=\"examples-of-personal-data\">Examples of personal data</h2>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>a name and surname;</li><li>a home address;</li><li>an email address such as&nbsp;<a href=\"mailto:name.surname@company.com\">name.surname@company.com</a>;</li><li>an identification card number;</li><li>location data (for example the location data function on a mobile phone)*;</li><li>an Internet Protocol (IP) address;</li><li>a cookie ID*;</li><li>the advertising identifier of your phone;</li><li>data held by a hospital or doctor, which could be a symbol that uniquely identifies a person.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Within identifiable data qualified as Personal Data, they are the special categories, previously called \'Sensitive Data\' tat requires further cautious and a higher level of protection. these will be data with regard to :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>race;</li><li>ethnic origin;</li><li>political opinions;</li><li>religious or philosophical beliefs;</li><li>trade union membership;</li><li>genetic data;</li><li>biometric data (where this is used for identification purposes);</li><li>health data;</li><li>sex life; or</li><li>sexual orientation.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>What about pseudonymised or anonymised Personal Data ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR defines pseudonymisation as:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":136} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.32.10.png\" alt=\"\" class=\"wp-image-136\" /><figcaption><br></figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":137} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.59.20.png\" alt=\"\" class=\"wp-image-137\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The EU Commission explains :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Personal data that has been de-identified, encrypted or&nbsp;pseudonymised&nbsp;but can be used to re-identify a person remains personal data and falls within the scope of the law.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Personal data that has been rendered&nbsp;anonymous&nbsp;in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example provided by the UK ICO </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":138} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-14.04.35.png\" alt=\"\" class=\"wp-image-138\" /></figure>\n<!-- /wp:image -->','What is Protected by the GDPR ?','The General Data Protection Regulation applies to Personal Data. But do we know what exactly defines Personal Data? The UK ICO recently published a clarification document. ','publish','open','open','','what-is-protected-by-the-gdpr','','','2019-01-27 19:11:01','2019-01-27 19:11:01','',0,'http://datarainbow.eu/?p=134',0,'post','',0),(135,5,'2019-01-24 13:03:00','2019-01-24 13:03:00','','Screenshot 2019-01-24 at 13.01.53','','inherit','open','closed','','screenshot-2019-01-24-at-13-01-53','','','2019-01-24 13:03:00','2019-01-24 13:03:00','',134,'/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.01.53.png',0,'attachment','image/png',0),(136,5,'2019-01-24 13:58:56','2019-01-24 13:58:56','','Screenshot 2019-01-24 at 13.32.10','','inherit','open','closed','','screenshot-2019-01-24-at-13-32-10','','','2019-01-24 13:58:56','2019-01-24 13:58:56','',134,'/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.32.10.png',0,'attachment','image/png',0),(137,5,'2019-01-24 13:59:48','2019-01-24 13:59:48','','Screenshot 2019-01-24 at 13.59.20','','inherit','open','closed','','screenshot-2019-01-24-at-13-59-20','','','2019-01-24 13:59:48','2019-01-24 13:59:48','',134,'/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.59.20.png',0,'attachment','image/png',0),(138,5,'2019-01-24 14:05:01','2019-01-24 14:05:01','','Screenshot 2019-01-24 at 14.04.35','','inherit','open','closed','','screenshot-2019-01-24-at-14-04-35','','','2019-01-24 14:05:01','2019-01-24 14:05:01','',134,'/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-14.04.35.png',0,'attachment','image/png',0),(139,5,'2019-01-24 14:06:32','2019-01-24 14:06:32','<!-- wp:paragraph -->\n<p>The General Data Protection Regulation applies to Personal Data. But do we know what exactly defines Personal Data? The <a href=\"https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/what-is-personal-data/what-is-personal-data/\">UK ICO </a>recently published a clarification document. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":135} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.01.53.png\" alt=\"\" class=\"wp-image-135\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>First limitation, it does not include legal personalities. Natural person, are living people in contrast with legal entities or organisation. They are technically labelled \"Data Subject\'. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'That individual must be identified or identifiable either directly or indirectly from one or more identifiers or from factors specific to the individual.\' this is where it gets more complicated and contextual.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR only applies to information which relates to an identifiable living individual. Consequently, information relating to a deceased person does not constitute personal data and therefore is not subject to the GDPR unless the EU country has opted to include them.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The processing of Personal Data covers a large variety of acts from collect, to copy to store the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The processing don\'t need to be electronically, there are two majors ways of processing:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>personal data processed wholly or partly by automated means (that is, information in electronic form); and</li><li>personal data processed in a non-automated manner which forms part of, or is intended to form part of, a ‘filing system’ (that is, manual information in a filing system).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ICO further adds : \"The GDPR does not cover information which is not, or is not intended to be, part of a ‘filing system’. However, under the Data Protection Act 2018 (DPA 2018) unstructured manual information processed only by public authorities constitutes personal data. This includes<strong> paper records </strong>that are not held as part of a filing system. While such information is personal data under the DPA 2018, it is exempted from most of the principles and obligations in the GDPR and is aimed at ensuring that it is appropriately protected for requests under the Freedom of Information Act 2000.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further guidance on the provisions of the DPA 2018 is awaited.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is more clarification from the <a href=\"https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en\">EU Commission</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2 id=\"examples-of-personal-data\">Examples of personal data</h2>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>a name and surname;</li><li>a home address;</li><li>an email address such as&nbsp;<a href=\"mailto:name.surname@company.com\">name.surname@company.com</a>;</li><li>an identification card number;</li><li>location data (for example the location data function on a mobile phone)*;</li><li>an Internet Protocol (IP) address;</li><li>a cookie ID*;</li><li>the advertising identifier of your phone;</li><li>data held by a hospital or doctor, which could be a symbol that uniquely identifies a person.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Within identifiable data qualified as Personal Data, they are the special categories, previously called \'Sensitive Data\' tat requires further cautious and a higher level of protection. these will be data with regard to :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>race;</li><li>ethnic origin;</li><li>political opinions;</li><li>religious or philosophical beliefs;</li><li>trade union membership;</li><li>genetic data;</li><li>biometric data (where this is used for identification purposes);</li><li>health data;</li><li>sex life; or</li><li>sexual orientation.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>What about pseudonymised or anonymised Personal Data ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR defines pseudonymisation as:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":136} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.32.10.png\" alt=\"\" class=\"wp-image-136\" /><figcaption><br></figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":137} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.59.20.png\" alt=\"\" class=\"wp-image-137\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The EU Commission explains :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Personal data that has been de-identified, encrypted or&nbsp;pseudonymised&nbsp;but can be used to re-identify a person remains personal data and falls within the scope of the law.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Personal data that has been rendered anonymous in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example provided by the UK ICO </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":138} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-14.04.35.png\" alt=\"\" class=\"wp-image-138\" /></figure>\n<!-- /wp:image -->','What is Protected by the GDPR ?','','inherit','closed','closed','','134-revision-v1','','','2019-01-24 14:06:32','2019-01-24 14:06:32','',134,'https://datarainbow.eu/2019/01/24/134-revision-v1/',0,'revision','',0),(141,5,'2019-01-24 14:15:21','2019-01-24 14:15:21','<!-- wp:paragraph -->\n<p>While this site is under construction, the big news of the French Data Protection Authority, CNIL, <a href=\"https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc\">fining Google 50 Million Euros </a> came.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":118,\"align\":\"left\",\"width\":416,\"height\":266} -->\n<div class=\"wp-block-image\"><figure class=\"alignleft is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-3.png\" alt=\"\" class=\"wp-image-118\" width=\"416\" height=\"266\" /></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://edpb.europa.eu/news/national-news/2019/cnils-restricted-committee-imposes-financial-penalty-50-million-euros_en\">European Data Protection Board summary </a>explains how the CNIL has played the role of the lead authority to investigate the class actions filed by the Austrian <a href=\"https://noyb.eu/\">Non Of Your Business, NOYB</a>, and the French <a href=\"https://www.laquadrature.net/en/personnal-data/\">La Quadrature Du Net</a>. \'L\'Europe est en marche\' - Europe is leading - and the Union is enforcing its capabilities. Britain will be missed after Brexit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>After Google, here comes Facebook : <a href=\"https://www.lesoir.be/140480/article/2018-02-16/protection-des-donnees-privees-la-belgique-fait-plier-facebook\">A Belgian court injonction to Facebook</a> to stop his illegal collect of personal data in an 80 pages decision. 250.000 € maximum de 100 millions d’euros for everyday they dont comply. Things are acceleration. If you havent yet seen the French CNIL Google fine, have a look and make sure your organisation is compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Today, January the 22nd is the day the <a href=\"https://www.voiceamerica.com/promo/episode/112620\">Radio interview of Tara Taubman-Bassirian</a>, voted Privacy Hero 2018, is being broadcasted by Voice of America Business, so tune in.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><a target=\"_blank\" href=\"https://www.voiceamerica.com/guest/42903/tara-taubman-bassirian\" rel=\"noreferrer noopener\">Tara Taubman-Bassirian</a></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>Episode Description</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><em>2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, with Rebecca.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the <strong>International Privacy Day</strong> on January the 28th. A <strong>TwitterChat at 3pm Eas</strong>t using the hashtag <strong>#PrivacyAware</strong> with help of Kingston Technology. A <strong>drink in a pub in London</strong> from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Let the data flow, <a href=\"https://blogs.dlapiper.com/privacymatters/eu-japan-let-the-data-flow-free-flow-of-personal-data-between-eu-countries-and-japan-confirmed/\">adequacy decision between EU and Japan</a> adopted.</p>\n<!-- /wp:paragraph -->','NEWS','','inherit','closed','closed','','65-revision-v1','','','2019-01-24 14:15:21','2019-01-24 14:15:21','',65,'https://datarainbow.eu/2019/01/24/65-revision-v1/',0,'revision','',0),(144,5,'2019-01-24 14:24:41','2019-01-24 14:24:41','<!-- wp:paragraph -->\n<p>The General Data Protection Regulation applies to Personal Data. But do we know what exactly defines Personal Data? The <a href=\"https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/what-is-personal-data/what-is-personal-data/\">UK ICO </a>recently published a clarification document. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":135} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.01.53.png\" alt=\"\" class=\"wp-image-135\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>First limitation, it does not include legal personalities. Natural person, are living people in contrast with legal entities or organisation. They are technically labelled \"Data Subject\'. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'That individual must be identified or identifiable either directly or indirectly from one or more identifiers or from factors specific to the individual.\' this is where it gets more complicated and contextual.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR only applies to information which relates to an identifiable living individual. Consequently, information relating to a deceased person does not constitute personal data and therefore is not subject to the GDPR unless the EU country has opted to include them.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The processing of Personal Data covers a large variety of acts from collect, to copy to store the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The processing don\'t need to be electronically, there are two majors ways of processing:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>personal data processed wholly or partly by automated means (that is, information in electronic form); and</li><li>personal data processed in a non-automated manner which forms part of, or is intended to form part of, a ‘filing system’ (that is, manual information in a filing system).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ICO further adds : \"The GDPR does not cover information which is not, or is not intended to be, part of a ‘filing system’. However, under the Data Protection Act 2018 (DPA 2018) unstructured manual information processed only by public authorities constitutes personal data. This includes<strong> paper records </strong>that are not held as part of a filing system. While such information is personal data under the DPA 2018, it is exempted from most of the principles and obligations in the GDPR and is aimed at ensuring that it is appropriately protected for requests under the Freedom of Information Act 2000.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further guidance on the provisions of the DPA 2018 is awaited.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is more clarification from the <a href=\"https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en\">EU Commission</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2 id=\"examples-of-personal-data\">Examples of personal data</h2>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>a name and surname;</li><li>a home address;</li><li>an email address such as&nbsp;<a href=\"mailto:name.surname@company.com\">name.surname@company.com</a>;</li><li>an identification card number;</li><li>location data (for example the location data function on a mobile phone)*;</li><li>an Internet Protocol (IP) address;</li><li>a cookie ID*;</li><li>the advertising identifier of your phone;</li><li>data held by a hospital or doctor, which could be a symbol that uniquely identifies a person.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Within identifiable data qualified as Personal Data, they are the special categories, previously called \'Sensitive Data\' tat requires further cautious and a higher level of protection. these will be data with regard to :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>race;</li><li>ethnic origin;</li><li>political opinions;</li><li>religious or philosophical beliefs;</li><li>trade union membership;</li><li>genetic data;</li><li>biometric data (where this is used for identification purposes);</li><li>health data;</li><li>sex life; or</li><li>sexual orientation.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>What about pseudonymised or anonymised Personal Data ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR defines pseudonymisation as:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":136} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.32.10.png\" alt=\"\" class=\"wp-image-136\" /><figcaption><br></figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":137} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.59.20.png\" alt=\"\" class=\"wp-image-137\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The EU Commission explains :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Personal data that has been de-identified, encrypted or&nbsp;pseudonymised&nbsp;but can be used to re-identify a person remains personal data and falls within the scope of the law.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Personal data that has been rendered&nbsp;anonymous&nbsp;in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example provided by the UK ICO </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":138} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-14.04.35.png\" alt=\"\" class=\"wp-image-138\" /></figure>\n<!-- /wp:image -->','What is Protected by the GDPR ?','','inherit','closed','closed','','134-revision-v1','','','2019-01-24 14:24:41','2019-01-24 14:24:41','',134,'https://datarainbow.eu/2019/01/24/134-revision-v1/',0,'revision','',0),(146,5,'2019-01-24 16:31:18','2019-01-24 16:31:18','<!-- wp:paragraph -->\n<p>Why DATARAINBOW ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":83,\"width\":688,\"height\":439} -->\n<figure class=\"wp-block-image is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-1.png\" alt=\"\" class=\"wp-image-83\" width=\"688\" height=\"439\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ....</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Who created DATARAINBOW ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, is a French Lawyer based in the UK who has studied private law at the prestigious Paris University Pantheon Assas, before specialising on Computer and Communication Law at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN\'s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group <a href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a> with <a href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>CONTACT : Data@datarainbow.eu</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018:&nbsp;Tara Taubman-Bassirian&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</a></strong></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><strong><br></strong> Privacy Hero of the Year poll, and the results are in...&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/taubmanbassirian/\" target=\"_blank\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;<br>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)<br>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of my radio show,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\" target=\"_blank\">Data Security and Privacy with The Privacy Professor</a>. I\'ve extended invitations to each today, so stay tuned for more details.&nbsp;<br><em><strong>Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</strong></em></td></tr></tbody></table>\n<!-- /wp:table -->','About','','inherit','closed','closed','','31-revision-v1','','','2019-01-24 16:31:18','2019-01-24 16:31:18','',31,'https://datarainbow.eu/2019/01/24/31-revision-v1/',0,'revision','',0),(147,5,'2019-01-24 16:31:32','2019-01-24 16:31:32','<!-- wp:paragraph -->\n<p>Why DATARAINBOW ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":83,\"width\":688,\"height\":439} -->\n<figure class=\"wp-block-image is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-1.png\" alt=\"\" class=\"wp-image-83\" width=\"688\" height=\"439\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ....</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Who created DATARAINBOW ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, is a French Lawyer based in the UK who has studied private law at the prestigious Paris University Pantheon Assas, before specialising on Computer and Communication Law at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN\'s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group <a href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a> with <a href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTACT : Data@datarainbow.eu</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018:&nbsp;Tara Taubman-Bassirian&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</a></strong></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><strong><br></strong> Privacy Hero of the Year poll, and the results are in...&nbsp;&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/in/taubmanbassirian/\" target=\"_blank\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;<br>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)<br>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of my radio show,&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\" target=\"_blank\">Data Security and Privacy with The Privacy Professor</a>. I\'ve extended invitations to each today, so stay tuned for more details.&nbsp;<br><em><strong>Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</strong></em></td></tr></tbody></table>\n<!-- /wp:table -->','About','','inherit','closed','closed','','31-revision-v1','','','2019-01-24 16:31:32','2019-01-24 16:31:32','',31,'https://datarainbow.eu/2019/01/24/31-revision-v1/',0,'revision','',0),(149,5,'2019-01-24 16:36:22','2019-01-24 16:36:22','<!-- wp:paragraph -->\n<p>Why DATARAINBOW ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":83,\"width\":688,\"height\":439} -->\n<figure class=\"wp-block-image is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-1.png\" alt=\"\" class=\"wp-image-83\" width=\"688\" height=\"439\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ....</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Who created DATARAINBOW ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, is a French Lawyer based in the UK who has studied private law at the prestigious Paris University Pantheon Assas, before specialising on Computer and Communication Law at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN\'s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group <a href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a> with <a href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTACT : Data@datarainbow.eu</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018: Tara Taubman-Bassirian</a></strong></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><br></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>Privacy Hero of the Year poll, and the results are in...&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of my radio show,&nbsp;<a href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\">Data Security and Privacy with The Privacy Professor</a>. I\'ve extended invitations to each today, so stay tuned for more details.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</em>.</p>\n<!-- /wp:paragraph -->','About','','inherit','closed','closed','','31-revision-v1','','','2019-01-24 16:36:22','2019-01-24 16:36:22','',31,'https://datarainbow.eu/2019/01/24/31-revision-v1/',0,'revision','',0),(151,5,'2019-01-24 16:38:49','2019-01-24 16:38:49','<!-- wp:paragraph -->\n<p>Why DATARAINBOW ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":83,\"width\":688,\"height\":439} -->\n<figure class=\"wp-block-image is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-1.png\" alt=\"\" class=\"wp-image-83\" width=\"688\" height=\"439\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ....</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Who created DATARAINBOW ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, is a French Lawyer based in the UK who has studied private law at the prestigious Paris University Pantheon Assas, before specialising on Computer and Communication Law at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN\'s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group <a href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a> with <a href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTACT : Data@datarainbow.eu</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018:&nbsp;Tara Taubman-Bassirian</a></strong></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><br></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>Privacy Hero of the Year poll, and the results are in...&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of <a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">Rebecca Herold\'s radio show</a>, <a href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\">Data Security and Privacy with The Privacy Professor</a>. I\'ve extended invitations to each today, so stay tuned for more details. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</em>.</p>\n<!-- /wp:paragraph -->','About','','inherit','closed','closed','','31-revision-v1','','','2019-01-24 16:38:49','2019-01-24 16:38:49','',31,'https://datarainbow.eu/2019/01/24/31-revision-v1/',0,'revision','',0),(152,5,'2019-01-24 16:39:20','2019-01-24 16:39:20','<!-- wp:paragraph -->\n<p><strong>Why DATARAINBOW ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":83,\"width\":688,\"height\":439} -->\n<figure class=\"wp-block-image is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-1.png\" alt=\"\" class=\"wp-image-83\" width=\"688\" height=\"439\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ....</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Who created DATARAINBOW ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, is a French Lawyer based in the UK who has studied private law at the prestigious Paris University Pantheon Assas, before specialising on Computer and Communication Law at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN\'s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group <a href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a> with <a href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTACT : Data@datarainbow.eu</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018:&nbsp;Tara Taubman-Bassirian</a></strong></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><br></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>Privacy Hero of the Year poll, and the results are in...&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of <a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">Rebecca Herold\'s radio show</a>, <a href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\">Data Security and Privacy with The Privacy Professor</a>. I\'ve extended invitations to each today, so stay tuned for more details. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Tara Taubman-Bassirian:&nbsp;Early adopter learns tech so she can teach others</em>.</p>\n<!-- /wp:paragraph -->','About','','inherit','closed','closed','','31-revision-v1','','','2019-01-24 16:39:20','2019-01-24 16:39:20','',31,'https://datarainbow.eu/2019/01/24/31-revision-v1/',0,'revision','',0),(155,5,'2019-01-24 16:48:08','2019-01-24 16:48:08','<!-- wp:paragraph -->\n<p><strong>Why DATARAINBOW ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":83,\"width\":688,\"height\":439} -->\n<figure class=\"wp-block-image is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-1.png\" alt=\"\" class=\"wp-image-83\" width=\"688\" height=\"439\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>After the storm, here comes the rainbow arch of colours. Data compliance of today will hopefully bring harmony by applying a series of rules and regulations. The new digital world is regulated by the GDPR in the EU with less known several other regulations, the ePrivacy, the PECR, Convention 108, the NIS, the eCommerce Directive, IP laws, ....</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want to help every individual and every organisations to know their rights and liabilities. We want to help you walk trough the labyrinth, under the DATARAINBOW.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We hope you will not see regulations simply as a burden, more as a Fundamental Human Right for individuals bringing better trust for a better business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Who created DATARAINBOW ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2>Tara Taubman-Bassirian</h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Tara Taubman-Bassirian, LLM, is a French Lawyer based in the UK who has studied private law at the prestigious Paris University Pantheon Assas, before specialising on Computer and Communication Law at Queen Mary at University of London. She has completed for IP Law knowledge with a Harvard University course. She has expertise in areas of privacy, data protection, intellectual property, eCommerce and eReputation. She has made a name for herself in several areas of the world, most notably the UK, France and the US. Languages she practices have helped her to widen her horizon and reach. An early adopter of emerging technologies, Tara makes it her business to understand the challenges presented by regulations in this high connectivity era, which is how she has become a trusted adviser to individuals &amp; businesses navigating legal pathways to justice on the internet. Tara is very active in raising awareness of the EU General Data Protection Regulation (GDPR) &amp; advising businesses on the compliance requirements. Tara is a member of ICANN\'s NCUC &amp; is a volunteer mediator for Surrey Mediation where she extends community mediation to copyright conflict resolution. Tara co-founded Facebook group <a href=\"https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Fgroups%2F167255910003191%2F%3Ffb_dtsg_ag%3DAQw9IfIePuQkc9TDea1_4RgJG1SdsWqqZUil9j7T6q25CQ%253AAQyW3EGpAIEMXEv2FVBpA_93mEYKgUwphsnFvCEdqqEPzQ%26jazoest%3D27874\">Fly A Kite</a> with <a href=\"https://simbus360.com/\">Rebecca Herold</a>. It is dedicated to eradicating cyber-bullying &amp; improving online security, something near &amp; dear to us both.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONTACT : Data@datarainbow.eu</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><br></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><strong><a href=\"https://myemail.constantcontact.com/January-Tips--Data-Privacy-Day-just-around-the-corner.html?soid=1102633925835&amp;aid=yBZYGvOtdbw#hero2\">Privacy Hero 2018: Tara Taubman-Bassirian﻿</a></strong><br></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:paragraph -->\n<p>Privacy Hero of the Year poll, and the results are in...&nbsp;&nbsp;<a href=\"https://www.linkedin.com/in/taubmanbassirian/\">Tara Taubman-Bassirian</a>&nbsp;is the winner!&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(Big thank you to the community of voters for participating in our first ever Privacy Hero of the Year initiative.)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Hopefully you will get a chance to hear from Tara and Philip on upcoming episodes of <a href=\"https://www.voiceamerica.com/episode/112620/gdpr-data-privacy-day-and-the-need-for-privacy\">Rebecca Herold\'s radio show</a>,&nbsp;<a href=\"https://www.voiceamerica.com/show/2733/data-security-and-privacy-with-the-privacy-professor\">Data Security and Privacy with The Privacy Professor</a>. I\'ve extended invitations to each today, so stay tuned for more details.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Tara Taubman-Bassirian: Early adopter learns tech so she can teach others</em>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For keeping up with news on IT security, Privacy and Online Security, join our Facebook Group <a href=\"https://www.facebook.com/groups/167255910003191/?multi_permalinks=2203761959685899&amp;notif_id=1548347410584622&amp;notif_t=feedback_reaction_generic\">Fly A Kite</a>.</p>\n<!-- /wp:paragraph -->','About','','inherit','closed','closed','','31-revision-v1','','','2019-01-24 16:48:08','2019-01-24 16:48:08','',31,'https://datarainbow.eu/2019/01/24/31-revision-v1/',0,'revision','',0),(156,5,'2019-01-24 16:52:17','2019-01-24 16:52:17','','Screenshot 2019-01-17 DataRainbow','','inherit','open','closed','','screenshot-2019-01-17-datarainbow','','','2019-01-24 16:52:17','2019-01-24 16:52:17','',0,'/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-17-DataRainbow.png',0,'attachment','image/png',0),(157,5,'2019-01-24 16:52:37','2019-01-24 16:52:37','/wp-content/uploads/sites/3/2019/01/cropped-Screenshot-2019-01-17-DataRainbow.png','cropped-Screenshot-2019-01-17-DataRainbow.png','','inherit','open','closed','','cropped-screenshot-2019-01-17-datarainbow-png','','','2019-01-24 16:52:37','2019-01-24 16:52:37','',0,'/wp-content/uploads/sites/3/2019/01/cropped-Screenshot-2019-01-17-DataRainbow.png',0,'attachment','image/png',0),(162,5,'2019-01-25 13:45:04','0000-00-00 00:00:00','<!-- wp:paragraph -->\n<p>After the UK leaves EU, it will become a country of \'non adequate Data Protection\'. That means the end of the free flow of data. Just like any country outside the EEA, UK organisations exchanging data with the EEA will have to prepare Binding Corporate Rules or Standard Contracual clauses until a Privacy Schield type of agreement or an adequacy decision is adopted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, The ICO, following the European Data Protection Board <a href=\"https://ico.org.uk/for-organisations/data-protection-and-brexit/data-protection-if-there-s-no-brexit-deal/the-gdpr/european-representatives/\">guidance</a>, has suggested every UK organisation that has not an establishment in EEA to designate a representative.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You have an exemption if :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> - you are a public authority; </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>or </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- your processing is only occasional, of low risk to the data protection rights of individuals, and does not involve special category or criminal offence data on a large scale. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp218_en.pdf\">Working Party Article 29</a> has produced guidance on the risk – based approach in the EU data protection legal framework</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board\'s Draft Guidelines on Territorial Scope go further on the requirement for an EU/EEA representative set in Article 27.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":164} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-25-at-11.31.06.png\" alt=\"\" class=\"wp-image-164\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":165} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-25-at-11.31.16.png\" alt=\"\" class=\"wp-image-165\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Which Supervisory Authority is competent ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the recent case of the CNIL v Google, Google argued that the French CNIL was not the competent Supervisory Authority but the Irish Data Protection Authority. The CNIL argued Google LLC (and not Google France) was the data controller. Google Ireland Limited could not be considered Google LLC’s main establishment in the EU.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It did not have any real and effective decision power over the relevant processing activities </li><li>the Irish entity does not determine the purposes and the means of the processing; </li><li>Google’s privacy policy does not make any reference to Google Ireland Limited as being the company making the decisions in this respect; </li><li>the Irish entity had not appointed a DPO to oversee such processing; and the Android operating system is solely developed by Google LLC.; </li><li>On top of that, Google mentioned in a letter that the transfer of responsibility in this respect from Google LLC to Google Ireland Limited would be completed on 31 January 2019. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Prohibition of forum shopping. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, in the absence of a main establishment in the EU, Google LLC could not benefit from the “one-stop-shop” mechanism, as it was not possible to clearly identify the lead supervisory authority. The CNIL thus confirmed that it was competent pursuant to Article 55 (which sets forth the competence of each SA for the processing carried out on its territory) and Article 58 (which lists the SA investigative powers) of GDPR to process the collective actions filed.</p>\n<!-- /wp:paragraph -->','UK After Brexit','','draft','open','open','','','','','2019-01-25 13:45:04','2019-01-25 13:45:04','',0,'http://datarainbow.eu/?p=162',0,'post','',0),(163,5,'2019-01-25 10:57:40','2019-01-25 10:57:40','','Screenshot 2019-01-25 at 10.57.09','','inherit','open','closed','','screenshot-2019-01-25-at-10-57-09','','','2019-01-25 10:57:40','2019-01-25 10:57:40','',162,'/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-25-at-10.57.09.png',0,'attachment','image/png',0),(164,5,'2019-01-25 11:31:40','2019-01-25 11:31:40','','Screenshot 2019-01-25 at 11.31.06','','inherit','open','closed','','screenshot-2019-01-25-at-11-31-06','','','2019-01-25 11:31:40','2019-01-25 11:31:40','',162,'/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-25-at-11.31.06.png',0,'attachment','image/png',0),(165,5,'2019-01-25 11:32:30','2019-01-25 11:32:30','','Screenshot 2019-01-25 at 11.31.16','','inherit','open','closed','','screenshot-2019-01-25-at-11-31-16','','','2019-01-25 11:32:30','2019-01-25 11:32:30','',162,'/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-25-at-11.31.16.png',0,'attachment','image/png',0),(166,5,'2019-01-25 13:45:02','2019-01-25 13:45:02','<!-- wp:paragraph -->\n<p>After the UK leaves EU, it will become a country of \'non adequate Data Protection\'. That means the end of the free flow of data. Just like any country outside the EEA, UK organisations exchanging data with the EEA will have to prepare Binding Corporate Rules or Standard Contracual clauses until a Privacy Schield type of agreement or an adequacy decision is adopted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Meanwhile, The ICO, following the European Data Protection Board <a href=\"https://ico.org.uk/for-organisations/data-protection-and-brexit/data-protection-if-there-s-no-brexit-deal/the-gdpr/european-representatives/\">guidance</a>, has suggested every UK organisation that has not an establishment in EEA to designate a representative.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You have an exemption if :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p> - you are a public authority; </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>or </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- your processing is only occasional, of low risk to the data protection rights of individuals, and does not involve special category or criminal offence data on a large scale. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp218_en.pdf\">Working Party Article 29</a> has produced guidance on the risk – based approach in the EU data protection legal framework</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board\'s Draft Guidelines on Territorial Scope go further on the requirement for an EU/EEA representative set in Article 27.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":164} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-25-at-11.31.06.png\" alt=\"\" class=\"wp-image-164\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":165} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-25-at-11.31.16.png\" alt=\"\" class=\"wp-image-165\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Which Supervisory Authority is competent ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the recent case of the CNIL v Google, Google argued that the French CNIL was not the competent Supervisory Authority but the Irish Data Protection Authority. The CNIL argued Google LLC (and not Google France) was the data controller. Google Ireland Limited could not be considered Google LLC’s main establishment in the EU.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>It did not have any real and effective decision power over the relevant processing activities </li><li>the Irish entity does not determine the purposes and the means of the processing; </li><li>Google’s privacy policy does not make any reference to Google Ireland Limited as being the company making the decisions in this respect; </li><li>the Irish entity had not appointed a DPO to oversee such processing; and the Android operating system is solely developed by Google LLC.; </li><li>On top of that, Google mentioned in a letter that the transfer of responsibility in this respect from Google LLC to Google Ireland Limited would be completed on 31 January 2019. </li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Prohibition of forum shopping. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, in the absence of a main establishment in the EU, Google LLC could not benefit from the “one-stop-shop” mechanism, as it was not possible to clearly identify the lead supervisory authority. The CNIL thus confirmed that it was competent pursuant to Article 55 (which sets forth the competence of each SA for the processing carried out on its territory) and Article 58 (which lists the SA investigative powers) of GDPR to process the collective actions filed.</p>\n<!-- /wp:paragraph -->','UK After Brexit','','inherit','closed','closed','','162-revision-v1','','','2019-01-25 13:45:02','2019-01-25 13:45:02','',162,'https://datarainbow.eu/2019/01/25/162-revision-v1/',0,'revision','',0),(168,5,'2019-01-25 13:46:04','2019-01-25 13:46:04','<!-- wp:paragraph -->\n<p>While this site is under construction, the big news of the French Data Protection Authority, CNIL, <a href=\"https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc\">fining Google 50 Million Euros </a> came.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":118,\"align\":\"left\",\"width\":416,\"height\":266} -->\n<div class=\"wp-block-image\"><figure class=\"alignleft is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-3.png\" alt=\"\" class=\"wp-image-118\" width=\"416\" height=\"266\" /></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://edpb.europa.eu/news/national-news/2019/cnils-restricted-committee-imposes-financial-penalty-50-million-euros_en\">European Data Protection Board summary </a>explains how the CNIL has played the role of the lead authority to investigate the class actions filed by the Austrian <a href=\"https://noyb.eu/\">Non Of Your Business, NOYB</a>, and the French <a href=\"https://www.laquadrature.net/en/personnal-data/\">La Quadrature Du Net</a>. \'L\'Europe est en marche\' - Europe is leading - and the Union is enforcing its capabilities. Britain will be missed after Brexit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>After Google, here comes Facebook : <a href=\"https://www.lesoir.be/140480/article/2018-02-16/protection-des-donnees-privees-la-belgique-fait-plier-facebook\">A Belgian court injonction to Facebook</a> to stop his illegal collect of personal data in an 80 pages decision. 250.000 € maximum de 100 millions d’euros for everyday they dont comply. Things are acceleration. If you havent yet seen the French CNIL Google fine, have a look and make sure your organisation is compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Today, January the 22nd is the day the <a href=\"https://www.voiceamerica.com/promo/episode/112620\">Radio interview of Tara Taubman-Bassirian</a>, voted Privacy Hero 2018, is being broadcasted by Voice of America Business, so tune in.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><a target=\"_blank\" href=\"https://www.voiceamerica.com/guest/42903/tara-taubman-bassirian\" rel=\"noreferrer noopener\">Tara Taubman-Bassirian</a></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>Episode Description</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><em>2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, with Rebecca.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the <strong>International Privacy Day</strong> on January the 28th. A <strong>TwitterChat at 3pm Eas</strong>t using the hashtag <strong>#PrivacyAware</strong> with help of Kingston Technology. A <strong>drink in a pub in London</strong> from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Let the data flow, <a href=\"https://blogs.dlapiper.com/privacymatters/eu-japan-let-the-data-flow-free-flow-of-personal-data-between-eu-countries-and-japan-confirmed/\">adequacy decision between EU and Japan</a> adopted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Former European Data Protection Supervisor Peter Hustinx joins <a href=\"https://t.co/2LSgMjSG6b\">ICO </a>as non-executive director.</p>\n<!-- /wp:paragraph -->','NEWS','','inherit','closed','closed','','65-revision-v1','','','2019-01-25 13:46:04','2019-01-25 13:46:04','',65,'https://datarainbow.eu/2019/01/25/65-revision-v1/',0,'revision','',0),(173,5,'2019-01-27 13:07:48','2019-01-27 13:07:48','<!-- wp:paragraph -->\n<p>We are working on building a privacy compliant website. This site does not use any analytics.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":116,\"align\":\"left\",\"width\":360,\"height\":230} -->\n<div class=\"wp-block-image\"><figure class=\"alignleft is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-2.png\" alt=\"\" class=\"wp-image-116\" width=\"360\" height=\"230\" /></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>We do not use cookies unless strict necessity. We are trying our best to not allow third parties to track our visitors by cookies or by Java Script embeded code. It\'s hard job. We might lose traffic and SEO. Help us by spreading the word. If you see anything suspicious, lets us know.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We believe our visitors deserve protection and privacy. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We want your trust.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":78} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-22-at-11.16.16-1024x415.png\" alt=\"\" class=\"wp-image-78\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>This website has been built with the support and help of <a href=\"https://baycloud.com/\">BayCloud.&nbsp;</a> They exceptionally provided the WordPress template and the hosting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We are very grateful for their hosting of this website and assistance. Here is what you can find on BayCloud website :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Back in May 2011 Baycloud Systems introduced the original tool for helping websites comply with Do-Not-Track and the Data Protection and ePrivacy Directives, backed by a cost-effective and exhaustive website auditing service.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Fast track to 2017 and we are now the leading provider to multi-national companies of multi-language and multi-compliance systems, capable of actively managing the users\'s terminal storage in a secure way, not only to protect website visitors’ personal data but also clearly giving them control over its collection and use.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>The Baycloud Consent Platform manages the consent request process, presenting information on usage commitments and user benefits in any language, with a per-site customised user experience and ensuring their choice is continuously available. We ensure that tracking and storage consent policies are properly adhered to, with users\' consent capable of being revoked at any time and automatically after a configurable \"sunset\" period.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Baycloud was the first universal ePrivacy consent platform, and has, since 2011, focused on real user choice, actively managing first-party cookies and tracking third-parties. This means our technology has been honed and further developed through continuous use on thousands of major brand websites over many years, giving us an unquestioned lead in this space.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>We believe that publishers and brands that respect and offer a straightforward choice to their customers will earn their trust and loyalty.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":75} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-22-at-11.14.49-1024x429.png\" alt=\"\" class=\"wp-image-75\" /></figure>\n<!-- /wp:image -->','Privacy Notice','','inherit','closed','closed','','33-revision-v1','','','2019-01-27 13:07:48','2019-01-27 13:07:48','',33,'https://datarainbow.eu/2019/01/27/33-revision-v1/',0,'revision','',0),(175,5,'2019-01-27 13:17:48','2019-01-27 13:17:48','<!-- wp:paragraph -->\n<p>While this site is under construction, the big news of the French Data Protection Authority, CNIL, <a href=\"https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc\">fining Google 50 Million Euros </a> came.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":118,\"align\":\"left\",\"width\":416,\"height\":266} -->\n<div class=\"wp-block-image\"><figure class=\"alignleft is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-21-at-14.52.01-3.png\" alt=\"\" class=\"wp-image-118\" width=\"416\" height=\"266\" /></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The <a href=\"https://edpb.europa.eu/news/national-news/2019/cnils-restricted-committee-imposes-financial-penalty-50-million-euros_en\">European Data Protection Board summary </a>explains how the CNIL has played the role of the lead authority to investigate the class actions filed by the Austrian <a href=\"https://noyb.eu/\">Non Of Your Business, NOYB</a>, and the French <a href=\"https://www.laquadrature.net/en/personnal-data/\">La Quadrature Du Net</a>. \'L\'Europe est en marche\' - Europe is leading - and the Union is enforcing its capabilities. Britain will be missed after Brexit.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>After Google, here comes Facebook : <a href=\"https://www.lesoir.be/140480/article/2018-02-16/protection-des-donnees-privees-la-belgique-fait-plier-facebook\">A Belgian court injonction to Facebook</a> to stop his illegal collect of personal data in an 80 pages decision. 250.000 € maximum de 100 millions d’euros for everyday they dont comply. Things are acceleration. If you havent yet seen the French CNIL Google fine, have a look and make sure your organisation is compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p style=\"text-align:center\"><strong>* * *</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.voiceamerica.com/promo/episode/112620\">Radio interview of Tara Taubman-Bassirian</a>, voted <strong>Privacy Hero 2018</strong>, is on Voice of America Business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:table -->\n<table class=\"wp-block-table\"><tbody><tr><td><a target=\"_blank\" href=\"https://www.voiceamerica.com/guest/42903/tara-taubman-bassirian\" rel=\"noreferrer noopener\">Tara Taubman-Bassirian</a></td></tr></tbody></table>\n<!-- /wp:table -->\n\n<!-- wp:heading {\"level\":4} -->\n<h4>Episode Description</h4>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p><em>2018 privacy hero of the year, Tara Taubman-Bassirian, discusses the EU GDPR, the increasing need for protecting privacy in the increasingly technology-rich environment, and some activities for Data Privacy Day on January 28, 2019. What are the benefits of GDPR? Where can it be improved upon? What do companies struggle with most for GDPR compliance? What is a “hot potato” GDPR issue? How are binding corporate rules (BCRs) used for non-adequate countries? How has Brexit impacted GDPR compliance? Why does privacy matter? What are the current largest threats to privacy? What are some activities for Data Privacy Day? Hear Tara discuss these topics, and more, with Rebecca.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the <strong>International Privacy Day</strong> on January the 28th. A <strong>TwitterChat at 3pm GMT</strong> using the hashtag <strong>#PrivacyAware</strong> with help of Kingston Technology. A <strong>drink in a pub in London</strong> from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations. contact data@datarainbow.eu</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p style=\"text-align:center\"><strong>* * *</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Let the data flow, <a href=\"https://blogs.dlapiper.com/privacymatters/eu-japan-let-the-data-flow-free-flow-of-personal-data-between-eu-countries-and-japan-confirmed/\">adequacy decision between EU and Japan</a> adopted.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Former European Data Protection Supervisor Peter Hustinx joins <a href=\"https://t.co/2LSgMjSG6b\">ICO </a>as non-executive director.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph {\"align\":\"center\"} -->\n<p style=\"text-align:center\"><strong>* * *</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://www.pearltrees.com/privacyday/twitter/id23766377#item247781087\">Twitter</a></em> under investigation by the Irish Data Protection Commission</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em><a href=\"https://www.computerweekly.com/news/252456335/Facebooks-objections-to-court-concerns-over-privacy-more-about-optics-than-facts\">Facebook</a></em>’s challenge to a High Court ruling that raises serious concerns about data transfers between Europe and the US is more about appearance than facts, lawyers for the Irish Data Protection Commission told Dublin\'s Supreme Court.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>WARNING : Links to external website may contain cookies and tracking of visitors data. Do adjust your privacy setting in accordance.</p>\n<!-- /wp:paragraph -->','NEWS','','inherit','closed','closed','','65-revision-v1','','','2019-01-27 13:17:48','2019-01-27 13:17:48','',65,'https://datarainbow.eu/2019/01/27/65-revision-v1/',0,'revision','',0),(176,5,'2019-01-27 13:19:47','2019-01-27 13:19:47','<!-- wp:paragraph -->\n<p><strong>CELEBRATING THE PRIVACY DAY 2019</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Every 28th of January, <a href=\"https://en.wikipedia.org/wiki/Member_states_of_the_Council_of_Europe\">47 European countries</a> with the <a href=\"https://en.wikipedia.org/wiki/United_States\">United States</a>,&nbsp;<a href=\"https://en.wikipedia.org/wiki/Canada\">Canada</a>, <a href=\"https://en.wikipedia.org/wiki/India\">India</a>&nbsp;and&nbsp; celebrate Data Privacy Day, which is designed to raise awareness of and generate discussion about data privacy rights and practices.  The purpose of Data Privacy Day is to raise awareness and promote privacy and data protection best practices. It is currently observed in the&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This year, they are few major reason to celebrate :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The EU GDPR Regulation entered into for on May 2018</li><li>Between other International Data Protection regulations, the California Consumers Protection Act.</li><li>The ‘Privacy Hero’ of the year vote for Tara Taubman-Bassirian&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the <strong>International Privacy Day</strong> on January the 28th. A <strong>TwitterChat at 3pm GMT</strong> using the hashtag <strong>#PrivacyAware</strong> with the help of Kingston Technology , follow @clarinette02. A <strong>drink in a pub in London</strong> from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations. Contact : Data@datarainbow.eu</p>\n<!-- /wp:paragraph -->','Privacy Day','','inherit','closed','closed','','35-revision-v1','','','2019-01-27 13:19:47','2019-01-27 13:19:47','',35,'https://datarainbow.eu/2019/01/27/35-revision-v1/',0,'revision','',0),(178,5,'2019-01-27 13:21:32','2019-01-27 13:21:32','','Champion Badge','','inherit','open','closed','','champion-badge','','','2019-01-27 13:21:32','2019-01-27 13:21:32','',35,'/wp-content/uploads/sites/3/2019/01/Champion-Badge.png',0,'attachment','image/png',0),(179,5,'2019-01-27 13:22:11','2019-01-27 13:22:11','<!-- wp:paragraph -->\n<p><strong>CELEBRATING THE PRIVACY DAY 2019</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Every 28th of January, <a href=\"https://en.wikipedia.org/wiki/Member_states_of_the_Council_of_Europe\">47 European countries</a> with the <a href=\"https://en.wikipedia.org/wiki/United_States\">United States</a>,&nbsp;<a href=\"https://en.wikipedia.org/wiki/Canada\">Canada</a>, <a href=\"https://en.wikipedia.org/wiki/India\">India</a>&nbsp;and&nbsp; celebrate Data Privacy Day, which is designed to raise awareness of and generate discussion about data privacy rights and practices.  The purpose of Data Privacy Day is to raise awareness and promote privacy and data protection best practices. It is currently observed in the&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This year, they are few major reason to celebrate :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The EU GDPR Regulation entered into for on May 2018</li><li>Between other International Data Protection regulations, the California Consumers Protection Act.</li><li>The ‘Privacy Hero’ of the year vote for Tara Taubman-Bassirian&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the <strong>International Privacy Day</strong> on January the 28th. A <strong>TwitterChat at 3pm GMT</strong> using the hashtag <strong>#PrivacyAware</strong> with the help of Kingston Technology , follow @clarinette02. A <strong>drink in a pub in London</strong> from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations. Contact : Data@datarainbow.eu</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":178} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Champion-Badge.png\" alt=\"\" class=\"wp-image-178\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img alt=\"\" /></figure>\n<!-- /wp:image -->','Privacy Day','','inherit','closed','closed','','35-revision-v1','','','2019-01-27 13:22:11','2019-01-27 13:22:11','',35,'https://datarainbow.eu/2019/01/27/35-revision-v1/',0,'revision','',0),(181,5,'2019-01-27 13:23:17','2019-01-27 13:23:17','','Get_Involved_DPD_2019','','inherit','open','closed','','get_involved_dpd_2019','','','2019-01-27 13:23:17','2019-01-27 13:23:17','',35,'/wp-content/uploads/sites/3/2019/01/Get_Involved_DPD_2019.pdf',0,'attachment','application/pdf',0),(182,5,'2019-01-27 13:24:27','2019-01-27 13:24:27','','Poster_letter-DPD_2019','','inherit','open','closed','','poster_letter-dpd_2019','','','2019-01-27 13:24:27','2019-01-27 13:24:27','',35,'/wp-content/uploads/sites/3/2019/01/Poster_letter-DPD_2019.pdf',0,'attachment','application/pdf',0),(183,5,'2019-01-27 13:25:10','2019-01-27 13:25:10','','Data_Privacy_Day_2019_Social_Posts','','inherit','open','closed','','data_privacy_day_2019_social_posts','','','2019-01-27 13:25:10','2019-01-27 13:25:10','',35,'/wp-content/uploads/sites/3/2019/01/Data_Privacy_Day_2019_Social_Posts.xlsx',0,'attachment','application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',0),(184,5,'2019-01-27 13:25:34','2019-01-27 13:25:34','','Poster_DPD_2019','','inherit','open','closed','','poster_dpd_2019','','','2019-01-27 13:25:34','2019-01-27 13:25:34','',35,'/wp-content/uploads/sites/3/2019/01/Poster_DPD_2019.pdf',0,'attachment','application/pdf',0),(185,5,'2019-01-27 13:25:42','2019-01-27 13:25:42','<!-- wp:paragraph -->\n<p><strong>CELEBRATING THE PRIVACY DAY 2019</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Every 28th of January, <a href=\"https://en.wikipedia.org/wiki/Member_states_of_the_Council_of_Europe\">47 European countries</a> with the <a href=\"https://en.wikipedia.org/wiki/United_States\">United States</a>,&nbsp;<a href=\"https://en.wikipedia.org/wiki/Canada\">Canada</a>, <a href=\"https://en.wikipedia.org/wiki/India\">India</a>&nbsp;and&nbsp; celebrate Data Privacy Day, which is designed to raise awareness of and generate discussion about data privacy rights and practices.  The purpose of Data Privacy Day is to raise awareness and promote privacy and data protection best practices. It is currently observed in the&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This year, they are few major reason to celebrate :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The EU GDPR Regulation entered into for on May 2018</li><li>Between other International Data Protection regulations, the California Consumers Protection Act.</li><li>The ‘Privacy Hero’ of the year vote for Tara Taubman-Bassirian&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the <strong>International Privacy Day</strong> on January the 28th. A <strong>TwitterChat at 3pm GMT</strong> using the hashtag <strong>#PrivacyAware</strong> with the help of Kingston Technology , follow @clarinette02. A <strong>drink in a pub in London</strong> from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations. Contact : Data@datarainbow.eu</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":178} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Champion-Badge.png\" alt=\"\" class=\"wp-image-178\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img alt=\"\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:file {\"id\":181,\"href\":\"/wp-content/uploads/sites/3/2019/01/Get_Involved_DPD_2019.pdf\"} -->\n<div class=\"wp-block-file\"><a href=\"/wp-content/uploads/sites/3/2019/01/Get_Involved_DPD_2019.pdf\">Get_Involved_DPD_2019</a><a href=\"/wp-content/uploads/sites/3/2019/01/Get_Involved_DPD_2019.pdf\" class=\"wp-block-file__button\" download>Download</a></div>\n<!-- /wp:file -->\n\n<!-- wp:file {\"id\":182,\"href\":\"/wp-content/uploads/sites/3/2019/01/Poster_letter-DPD_2019.pdf\"} -->\n<div class=\"wp-block-file\"><a href=\"/wp-content/uploads/sites/3/2019/01/Poster_letter-DPD_2019.pdf\">Poster_letter-DPD_2019</a><a href=\"/wp-content/uploads/sites/3/2019/01/Poster_letter-DPD_2019.pdf\" class=\"wp-block-file__button\" download>Download</a></div>\n<!-- /wp:file -->\n\n<!-- wp:file {\"id\":183,\"href\":\"/wp-content/uploads/sites/3/2019/01/Data_Privacy_Day_2019_Social_Posts.xlsx\"} -->\n<div class=\"wp-block-file\"><a href=\"/wp-content/uploads/sites/3/2019/01/Data_Privacy_Day_2019_Social_Posts.xlsx\">Data_Privacy_Day_2019_Social_Posts</a><a href=\"/wp-content/uploads/sites/3/2019/01/Data_Privacy_Day_2019_Social_Posts.xlsx\" class=\"wp-block-file__button\" download>Download</a></div>\n<!-- /wp:file -->\n\n<!-- wp:file {\"id\":184,\"href\":\"/wp-content/uploads/sites/3/2019/01/Poster_DPD_2019.pdf\"} -->\n<div class=\"wp-block-file\"><a href=\"/wp-content/uploads/sites/3/2019/01/Poster_DPD_2019.pdf\">Poster_DPD_2019</a><a href=\"/wp-content/uploads/sites/3/2019/01/Poster_DPD_2019.pdf\" class=\"wp-block-file__button\" download>Download</a></div>\n<!-- /wp:file -->','Privacy Day','','inherit','closed','closed','','35-revision-v1','','','2019-01-27 13:25:42','2019-01-27 13:25:42','',35,'https://datarainbow.eu/2019/01/27/35-revision-v1/',0,'revision','',0),(186,5,'2019-01-27 18:40:40','2019-01-27 18:40:40','<!-- wp:paragraph -->\n<p><strong>CELEBRATING THE PRIVACY DAY 2019</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":178} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Champion-Badge.png\" alt=\"\" class=\"wp-image-178\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>Every 28th of January, <a href=\"https://en.wikipedia.org/wiki/Member_states_of_the_Council_of_Europe\">47 European countries</a> with the <a href=\"https://en.wikipedia.org/wiki/United_States\">United States</a>,&nbsp;<a href=\"https://en.wikipedia.org/wiki/Canada\">Canada</a>, <a href=\"https://en.wikipedia.org/wiki/India\">India</a>&nbsp;and&nbsp; celebrate Data Privacy Day, which is designed to raise awareness of and generate discussion about data privacy rights and practices.  The purpose of Data Privacy Day is to raise awareness and promote privacy and data protection best practices. It is currently observed in the&nbsp;.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This year, they are few major reason to celebrate :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The EU GDPR Regulation entered into for on May 2018</li><li>Between other International Data Protection regulations, the California Consumers Protection Act.</li><li>The ‘Privacy Hero’ of the year vote for Tara Taubman-Bassirian&nbsp;</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>We are preparing to celebrate the&nbsp;<strong>International Privacy Day</strong>&nbsp;on January the 28th. A&nbsp;<strong>TwitterChat at 3pm GMT</strong> using the hashtag&nbsp;<strong>#PrivacyAware</strong> with the help of Kingston Technology , follow @clarinette02. A&nbsp;<strong>drink in a pub in London</strong>&nbsp;from 6 to 9pm, you might want to register for. Hope to see many join us for these celebrations. Contact : Data@datarainbow.eu</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image -->\n<figure class=\"wp-block-image\"><img alt=\"\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:file {\"id\":181,\"href\":\"/wp-content/uploads/sites/3/2019/01/Get_Involved_DPD_2019.pdf\"} -->\n<div class=\"wp-block-file\"><a href=\"/wp-content/uploads/sites/3/2019/01/Get_Involved_DPD_2019.pdf\">Get_Involved_DPD_2019</a><a href=\"/wp-content/uploads/sites/3/2019/01/Get_Involved_DPD_2019.pdf\" class=\"wp-block-file__button\" download>Download</a></div>\n<!-- /wp:file -->\n\n<!-- wp:file {\"id\":182,\"href\":\"/wp-content/uploads/sites/3/2019/01/Poster_letter-DPD_2019.pdf\"} -->\n<div class=\"wp-block-file\"><a href=\"/wp-content/uploads/sites/3/2019/01/Poster_letter-DPD_2019.pdf\">Poster_letter-DPD_2019</a><a href=\"/wp-content/uploads/sites/3/2019/01/Poster_letter-DPD_2019.pdf\" class=\"wp-block-file__button\" download>Download</a></div>\n<!-- /wp:file -->\n\n<!-- wp:file {\"id\":183,\"href\":\"/wp-content/uploads/sites/3/2019/01/Data_Privacy_Day_2019_Social_Posts.xlsx\"} -->\n<div class=\"wp-block-file\"><a href=\"/wp-content/uploads/sites/3/2019/01/Data_Privacy_Day_2019_Social_Posts.xlsx\">Data_Privacy_Day_2019_Social_Posts</a><a href=\"/wp-content/uploads/sites/3/2019/01/Data_Privacy_Day_2019_Social_Posts.xlsx\" class=\"wp-block-file__button\" download>Download</a></div>\n<!-- /wp:file -->\n\n<!-- wp:file {\"id\":184,\"href\":\"/wp-content/uploads/sites/3/2019/01/Poster_DPD_2019.pdf\"} -->\n<div class=\"wp-block-file\"><a href=\"/wp-content/uploads/sites/3/2019/01/Poster_DPD_2019.pdf\">Poster_DPD_2019</a><a href=\"/wp-content/uploads/sites/3/2019/01/Poster_DPD_2019.pdf\" class=\"wp-block-file__button\" download>Download</a></div>\n<!-- /wp:file -->','Privacy Day','','inherit','closed','closed','','35-revision-v1','','','2019-01-27 18:40:40','2019-01-27 18:40:40','',35,'https://datarainbow.eu/2019/01/27/35-revision-v1/',0,'revision','',0),(188,5,'2019-01-27 18:56:46','2019-01-27 18:56:46','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian LLM</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There has been and still remains interrogations and uncertainties around the scope of application of the General Data Protection Regulation. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR contains rules concerning the protection of natural persons when their personal data are processed and rules on the free movement of personal data, as stressed in&nbsp;Article 1(1) GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 1 GDPR Subject-matter and objectives edicts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3. The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Related Recitals : 1 to 12</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 1(2) GDPR&nbsp;provides that the GDPR seeks to protect&nbsp;fundamental rights and freedoms of natural persons&nbsp;and, more specifically, their&nbsp;right to the protection of personal data. It means that, as such, the Regulation does not deal with the rights and freedoms of legal persons, such as companies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Rec.27, 158, 160; Art.1(1)-(2), 4(1) The law protects the personal data of natural persons, but does not apply to data of deceased persons. However, Member States may provide for rules regarding the processing of data of deceased persons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Article 8 of the EU Charter of Fundamental Rights -&nbsp;Protection of Personal data :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. Everyone has the right to the protection of personal data concerning him or her.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3. Compliance with these rules shall be subject to control by an independent authority.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 2 GDPR Material scope :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. This Regulation does not apply to the processing of personal data:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. in the course of an activity which falls outside the scope of Union law;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. by the Member States when carrying out activities which fall within the scope of&nbsp;<a href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:12012M/TXT\" target=\"_blank\" rel=\"noreferrer noopener\">Chapter 2 of Title V of the TEU</a>;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3. by a natural person in the course of a purely personal or household activity;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>4. by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3. For the processing of personal data by the Union institutions, bodies, offices and agencies,&nbsp;<a href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32001R0045\" target=\"_blank\" rel=\"noreferrer noopener\">Regulation (EC) No 45/2001</a>&nbsp;applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with&nbsp;<a href=\"https://gdpr-info.eu/art-98-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 98</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>4. This Regulation shall be without prejudice to the application of&nbsp;<a href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32000L0031\" target=\"_blank\" rel=\"noreferrer noopener\">Directive 2000/31/EC</a>, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Related Recitals : 13 to 21, 27</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Directive applies to the processing of personal data:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>• by automatic means (e.g., a computerised system or database); and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>• by other (non-automated) means that form part of a relevant filing system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The protection of individuals should be technologically neutral and should not depend on the techniques used.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 3 GDPR Territorial scope</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board, the supervisory authority that replaced the Working Party Article 29, has issued guidance on the territorial scope of the GDPR</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. the monitoring of their behaviour as far as their behaviour takes place within the Union.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Related Recitals : 22 to 25</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Recital 24:</strong>&nbsp;“Factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 3(1): “This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.” Article 3(2): “This regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: a. The offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or b. The monitoring of their behavior as far as their behavior takes place within the Union.”&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google Spain case (<a rel=\"noreferrer noopener\" href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=152065&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=703553\" target=\"_blank\">C-131/12</a>), in which the CJEU ruled that&nbsp;\"processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State, within the meaning of that provision, when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State.\"&nbsp;Thus, an EU-based entity that does not carry out data processing but performs an activity which can be considered inextricably linked to data processing will fall under the GDPR.&nbsp;&nbsp;&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>France v Google, Advocate General</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UK ICO : What is Personal data ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Personal data&nbsp;are defined as \"any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does this includes IP addresses? In a&nbsp;<a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=184668&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1034974\" target=\"_blank\" rel=\"noreferrer noopener\">groundbreaking decision on October 19th</a>,&nbsp;the Court of Justice of the European Union (CJEU) ruled that dynamic IP addresses could be considered as personal data. Under GDPR,&nbsp;clearly, the IP address, an ‘identification number’, can be personal data.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR applies to both automated personal data and to manual filing systems where personal data are accessible according to specific criteria. This could include chronologically ordered sets of manual records containing personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Personal data that has been pseudonymised can fall within the scope of the GDPR depending on how difficult it is to attribute the pseudonym to a particular individual.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Widening the scope of personal data from the Data Protection Directive, the GDPR applies to :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>EU based controllers and processors when personal data is processed “in the context of its activities”.&nbsp;</li><li>In addition, GDPR will apply to controllers and processors established in the European Economic Area (EEA) member states Iceland, Norway and Liechtenstein.</li><li>The GDPR may also apply to those established outside the European Union that target, by offering goods or services to data subjects in the EU/EEA, or that monitor the behaviour of such data subjects. The use of an EU language/currency, the ability to place orders in that other language and references to EU users or customers will be relevant.&nbsp;(Pammer v Reederei Karl Schlüter GmbH &amp; Co and Hotel Alpenhof v Heller (<a href=\"http://curia.europa.eu/juris/liste.jsf?language=en&amp;num=C-585/08\" target=\"_blank\" rel=\"noreferrer noopener\">Joined cases(C-585/08</a>) and (C-144/09))</li><li>Non-EU/EEA controllers established in a place where EU/EEA law applies by virtue of public international law.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Would the GDPR apply to non EU controllers established within the EEA but exclusively processing data of non EU/EEA residents?&nbsp;Some data processors process data of non EU citizens while based in the EU/EEA. To me, it s unclear if GDPR applies to them. The main practical issue here is the reach of jurisdiction for non EU citizen.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The long-arm of EU jurisdiction is translated by the requirement for controllers falling into these categories to appoint an EU-based representative. Falling ‘outside the scope of Union law’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR should not apply to the processing of the personal data of EU/EEA citizens, when collected outside the EU by non EU controllers based outside the EU/EEA. For instance data collected from an EU citizen when traveling abroad outside the EU.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2><a href=\"https://edpb.europa.eu/our-work-tools/public-consultations/2018/guidelines-32018-territorial-scope-gdpr-article-3_en\" target=\"_blank\" rel=\"noreferrer noopener\">EDPB Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)</a></h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->','GDPR Material and Territorial Scopes','','inherit','closed','closed','','12-revision-v1','','','2019-01-27 18:56:46','2019-01-27 18:56:46','',12,'https://datarainbow.eu/2019/01/27/12-revision-v1/',0,'revision','',0),(189,5,'2019-01-27 18:57:28','2019-01-27 18:57:28','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian LLM</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Early July this year the French CNIL published its&nbsp;<a href=\"https://www.cnil.fr/fr/quelles-thematiques-prioritaires-et-quelle-strategie-de-controle-pour-2018\" target=\"_blank\" rel=\"noreferrer noopener\">priorities and main targets for 2018</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Recruitment companies</li><li>Rental companies</li><li>Parking automated pay machines</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Here is a&nbsp;<a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6471344692427661312\" target=\"_blank\" rel=\"noreferrer noopener\">snapchot</a>&nbsp;of the CNIL\'s main investigations</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":19} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-20-at-23.22.15.png\" alt=\"\" class=\"wp-image-19\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Validity of consent :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL investigated mobile applications using embedded software development kit (SDK) and ad biding gathering personal data even when the application is not in use. The data collection is activated by default, which is contrary to the principal of privacy by design.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* The company&nbsp;<a href=\"https://www.legifrance.gouv.fr/affichCnil.do?oldAction=rechExpCnil&amp;id=CNILTEXT000037594451&amp;fastReqId=974682228&amp;fastPos=2\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>VECTUARY</strong></a>&nbsp;had suggested the use of Consent Management Provider – the CNIL considered the CMP not offering suffisant protection, the consumer still lacking information. Consent needs to be informed, specific and affirmative. The technicality and opacity of the ad targeting justifies greater transparency requirement. The CNIL is insisting that informed consent has to be given before the data is collected. Personal data is used for profiling and targeted advertising as large scale as many have phones. The data collected representing serious risk of privacy, the geolocation tracking revealing intimate information about habits and patterns of life.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent cannot be passed to another controller through a contractual relationship. Following the Article 7, a controller has the obligation to demonstrate, for the entirety of the data they are processing under consent, the validity of the consent obtained.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>VECTUARY has an injunction to cease data collection, to provide clear information before requiring informe consent. It has been asked to delete all data collected. that is 42 millions of personal identification and geolocation data collected from 32 000 application. Vectuary has 3 months to comply to avoid further sanctions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This case challenged the IAB Europe consent framework French regulator’s decision against an adtech company confirms that IAB “Transparency &amp; Consent Framework” does not obtain valid consent. It also illustrates how even tiny adtech companies can unlawfully gather millions of people’s personal data from RTB.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* Very similar case of lack of valid consent for&nbsp;<a href=\"https://www.cnil.fr/fr/applications-mobiles-mises-en-demeure-pour-absence-de-consentement-au-traitement-de-donnees-de\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>SINGLESPOT</strong></a>&nbsp;using SDK for targeted advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* Previously in July, the CNIL&nbsp;<a href=\"https://www.cnil.fr/fr/applications-mobiles-mises-en-demeure-absence-de-consentement-geolocalisation-ciblage-publicitaire\" target=\"_blank\" rel=\"noreferrer noopener\">announced</a>&nbsp;that it served a formal notice to two advertising startups&nbsp;<a href=\"https://www.cnil.fr/fr/applications-mobiles-mises-en-demeure-absence-de-consentement-geolocalisation-ciblage-publicitaire\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>FIDZUP</strong></a>&nbsp;and&nbsp;<a href=\"https://www.cnil.fr/fr/applications-mobiles-cloture-de-la-mise-en-demeure-lencontre-de-la-societe-teemo\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>TEEMO</strong></a>. Both companies collect as well personal data from mobile phones via (“SDK” tools integrated into the code of their partners’ mobile apps—even when the apps are not in use—and process the data to conduct marketing campaigns on mobile phones.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Users were not informed when downloading mobile apps that an SDK that will collect their data is integrated into the apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, they not informed about the advertising targeting purposes of the processing or the data controller’s identity when installing the app. they were required to obtain valid consent by providing that information before collating the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL found that the retention of geolocation data for 13 months was excessive as disproportionate in relation to the purpose of the processing. The CNIL stressed that use of geolocation devices are especially intrusive as they constantly track users in real time.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL ordered TEEMO and FIDZUP to obtain users’ valid consent within three months (e.g., via a pop-up containing specific information and a tick-box to signify consent). The CNIL also ordered TEEMO to define a retention period for geolocation data that is proportionate to the purpose of the processing. Failure to do so within the prescribed time limit may result in sanctions, including a fine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* On March 2018, the CNIL had served a notice to&nbsp;<strong>Direct Energie</strong>, the company behind the smart meter Linky. for lack of transparency in the collect of consumers personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Intrusive camera surveillance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>*&nbsp;</strong><a href=\"https://www.legifrance.gouv.fr/affichCnil.do?oldAction=rechExpCnil&amp;id=CNILTEXT000037537391&amp;fastReqId=1466136022&amp;fastPos=4\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Association 42</strong></a>, is a higher education. In February 2018, the CNIL proceeded to an investigation in their premises to detect abusive permanent video camera footage everywhere without due notice. Furthermore the live video recording was accessible to everyone.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was reminded that the video surveillance should be limited and access limited to authorised staff. Association 42 was given two month to comply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* The&nbsp;<a href=\"https://www.cnil.fr/fr/videosurveillance-excessive-mise-en-demeure-itic\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Institut des techniques informatiques et commerciales (l’ITIC)</strong></a>, another private school,&nbsp;had a similar practice of excessive camera surveillance, with retention of video footage over the required one month, lacking secure storage to avoid unauthorised access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data breach</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* If all these companies were served a notice,&nbsp;<a href=\"https://www.cnil.fr/fr/optical-center-sanction-de-250000eu-pour-une-atteinte-la-securite-des-donnees-des-clients-du-site\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>OPTICAL CENTRE</strong></a>&nbsp;has incurred a fine of 250,000 euros for a significant data leak that might have exposed customers’ sensitive personal information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"An on-site inspection was carried out on the premises of OPTICAL CENTER, during which [the company] acknowledged that [its] website did indeed have a security defect. In this case, the site&nbsp;&nbsp;<em>www.optical-center.fr</em>&nbsp;did not include functionality to verify that a customer is well connected to his personal space (“customer area”) before displaying his invoices. It was thus relatively simple to access documents from another client of the company.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Biometrics in workplace</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>*&nbsp;<a href=\"https://www.cnil.fr/fr/biometrie-au-travail-illegale-sanction-de-10000-euros\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Assistance Centre d\'Appels</strong></a>&nbsp;was investigated in its premises back in 2016. Several irregularities were found :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>fingerprint used to control work hours without prior authorisation,</li><li>audio recording of phone conversations without notice to employees and contacts</li><li>lack of strong passwords and automatic lock</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>After an initial notice, the CNIL did a second inspection that revealed only a partial application of the injunctions. therefore a fine of 10.000 Euros was given.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are the decisions that were deemed worthy of publication by the CNIL. Neither of them belong to the targeted sectors. the fines are minimal. the CNIL has preferred the approach of giving notice and checking if the injunctions have been followed by action.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>List of all CNIL\'s sanctions&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/tag/sanctions\" target=\"_blank\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a rel=\"noreferrer noopener\" href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>.<br></p>\n<!-- /wp:paragraph -->','French CNIL\'s six first month of GDPR','','inherit','closed','closed','','18-revision-v1','','','2019-01-27 18:57:28','2019-01-27 18:57:28','',18,'https://datarainbow.eu/2019/01/27/18-revision-v1/',0,'revision','',0),(190,5,'2019-01-27 19:06:32','2019-01-27 19:06:32','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian LLM</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Early July this year the French CNIL published its&nbsp;<a href=\"https://www.cnil.fr/fr/quelles-thematiques-prioritaires-et-quelle-strategie-de-controle-pour-2018\" target=\"_blank\" rel=\"noreferrer noopener\">priorities and main targets for 2018</a>&nbsp;:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Recruitment companies</li><li>Rental companies</li><li>Parking automated pay machines</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Here is a&nbsp;<a href=\"https://www.linkedin.com/feed/update/urn:li:activity:6471344692427661312\" target=\"_blank\" rel=\"noreferrer noopener\">snapchot</a>&nbsp;of the CNIL\'s main investigations</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":19} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-20-at-23.22.15.png\" alt=\"\" class=\"wp-image-19\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p><strong>Validity of consent :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL investigated mobile applications using embedded software development kit (SDK) and ad biding gathering personal data even when the application is not in use. The data collection is activated by default, which is contrary to the principal of privacy by design.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* The company&nbsp;<a href=\"https://www.legifrance.gouv.fr/affichCnil.do?oldAction=rechExpCnil&amp;id=CNILTEXT000037594451&amp;fastReqId=974682228&amp;fastPos=2\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>VECTUARY</strong></a>&nbsp;had suggested the use of Consent Management Provider – the CNIL considered the CMP not offering suffisant protection, the consumer still lacking information. Consent needs to be informed, specific and affirmative. The technicality and opacity of the ad targeting justifies greater transparency requirement. The CNIL is insisting that informed consent has to be given before the data is collected. Personal data is used for profiling and targeted advertising as large scale as many have phones. The data collected representing serious risk of privacy, the geolocation tracking revealing intimate information about habits and patterns of life.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consent cannot be passed to another controller through a contractual relationship. Following the Article 7, a controller has the obligation to demonstrate, for the entirety of the data they are processing under consent, the validity of the consent obtained.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>VECTUARY has an injunction to cease data collection, to provide clear information before requiring informe consent. It has been asked to delete all data collected. that is 42 millions of personal identification and geolocation data collected from 32 000 application. Vectuary has 3 months to comply to avoid further sanctions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This case challenged the IAB Europe consent framework French regulator’s decision against an adtech company confirms that IAB “Transparency &amp; Consent Framework” does not obtain valid consent. It also illustrates how even tiny adtech companies can unlawfully gather millions of people’s personal data from RTB.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* Very similar case of lack of valid consent for&nbsp;<a href=\"https://www.cnil.fr/fr/applications-mobiles-mises-en-demeure-pour-absence-de-consentement-au-traitement-de-donnees-de\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>SINGLESPOT</strong></a>&nbsp;using SDK for targeted advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* Previously in July, the CNIL&nbsp;<a href=\"https://www.cnil.fr/fr/applications-mobiles-mises-en-demeure-absence-de-consentement-geolocalisation-ciblage-publicitaire\" target=\"_blank\" rel=\"noreferrer noopener\">announced</a>&nbsp;that it served a formal notice to two advertising startups&nbsp;<a href=\"https://www.cnil.fr/fr/applications-mobiles-mises-en-demeure-absence-de-consentement-geolocalisation-ciblage-publicitaire\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>FIDZUP</strong></a>&nbsp;and&nbsp;<a href=\"https://www.cnil.fr/fr/applications-mobiles-cloture-de-la-mise-en-demeure-lencontre-de-la-societe-teemo\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>TEEMO</strong></a>. Both companies collect as well personal data from mobile phones via (“SDK” tools integrated into the code of their partners’ mobile apps—even when the apps are not in use—and process the data to conduct marketing campaigns on mobile phones.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Users were not informed when downloading mobile apps that an SDK that will collect their data is integrated into the apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, they not informed about the advertising targeting purposes of the processing or the data controller’s identity when installing the app. they were required to obtain valid consent by providing that information before collating the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally, the CNIL found that the retention of geolocation data for 13 months was excessive as disproportionate in relation to the purpose of the processing. The CNIL stressed that use of geolocation devices are especially intrusive as they constantly track users in real time.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL ordered TEEMO and FIDZUP to obtain users’ valid consent within three months (e.g., via a pop-up containing specific information and a tick-box to signify consent). The CNIL also ordered TEEMO to define a retention period for geolocation data that is proportionate to the purpose of the processing. Failure to do so within the prescribed time limit may result in sanctions, including a fine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* On March 2018, the CNIL had served a notice to&nbsp;<strong>Direct Energie</strong>, the company behind the smart meter Linky. for lack of transparency in the collect of consumers personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Intrusive camera surveillance</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>*&nbsp;</strong><a href=\"https://www.legifrance.gouv.fr/affichCnil.do?oldAction=rechExpCnil&amp;id=CNILTEXT000037537391&amp;fastReqId=1466136022&amp;fastPos=4\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Association 42</strong></a>, is a higher education. In February 2018, the CNIL proceeded to an investigation in their premises to detect abusive permanent video camera footage everywhere without due notice. Furthermore the live video recording was accessible to everyone.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It was reminded that the video surveillance should be limited and access limited to authorised staff. Association 42 was given two month to comply.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* The&nbsp;<a href=\"https://www.cnil.fr/fr/videosurveillance-excessive-mise-en-demeure-itic\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Institut des techniques informatiques et commerciales (l’ITIC)</strong></a>, another private school,&nbsp;had a similar practice of excessive camera surveillance, with retention of video footage over the required one month, lacking secure storage to avoid unauthorised access.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Data breach</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>* If all these companies were served a notice,&nbsp;<a href=\"https://www.cnil.fr/fr/optical-center-sanction-de-250000eu-pour-une-atteinte-la-securite-des-donnees-des-clients-du-site\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>OPTICAL CENTRE</strong></a>&nbsp;has incurred a fine of 250,000 euros for a significant data leak that might have exposed customers’ sensitive personal information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>\"An on-site inspection was carried out on the premises of OPTICAL CENTER, during which [the company] acknowledged that [its] website did indeed have a security defect. In this case, the site&nbsp;&nbsp;<em>www.optical-center.fr</em>&nbsp;did not include functionality to verify that a customer is well connected to his personal space (“customer area”) before displaying his invoices. It was thus relatively simple to access documents from another client of the company.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p><strong>Biometrics in workplace</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>*&nbsp;<a href=\"https://www.cnil.fr/fr/biometrie-au-travail-illegale-sanction-de-10000-euros\" target=\"_blank\" rel=\"noreferrer noopener\"><strong>Assistance Centre d\'Appels</strong></a>&nbsp;was investigated in its premises back in 2016. Several irregularities were found :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>fingerprint used to control work hours without prior authorisation,</li><li>audio recording of phone conversations without notice to employees and contacts</li><li>lack of strong passwords and automatic lock</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>After an initial notice, the CNIL did a second inspection that revealed only a partial application of the injunctions. therefore a fine of 10.000 Euros was given.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are the decisions that were deemed worthy of publication by the CNIL. Neither of them belong to the targeted sectors. the fines are minimal. the CNIL has preferred the approach of giving notice and checking if the injunctions have been followed by action.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>List of all CNIL\'s sanctions&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.cnil.fr/fr/tag/sanctions\" target=\"_blank\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a rel=\"noreferrer noopener\" href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\">Creative Commons Attribution 4.0 International License</a>.<br></p>\n<!-- /wp:paragraph -->','French CNIL\'s six first month of GDPR','The CNIL investigated mobile applications using embedded software development kit (SDK) and ad biding gathering personal data even when the application is not in use. The data collection is activated by default, which is contrary to the principal of privacy by design.','inherit','closed','closed','','18-revision-v1','','','2019-01-27 19:06:32','2019-01-27 19:06:32','',18,'https://datarainbow.eu/2019/01/27/18-revision-v1/',0,'revision','',0),(191,5,'2019-01-27 19:07:50','2019-01-27 19:07:50','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian LLM</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>There has been and still remains interrogations and uncertainties around the scope of application of the General Data Protection Regulation. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR contains rules concerning the protection of natural persons when their personal data are processed and rules on the free movement of personal data, as stressed in&nbsp;Article 1(1) GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 1 GDPR Subject-matter and objectives edicts :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. This Regulation lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3. The free movement of personal data within the Union shall be neither restricted nor prohibited for reasons connected with the protection of natural persons with regard to the processing of personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Related Recitals : 1 to 12</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 1(2) GDPR&nbsp;provides that the GDPR seeks to protect&nbsp;fundamental rights and freedoms of natural persons&nbsp;and, more specifically, their&nbsp;right to the protection of personal data. It means that, as such, the Regulation does not deal with the rights and freedoms of legal persons, such as companies.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Rec.27, 158, 160; Art.1(1)-(2), 4(1) The law protects the personal data of natural persons, but does not apply to data of deceased persons. However, Member States may provide for rules regarding the processing of data of deceased persons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Article 8 of the EU Charter of Fundamental Rights -&nbsp;Protection of Personal data :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. Everyone has the right to the protection of personal data concerning him or her.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3. Compliance with these rules shall be subject to control by an independent authority.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 2 GDPR Material scope :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. This Regulation does not apply to the processing of personal data:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. in the course of an activity which falls outside the scope of Union law;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. by the Member States when carrying out activities which fall within the scope of&nbsp;<a href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:12012M/TXT\" target=\"_blank\" rel=\"noreferrer noopener\">Chapter 2 of Title V of the TEU</a>;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3. by a natural person in the course of a purely personal or household activity;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>4. by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3. For the processing of personal data by the Union institutions, bodies, offices and agencies,&nbsp;<a href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32001R0045\" target=\"_blank\" rel=\"noreferrer noopener\">Regulation (EC) No 45/2001</a>&nbsp;applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal data shall be adapted to the principles and rules of this Regulation in accordance with&nbsp;<a href=\"https://gdpr-info.eu/art-98-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">Article 98</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>4. This Regulation shall be without prejudice to the application of&nbsp;<a href=\"http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32000L0031\" target=\"_blank\" rel=\"noreferrer noopener\">Directive 2000/31/EC</a>, in particular of the liability rules of intermediary service providers in Articles 12 to 15 of that Directive.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Related Recitals : 13 to 21, 27</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Directive applies to the processing of personal data:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>• by automatic means (e.g., a computerised system or database); and</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>• by other (non-automated) means that form part of a relevant filing system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The protection of individuals should be technologically neutral and should not depend on the techniques used.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Art. 3 GDPR Territorial scope</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The European Data Protection Board, the supervisory authority that replaced the Working Party Article 29, has issued guidance on the territorial scope of the GDPR</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>1. the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>2. the monitoring of their behaviour as far as their behaviour takes place within the Union.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>3. This Regulation applies to the processing of personal data by a controller not established in the Union, but in a place where Member State law applies by virtue of public international law.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Related Recitals : 22 to 25</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Recital 24:</strong>&nbsp;“Factors such as the use of a language or a currency generally used in one or more Member States with the possibility of ordering goods and services in that other language, or the mentioning of customers or users who are in the Union, may make it apparent that the controller envisages offering goods or services to data subjects in the Union.”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 3(1): “This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.” Article 3(2): “This regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to: a. The offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or b. The monitoring of their behavior as far as their behavior takes place within the Union.”&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google Spain case (<a rel=\"noreferrer noopener\" href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=152065&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=703553\" target=\"_blank\">C-131/12</a>), in which the CJEU ruled that&nbsp;\"processing of personal data is carried out in the context of the activities of an establishment of the controller on the territory of a Member State, within the meaning of that provision, when the operator of a search engine sets up in a Member State a branch or subsidiary which is intended to promote and sell advertising space offered by that engine and which orientates its activity towards the inhabitants of that Member State.\"&nbsp;Thus, an EU-based entity that does not carry out data processing but performs an activity which can be considered inextricably linked to data processing will fall under the GDPR.&nbsp;&nbsp;&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>France v Google, Advocate General</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>UK ICO : What is Personal data ?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Personal data&nbsp;are defined as \"any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does this includes IP addresses? In a&nbsp;<a href=\"http://curia.europa.eu/juris/document/document.jsf?text=&amp;docid=184668&amp;pageIndex=0&amp;doclang=EN&amp;mode=lst&amp;dir=&amp;occ=first&amp;part=1&amp;cid=1034974\" target=\"_blank\" rel=\"noreferrer noopener\">groundbreaking decision on October 19th</a>,&nbsp;the Court of Justice of the European Union (CJEU) ruled that dynamic IP addresses could be considered as personal data. Under GDPR,&nbsp;clearly, the IP address, an ‘identification number’, can be personal data.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR applies to both automated personal data and to manual filing systems where personal data are accessible according to specific criteria. This could include chronologically ordered sets of manual records containing personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Personal data that has been pseudonymised can fall within the scope of the GDPR depending on how difficult it is to attribute the pseudonym to a particular individual.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Widening the scope of personal data from the Data Protection Directive, the GDPR applies to :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>EU based controllers and processors when personal data is processed “in the context of its activities”.&nbsp;</li><li>In addition, GDPR will apply to controllers and processors established in the European Economic Area (EEA) member states Iceland, Norway and Liechtenstein.</li><li>The GDPR may also apply to those established outside the European Union that target, by offering goods or services to data subjects in the EU/EEA, or that monitor the behaviour of such data subjects. The use of an EU language/currency, the ability to place orders in that other language and references to EU users or customers will be relevant.&nbsp;(Pammer v Reederei Karl Schlüter GmbH &amp; Co and Hotel Alpenhof v Heller (<a href=\"http://curia.europa.eu/juris/liste.jsf?language=en&amp;num=C-585/08\" target=\"_blank\" rel=\"noreferrer noopener\">Joined cases(C-585/08</a>) and (C-144/09))</li><li>Non-EU/EEA controllers established in a place where EU/EEA law applies by virtue of public international law.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Would the GDPR apply to non EU controllers established within the EEA but exclusively processing data of non EU/EEA residents?&nbsp;Some data processors process data of non EU citizens while based in the EU/EEA. To me, it s unclear if GDPR applies to them. The main practical issue here is the reach of jurisdiction for non EU citizen.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The long-arm of EU jurisdiction is translated by the requirement for controllers falling into these categories to appoint an EU-based representative. Falling ‘outside the scope of Union law’ ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR should not apply to the processing of the personal data of EU/EEA citizens, when collected outside the EU by non EU controllers based outside the EU/EEA. For instance data collected from an EU citizen when traveling abroad outside the EU.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2><a href=\"https://edpb.europa.eu/our-work-tools/public-consultations/2018/guidelines-32018-territorial-scope-gdpr-article-3_en\" target=\"_blank\" rel=\"noreferrer noopener\">EDPB Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)</a></h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->','GDPR Material and Territorial Scopes','There has been and still remains interrogations and uncertainties around the scope of application of the General Data Protection Regulation.','inherit','closed','closed','','12-revision-v1','','','2019-01-27 19:07:50','2019-01-27 19:07:50','',12,'https://datarainbow.eu/2019/01/27/12-revision-v1/',0,'revision','',0),(192,5,'2019-01-27 19:09:16','2019-01-27 19:09:16','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":95,\"align\":\"left\",\"width\":439,\"height\":287} -->\n<div class=\"wp-block-image\"><figure class=\"alignleft is-resized\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-22-at-12.04.25.png\" alt=\"\" class=\"wp-image-95\" width=\"439\" height=\"287\" /></figure></div>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>In “<a href=\"https://press.princeton.edu/titles/9436.html\">Delete : The Virtue of Forgetting in the Digital Age</a>”, <a href=\"https://www.oii.ox.ac.uk/people/viktor-ms/\">Viktor Mayer-Schonberger</a> from the <a href=\"https://cyber.harvard.edu/\">Berkman Klein Centre of Internet and Society</a>, exposes the permanent shadow that follows us online for ever. The issues of privacy and freedom that results and his suggested solution : auto-delete files or information expiry date.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Changing back the default setting from remembering to forgetting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The crumbs of information left behind, get aggregated and build a picture, sometimes distorted, that follows us.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to the theory of conservation of energy, data does have a deceptively long lifespan.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Nothing gets deleted.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As Viktor Mayer-Schonberger points out, the German Stasi genocide project would have taken a whole different apocalyptic dimension had Google storage and data indexing existed at the time.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He mentions the case of the Dutch Citizens register put in place in the 1930s. To ensure the administration of social securities, it included religious and ethnicity. Once the nazi had occupied the Netherland, they exploited the register to identify jews to be deported and sent to concentration camps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Another major Privacy scholar, Professor Daniel Solove, has been actively raising awareness on privacy and the future of reputation online.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>His paper,&nbsp;<a href=\"http://ssrn.com/abstract=998565\" target=\"_blank\" rel=\"noreferrer noopener\">“I’ve Got Nothing to Hide,” and Other Misunderstandings of Privacy</a>,&nbsp;explains why privacy matters.&nbsp;He later expanded his ideas in the essay into a book:&nbsp;<a href=\"http://www.amazon.com/gp/product/0300172338\" target=\"_blank\" rel=\"noreferrer noopener\">Nothing to Hide: The False Tradeoff Between Privacy and Security</a>.&nbsp;&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you think The only people who should worry are those who are doing something immoral or illegal, you should read his essays and books. With the mass of omni-veillance data, the situation is not just Orwellian, but Kafkaesque.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In a series of YouTube videos and conferences, Daniel Solove brings public attention to cases of online harassement.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The Dog Pooh girl is the story of an unlucky girl. She is with her dog in a suburban tube of South Korea. The dog poop on the train, she is on a hurry, she leaves the train refusing to clean up behind. In the old days, that would have been the end of it. Today, when face-to-face persuasion fails, there’s a fallback plan : anonymous Internet humiliation.&nbsp;The witness who recorded her with his smartphone, posted the shaming video online. Within days, her identity and her past were revealed. The video gets viral all around the world. Posters and all kinds of jokes were made. Media wrote about her.&nbsp;Even the US Washington Post wrote about her story.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>She eventually reached a fame she wished she did never achieved. For ever, the image will follow her. This girl will be called the Dog Pooh Girl.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Another illustration, The sad story of the the Star Wars Kid. A young chubby boy in Canada. He&nbsp;posted a video of himself online in his rather unsuccessful attempt to imitate George Lucas, the famous movie star. His video was watched by tens of millions of internautes who commented, and widely mocked his gesture. He was teased by the whole world.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A childhood incident that will follow him forever.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Daniel Solove questions the Future of Reputation in the digital age and how data can track you back.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He wrote : “<em>If the Empire in Star Wars Had Big Data, the Empire would have won. A search of records would have revealed where Luke Skywalker was living on Tatooine.&nbsp;A more efficient collection and aggregation of Jawa records would have located the droids immediately.&nbsp;Simple data analysis would have revealed that Ben Kenobi was really Obi Wan Kenobi. A search of birth records would have revealed that Princess Leia was Luke\'s sister. Had the Empire had anything like the NSA, it would have had all the data it needed, and it could have sweptup the droids and everyone else, and that would have been that.</em>&nbsp;“</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So, Is more information stored any better?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is an information taken out of context.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What is individuals freedom and autonomy when we can’t escape from our past?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>During an interview with the Wall Street Journal, Google’s CEO, Eric Schmidt, suggested that young people should be entitled to change their identity once achieved 21 years of age to escape their youth mistakes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>He adds : ”<em>I don\'t believe society understands what happens when everything is available, knowable and recorded by everyone all the time.</em>”</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>So, is taking a new identity a realistic option?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Facebook is one other place where users are encouraged to share their day to day stories, their feelings and their believes. Users profiles were exploited by Cambridge Analytica to manipulate electoral votes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>More worrying, Facebook does not respect the multi layers of our personality by storing all in one place. No more free speech nor modular language between levels of relationships.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the past, people will write diaries. Today, it’s been replaced by online blogs or social media platforms where people reveal most intimates details of their life.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And incidentally the live of their family, friends, co-workers, everyone, posted online for the eternity.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>50% of blogs are from children under&nbsp;the age of 18.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The generation Google, as Daniel Solove calls it , has its memories engaged for ever.&nbsp;A childhood that will follow them for ever, for the leisure of Google to bring back every piece of memories.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Forgetting is not forgiving. It’s a salutatory purge of our brain. it’s mostly random purge.</strong>&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Maybe have you heard of Neuralink, a revolutionary project funded by Elon Musk.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Elon Musk&nbsp;is the American multibillionaire CEO of Tesla electric cars, the inventor of the fabulous solar roof tiles. He even projects to colonise the Planet Mars.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The richest man in the world according to Forbes magazine.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>His Neuralink project aims to reduce social inequalities by boosting cognitive capacities.&nbsp;A project to implant Computer interfaces in the brain of disadvantage populations, as he believes they lack intelligence. A theory supported by the French Dr Laurent Alexandre believing high IQ is key to success. A whole utopia of transhumanism.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Give them extra brain processing and you’ll resolve the issues of poverty!</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Adding memory :</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Now, lets look at a little story told by Jean-Gabriel Ganascia :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A little girl, Adele, asks her grand mother Juliette :&nbsp;<em>Grand’ma, what does it mean a ‘recitation’&nbsp;</em>? The Grand’ma vaguely remembers that early Twenty-One century, people had to read and read again to memorise poetry or other texts. Adele lives in 2075. She has no idea of that.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Neuralink has resolved the memory issue.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, Elon Musk, has borrowed his idea from NEURALIFE in ‘<em>Tomorrow and Beyond</em>’, Science fiction book by Ian Bronx.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The little girl is curious to know if this learning by heart process was any painful. The grand’ma says : ‘<em>no, we just had to read and read again to memorise, not to forget.</em>&nbsp;‘&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The little girl has no idea what forget means.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Jean-Gabriel Ganascia, who tells this science fiction story, is a professor of Computer Science and a French Philosopher. He is the President of the Ethics committee at the French Research Center, CNRS. His research is particularly focused on Ethics and Artificial Intelligence.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In France, patients are already treated by deep electronic simulations of the brain to treat the symptoms of Parkinson disease.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Now, imagine having an astonishing memory to record and remember everything, including every dream, every single detail of your life.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Well, near 80 people around the world today have&nbsp;naturally this biological capability.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Actually, they suffer, they suffer from Hypermnesia disorder. They permanently keep a perfect memory of their life. They virtually remember every minor event most people would forget within days.&nbsp;The memory for them is so vivid, they can feel the pain for ever once recorded. Every painful image they see remains engraved in their brain.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Imagine the nightmare they live.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Without forgetting, we are haunted by the past without the ability to forgive or decide in present</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If Neuralink project was to go ahead, it needed a delete button.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>And here is the big question : Who can decide to select and delete one’s memories ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Before Neuralink, we are the first generations to have big parts of our lives permanently, digitally recorded.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google aggregate and bring up in a click all crumbs of information to re-compose the puzzle of our life.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What the right to be forgotten can do?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The so called Right to be Forgotten created by the European Court of Justice is not deleting the information but only de-linking the content by the search engine Google.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Under specific circumstances a right to delete has been introduced by the the recent European Regulation for the protection of personal data. But that is for a very small parcel of our sparse available information.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Since its creation 20 years ago, Google has been collecting a mass of data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google knows more about each of us than we know ourself.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>The new global&nbsp;Panoptican society of invisible surveillance is treat to human freedom and dignity.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Remembering has long been human’s dream. However, forgetting is a biological capacity. Today there is a shift. From biological forgetting we have moved to digital remembering.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Naturally, Memory is the exception, forgetting the default</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Digitally, Remembering has become the default, forgetting the exception.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Human health and wellness is based on the balance between memory and forgetfulness.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Leaves on trees take the colours of the autumn to fall. Gradually, they join the soil to enrich its nutrients. This putrefaction is what later allows the birth of new lives.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A transmutation the epigenetic is starting to see in human DNA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>We need to forget to better remember.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Awareness gives the ability to balance the pros and cons. To be aware is not being scared.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Does it worth the risk to post it online for the eternity ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>How best to protect our privacy?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>How to bring transparency and control for better privacy ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These are the options of our future, the future of our children.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Which kind of society we want for them ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To protect against unforeseen future, it’s better to store less than more.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Let us remember to forget, to borrow VMS words.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further reading :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><a href=\"https://www.linkedin.com/pulse/life-under-digit-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">Life Under Digits</a></li><li><a href=\"http://keeping%20an%20eye/\" target=\"_blank\" rel=\"noreferrer noopener\">Keeping an Eye</a></li><li><a href=\"https://www.linkedin.com/pulse/drones-autonomus-cars-ethics-regulation-tara-taubman-bassirian/\" target=\"_blank\" rel=\"noreferrer noopener\">Drones, Autonomous Cars Ethics and Regulation</a></li><li><a href=\"https://www.linkedin.com/pulse/challenges-artificial-intelligence-france-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">France Initiatives to Tackle the Challenges of Artificial Intelligence</a></li><li><a href=\"https://www.linkedin.com/pulse/video-surveillance-technology-tara-taubman-bassirian/\" target=\"_blank\" rel=\"noreferrer noopener\">Wearable Cameras</a></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</p>\n<!-- /wp:paragraph -->','Why Privacy Matters','The crumbs of information left behind, get aggregated and build a picture, sometimes distorted, that follows us. ','inherit','closed','closed','','14-revision-v1','','','2019-01-27 19:09:16','2019-01-27 19:09:16','',14,'https://datarainbow.eu/2019/01/27/14-revision-v1/',0,'revision','',0),(193,5,'2019-01-27 19:10:57','2019-01-27 19:10:57','<!-- wp:paragraph -->\n<p>The General Data Protection Regulation applies to Personal Data. But do we know what exactly defines Personal Data? The <a href=\"https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/what-is-personal-data/what-is-personal-data/\">UK ICO </a>recently published a clarification document. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":135} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.01.53.png\" alt=\"\" class=\"wp-image-135\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>First limitation, it does not include legal personalities. Natural person, are living people in contrast with legal entities or organisation. They are technically labelled \"Data Subject\'. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\'That individual must be identified or identifiable either directly or indirectly from one or more identifiers or from factors specific to the individual.\' this is where it gets more complicated and contextual.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR only applies to information which relates to an identifiable living individual. Consequently, information relating to a deceased person does not constitute personal data and therefore is not subject to the GDPR unless the EU country has opted to include them.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The processing of Personal Data covers a large variety of acts from collect, to copy to store the data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The processing don\'t need to be electronically, there are two majors ways of processing:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>personal data processed wholly or partly by automated means (that is, information in electronic form); and</li><li>personal data processed in a non-automated manner which forms part of, or is intended to form part of, a ‘filing system’ (that is, manual information in a filing system).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>The ICO further adds : \"The GDPR does not cover information which is not, or is not intended to be, part of a ‘filing system’. However, under the Data Protection Act 2018 (DPA 2018) unstructured manual information processed only by public authorities constitutes personal data. This includes<strong> paper records </strong>that are not held as part of a filing system. While such information is personal data under the DPA 2018, it is exempted from most of the principles and obligations in the GDPR and is aimed at ensuring that it is appropriately protected for requests under the Freedom of Information Act 2000.\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Further guidance on the provisions of the DPA 2018 is awaited.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is more clarification from the <a href=\"https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-personal-data_en\">EU Commission</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2 id=\"examples-of-personal-data\">Examples of personal data</h2>\n<!-- /wp:heading -->\n\n<!-- wp:list -->\n<ul><li>a name and surname;</li><li>a home address;</li><li>an email address such as&nbsp;<a href=\"mailto:name.surname@company.com\">name.surname@company.com</a>;</li><li>an identification card number;</li><li>location data (for example the location data function on a mobile phone)*;</li><li>an Internet Protocol (IP) address;</li><li>a cookie ID*;</li><li>the advertising identifier of your phone;</li><li>data held by a hospital or doctor, which could be a symbol that uniquely identifies a person.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Within identifiable data qualified as Personal Data, they are the special categories, previously called \'Sensitive Data\' tat requires further cautious and a higher level of protection. these will be data with regard to :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>race;</li><li>ethnic origin;</li><li>political opinions;</li><li>religious or philosophical beliefs;</li><li>trade union membership;</li><li>genetic data;</li><li>biometric data (where this is used for identification purposes);</li><li>health data;</li><li>sex life; or</li><li>sexual orientation.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>What about pseudonymised or anonymised Personal Data ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR defines pseudonymisation as:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":136} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.32.10.png\" alt=\"\" class=\"wp-image-136\" /><figcaption><br></figcaption></figure>\n<!-- /wp:image -->\n\n<!-- wp:image {\"id\":137} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-13.59.20.png\" alt=\"\" class=\"wp-image-137\" /></figure>\n<!-- /wp:image -->\n\n<!-- wp:paragraph -->\n<p>The EU Commission explains :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Personal data that has been de-identified, encrypted or&nbsp;pseudonymised&nbsp;but can be used to re-identify a person remains personal data and falls within the scope of the law.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>Personal data that has been rendered&nbsp;anonymous&nbsp;in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Here is an example provided by the UK ICO </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:image {\"id\":138} -->\n<figure class=\"wp-block-image\"><img src=\"/wp-content/uploads/sites/3/2019/01/Screenshot-2019-01-24-at-14.04.35.png\" alt=\"\" class=\"wp-image-138\" /></figure>\n<!-- /wp:image -->','What is Protected by the GDPR ?','The General Data Protection Regulation applies to Personal Data. But do we know what exactly defines Personal Data? The UK ICO recently published a clarification document. ','inherit','closed','closed','','134-revision-v1','','','2019-01-27 19:10:57','2019-01-27 19:10:57','',134,'https://datarainbow.eu/2019/01/27/134-revision-v1/',0,'revision','',0),(194,5,'2019-01-27 19:12:05','2019-01-27 19:12:05','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Decembre 2016, <a rel=\"noreferrer noopener\" href=\"http://www.infosecurity-magazine.com/news/over-half-of-global-firms-gdpr/?utm_source=dlvr.it&amp;utm_medium=twitter\" target=\"_blank\">Infosecurity</a> magasine titled \"Over Half of Global Firms Still Not Progressing with GDPR\" reporting :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“GDPR is the most significant change to data protection in a generation and an imminent global issue that will dominate data privacy, management and regulation discussions in 2017,” said Mike Palmer, executive vice-president at Veritas. “To avoid potential regulatory fines or worse, damage to their corporate brands and reputations, global enterprises must take action now to understand where their data resides and how to protect it.”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Since the UK referendum voting for BREXIT much has been speculated about the situation of the UK with regard to compliance to the GDPR enforceable from 28 May 2018. Although they are uncertainties, the recent&nbsp;<a href=\"http://www.pearltrees.com/idigital/uk-brexit-perspective-gdpr/id16418899#item186474786\" target=\"_blank\" rel=\"noreferrer noopener\">UK Information Commissioner speech</a>&nbsp;has reinforced the opinion that&nbsp;<a href=\"http://www.pearltrees.com/idigital/uk-brexit-perspective-gdpr/id16418899#item186474786\" target=\"_blank\" rel=\"noreferrer noopener\">UK businesses need to get ready to comply</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/gdpr-new-text/id15747243#item175275842\" target=\"_blank\">The GDPR&nbsp;</a>has  significantly raised the bar for compliance. Fines can go up to €20 million or 4% of annual global turnover. Organisations had two years to be ready. Shortage of Data Protection Officers was predicted. After an initial period of panic, the summer 2018 was rather quiet, many organisations were expectative waiting for the enforcement of the regulation. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The new EU data protection law, non sector-specific, is technologically neutral and all types of organisations are affected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Recital 22; Art.3(1), the GDPR applies to organisations that are established in one or more Member State and process personal data in the context of that establishment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 23 Art.3(2)(a) adds :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR applies to organisations established outside the EU if they process data of EU residents when offering them goods or services.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Finally, Recital 24 Art.3(2)(b) states :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR applies to organisations established outside the EU if they monitor the behaviour of EU residents.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What justifies compliance ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Because UK businesses will need to be compliant to continue to trade with the rest of the EU. </li><li>Because gaining customers trust is important. </li><li>Data breach notification cannot be neglected, the organisation\'s reputation can be badly hurt. </li><li>So much can be gained, from Big Data, geolocation data, IoT, etc... Privacy should be seen as an asset and not just a burden. </li><li>Marketers would benefit from accurate data instead of bulk out of date or inaccurate data collection . </li><li>Making privacy and data protection an asset could be the future of Big Data.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Collecting and legitimately processing data with respect to the 8 principals, incorporated into Chapter&nbsp;2, Article 5 (1) (a)-(f). are the future of data industry :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>storing data for a limited period or only where necessary, </li><li>keeping data accurate and adequate,</li><li>processing lawfully, fairly and in a transparent manner, with purpose limitation,</li><li>processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage,</li><li>using appropriate technical or organisational measures,</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>are all major improvements, Much remain to be done with ethics. Read more&nbsp;<a href=\"http://www.linkedin.com/pulse/drones-autonomus-cars-ethics-regulation-tara-taubman-bassirian?trk=mp-reader-card\" target=\"_blank\" rel=\"noreferrer noopener\">here&nbsp;</a>and&nbsp;<a href=\"http://itsecurity.co.uk/2016/10/still-denial-tough-new-privacy-law-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2016/10/still-denial-tough-new-privacy-law-gdpr/\" target=\"_blank\">Still in Denial of the Tough New Privacy Law GDPR?</a></h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Here is my compilation of all various opinions and analysis of the situation:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>to better understand what is required by the&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/gdpr/id15213471\" target=\"_blank\">GDPR</a>,</li><li>The&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/uk-brexit-perspective-gdpr/id16418899\" target=\"_blank\">UK and the GDPR</a>&nbsp;after BREXIT,</li><li>The&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/uk-brexit-perspective-gdpr/id16418899\" target=\"_blank\">Working Party ARticle 29</a>&nbsp;position,</li><li>Opinions of&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/from-privacy-experts-corner/id15213561\" target=\"_blank\">Privacy experts</a>,</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>This work is licensed under a&nbsp;</em></strong><a rel=\"noreferrer noopener\" href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\"><strong><em>Creative Commons Attribution 4.0 International License</em></strong></a><strong><em>.</em></strong></p>\n<!-- /wp:paragraph -->','What to retain from the GDPR','Since the UK referendum voting for BREXIT much has been speculated about the situation of the UK with regard to compliance to the GDPR enforceable from 28 May 2018. Although they are uncertainties, the recent UK Information Commissioner speech has reinforced the opinion that UK businesses need to get ready to comply.','inherit','closed','closed','','10-revision-v1','','','2019-01-27 19:12:05','2019-01-27 19:12:05','',10,'https://datarainbow.eu/2019/01/27/10-revision-v1/',0,'revision','',0),(195,5,'2019-01-27 19:20:52','2019-01-27 19:20:52','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian LLM</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Much has been said and complained about data protection regulations. Lots of criticism, its cost, resources consumption, business killer,….</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What\'s been forgotten is that the&nbsp;<a rel=\"noreferrer noopener\" href=\"https://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian/\" target=\"_blank\">General Data Protection Regulation (GDPR)</a>&nbsp;is not against data processing when done in respect with the data subject rights. The amount of electronically available data and curation and storage tools, justify a better protection. Privacy is a&nbsp;<a rel=\"noreferrer noopener\" href=\"https://rightsinfo.org/the-rights-in-the-european-convention/\" target=\"_blank\">Fundamental Human Right</a>, for dignity and freedom.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The equation is simple : Privacy = Transparency + Control</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A balance of rights and freedom of data subjects with respect to the interest of the business.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Before the GDPR, data protection directive lacked uniformity and the necessary certainty throughout the EU. The new Regulation is based on harmonisation and the&nbsp;<a href=\"https://rightsinfo.org/the-rights-in-the-european-convention/\" target=\"_blank\" rel=\"noreferrer noopener\">European Data Protection Board (EDPB)</a>&nbsp;is the authority in charge of the&nbsp;<a href=\"https://gdpr-info.eu/art-63-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">consistency mechanism - Article 63</a>&nbsp;- to make sure the regulation and its enforcement are harmoniously applied by all national Data Protection Authorities (DPAs).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>One of the more pro-active DPAs has been the French&nbsp;<a href=\"https://www.cnil.fr/en/home\" target=\"_blank\" rel=\"noreferrer noopener\">Commission Nationale de l\'Informatique et des Libertes (CNIL)</a>&nbsp;producing many guidelines in both French and English, including a very useful&nbsp;<a href=\"https://www.cnil.fr/en/pia-software-20-available-and-growth-pia-ecosystem\" target=\"_blank\" rel=\"noreferrer noopener\">Privacy Impact Assessment (PIA) tool</a>. So, I would like to think French companies have benefited from all necessary guidances to comply after two years period of preparation and 6 months after the GDPR entered into effect.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In two previous article, I wrote about the&nbsp;<a href=\"https://www.linkedin.com/pulse/cnil-published-first-review-6-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">CNIL’s report after 6 months of activities</a>&nbsp;and&nbsp;<a href=\"https://www.linkedin.com/pulse/six-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">some of their main cases.</a>&nbsp;While The UK ICO has been more focusing on fining nuisance calls and clarifying data subject\'s access after investigating Facebook Analytica case, The French CNIL focus has been :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>clarifying criteria of consent in four cases of Mobile App data collection,</li><li>clarifying CCTV monitoring and biometrics in work place</li><li>clarifying cookie compliance.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p><strong>What are cookies?</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Better than me,&nbsp;<a href=\"https://termly.io/resources/articles/cookies-comprehensive-guide/\" target=\"_blank\" rel=\"noreferrer noopener\">KJ Kearie has a Comprehensive Guide&nbsp;</a>on cookies, I recommend you read.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“A cookie is&nbsp;<a href=\"https://www.theguardian.com/technology/2012/apr/23/cookies-and-web-tracking-intro\" target=\"_blank\" rel=\"noreferrer noopener\">a tiny bit of plain text</a>&nbsp;that a website downloads to a computer when that user’s browser opens a new webpage. They are used to remember useful pieces of data from the users they encounter, acting as an<strong>invisible liaison between a domain’s owner and visitors</strong>.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>A cookie can identify both the user and the browser, and can be left on the user’s device indefinitely. When the user’s browser returns to that website, the cookie connects with the domain and shares with it the data it has collected or stored about that user.</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>There are two main types of cookies –&nbsp;<a href=\"http://www.allaboutcookies.org/cookies/session-cookies-used-for.html\" target=\"_blank\" rel=\"noreferrer noopener\">session cookies</a>&nbsp;only collect details from a single browsing sessions, while&nbsp;<a href=\"https://www.techopedia.com/definition/4901/persistent-cookie\" target=\"_blank\" rel=\"noreferrer noopener\">persistent cookies</a>remain on the user’s device and collect information over time.\"</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>In terms of functionality, some cookies aim to a better browsing experience such as remembering the language of their visitor, others, more pernicious, track the users habits, profiling users for targeted advertising. Data collected has fuelled a huge business of data brokage raising privacy and security concerns. In November,&nbsp;<a href=\"https://privacyinternational.org/feature/2433/i-asked-online-tracking-company-all-my-data-and-heres-what-i-found\" target=\"_blank\" rel=\"noreferrer noopener\">Privacy International</a>, the UK based organisation, has filed&nbsp;<a href=\"https://privacyinternational.org/press-release/2424/privacy-international-files-complaints-against-seven-companies-wide-scale-and\" target=\"_blank\" rel=\"noreferrer noopener\">complaints</a>&nbsp;against seven data brokers (Acxiom, Oracle), ad-tech companies (Criteo, Quantcast, Tapad), and credit referencing agencies (Equifax, Experian) with data protection authorities in France, Ireland, and the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If you think online tracking and profiling are legitimate? Watch&nbsp;<a href=\"https://www.youtube.com/watch?v=xYZtHIPktQg&amp;feature=youtu.be\" target=\"_blank\" rel=\"noreferrer noopener\">this video</a>&nbsp;it\'s eloquent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Online customers deserve the same privacy as offline.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Cookie law, known as the ePrivacy Directive, has long been misunderstood. It is not a useless banner asking you to confirm you agree for your personal data to be collected in order to access the website. Just in case, you have forgotten, an IP address or any identifiable information is considered a personal data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>What are website owners duties exactly ?</strong>&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To provide clear transparency to inform their visitors about the personal data they collect, how long it is kept, with whom they share the data and data subjects rights of access, right to delete, amend or the right of portability. These informations should be provided at the time of data collection, made accessible on each webpage, in clear language.&nbsp;<a href=\"https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227\" target=\"_blank\" rel=\"noreferrer noopener\">The WP art 29&nbsp;</a>requires that</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“Every organisation that maintains a website should publish a privacy statement/ notice on the website. A link to this privacy statement/ notice should be clearly visible on each page of this website under a commonly used term (such as “Privacy”, “Privacy Policy” or “Data Protection Notice”). Positioning or colour schemes that make a text or link less noticeable, or hard to find on a webpage, are not considered easily accessible. “</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:list -->\n<ul><li>it must be concise, transparent, intelligible and easily accessible (Article 12.1);</li><li>clear and plain language must be used (Article 12.1);</li><li>the requirement for clear and plain language is of particular importance when</li><li>providing information to children (Article 12.1);</li><li>it must be in writing “or by other means, including where appropriate, by electronic</li><li>means” (Article 12.1);</li><li>where requested by the data subject it may be provided orally (Article 12.1) ; and</li><li>it must be provided free of charge (Article 12.5).</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>In short, a privacy notice is required to provide “<em>Concise, transparent, intelligible and easily accessible</em>” information about the data collected from visitors.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Alined with the WP guidance, the&nbsp;<a href=\"https://www.linkedin.com/pulse/six-months-gdpr-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">French DPA CNIL</a>&nbsp;has required clear information for visitors, and for non exclusively technical cookies, consent is required. AND - that is very important - opting out of cookie tracking should not be detrimental to the use of the service. This goes with the clear position of the Working Party Art 29, replaced by the EDPB.&nbsp;For more on Privacy by Design, you might want to follow&nbsp;<a href=\"https://www.ryerson.ca/pbdce/about/ann-cavoukian/\" target=\"_blank\" rel=\"noreferrer noopener\">Ann Cavoukian</a>, Leading the Privacy by Design Centre of Excellence at Ryerson University.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>So, remember, privacy = transparency + control. that means an obligation to tell visitors what is collected, with whom is shared, users rights and clear opt out.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Despite all clear guidance, too many websites are non compliant.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>You’d expect lawyers would have it right, for being well aware of the regulation. The French association of lawyers, the CNB, has done a good job informing their members by producing ample&nbsp;<a href=\"https://www.cnb.avocat.fr/sites/default/files/documents/guide_rgpd_avocats-2018.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">guidance</a>&nbsp;to follow.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additionally law firms handle sensitive data of clients, so they should be the ones showing the good example.&nbsp;<a href=\"https://twitter.com/clarinette02/status/1071025796767236097\" target=\"_blank\" rel=\"noreferrer noopener\">Recently</a>, I have looked at&nbsp;<a href=\"http://www.cbbc-avocats.com/cbbc/lequipe\" target=\"_blank\" rel=\"noreferrer noopener\">few websites</a>&nbsp;from some of&nbsp;<a href=\"http://www.hleclerc-avocats.fr/alain-weber\" target=\"_blank\" rel=\"noreferrer noopener\">the top law firms</a>&nbsp;in Paris. It is outraging to see they are mostly ignoring their obligations. Lack of information about cookies, no privacy notice or insufficient information. Too many are even&nbsp;<a href=\"https://www.theverge.com/2018/7/24/17603126/google-chrome-unencrypted-not-secure\" target=\"_blank\" rel=\"noreferrer noopener\">tagged as ‘Not Secure’ by Google Chrome web browser&nbsp;</a>lacking encryption. [This is when the lock does not show next to the URL ‘http’ instead of https. unencrypted transmission means that data can be intercepted.] Some of the websites I visited have visitors contact forms or candidates applications online with CV upload.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I raised the issue few weeks ago, two of the law firms amended the security certification to https. One specialised DPO did not considered a cookie banner or&nbsp;<a href=\"http://www.jacobavocats.com/mentions-legales/\" target=\"_blank\" rel=\"noreferrer noopener\">more comprehensive privacy notice was needed</a>. It is painful to see members of the law society or big law firms could have so little consideration for privacy and data protection of clients and web visitors. I see too many exchange documents via un-encrypted email attachments. These big law firms have opulent clients around the world including outside the EU. How do they comply with data flow regulation to countries of non adequate data protection, not just China, that includes the USA as well. I have brought the CNIL\'s attention to this issue. Knowing that a website is the vitrine of a business, it worth the effort.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Data breach has been on everyday news. Have you heard of&nbsp;<a href=\"https://www.forbes.com/sites/davidvolodzko/2018/12/04/marriott-breach-exposes-far-more-than-just-data/\" target=\"_blank\" rel=\"noreferrer noopener\">Marriott hotels breach</a>&nbsp;gone undetected for four years?&nbsp;<a href=\"https://www.linkedin.com/pulse/after-canada-airlines-here-comes-british-airways-tara/\" target=\"_blank\" rel=\"noreferrer noopener\">Air Canada</a>, British Airways, Cathay Pacific, Yahoo, Equifax,,.... and many more. Fines will not give back data subjects\' hassle when dealing with ID theft or financial misuse.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It’s not anymore IF but WHEN.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Any data collection creates data breach risk.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I invite you to read&nbsp;<a href=\"https://www.linkedin.com/pulse/memory-forgetfulness-privacy-tara-taubman-bassirian-llm/\" target=\"_blank\" rel=\"noreferrer noopener\">Memory, Forgetfulness and Delete</a>&nbsp;because Privacy matters to us all,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>and from&nbsp;<a href=\"https://blog.usejournal.com/is-your-web-site-breaking-eu-law-7e5b7eb33d5d?fbclid=IwAR3n5duN22qnmVk_he_EHxsg2JQA2DCeCzAzoTk9AUBUWlUvV8h4k75FoBg\" target=\"_blank\" rel=\"noreferrer noopener\">Alexander Hanff&nbsp;</a>: \"<em>Your consent notice should provide a list of all of these assets (unless covered by the “strictly necessary” exception) and provide the option for the data to refuse the loading of any or all of these assets.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Connected read&nbsp;<a href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/?published=t\" target=\"_blank\" rel=\"noreferrer noopener\">Law&nbsp;</a>Firm Internet Security and Data Protection</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/pulse/law-firm-internet-security-data-protection-tara-taubman-bassirian-llm/?published=t\" target=\"_blank\" rel=\"noreferrer noopener\">Firms Data Security</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Follow ongoing&nbsp;<a href=\"http://www.pearltrees.com/idigital/firms-data-security-liability/id15689736\" target=\"_blank\" rel=\"noreferrer noopener\">Pearltrees curation</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>This work is licensed under a&nbsp;<a href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\" rel=\"noreferrer noopener\">Creative Commons Attribution 4.0 International License</a>.</li></ul>\n<!-- /wp:list -->','Website transparency : Cookies and privacy notice','The General Data Protection Regulation (GDPR) is not against data processing when done in respect with the data subject rights. The amount of electronically available data and curation and storage tools, justify a better protection. Privacy is a Fundamental Human Right, for dignity and freedom.','inherit','closed','closed','','26-revision-v1','','','2019-01-27 19:20:52','2019-01-27 19:20:52','',26,'https://datarainbow.eu/2019/01/27/26-revision-v1/',0,'revision','',0),(197,5,'2019-01-27 19:22:54','2019-01-27 19:22:54','<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In Decembre 2016, <a rel=\"noreferrer noopener\" href=\"http://www.infosecurity-magazine.com/news/over-half-of-global-firms-gdpr/?utm_source=dlvr.it&amp;utm_medium=twitter\" target=\"_blank\">Infosecurity</a> magasine titled \"Over Half of Global Firms Still Not Progressing with GDPR\" reporting :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:quote -->\n<blockquote class=\"wp-block-quote\"><p>“GDPR is the most significant change to data protection in a generation and an imminent global issue that will dominate data privacy, management and regulation discussions in 2017,” said Mike Palmer, executive vice-president at Veritas. “To avoid potential regulatory fines or worse, damage to their corporate brands and reputations, global enterprises must take action now to understand where their data resides and how to protect it.”</p></blockquote>\n<!-- /wp:quote -->\n\n<!-- wp:paragraph -->\n<p>Since the UK referendum vote for BREXIT much has been speculated about the situation of the UK with regard to compliance to the GDPR enforceable from 28 May 2018. Although they are uncertainties, the recent <a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/uk-brexit-perspective-gdpr/id16418899#item186474786\" target=\"_blank\">UK Information Commissioner speech</a> has reinforced the opinion that <a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/uk-brexit-perspective-gdpr/id16418899#item186474786\" target=\"_blank\">UK businesses need to get ready to comply</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/gdpr-new-text/id15747243#item175275842\" target=\"_blank\">The GDPR&nbsp;</a>has  significantly raised the bar for compliance. Fines can go up to €20 million or 4% of annual global turnover. Organisations had two years to be ready. Shortage of Data Protection Officers was predicted. After an initial period of panic, the summer 2018 was rather quiet, many organisations were expectative waiting for the enforcement of the regulation. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The new EU data protection law, non sector-specific, is technologically neutral and all types of organisations are affected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>According to Recital 22; Art.3(1), the GDPR applies to organisations that are established in one or more Member State and process personal data in the context of that establishment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 23 Art.3(2)(a) adds :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>The GDPR applies to organisations established outside the EU if they process data of EU residents when offering them goods or services.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Finally, Recital 24 Art.3(2)(b) states :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR applies to organisations established outside the EU if they monitor the behaviour of EU residents.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>What justifies compliance ? </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Because UK businesses will need to be compliant to continue to trade with the rest of the EU. </li><li>Because gaining customers trust is important. </li><li>Data breach notification cannot be neglected, the organisation\'s reputation can be badly hurt. </li><li>So much can be gained, from Big Data, geolocation data, IoT, etc... Privacy should be seen as an asset and not just a burden. </li><li>Marketers would benefit from accurate data instead of bulk out of date or inaccurate data collection . </li><li>Making privacy and data protection an asset could be the future of Big Data.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Collecting and legitimately processing data with respect to the 8 principals, incorporated into Chapter&nbsp;2, Article 5 (1) (a)-(f). are the future of data industry :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>storing data for a limited period or only where necessary, </li><li>keeping data accurate and adequate,</li><li>processing lawfully, fairly and in a transparent manner, with purpose limitation,</li><li>processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage,</li><li>using appropriate technical or organisational measures,</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>are all major improvements, Much remain to be done with ethics. Read more&nbsp;<a href=\"http://www.linkedin.com/pulse/drones-autonomus-cars-ethics-regulation-tara-taubman-bassirian?trk=mp-reader-card\" target=\"_blank\" rel=\"noreferrer noopener\">here&nbsp;</a>and&nbsp;<a href=\"http://itsecurity.co.uk/2016/10/still-denial-tough-new-privacy-law-gdpr/\" target=\"_blank\" rel=\"noreferrer noopener\">here</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:heading -->\n<h2><a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/2016/10/still-denial-tough-new-privacy-law-gdpr/\" target=\"_blank\">Still in Denial of the Tough New Privacy Law GDPR?</a></h2>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>Here is my compilation of all various opinions and analysis of the situation:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>to better understand what is required by the&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/gdpr/id15213471\" target=\"_blank\">GDPR</a>,</li><li>The&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/uk-brexit-perspective-gdpr/id16418899\" target=\"_blank\">UK and the GDPR</a>&nbsp;after BREXIT,</li><li>The&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/uk-brexit-perspective-gdpr/id16418899\" target=\"_blank\">Working Party ARticle 29</a>&nbsp;position,</li><li>Opinions of&nbsp;<a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/from-privacy-experts-corner/id15213561\" target=\"_blank\">Privacy experts</a>,</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong><em>This work is licensed under a&nbsp;</em></strong><a rel=\"noreferrer noopener\" href=\"http://creativecommons.org/licenses/by/4.0/\" target=\"_blank\"><strong><em>Creative Commons Attribution 4.0 International License</em></strong></a><strong><em>.</em></strong></p>\n<!-- /wp:paragraph -->','What to retain from the GDPR after BREXIT','Since the UK referendum vote for BREXIT much has been speculated about the situation of the UK with regard to compliance to the GDPR enforceable from 28 May 2018. Although they are uncertainties, the recent UK Information Commissioner speech has reinforced the opinion that UK businesses need to get ready to comply.','inherit','closed','closed','','10-revision-v1','','','2019-01-27 19:22:54','2019-01-27 19:22:54','',10,'https://datarainbow.eu/2019/01/27/10-revision-v1/',0,'revision','',0),(198,5,'2019-01-27 19:56:41','2019-01-27 19:56:41','<!-- wp:paragraph -->\n<p>by MC PÉROUX, LL. M January 14, 2019 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>WHY PRIVACY BY DESIGN UNDER THE GDPR IS IMPORTANT FOR COMPANIES (1)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>MC PÉROUX, LL. M</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>January 22, 2019</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A QUICK RECAP OF THE 7 FOUNDATIONAL PRINCIPLES (2)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have been developed and conceptualised since the 90’s by Ann Cavoukian, Ph.D., and for the first time, a mandatory legal text has included its tenets, the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>➔ purpose limitation (GDPR, art 5-1 b), data minimisation (GDPR, art 5-1 c))</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li>Proactive not Reactive; Preventative not Remedial -&gt; purpose limitation (GDPR, art 5-1 b), data minimisation (GDPR, art 5-1 c))</li><li>Privacy as the Default Setting</li><li>Privacy Embedded into Design -&gt; GDPR art 25</li><li>Full Functionality - Positive-Sum, not Zero-Sum -&gt; “Privacy by Design avoids the pretense of false dichotomies, such as privacy vs. security, demonstrating that it is possible to have both. “  -&gt; See the current discussions on different business models of free information services accessibility without a paywall (personal information given of exchange of free information) (4)</li><li>End-to-End Security - Full Lifecycle Protection -&gt; GDPR: art 5-1 f), art 25 and art 32 (“ level of security appropriate to the risk “)</li><li>Visibility and Transparency - Keep it Open -&gt; Accountability, GDPR art 5-2, art12</li><li>Respect for User Privacy - Keep it User-Centric -&gt;  Accuracy GDPR art 5-1 d), Rights of the Data Subjects, GDPR Chapter III</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>WHY SHOULD COMPANIES REALISE THE IMPORTANCE OF PRIVACY BY DESIGN ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR introduces a change in paradigm.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is not centered on the processors but on the individuals’ fundamental rights.  (5)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The gauge to assess an envisaged personal treatment remains the risk it represents to the data subjects’ fundamental rights, the right to privacy being one of them.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>NO RIGHT IS ABSOLUTE AND THE GDPR IS A BALANCING ACT BETWEEN THE RIGHT TO PRIVACY AND OTHER RIGHTS</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the current issue on the right to erasure (art 17) where the CJEU Attorney General, M. Maciej Szpunar, recommends a limitation of this rights balancing it with the right to information: §<em>57 “ En revanche, et c’est en quelque sorte le nœud de la présente affaire, le « droit à l’oubli » doit être mis en balance avec d’autres droits fondamentaux. “  </em>(6)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When designing any process on personal data the very first question of the processor should be “do I respect and embed the fundamental rights of the persons when I use their personal data? “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I know this is still too rare an attitude especially among the internet personal data giants like the (in)famous GAFAM (7).  Their entire business model is based on the gathering of as much personal data (under the GDPR extensive definition) as possible with too often very deceptive opaque methods.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>NEW TRENDS AMONG COMPANIES PROCESSING PERSONAL DATA&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some companies, more forward looking, realise that the users, real persons with real interest in protecting their physical life from intrusive data hogging methods, demand that something has to change in the handling of their private information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have perhaps understood the general move towards more respect for the individuals’ privacy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Look at the legal trend towards the respect of private information from the upcoming Californian Legislation (8), the success of Convention108 in bringing privacy considerations into many jurisdictions (9) , even the president of Apple, Tim Cook, is asking for a legislation on privacy (10).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>At the recent 2019 edition of the CES, privacy made an entrance but it remains to be seen whether the companies do really apply Privacy By Design or if they are just surfing on the trends.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Too often, companies with a business model based on processing personal data or selling software allowing it, announce that they are “100% GDPR compliant “ but when one looks more into the process they use, it is clear that the GDPR principles have been overlooked or interpreted wrongly… (11)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the other end of the spectrum, one finds even some American companies that communicate on privacy as a feature embedded from the start in their business model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example:&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Info: I have no affiliation, no interest in the companies, I do not endorse their products</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ HUMU  (12)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although I do not like behavioural analysis in general, finding it extremely invasive on privacy, this company’s communication seems ahead of others on Privacy By Design &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>That’s why we built with the GDPR in mind from day one, and we extend the rights from the GDPR to every user no matter where in the world they live. This includes transparency, control, and data portability. </em>“ (13)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ SNIPS (14)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>Snips Global Communications Director Genia Shipova said the focus on privacy by design is what makes Snips a GDPR-friendly solution. »  She said Snips wants to avoid data-centric business models used by larger tech companies by focusing on contracts with its customers.</em>“  (15)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ Q-Branch Labs (16)  and their Vektor (17) product</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\" <em>We start with the assumption that everything we send out of this device has to be GDPR-cleared. We just don\'t want to deal with the problems. All of the logs and security alerts that we send out, we still rip out all of the private information.</em>\" Says the founder Jim McCoy </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ OEKON SAS and its device ASK-HARROLD  (19) developed in France </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on an AI that searches for you information on Internet</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONCLUSION</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I hope that companies realise how important it is to understand the principles to protect and respect the ever-growing mass of personal data they handle. They could start reading Art 5 of the GDPR relating to its founding principles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google just learned the hard way what Privacy By Design means for the French DPA, the CNIL.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its last decision,&nbsp; the CNIL clearly states that the users are not properly informed before consenting due to the numerous steps they have to take in order to find information in the process. The decision is a lesson on what is bad and opaque design to lure the users to consent to vague descriptions of processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To respect Privacy By Design is just to respect the persons at the end of the process.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Maybe by showing respect, some companies could even gain trust from their customers.</li><li>Place yourself in the shoes of the person when you design any personal data treatment.</li><li>Imagine that this person is someone important to you and see how it really feels to you that her personal data, her life, is processed by your envisaged treatment.</li><li>Educate the developers to the values of privacy during their studies.</li><li>Hire people who understand the value of their own privacy to develop your processes.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Yes business is important but ethics, respect should not be lost.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A person who trusts a company’s handling of her data will give the information needed, it is a trust that companies should gain, not steel away by opaque processes and algorithms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>MC PÉROUX, LL. M</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Blog in French to help SMB’s to understand privacy <a href=\"https://mementosafe.com/\">https://mementosafe.com/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/in/marieclaire74/\">LinkedIn</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://twitter.com/MCPLLM\">Twitter</a></p>\n<!-- /wp:paragraph -->','PRIVACY BY DESIGN AND BY DEFAULT UNDER THE GDPR','PRIVACY BY DESIGN have been developed and conceptualised since the 90’s by Ann Cavoukian, Ph.D., and for the first time, a mandatory legal text has included its tenets, the GDPR.','inherit','closed','closed','','16-revision-v1','','','2019-01-27 19:56:41','2019-01-27 19:56:41','',16,'https://datarainbow.eu/2019/01/27/16-revision-v1/',0,'revision','',0),(199,5,'2019-01-27 20:00:45','2019-01-27 20:00:45','<!-- wp:heading {\"level\":1} -->\n<h1>The GDPR</h1>\n<!-- /wp:heading -->\n\n<!-- wp:paragraph -->\n<p>by Tara Taubman-Bassirian</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The General Data Protection Regulation, or \"GDPR\" - “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. - was published 4 May 2016. Enforceable after a grace period of two year,  from the 28th of May 2018. What made the headlines was the maximum fines of up to  20 million € or 4% of annual global turnover.  </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The text is a major reform of Data Protection Directive. An evolution but not a revolution. With the aim of introducing harmonisation, Some of the major  changes are  :</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;<strong>mandatory reporting for data breaches</strong>, to the Data Protection Authority and if risk to data subject, within&nbsp;<strong>72 hours,</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;<strong>heavier sanctions</strong>, with significant new fines: Maximum fines of&nbsp;<strong>€20 million&nbsp;</strong>or&nbsp;<strong>4% of annual global turnover&nbsp;</strong><em>per&nbsp;</em>breach (a dramatic increase from the current typical maximum of less than €1 million).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- extra-territorial jurisdiction : businesses outside the EU will be subject to the GDPR, if they are&nbsp;<strong>offering goods or services to</strong>, or&nbsp;<strong>monitoring the behaviour of</strong>, EU residents (currently they are only caught if they operate data processing equipment in the EU). See further on this below.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;<strong>the one-stop-shop</strong>, </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>- Organisations will have to formally appoint an&nbsp;<strong>independent Data Protection Officer</strong>, where, according to the Art 37 ; </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li>the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;</li><li>the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or</li><li>the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to&nbsp;<a href=\"https://gdpr-info.eu/art-9-gdpr/\">Article 9</a>&nbsp;or personal data relating to criminal convictions and offences referred to in&nbsp;<a href=\"https://gdpr-info.eu/art-10-gdpr/\">Article 10</a>.</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;<strong>revised consent</strong>, a higher standard required to be express/opt-in (a ‘clear affirmative action’) whereas, under the previous regime, implied/opt-out consent is sometimes sufficient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;<strong>No more registration for data</strong>&nbsp;controllers. Instead, they are required to maintain internal records of their processing activities (for disclosure on demand to Data Protection Authorities), However, the registration and fees were maintained in the UK.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;<strong>Processor liability:&nbsp;</strong>data processors (i.e. businesses processing personal data solely for and on the instructions of data controllers) will have direct regulatory obligations/liability.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>-&nbsp;<strong>data protection impact assessments</strong>&nbsp;featuring as key aspects. If the results of the assessment indicate a high risk, obtain a prior review by the relevant Data Protection Authority. The accountability principle gives some homework to organisations to demonstrate to lead risk assessments and keep registers.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>EU countries had to consequently modify their national legislations with few options for exceptions.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The UK situation of adequacy is pendant to the Brexit. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/s/file/preview/137285627/GDPR_infographic_PrivacyPerfect.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">GDPR Infographic PrivacyPerfect</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Additional sources :<a rel=\"noreferrer noopener\" href=\"http://iapp.org/media/pdf/resource_center/iapp-EY-2016-SLIDES_85%E2%80%9396.pdf%20%E2%80%A6\" target=\"_blank\">Survey: \"most commonly taken steps to prepare for GDPR\"</a><a rel=\"noreferrer noopener\" href=\"http://teachprivacy.com/gdpr-privacy-shield-training-requirements-faq/%20%E2%80%A6\" target=\"_blank\">G</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"http://teachprivacy.com/gdpr-privacy-shield-training-requirements-faq/%20%E2%80%A6\" target=\"_blank\">See more here on&nbsp;</a><a rel=\"noreferrer noopener\" href=\"http://www.pearltrees.com/idigital/gdpr/id15213471\" target=\"_blank\">Pearltrees kept updated.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a rel=\"noreferrer noopener\" href=\"http://www.linkedin.com/pulse/all-you-need-know-gdpr-compliance-tara-taubman-bassirian?trk=mp-reader-card\" target=\"_blank\">All You Need To Know About The GDPR Compliance</a>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"http://www.pearltrees.com/idigital/gdpr/id15213471\" target=\"_blank\" rel=\"noreferrer noopener\">Using the curation tool Pearltrees, the resource will be kept updated.</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Publication in ITsecurity.co.uk :&nbsp;<a rel=\"noreferrer noopener\" href=\"http://itsecurity.co.uk/?p=4413\" target=\"_blank\">Still in Denial of the Tough New Privacy Law #GDPR?</a>&nbsp;UK data protection and BREXIT.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li></li></ul>\n<!-- /wp:list -->','Navigating the new EU Data Protection Rules','The General Data Protection Regulation, or \"GDPR\" - “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. - was published 4 May 2016. Enforceable after a grace period of two year,  from the 28th of May 2018. ','inherit','closed','closed','','8-revision-v1','','','2019-01-27 20:00:45','2019-01-27 20:00:45','',8,'https://datarainbow.eu/2019/01/27/8-revision-v1/',0,'revision','',0),(201,5,'2019-01-27 20:14:03','2019-01-27 20:14:03','<!-- wp:paragraph -->\n<p>by MC PÉROUX, LL. M January 14, 2019 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>WHY PRIVACY BY DESIGN UNDER THE GDPR IS IMPORTANT FOR COMPANIES&nbsp;(1)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>MC PÉROUX, LL. M</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>January 22, 2019</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A QUICK RECAP OF THE 7 FOUNDATIONAL PRINCIPLES&nbsp;(2)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have been developed and conceptualised since the 90’s by Ann Cavoukian, Ph.D., and for the first time, a mandatory legal text has included its tenets, the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>➔ purpose limitation (GDPR, art 5-1 b), data minimisation (GDPR, art 5-1 c))</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li>Proactive not Reactive; Preventative not Remedial -&gt; purpose limitation (GDPR, art 5-1 b), data minimisation (GDPR, art 5-1 c))</li><li>Privacy as the Default Setting</li><li>Privacy Embedded into Design -&gt; GDPR art 25</li><li>Full Functionality - Positive-Sum, not Zero-Sum -&gt; “Privacy by Design avoids the pretense of false dichotomies, such as privacy vs. security, demonstrating that it is possible to have both. “&nbsp; -&gt; See the current discussions on different business models of free information services accessibility without a paywall (personal information given of exchange of free information)&nbsp;(4)</li><li>End-to-End Security - Full Lifecycle Protection -&gt; GDPR: art 5-1 f), art 25 and art 32 (“ level of security appropriate to the risk “)</li><li>Visibility and Transparency - Keep it Open -&gt; Accountability, GDPR art 5-2, art12</li><li>Respect for User Privacy - Keep it User-Centric -&gt;  Accuracy GDPR art 5-1 d), Rights of the Data Subjects, GDPR Chapter III</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>WHY SHOULD COMPANIES REALISE THE IMPORTANCE OF PRIVACY BY DESIGN ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR introduces a change in paradigm.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is not centered on the processors but on the individuals’ fundamental rights.&nbsp; (5)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The gauge to assess an envisaged personal treatment remains the risk it represents to the data subjects’ fundamental rights, the right to privacy being one of them.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>NO RIGHT IS ABSOLUTE AND THE GDPR IS A BALANCING ACT BETWEEN THE RIGHT TO PRIVACY AND OTHER RIGHTS</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the current issue on the right to erasure (art 17) where the CJEU Attorney General, M. Maciej Szpunar, recommends a limitation of this rights balancing it with the right to information:&nbsp;§<em>57 “ En revanche, et c’est en quelque sorte le nœud de la présente affaire, le « droit à l’oubli » doit être mis en balance avec d’autres droits fondamentaux. “&nbsp;&nbsp;</em>(6)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When designing any process on personal data the very first question of the processor should be “do I respect and embed the fundamental rights of the persons when I use their personal data? “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I know this is still too rare an attitude especially among the internet personal data giants like the (in)famous GAFAM (7).&nbsp; Their entire business model is based on the gathering of as much personal data (under the GDPR extensive definition) as possible with too often very deceptive opaque methods.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>NEW TRENDS AMONG COMPANIES PROCESSING PERSONAL DATA&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some companies, more forward looking, realise that the users, real persons with real interest in protecting their physical life from intrusive data hogging methods, demand that something has to change in the handling of their private information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have perhaps understood the general move towards more respect for the individuals’ privacy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Look at the legal trend towards the respect of private information from the upcoming Californian Legislation (8), the success of Convention108 in bringing privacy considerations into many jurisdictions (9) , even the president of Apple, Tim Cook, is asking for a legislation on privacy&nbsp;(10).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>At the recent 2019 edition of the CES, privacy made an entrance but it remains to be seen whether the companies do really apply Privacy By Design or if they are just surfing on the trends.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Too often, companies with a business model based on processing personal data or selling software allowing it, announce that they are “100% GDPR compliant “ but when one looks more into the process they use, it is clear that the GDPR principles have been overlooked or interpreted wrongly…&nbsp;(11)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the other end of the spectrum, one finds even some American companies that communicate on privacy as a feature embedded from the start in their business model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example:&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Info: I have no affiliation, no interest in the companies, I do not endorse their products</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ HUMU&nbsp; (12)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although I do not like behavioural analysis in general, finding it extremely invasive on privacy, this company’s communication seems ahead of others on Privacy By Design &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>That’s why we built with the GDPR in mind from day one, and we extend the rights from the GDPR to every user no matter where in the world they live. This includes transparency, control, and data portability. </em>“&nbsp;(13)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ SNIPS&nbsp;(14)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>Snips Global Communications Director Genia Shipova said the focus on privacy by design is what makes Snips a GDPR-friendly solution. »&nbsp; She said Snips wants to avoid data-centric business models used by larger tech companies by focusing on contracts with its customers.</em>“&nbsp; (15)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ Q-Branch Labs (16)&nbsp; and their Vektor&nbsp;(17) product</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\" <em>We start with the assumption that everything we send out of this device has to be GDPR-cleared. We just don\'t want to deal with the problems. All of the logs and security alerts that we send out, we still rip out all of the private information.</em>\" Says the founder Jim McCoy&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ OEKON SAS and its device ASK-HARROLD&nbsp; (19) developed in France&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on an AI that searches for you information on Internet</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONCLUSION</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I hope that companies realise how important it is to understand the principles to protect and respect the ever-growing mass of personal data they handle. They could start reading Art 5 of the GDPR relating to its founding principles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google just learned the hard way what Privacy By Design means for the French DPA, the CNIL.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its last decision,&nbsp; the CNIL clearly states that the users are not properly informed before consenting due to the numerous steps they have to take in order to find information in the process. The decision is a lesson on what is bad and opaque design to lure the users to consent to vague descriptions of processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To respect Privacy By Design is just to respect the persons at the end of the process.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Maybe by showing respect, some companies could even gain trust from their customers.</li><li>Place yourself in the shoes of the person when you design any personal data treatment.</li><li>Imagine that this person is someone important to you and see how it really feels to you that her personal data, her life, is processed by your envisaged treatment.</li><li>Educate the developers to the values of privacy during their studies.</li><li>Hire people who understand the value of their own privacy to develop your processes.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Yes business is important but ethics, respect should not be lost.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A person who trusts a company’s handling of her data will give the information needed, it is a trust that companies should gain, not steel away by opaque processes and algorithms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>MC PÉROUX, LL. M</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Blog in French to help SMB’s to understand privacy <a href=\"https://mementosafe.com/\">https://mementosafe.com/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/in/marieclaire74/\">LinkedIn</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://twitter.com/MCPLLM\">Twitter</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(1) More details on PBD “<a href=\"https://www.linkedin.com/pulse/privacy-security-design-data-gdpr-compliance-marieclaire-p%C3%A9roux/\">Privacy and security by design, data security, and GDPR compliance</a>“, MC Péroux, dec.12, 2018 on LinkedIn<br>(2) <a href=\"https://www.ipc.on.ca/wpcontent/uploads/resources/7foundationalprinciples.pdf\">Privacy By Design The 7 Foundational Principles</a>- January 2011 <br>(3) <em>Ibid</em>.<br>(4) “<a href=\"https://www.huntonprivacyblog.com/2019/01/07/austrian-dpa-issues-decision-on-validityof-cookie-consent-solution/\">A</a><em><a href=\"https://www.huntonprivacyblog.com/2019/01/07/austrian-dpa-issues-decision-on-validityof-cookie-consent-solution/\">ustrian DPA Issues Decision on Validity of Cookie Consent Solution</a></em>“ , Hunton Andrews, Kurth LLP, Posted on January 7, 2019,<br> “<em>The differing approaches taken by the Austrian DPA and the UK ICO demonstrates a lack of alignment on this issue, and it remains to be seen how other DPAs will decide on the issue</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(5) <a href=\"http://www.europarl.europa.eu/charter/pdf/text_en.pdf\">Charter of Fundamental Rights of the European Union, art 8(1)</a><br>(6) In French, Conclusions de l’avocat général M. Maciej Szpunar présentées le 10 janvier 2019, <a href=\"http://curia.europa.eu/juris/celex.jsf?celex=62017CC0507&amp;lang1=fr&amp;lang2=EN&amp;type=TXT  &amp;ancre=\">Affaire C-507/17, Google LLC</a>, venant aux droits de Google Inc. Contre Commission Nationale de l’Informatique et des Libertés (CNIL),<br>(7) GOOGLE, AMAZON, FACEBOOK, APPLE, MICROSOFT<br>(8) AB-375 Privacy: personal information: businesses. (2017-2018), Assembly <a href=\"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375\">Bill No. 375 CHAPTER 55</a>, An act to add Title 1.81.5 (commencing with Section 1798.100) to Part 4 of Division 3 of the Civil Code, relating to privacy. [Approved by Governor June 28, 2018. Filed with Secretary of State June 28, 2018.]<br>(9) Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Strasbourg, 28.I.1981, “This Convention is the first binding international instrument which protects the individual against abuses which may accompany the collection and processing of personal data and which seeks to regulate at the same time the transfrontier flow of personal data. “ https://www.coe.int/fr/web/conventions/full-list/-<br> /conventions/rms/0900001680078b37</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(10)  “<em>This Is Surveillance.\' Apple CEO Tim Cook Slams Tech Rivals Over Data Collection“ </em>“ Cook also reiterated calls for federal privacy laws in the U.S., similar to those unveiled in Europe, called the General Data Protection Regulation.“ Natalia Drozdiak and <a href=\"http://time.com/5433499/tim-cookapple-data-privacy/\">Stephanie Bodoni / Bloomberg October 24, 2018 via TIME</a>, </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(11) An example among many “<a href=\"https://twitter.com/gaeel/status/1082702284746883072\">How did we get here? </a>“Twitter feed @<em>gaeel</em><br>(12) https://humu.com/<br>(13) “<a href=\"https://humu.com/2019/01/09/humu-data-privacy-trust-iso-soc/\">Data Privacy at Humu: Building Systems for Trust to Make Work Better</a> “, January 9, 2019, Bryan Zimmer </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(14) https://snips.ai/<br> (15) “<a href=\"https://iapp.org/news/a/ces-2019-gdpr-talk-fills-halls-of-eureka-park/\">CES 2019: GDPR talk fills halls of Eureka Park</a> “, Ryan Chiavetta, CIPP/US, Jan.9, 2019,<br> (16) https://www.q-branch.net/index_d/<br> (17) https://getvektor.com/<br> (18) Above note 15</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br><br></p>\n<!-- /wp:paragraph -->','PRIVACY BY DESIGN AND BY DEFAULT UNDER THE GDPR','PRIVACY BY DESIGN have been developed and conceptualised since the 90’s by Ann Cavoukian, Ph.D., and for the first time, a mandatory legal text has included its tenets, the GDPR.','inherit','closed','closed','','16-revision-v1','','','2019-01-27 20:14:03','2019-01-27 20:14:03','',16,'https://datarainbow.eu/2019/01/27/16-revision-v1/',0,'revision','',0),(203,5,'2019-01-27 20:15:09','2019-01-27 20:15:09','<!-- wp:paragraph -->\n<p>by MC PÉROUX, LL. M January 14, 2019 </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>WHY PRIVACY BY DESIGN UNDER THE GDPR IS IMPORTANT FOR COMPANIES&nbsp;(1)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>MC PÉROUX, LL. M</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>January 22, 2019</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A QUICK RECAP OF THE 7 FOUNDATIONAL PRINCIPLES&nbsp;(2)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have been developed and conceptualised since the 90’s by Ann Cavoukian, Ph.D., and for the first time, a mandatory legal text has included its tenets, the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li></li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>➔ purpose limitation (GDPR, art 5-1 b), data minimisation (GDPR, art 5-1 c))</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list {\"ordered\":true} -->\n<ol><li>Proactive not Reactive; Preventative not Remedial -&gt; purpose limitation (GDPR, art 5-1 b), data minimisation (GDPR, art 5-1 c))</li><li>Privacy as the Default Setting</li><li>Privacy Embedded into Design -&gt; GDPR art 25</li><li>Full Functionality - Positive-Sum, not Zero-Sum -&gt; “Privacy by Design avoids the pretense of false dichotomies, such as privacy vs. security, demonstrating that it is possible to have both. “&nbsp; -&gt; See the current discussions on different business models of free information services accessibility without a paywall (personal information given of exchange of free information)&nbsp;(4)</li><li>End-to-End Security - Full Lifecycle Protection -&gt; GDPR: art 5-1 f), art 25 and art 32 (“ level of security appropriate to the risk “)</li><li>Visibility and Transparency - Keep it Open -&gt; Accountability, GDPR art 5-2, art12</li><li>Respect for User Privacy - Keep it User-Centric -&gt;  Accuracy GDPR art 5-1 d), Rights of the Data Subjects, GDPR Chapter III</li></ol>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>WHY SHOULD COMPANIES REALISE THE IMPORTANCE OF PRIVACY BY DESIGN ?</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The GDPR introduces a change in paradigm.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It is not centered on the processors but on the individuals’ fundamental rights.&nbsp; (5)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The gauge to assess an envisaged personal treatment remains the risk it represents to the data subjects’ fundamental rights, the right to privacy being one of them.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>NO RIGHT IS ABSOLUTE AND THE GDPR IS A BALANCING ACT BETWEEN THE RIGHT TO PRIVACY AND OTHER RIGHTS</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>See the current issue on the right to erasure (art 17) where the CJEU Attorney General, M. Maciej Szpunar, recommends a limitation of this rights balancing it with the right to information:&nbsp;§<em>57 “ En revanche, et c’est en quelque sorte le nœud de la présente affaire, le « droit à l’oubli » doit être mis en balance avec d’autres droits fondamentaux. “&nbsp;&nbsp;</em>(6)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>When designing any process on personal data the very first question of the processor should be “do I respect and embed the fundamental rights of the persons when I use their personal data? “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I know this is still too rare an attitude especially among the internet personal data giants like the (in)famous GAFAM (7).&nbsp; Their entire business model is based on the gathering of as much personal data (under the GDPR extensive definition) as possible with too often very deceptive opaque methods.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>NEW TRENDS AMONG COMPANIES PROCESSING PERSONAL DATA&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Some companies, more forward looking, realise that the users, real persons with real interest in protecting their physical life from intrusive data hogging methods, demand that something has to change in the handling of their private information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>They have perhaps understood the general move towards more respect for the individuals’ privacy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Look at the legal trend towards the respect of private information from the upcoming Californian Legislation (8), the success of Convention108 in bringing privacy considerations into many jurisdictions (9) , even the president of Apple, Tim Cook, is asking for a legislation on privacy&nbsp;(10).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>At the recent 2019 edition of the CES, privacy made an entrance but it remains to be seen whether the companies do really apply Privacy By Design or if they are just surfing on the trends.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Too often, companies with a business model based on processing personal data or selling software allowing it, announce that they are “100% GDPR compliant “ but when one looks more into the process they use, it is clear that the GDPR principles have been overlooked or interpreted wrongly…&nbsp;(11)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>On the other end of the spectrum, one finds even some American companies that communicate on privacy as a feature embedded from the start in their business model.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example:&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Info: I have no affiliation, no interest in the companies, I do not endorse their products</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ HUMU&nbsp; (12)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Although I do not like behavioural analysis in general, finding it extremely invasive on privacy, this company’s communication seems ahead of others on Privacy By Design &nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>That’s why we built with the GDPR in mind from day one, and we extend the rights from the GDPR to every user no matter where in the world they live. This includes transparency, control, and data portability. </em>“&nbsp;(13)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ SNIPS&nbsp;(14)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>“<em>Snips Global Communications Director Genia Shipova said the focus on privacy by design is what makes Snips a GDPR-friendly solution. »&nbsp; She said Snips wants to avoid data-centric business models used by larger tech companies by focusing on contracts with its customers.</em>“&nbsp; (15)</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ Q-Branch Labs (16)&nbsp; and their Vektor&nbsp;(17) product</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>\" <em>We start with the assumption that everything we send out of this device has to be GDPR-cleared. We just don\'t want to deal with the problems. All of the logs and security alerts that we send out, we still rip out all of the private information.</em>\" Says the founder Jim McCoy&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>➔ OEKON SAS and its device ASK-HARROLD&nbsp; (19) developed in France&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on an AI that searches for you information on Internet</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>CONCLUSION</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>I hope that companies realise how important it is to understand the principles to protect and respect the ever-growing mass of personal data they handle. They could start reading Art 5 of the GDPR relating to its founding principles.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google just learned the hard way what Privacy By Design means for the French DPA, the CNIL.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its last decision,&nbsp; the CNIL clearly states that the users are not properly informed before consenting due to the numerous steps they have to take in order to find information in the process. The decision is a lesson on what is bad and opaque design to lure the users to consent to vague descriptions of processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>To respect Privacy By Design is just to respect the persons at the end of the process.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Maybe by showing respect, some companies could even gain trust from their customers.</li><li>Place yourself in the shoes of the person when you design any personal data treatment.</li><li>Imagine that this person is someone important to you and see how it really feels to you that her personal data, her life, is processed by your envisaged treatment.</li><li>Educate the developers to the values of privacy during their studies.</li><li>Hire people who understand the value of their own privacy to develop your processes.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Yes business is important but ethics, respect should not be lost.&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>A person who trusts a company’s handling of her data will give the information needed, it is a trust that companies should gain, not steel away by opaque processes and algorithms.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>MC PÉROUX, LL. M</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Blog in French to help SMB’s to understand privacy <a href=\"https://mementosafe.com/\">https://mementosafe.com/</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://www.linkedin.com/in/marieclaire74/\">LinkedIn</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><a href=\"https://twitter.com/MCPLLM\">Twitter</a></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(1) More details on PBD “<a href=\"https://www.linkedin.com/pulse/privacy-security-design-data-gdpr-compliance-marieclaire-p%C3%A9roux/\">Privacy and security by design, data security, and GDPR compliance</a>“, MC Péroux, dec.12, 2018 on LinkedIn<br>(2) <a href=\"https://www.ipc.on.ca/wpcontent/uploads/resources/7foundationalprinciples.pdf\">Privacy By Design The 7 Foundational Principles</a>- January 2011 <br>(3) <em>Ibid</em>.<br>(4) “<a href=\"https://www.huntonprivacyblog.com/2019/01/07/austrian-dpa-issues-decision-on-validityof-cookie-consent-solution/\">A</a><em><a href=\"https://www.huntonprivacyblog.com/2019/01/07/austrian-dpa-issues-decision-on-validityof-cookie-consent-solution/\">ustrian DPA Issues Decision on Validity of Cookie Consent Solution</a></em>“ , Hunton Andrews, Kurth LLP, Posted on January 7, 2019,<br> “<em>The differing approaches taken by the Austrian DPA and the UK ICO demonstrates a lack of alignment on this issue, and it remains to be seen how other DPAs will decide on the issue</em> “</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(5) <a href=\"http://www.europarl.europa.eu/charter/pdf/text_en.pdf\">Charter of Fundamental Rights of the European Union, art 8(1)</a><br>(6) In French, Conclusions de l’avocat général M. Maciej Szpunar présentées le 10 janvier 2019, <a href=\"http://curia.europa.eu/juris/celex.jsf?celex=62017CC0507&amp;lang1=fr&amp;lang2=EN&amp;type=TXT  &amp;ancre=\">Affaire C-507/17, Google LLC</a>, venant aux droits de Google Inc. Contre Commission Nationale de l’Informatique et des Libertés (CNIL),<br>(7) GOOGLE, AMAZON, FACEBOOK, APPLE, MICROSOFT<br>(8) AB-375 Privacy: personal information: businesses. (2017-2018), Assembly <a href=\"https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180AB375\">Bill No. 375 CHAPTER 55</a>, An act to add Title 1.81.5 (commencing with Section 1798.100) to Part 4 of Division 3 of the Civil Code, relating to privacy. [Approved by Governor June 28, 2018. Filed with Secretary of State June 28, 2018.]<br>(9) Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, Strasbourg, 28.I.1981, “This Convention is the first binding international instrument which protects the individual against abuses which may accompany the collection and processing of personal data and which seeks to regulate at the same time the transfrontier flow of personal data. “ https://www.coe.int/fr/web/conventions/full-list/-<br> /conventions/rms/0900001680078b37</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(10)  “<em>This Is Surveillance.\' Apple CEO Tim Cook Slams Tech Rivals Over Data Collection“ </em>“ Cook also reiterated calls for federal privacy laws in the U.S., similar to those unveiled in Europe, called the General Data Protection Regulation.“ Natalia Drozdiak and <a href=\"http://time.com/5433499/tim-cookapple-data-privacy/\">Stephanie Bodoni / Bloomberg October 24, 2018 via TIME</a>, </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(11) An example among many “<a href=\"https://twitter.com/gaeel/status/1082702284746883072\">How did we get here? </a>“Twitter feed @<em>gaeel</em><br>(12) https://humu.com/<br>(13) “<a href=\"https://humu.com/2019/01/09/humu-data-privacy-trust-iso-soc/\">Data Privacy at Humu: Building Systems for Trust to Make Work Better</a> “, January 9, 2019, Bryan Zimmer </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(14) https://snips.ai/<br>(15) “<a href=\"https://iapp.org/news/a/ces-2019-gdpr-talk-fills-halls-of-eureka-park/\">CES 2019: GDPR talk fills halls of Eureka Park</a> “, Ryan Chiavetta, CIPP/US, Jan.9, 2019,<br>(16) https://www.q-branch.net/index_d/<br>(17) https://getvektor.com/<br>(18) Above note 15</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(19) http://minim-e.com/ and https://play.google.com/store/apps/details?id=fr.oekon.harold<br>https://itunes.apple.com/us/app/ask-harold/id1332599364</p>\n<!-- /wp:paragraph -->','PRIVACY BY DESIGN AND BY DEFAULT UNDER THE GDPR','PRIVACY BY DESIGN have been developed and conceptualised since the 90’s by Ann Cavoukian, Ph.D., and for the first time, a mandatory legal text has included its tenets, the GDPR.','inherit','closed','closed','','16-revision-v1','','','2019-01-27 20:15:09','2019-01-27 20:15:09','',16,'https://datarainbow.eu/2019/01/27/16-revision-v1/',0,'revision','',0),(204,5,'2019-01-28 05:30:50','2019-01-28 05:30:50','<!-- wp:paragraph -->\n<p>In what is today the biggest fine under the GDPR, the French Data Protection Authority CNIL investigated Google Android transparency in Data processing. The investigation was consecutive to two class actions filed on the 25th of May 2018. One by the Austrian NGO Non Of Your Business (NOYB), another by the French La Quadrature du Net (LQDN). The complained have been partly answered as limited to the mobile Android Operating System. Still remain Youtube, Gmail and Google Search. This decision worth a close look up.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its complaint, NOYB stated in particular that users of Android mobile devices are required to accept Google\'s privacy policy and general terms and conditions of service and that, failing such acceptance, they could not use their terminal.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The association LQDN complained that, regardless of the terminal used, Google does not have valid legal bases to implement the processing of personal data for purposes of behaviour analysis and advertising targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>First  of all, the CNIL has shown high celerity to deal with the complaints.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>On 1st June 2018, the CNIL submitted the complaints to its European counterparts via the European information exchange system with a view to the designation of a possible lead authority in accordance with the provisions of Article 56 of the GDPR.</li><li>20 September 2018 : Decision to investigate the Android\'s data procession is taken; </li><li>on 21 September, an online test was carried out  to verify the compliance of any processing relating to the use of the operating system Android for mobile equipment, including the creation of a Google account.</li><li>24 and 25th September, the report was notified to GOOGLE LLC companies.&nbsp;and Google France SARL</li><li>28 September 28,  the two companies also received the aforementioned complaints by courier of the CNIL</li><li>2nd Octobre, Mr. François PELLEGRINI was appointed as rapporteur according to the article 47 French Data Protection law of January 6, 1978</li><li>22nd October, the reporter notified Google LLC&nbsp;and Google France a report detailing shortcomings relating to sections 6, 12 and 13 of the GDPR. The report suggested&nbsp;a fine of 50 million euros to be made public.&nbsp;</li><li>7 November 2018, Google requested a hearing from the rapporteur, </li><li>13 November the request was rejected .</li><li> On the same date, the company also made a request for closed doors and postponement of the meeting, </li><li>15 November the request was rejected.</li><li>22nd November, Google filed a written comments on the report.&nbsp;</li><li>7th December, the rapporteur replied to these observations.</li><li>11th December, Google, which had fifteen days from receipt of the rapporteur\'s to reply, requested to postpone the meeting and extend the deadline to produce new observations.&nbsp; </li><li>13th December , the request was accepted to postpone for two weeks - until January 7 - the deadline for filing these observations and to postpone the meeting to January 15, 2019.</li><li>4th January, Google filed new observations in response to those of the rapporteur.</li><li>All observations were reiterated orally during the meeting of 15 January 2019.</li><li>21st January the decision was made public.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>On the decision itself, Google argued the French CNIL should not be the competent Data Protection Authority.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on Article 55 (1) of the GDPR states: Each supervisory authority shall be competent to exercise the tasks and powers vested in it in accordance with this Regulation in the territory of the Member State to which it belongs.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 56 (1) of the GDPR provides: Without prejudice to Article 55, the supervisory authority of the principal place of business or of the sole place of business of the controller or processor shall have jurisdiction to act as lead supervisory authority for cross-border processing by that controller or processor, in accordance with the procedure laid down in Article 60.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google argued that the CNIL could not be competent to conduct this procedure and that it should have transmitted the complaints received to the Irish Data Protection Commission (DPC) the lead authority to deal with these cross-border complaints in accordance with Art 60 GDPR.&nbsp;Google Ireland Limited being its main establishment in the EU for some of the its cross-border processing, including those objects of the complaints.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, initial discussions turned around the competent authority as defined by the main establishment of the company. Google arguing Ireland to be its main establishment, the CNIL responding the main Administrative establishment is not the criteria. Based on Article 4 (16) of the RGPD&nbsp;and Recital 36 GDPR, the main establishment to consider should be based on objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes and means of processing trough stable arrangements. The CNIL added that the determination should be analysed in concreto, according to objective criteria. The main establishment could therefore not necessarily correspond to the main designated administrative establishment.  The CNIL based its position on the WP article 29 guidance WP244 of 5th April 2017 \"<em>the central administration is the place where the decisions are made on the purposes and means of processing.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciding otherwise would result on forum shopping, says the CNIL. Google Ireland had no decisional power. Google Ireland Limited is not mentioned in the Company\'s Privacy Policy dated May 25, 2018 as the entity where the main decisions about the purposes and means of the processing are made. covered by the privacy policy presented to the user when creating his account, during the configuration of his mobile phone on Android. In fact Google had not either named any DPO in Ireland who would be in charge of the processing of personal data that it could implement in the European Union.&nbsp;It further notes that the Android operating system is developed solely by Google LLC.. Additionally, the company itself had indicated, by mail dated December 3, 2018 addressed to the DPC, that the transfer of responsibility of Google LLC.&nbsp;to Google Ireland Limited on certain processing of personal data concerning European citizens would be finalized on 31 January 2019. It later specified to update its confidentiality rules which will come into effect on 22 January 2019. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google\'s argument that a reorganisation both operational and organizational was underway to make the company Google Ireland Limited the controller for certain processing of personal data concerning European nationals, was in my view a mistake only proving that at the time of the compliant Google Ireland had no decisional power.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It also considers that the definition of principal place of business should be distinguished from that of controller. Arguing that if the European legislator had intended that the concept of principal place of business should be interpreted as the place where decisions concerning \'would have expressly indicated simply ignored the text of the Recital 36.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the absence of a principal establishment allowing the identification of a lead authority, the one stop shop did not apply, and the CNIL was competent to initiate this procedure and to exercise all of its powers under Article 58 of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very interesting analysis to determine the main establishment and the lead authority based on objective criteria and not a subjective decision favouring forum shopping. The decision dismisses the application of the GDPR’s one-stop-shop by holding that Google Ireland Limited is not Google’s main establishment in the EU. A rather strict interpretation of the concept of “main establishment”. With no main establishment in the EU, Google LLC could potentially be subject to enforcement by any supervisory authority in the EU where Google has an establishment, including France.&nbsp; </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Once the CNIL confirmed its competence, it goes into a detailed analysis of the transparency requirement and legitimate basis of processing. here after, a free translation is offered:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>2- On the Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google argued on the validity of the complaints. &nbsp;The CNIL responded that the question of the admissibility of the complaints could not affect the legality of the proceedings, as it could self-refer itself based on the findings made by its services.&nbsp;The CNIL had therefore a mission to supervise the application of the regulation and to ensure compliance with it and that it has, for this purpose, the power to carry out investigations, in accordance with Arti 57 1. a) and h) of the RGPD. In fact, the two associations had been mandated to represent the complaints under article 80 of the RGPD.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The second argument claiming that the proceedings breached its right to a fair trial according to Art 6 of the Convention for the Protection of Human Rights and Fundamental Freedoms that the rapport to his observations were addressed in French, sounded rather difficult to succeed. The CNIL responded to that any notification of a penalty report had to be in French based on a legal obligation laid down in Article 111-1 of the Code of relations between the public and the administration which provides that use of the French language is prescribed in the exchanges between the public and the administration, in accordance with the provisions of the law n ° 94-665 of August 4, 1994 relating to the use of the French language. Google has an establishment on the French territory with several hundred employees. Google had in any event sufficient material and human resources enabling it to ensure a translation of the documents in English in sufficient time to become acquainted with it and to make observations within the deadline.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of these elements, the Restricted Training considers that the company had in any event sufficient material and human resources enabling it to ensure a translation of the documents in English in sufficient time to become acquainted with it and to make observations in the the deadline fixed for it.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This point explains why it is important that the Organisations\' representative speak the language of the DPA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also the refusal to extend the time limit he was opposed to produce his first observations and limited the time available to prepare his defence.&nbsp;It also considers that the adjournment of the meeting as well as the additional time it was finally granted to produce its second observations were still not sufficient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>3.Over the scope of investigations</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google argued first of all that the rapporteur has confused the Android operating system and the Google account when they are separate services that implement different treatment activities. Then argued that the scope of control chosen by the CNIL - namely the creation of a Google account when setting up a new device using the Android operating system - is limited in that it only represents a case figure affecting 7% of users. Finally, it indicated that the findings were made on an older version of the Android operating system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL did not disputed the existence of separate services, respectively related to the Android operating system and the Google Account, implementing different processing activities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It observed, however, that the facts covered by the investigations corresponded to the scenario chosen to carry out the on-line check, namely the journey of a user and the documents to which he could have accessed during the initial configuration of his mobile equipment using the Android operating system.&nbsp;This path included the creation of an account.&nbsp;These facts therefore related to the treatments covered by the privacy policy presented to the user when creating an account during the setting up of their mobile phone on Android.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Then, adding that if it was true that the user actually had the choice to create an account and has the opportunity to use some of the services without having to create an account, however, when setting up an Android device, the ability to create a Google account or connect to an existing account naturally appeared at the beginning of the setting process, without specific action of the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In any case, under Article 11.I.2 of the Data Protection Act, the CNIL has a broad discretion as to the scope of the controls it may undertake.&nbsp;A specific control scenario, such as that used in this case, may make it possible to make findings reflecting a more comprehensive privacy policy. The scope of the processing of personal data that is performed&nbsp;is therefore is irrelevant so is the version of the Android operating system since it appears from the documents provided by Google that the user\'s journey is similar in the newer version .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>4.On breach of transparency and information obligations</strong><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google infringed the GDPR for three main reasons: (1)&nbsp;<strong>lack of transparency&nbsp;</strong>(art. 5 GDPR); (2)&nbsp;<strong>insufficient information&nbsp;</strong>(art. 12 and 13 GDPR); and (3)&nbsp;<strong>invalid consent collection or lawfulness basis&nbsp;</strong>(art. 7 GDPR). The CNIL found the information Google provides when creating an account is not clearly accessible and therefore consent is not \'informed\' and explicitly obtained. Criticising pre-ticked boxes explicitly prohibited by the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The <strong>obligations of transparency</strong> resulted on Article 12 (1) GDPR that provides: \"<em>1.The controller shall take appropriate measures to provide any information referred to in&nbsp;</em><a href=\"http://www.privacy-regulation.eu/en/article-13-information-to-be-provided-where-personal-data-are-collected-from-the-data-subject-GDPR.htm\"><em>Articles 13</em></a><em>&nbsp;and 14 and any communication under&nbsp;</em><a href=\"http://www.privacy-regulation.eu/en/article-15-right-of-access-by-the-data-subject-GDPR.htm\"><em>Articles 15</em></a><em>&nbsp;to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.\"&nbsp;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 13 (1) provides that:  <em>\"1.&nbsp;Where personal data relating to a data subject are collected from the data subject, the&nbsp;controller&nbsp;shall, at the time when personal data are obtained, provide the data subject with all of the following information:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(a)&nbsp;&nbsp;&nbsp; the identity and the contact details of the&nbsp;controller&nbsp;and, where applicable, of the&nbsp;controller\'s&nbsp;representative;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(b)&nbsp;&nbsp;&nbsp; the contact details of the data protection officer, where applicable;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(c)&nbsp;&nbsp;&nbsp; the purposes of the&nbsp;processing&nbsp;for which the personal data are intended as well as the legal basis for the&nbsp;processing;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(d)&nbsp;&nbsp;&nbsp; where the&nbsp;processing&nbsp;is based on point (f) of Article 6(1), the legitimate interests pursued by the&nbsp;controller&nbsp;or by a&nbsp;third party;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(e)&nbsp;&nbsp;&nbsp; the&nbsp;recipients or categories of&nbsp;recipients of the personal data, if any;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(f)&nbsp;&nbsp;&nbsp; where applicable, the fact that the&nbsp;controller&nbsp;intends to transfer personal data to a third country or&nbsp;international organisation&nbsp;and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article&nbsp;46 or 47, or the second subparagraph of Article&nbsp;49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google firstly considered that the Confidentiality rules and conditions of use, accessible when creating an account, constitutes first-level information in accordance with the EDPS Guidelines on Transparency within the meaning of the EU Regulation 2016 / 679 (WP260) of 25 May 2018. It states that the document provides a good overview of the treatments implemented and that the mention of the legal basis of these treatments does not have to be included in this first level information.&nbsp;Information about how long the data is kept is in the section Exporting and Deleting the Information in the Privacy Policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google goes on to argue that the information of individuals must, in the light of sections 12 and 13 of the Regulations, be assessed on a global basis.&nbsp;In this regard, it states that the information it issues is also used, in addition to the documents entitled Confidentiality Rules and Conditions of Use, Privacy Policy and Terms of Use, through several other terms and conditions.&nbsp;Additional information messages may appear when creating an account under each of the privacy settings.&nbsp;In addition, an e-mail is sent to the user when an account is created, stating that: it can change the privacy and security settings of the Google account at any time,&nbsp;create reminders to check the privacy or security settings.&nbsp;This e-mail  contains clickable links to various setting tools.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These other control tools, which are made available to the user after the creation of his account from the management interface of his account include for example a tool called check-up confidentiality that allows users to choose privacy settings that suit them, including custom ads, location history, web-based activity, and apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google also puts forward a Dashboard tool that allows users to have an overview of the use they make of the services offered by Google such as Gmail or Youtube.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Finally, Google reminds that when a user clicks Create Account without having disabled custom ad settings, an account creation confirmation pop-up appears to remind that the account is set to include customisation features.&nbsp;The company indicates that the user journey is thus configured to slow down the progression of users who would not have spontaneously made the choice of more privacy-friendly settings.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL takes note of the progress made in recent years by the company in its policy of informing users, in the sense of greater transparency and greater control over their data expected by them.&nbsp;For the reasons that follow, however, it considers that the requirements of the GDPR, the implementation of which must be assessed in the light of the concrete scope of the processing of personal data in question, are not respected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Firstly, the CNIL recalls that pursuant to the provisions of Art 12 of the Regulation, information must be provided in an <strong>easily accessible way</strong>.&nbsp;This accessibility requirement is informed by the <strong>transparency guidelines</strong>, in which the EDPS considered that a key aspect of the transparency principle highlighted in these provisions is that the data subject should be able to advance what the scope and consequences of the processing encompass so as not to be caught off guard at a later stage as to how its personal data were used.&nbsp;[...] In particular, with regard to complex, technical or non-planned data processing,&nbsp;G29\'s position is that [...] controllers should <strong>separately and clearly define the main consequences of treatment</strong>: in other words, what will actually be the effect of the specific treatment described in a statement or opinion on the protection of the privacy for the data subject.&nbsp;The CNIL also recalls that the <strong>accessibility requirement </strong>of Article 12 is based in part on the ergonomic choices made by the controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In this case, the CNIL found that the general architecture of the information chosen by the Corporation does not meet the requirements of the Regulations.&nbsp;The information that must be disclosed to individuals pursuant to section 13 is <strong>excessively scattered in several documents</strong>: Privacy Policy and Terms of Use, displayed during the creation of the account, then Terms of Use and Rules of confidentiality which are accessible in a second time by means of clickable links appearing on the first document.&nbsp;These different documents include buttons and links that must be activated to learn additional information.&nbsp;Such an ergonomic choice leads to a fragmentation of information thus forcing the user to multiply the clicks necessary to access the different documents.&nbsp;The user must then carefully consult a large amount of information before he or she can identify the relevant paragraph (s).&nbsp;However, the work provided by the user does not stop there since it will still have to cross-check and compare the collected information in order to understand which data are collected according to the various settings that he may have chosen.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL noted that, given this architecture, some information is difficult to find. For example, with regard to targeted advertising, to know the information that is collected, a user must perform many actions and combine several documentary resources.&nbsp;As a first step, you should read the General Privacy Policy and Terms of Service, then click the More Options button and then the Read more link to display the Customise Ads page.&nbsp;He will thus have access to a first description of the treatment relating to the personalisation of the advertisement which proves to be incomplete.&nbsp;To complete the information relating to the data processed for this purpose,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Similarly, in terms of <strong>geolocation data processing</strong>, the CNIL noted that the same course devoid of any intuitive character is required from the user with regard to information relating to geolocation data.&nbsp;The user will have to complete the following steps: Review the Privacy Policy and Terms of Service, click More Options, and then click the Learn more link to view the Location History page and view the displayed text. However, as this text is only a short description of the processing, the user will need to go to the Privacy Policy document and access the Information about your location to access the rest of the information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the two cases described, <strong>five actions are necessary for the user to access the information</strong> relating to the targeted advertisements and s<strong>ix for the geolocation</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL stated that if the user wished to have <strong>information on the retention periods</strong> of his personal data, he must first consult the Privacy Policy found in the main document and then go to the section titled Export and delete the information and finally click on the hyperlink click here contained in a general paragraph on storage times.&nbsp;It is therefore only after four clicks that the user accesses this information.&nbsp;The Restricted Training further notes that the title chosen by the company for Exporting and Deleting Your Information does not easily allow the user to understand that this is a topic to access information about retention periods .&nbsp;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As a result of all these factors, there is an <strong>overall lack of accessibility</strong> of the information provided by the company in the context of the processing in question.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, the CNIL considered that the<strong> clear and comprehensible nature of the information provided</strong>, as required by Article 12 of the GDPR, <strong>must be assessed taking into account the nature of each treatment</strong> in question and its <strong>concrete impact on the persons concerned</strong>. concerned.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Beforehand, the CNIL considered it was essential to emphasise that the <strong>data processing</strong> implemented by the controller was <strong>particularly massive and intrusive</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data Google collects <strong>comes from a wide variety of sources</strong>.&nbsp;This data is collected both from the use of the phone, the use of the company services, such as the Gmail email service or the Youtube video platform, but also from the data generated by the user activity when they visit third-party sites that use <strong>Google services, including Google Analytics cookies placed on these sites.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As such, the Privacy Policy reveals that <strong>at least twenty services</strong> offered by the company are likely to be involved in the processing, which may concern data such as web browsing history, history from applications, data stored locally on the equipment (such as address books), geolocation of equipment, etc.&nbsp;Therefore, <strong>a lot of data is processed as part of these services via or in connection with the Android operating system</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The record shows that, in addition to data from external sources, the company treats <strong>at least three categories of data</strong>: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><strong>data produced by the user</strong> (for example, their name, password, phone number, email address, payment method, content created, imported or received, such as writings, photos or videos );  </li><li><strong>data generated by its activities</strong> (for example, IP address, unique user credentials, mobile network data, data related to wireless networks and Bluetooth devices, timestamp of actions performed, data geolocation, the technical data of the devices used including data relating to the sensors (accelerometer, etc.), the videos viewed, the searches made, the browsing history, the purchases, the applications used, etc .;</li><li><strong>Derived or inferred data from data provided by the user or his activities</strong>.&nbsp;In this category, the Privacy Policy lists a number of purposes that can only be accomplished by generating data from the other two categories of data.&nbsp;Thus, the customisation of the ads that the company realises requires to infer the interests of users from their activity in order to offer them to advertisers.&nbsp;In the same way, the purposes of providing content, research and personalised recommendations require inferring new information from those declared, produced or generated by the activity of the user.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Moreover, if the very large number of processed data can characterise alone the massive and intrusive nature of the treatments performed, the very nature of some of the data described, such as geolocation data or content consulted, reinforces this finding.&nbsp;Considered in isolation, the <strong>collection of each of these data is likely to reveal with a high degree of precision many of the most intimate aspects of people\'s lives, including their lifestyle, their tastes, their contacts, their opinions or their trips</strong>.&nbsp;The result of the combination of these data greatly reinforces the <strong>massive and intrusive nature of the processing</strong>.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consequently, it is in the light of the particular characteristics of these processing of personal data which have just been recalled that the characters are clear and understandable, within the meaning of Art 12 of the GDPR, of the information provided for in Art 13 of the Regulations, must be appreciated.&nbsp;The CNIL considered that these requirements were not respected in this case.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Specifically, the CNIL noted that the information provided by Google did not allow the users to understand sufficiently the particular consequences of the processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the purposes announced in the various documents are described as follows: offer personalised services in terms of content and advertisements, ensure the safety of products and services, provide and develop services, etc.&nbsp;.&nbsp;They are too generic in terms of the scope of the treatments implemented and their consequences.&nbsp;This is also the case when users are told too loosely: <em>The information we collect is used to improve the services offered to all our users.&nbsp;[...] The information we collect and how we use it depends on how you use our services and how you manage your privacy settings.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL noted that the description of the aims pursued did not allow users to measure the extent of the treatments and the degree of intrusion into their private lives that they are likely to take away.&nbsp;It considered, in particular, that such information is not provided in a clear manner, nor at the first level of information provided to users through, in this case, the document entitled Confidentiality rules and conditions of use nor in the other levels of information proposed by the company.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL further noted that the description of the data collected, which could be of such a nature as to clarify the scope of these purposes and to prevent the user from being subsequently caught off guard as to the way in which his data were used and combined, is particularly imprecise and incomplete, both in the analysis of the first level of information and that of the other documents provided.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example, the Privacy Policy and Terms of Use document and the Privacy Policy document specify: <em>This may be more complex (...) information, such as the ads you find most useful, the people you care about. interest most on the web or YouTube videos that are likely to interest you.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of the foregoing, the CNIL believed that the user is not able, especially by being aware of the first level of information presented to him in the Privacy Policy and Terms of Use, to measure the scope of the main treatments on his private life.&nbsp;While it noted that exhaustive information, from the first level, would be counterproductive and does not respect the requirement of transparency, it considers that it should contain terms that would objectify the number and scope of implemented.&nbsp;It further considered that it would be possible, by other types of presentation methods adapted to data combining services,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The finding of lack of clarity and comprehensibility must also be made with regard to the mention of the legal basis of targeted advertising .&nbsp;In fact, the company first states in the Privacy Policy: <em>We ask you for permission to process your information for specific purposes, and you are free to revoke your consent at any time.&nbsp;For example, we ask you for permission to provide personalised services, such as ads.&nbsp;The legal basis chosen here therefore appears to be consent.&nbsp;</em>However, the company further adds it relies on the legitimate interest,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL stressed that if Google had indicated before that the only legal basis for the processing of the targeted advertisement was consent, the investigation shows that this clarification is not brought to the attention of the users.&nbsp;The formulations recalled above did not allow the latter to clearly measure the distinction between properly targeted advertising, based on the combination of multiple user data, which is based on the company\'s consent statement , other forms of targeting using for example the context of navigation, based on the legitimate interest.&nbsp;The CNIL stressed the particular importance of the need for clarity in these processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With respect to information on the retention period, the CNIL noted that the How are Google\'s collected information page is maintained has four categories: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Information retained until the user deleted it;</li><li>Information with a timeout;</li><li>Information retained until user\'s Google Account is deleted;</li><li>Information kept for long periods of time for specific reasons.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>It noted, however, that as regards to the latter category, only very general explanations of the purpose of this retention are provided and no precise duration or the criteria used to determine that duration are indicated.&nbsp;This information is among those that must be issued to users pursuant to Article 13 (2) (a) of the Regulations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Finally, if the company claims that multiple information tools are made available to users concomitantly and after the creation of their account, the restricted training notes that these methods do not make it possible to reach the requirements of transparency and transparency. information from articles 12 and 13 of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First, the CNIL noted that the tools to which the company refers do contribute, to a certain extent, to the goal of transparency throughout the life of the account and the use of Google\'s services.&nbsp;However, it considered that they do not participate sufficiently in the information provided for in Article 13, which must be provided at the time data are obtained.&nbsp;As mentioned in the EDPS Transparency Guidelines, Article 13 specifies the information to be provided to data subjects from the start of the processing cycle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If any data other than those strictly necessary to create the account, are collected throughout the life of the account, such as browsing history or purchases, the time of its creation marks the entry of the user in the ecosystem of Google services, whose particularly massive and intrusive nature of processing has been recalled previously.&nbsp;This step marks the beginning of a multitude of treatment operations: collection, combination, analysis, etc.&nbsp;Therefore, since the process of creating the account is essential in the understanding of treatments and their impact and where the proposed user journey itself invites the person concerned to focus his attention at this stage, the information provided for in Rule 13 of the Rules of Procedure at that time must.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Moreover, both the pop-up window appearing at the time of the creation of the account and the electronic message sent as soon as the account is created contain only a summary or very specific information on the processing implemented and can not allow to consier the prior information as sufficient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the text of the pop-up window indicates <em>This Google Account is configured to include customisation features (such as recommendations and custom ads) that are based on the information stored in your account.&nbsp;The e-mail indicates the main features of the Google Account and the existence of control tools.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With regard to the confidentiality check-up tool, this essentially allows the user to set up the collected information such as browsing history or visited places.&nbsp;Finally, the Dashboard consists of an information panel for each Google service overview of the use of the account holder.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Nevertheless, these confidentiality check-up and Dashboard tools can only be used, just like the e-mail mentioned above, after the account creation step, which is nevertheless essential for informing users as well as it has been said.&nbsp;In addition, although their existence and interest are brought to the attention of users, they imply an active and initiative of these.&nbsp;For these reasons, these tools do not allow to consider that sufficient information is provided for the application of Article 13 of the Regulations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the light of all these elements, the CNIL committee considers that a breach of the transparency and information obligations as provided for in Articles 12 and 13 of the Regulation is characterised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>5. Failure to provide a legal basis for the processing implemented</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6 of the RGPD states that: 1.&nbsp;&nbsp;&nbsp;Processing&nbsp;shall be lawful only if and to the extent that at least one of the following applies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(a)&nbsp;&nbsp;&nbsp; the data subject has given consent to the&nbsp;processing&nbsp;of his or her personal data for one or more specific purposes;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(b)&nbsp;&nbsp;&nbsp;&nbsp;processing&nbsp;is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(c)&nbsp;&nbsp;&nbsp;&nbsp;processing&nbsp;is necessary for compliance with a legal obligation to which the&nbsp;controller&nbsp;is subject;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(d)&nbsp;&nbsp;&nbsp;&nbsp;processing&nbsp;is necessary in order to protect the vital interests of the data subject or of another natural person;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(e)&nbsp;&nbsp;&nbsp;&nbsp;processing&nbsp;is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the&nbsp;controller;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(f)&nbsp;&nbsp;&nbsp;&nbsp;processing&nbsp;is necessary for the purposes of the legitimate interests pursued by the&nbsp;controller&nbsp;or by a&nbsp;third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>the processing is necessary to safeguard the vital interests of the data subject or of another natural person;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google was criticised for failing to validly collect the consent of individuals for targeted advertising.&nbsp;It was also considered that the company could not claim a legitimate interest for these processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In defence, Google specified that it relied solely on the consent for the targeted advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 4 (11) of the above-mentioned Regulations specifies what consent means: <em>any freely given, specific, informed and unambiguous indication of the data subject\'s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 7 of the same Regulation provides the conditions that apply to it:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>1.&nbsp;&nbsp;&nbsp;Where&nbsp;processing&nbsp;is based on consent, the&nbsp;controller&nbsp;shall be able to demonstrate that the data subject has consented to&nbsp;processing&nbsp;of his or her personal data.</em></li><li><em>2.&nbsp;&nbsp;&nbsp;If the data subject\'s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.</em></li><li><em>3.&nbsp;&nbsp;&nbsp;The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of&nbsp;processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.</em></li><li><em>4.&nbsp;&nbsp;&nbsp;When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia , the performance of a contract, including the provision of a service, is conditional on consent to the&nbsp;processing&nbsp;of personal data that is not necessary for the performance of that contract.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Firstly, Google said that the users\' consent is informed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It believes that simple and clear information is presented to the user when creating an account and allow him to know how the company uses the data for customisation purposes.&nbsp;In particular, the Company refers to the summary entitled Privacy Policy and Terms of Use, the sections dedicated to the targeted advertisements contained in the Privacy Policy and the additional information message entitled Targeted Advertising in the Menu Options account creation setting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, Google claimed that the user\'s consent is specific and unambiguous.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In particular, it stated that when setting up the account, the user has the option of making a choice regarding the display of targeted advertising .&nbsp;It considers that this possibility enables to express its consent to the use of its data independently of the other choices it may express with regard to the other purposes relating to the processing associated with the Google Account (eg YouTube search history).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It also considered that the procedures for obtaining consent for the purposes of targeted advertisements it sets up are in line with the recommendations of the CNIL of December 5, 2013 regarding cookies.&nbsp;In particular, it specifies that short information is available on the targeted ads followed by an \"I accept\" button (the Privacy Policy and the Terms of Use), preceded by a \"more options\" button that gives users the ability to disable multiple processing operations, including for targeted ad purposes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It also argued that the solution presented in the public notice of the president of the CNIL No. MED-2018-023 of November 29, 2018 allows the user to consent to all ends via a button accept all.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lastly, it considered that explicit consent for the processing of data for the purposes of targeted advertising, within the meaning of Art 9 (2) (a) of the GDPR, could not be required in the absence of sensitive data.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Regarding the informed consent&nbsp;and&nbsp;the&nbsp;spread&nbsp;of&nbsp;information</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the first place, the CNIL specified that this informed character must be examined in the light of the preceding developments concerning the lack of transparency and information of the users during the setting up of their account.&nbsp;It considered that the deficiencies previously identified necessarily have an impact on the information delivered to the users to ensure the informed nature of the consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL indicated that the EDPS Guideline of 10 April 2018 on Consent within the meaning of Regulation 2016/679 (WP250) states that the controller must ensure that consent is provided on the basis of information that enables the people concerned to easily identify who is responsible for the data and to understand what they are agreeing to.&nbsp;[It] must clearly describe the purpose of the data processing for which consent is sought.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These guidelines also state that: In order for consent to be informed, it is necessary to inform the person concerned of certain crucial elements in making a choice.&nbsp;[..] At least the following information is required in order to obtain valid consent: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>the identity of the controller,</em></li><li><em>the purpose of each processing operation for which consent is sought,</em></li><li><em>the (types of) data collected and used,</em></li><li><em>the existence of the right to withdraw consent,</em></li><li><em>information on the use of data for automated decision-making [..] and</em></li><li><em>information on the possible risks associated with the transmission of data due to the lack of a decision on adequacy and appropriate safeguards [...].</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>As it was able to identify under the breach of the transparency and information requirements, the CNIL considered that the information on targeted advertising is excessively disseminated in separate documents and is not, as such, easily accessible.&nbsp;In this respect, the CNIL refered to the preceding developments on the multiple actions that must be performed by a user who wishes to be made aware of available on the processing related to the targeted advertisement.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In addition, the CNIL also noted under the breach of transparency obligations, the information provided was not sufficiently clear and understandable in that it was difficult for a user to have a global understanding of the can do the object and their scope.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As an illustration, the information in the targeted Ad section, accessible from the Privacy Policy and Terms and Conditions document through the More Options button, contains the following: Google can show you ads based on your activity in Google services (for example, in the search or on YouTube, as well as on Google\'s websites and partner applications).&nbsp;The CNIL noted that it is not possible to read, for example through clickable links, the services, sites and Google application to which the company refers.&nbsp;Therefore, the user was not able to understand the targeted advertising they are subject to, as well as their scope,&nbsp;even though these treatments nevertheless imply a plurality of services (for example: Google search, YouTube, Google home, Google maps, Playstore, Google photo, Google play, Google analytics, Google translation, Play books) and the processing of a large amount of data personal character.&nbsp;Users are not able to have a proper perception of the nature and volume of data that is collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of these elements, the CNIL committee considered that the users\' consent for targeted advertising was not sufficiently informed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>With regard to the specific and unequivocal nature of the consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 32 of the Regulation provides that: <em>Consent must be given by a clear positive act by which the data subject expresses in a free, specific, informed and unambiguous manner his agreement to the processing of his personal data [...].&nbsp;There can therefore be no consent in the event of silence, boxes checked by default or inactivity.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 43 of the GDPR states that: <em>Consent is presumed not to have been freely given if separate consent can not be given to different personal data processing operations, although this is appropriate in the present case.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The above EDPS guidance on consent states that: <em>In order to comply with the specific nature of consent, the controller must ensure: [...] (ii) the detailed nature of consent requests [...] This means that data controller who seeks consent for various specific purposes should provide separate consent for each purpose so that users can give specific consent for specific purposes.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In this case, the CNIL noted that when the user creates an account, he has the possibility to modify some of the parameters associated with the account.&nbsp;To access these settings, the user must click the more options button, present before the Create Account button.&nbsp;the CNIL also noted that the personalisation settings of the account, which contain the choice for the display of personalised ads, are pre-checked by default, which means, unless otherwise indicated, the agreement of the user to processing of its data for the purposes mentioned (eg YouTube search history, display of personalised ads etc.).&nbsp;The user has the option to uncheck these parameters if he does not want these treatments to be implemented.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL observed that, at the time of the creation of the account, if the user does not click on the button more options to set his account, he must check the boxes <em>I accept the terms of use of Google and I agree that my information will be used as described above and detailed in the Privacy Policy</em>.&nbsp;Subsequently, he must press the <em>Create Account</em> button.&nbsp;A pop-up window appears, titled Simple confirmation that contains the following text This Google Account is set up to include customisation features (such as recommendations and custom ads), which are based on information stored in your account.&nbsp;To change your personalisation settings and the information stored in your account,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If it does not click <em>More Options</em>, the user must select the <em>Confirm</em> button to complete the account creation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of the foregoing, the CNIL noted that if the user has the possibility to modify the configuration of the parameters of his account prior to its creation, a positive action on his part is necessary to access the possibilities of setting up the account.&nbsp;Thus, the user can completely create his account, and accept the related processing, including targeted advertising, without clicking <em>More options</em>.&nbsp;Therefore, the user\'s consent is not, in this case, validly collected to the extent that it is not given through a positive act by which the person consents specifically and distinctly to the processing of its data for purposes of targeted advertising compared to other purposes of treatment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL also considered that the actions by which the user proceeds to the creation of his account - by ticking the boxes I accept the conditions of use of Google and I accept that my information is used as described below above and detailed in the privacy rules, and then selecting Create Account - can not be considered as the expression of a valid consent.&nbsp;The specific nature of the consent is not respected because the user, by these actions, accepts all the processing of personal data implemented by the company, including those of targeted advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In addition, the CNIL noted that multiple technology processes are used by the company to combine and analyse data from different external services, applications or sources.&nbsp;They undeniably have a multiplying effect on the precise knowledge society has of its users.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As a result, the restricted formation believes that the company has operations of combinations with almost unlimited potential allowing a massive and intrusive treatment of the data of the users.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Given the scope of the data processing - in particular that of targeted advertising - and the number of people concerned, the CNIL underlined that the deficiencies previously retained are of a particular gravity.&nbsp;A lack of transparency regarding these wide-scope processing, as well as a lack of valid user consent to targeted advertising, constitute substantial infringements of the protection of their privacy and are contrary to legitimate aspirations of people who want to keep control of their data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In this respect, strengthening the rights of individuals is one of the main thrusts of the Regulation.&nbsp;The European legislator recalls that The rapid evolution of technologies and globalization have created new challenges for the protection of personal data.&nbsp;The extent of collection and sharing of personal data has increased significantly.&nbsp;Technologies allow both private and public authorities to use personal data as never before in their business (...) Technologies have transformed both the economy and social relations (recital 6) .&nbsp;It stresses that these developments require a strong data protection framework (...) with rigorous enforcement of the rules, it is important to create the confidence that will enable the digital economy to develop in the internal market as a whole.&nbsp;Individuals should have control over their personal data.&nbsp;(recital 7).&nbsp;The European legislator regrets, finally, that Directive 95/46 / EC has not made it possible to avoid the widespread public perception that significant risks to the protection of individuals still exist, in particular as regards the online environment.&nbsp;(recital 9).&nbsp;whereas Directive 95/46 / EC has not prevented the widespread public perception that significant risks to the protection of individuals still exist, in particular with regard to the online environment.&nbsp;(recital 9).&nbsp;whereas Directive 95/46 / EC has not prevented the widespread public perception that significant risks to the protection of individuals still exist, in particular with regard to the online environment.&nbsp;(recital 9).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL thus considered, in view of the scale of the processing carried out and the compelling need for the users to keep control of their data, that they must be put in a position to be sufficiently informed of the scope of the data implemented and to validly consent to it, unless to deprive of basic confidence in the digital ecosystem.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Finally, the CNIL emphasised that shortcomings need to be put into perspective with regard to the company\'s business model, in particular the place of the users\' data processing for advertising purposes via the Android operating system.&nbsp;In view of the benefits it takes from these processing, Google must pay particular attention to its responsibility under the GDPR in their implementation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It follows from all the foregoing and the criteria which have been duly taken into account by the Committee, in view of the maximum amount incurred on the basis of 4% of the turnover indicated in point 2 of this Decision, that a financial penalty is justified up to 50 million euros, as well as a supplementary publicising sanction for the same reasons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Account is also taken of the company\'s prominent place in the market for operating systems, the seriousness of the deficiencies and the interest this decision represents in informing the public in determining the duration of its publication.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>FOR THESE REASONS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The restricted formation of the CNIL, after having deliberated, decides:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>to award Google LLC a monetary penalty in the amount of 50 (fifty) million euros;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>to send this decision to Google France Sarl for the execution of this decision;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google has already publicly announced it has appealed the case. It\'s of course important as this decision creates a precedent and establish the rules.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is only  start.<a href=\"https://www.laquadrature.net/en/2019/01/21/first-sanction-against-google-following-our-collective-complaints/\"> La Quadrature du Net publishe</a>d : \"<em>Today, the CNIL&nbsp;</em><a href=\"https://www.cnil.fr/en/cnils-restricted-committee-imposes-financial-penalty-50-million-euros-against-google-llc\"><em>sanctioned</em></a><em>&nbsp;</em><strong><em>Google to a 50 million Euros fine</em></strong><em>, stating that the targeted advertising it engages in with its operating system Android is in breach of the GDPR, the new European regulation that came into effect on May 25. However, this sanction is really only the beginning of an answer to our complaint against Google, which denounced especially the targeted advertising imposed on Youtube, Gmail and Google Search in violation of our consent.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>In this respect, the CNIL explains the low amount of its sanction, considering Google’s nearly&nbsp;</em><a href=\"https://www.statista.com/statistics/266206/googles-annual-global-revenue/\"><em>110 billion US dollars</em></a><em>&nbsp;revenue, by the fact it limited the scope of its examination to “the data processing covered by the privacy policy presented to a user when creating their account on their Android mobile phone” (our translation).&nbsp;</em><sup><em>1</em></sup><em>&nbsp;We therefore expect the CNIL to quickly answer the rest of our complaint, which concerns Youtube, Gmail and Google Search, by issuing a fine commensurate with this company and the extent and the duration of the violation of ours rights (the maximum amount possible is 4 billion euros – 4% of global revenue –, which we hope for).</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This publication is licensed under a Creative Commons Attribution 4.0 International<br>More information on the licence can be found <a href=\"http://creativecommons.org/licenses/by/4.0/\">here</a>. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Google Subject to the Biggest Fine Under GDPR','In what is today the biggest fine under the GDPR, the French Data Protection Authority CNIL investigated Google Android transparency in Data procession. The investigation was consecutive to two class actions filed on the 25th of May 2018. One by the Austrian NGO Non Of Your Business (NOYB), another by the French La Quadrature du Net (LQDN). This decision worth a close look.','publish','open','open','','google-subject-to-the-biggest-fine-under-gdpr','','\nhttps://www.laquadrature.net/en/2019/01/21/first-sanction-against-google-following-our-collective-complaints/','2020-10-27 14:14:22','2020-10-27 14:14:22','',0,'http://datarainbow.eu/?p=204',0,'post','',0),(205,5,'2019-01-28 03:42:18','2019-01-28 03:42:18','<!-- wp:paragraph -->\n<p>In what is today the biggest fine under the GDPR, the French Data Protection Authority CNIL investigated Google Android transparency in Data procession. The investigation was consecutive to two class actions filed on the 25th of May 2018. One by the Austrian NGO Non Of Your Business (NOYB), another by the French La Quadrature du Net (LQDN).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its complaint, NOYB stated in particular that users of Android mobile devices are required to accept Google\'s privacy policy and general terms and conditions of service and that, failing such acceptance, they could not use their terminal.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The association LQDN complained that, regardless of the terminal used, Google does not have valid legal bases to implement the processing of personal data for purposes of behaviour analysis and advertising targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>First  of all, the CNIL has shown high celerity to deal with the complaints.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>On 1st June 2018, the CNIL submitted the complaints to its European counterparts via the European information exchange system with a view to the designation of a possible lead authority in accordance with the provisions of Article 56 of the GDPR.</li><li>20 September 2018 : Decision to investigate the Android\'s data procession is taken; </li><li>on 21 September, an online test was carried out  to verify the compliance of any processing relating to the use of the operating system Android for mobile equipment, including the creation of a Google account.</li><li>24 and 25th September, the report was notified to GOOGLE LLC companies. and Google France SARL</li><li>28 September 28,  the two companies also received the aforementioned complaints by courier of the CNIL</li><li>2nd Octobre, Mr. François PELLEGRINI was appointed as rapporteur according to the article 47 French Data Protection law of January 6, 1978</li><li>22nd October, the reporter notified Google LLC and Google France a report detailing shortcomings relating to sections 6, 12 and 13 of the GDPR. The report suggested a fine of 50 million euros to be made public. </li><li>7 November 2018, Google requested a hearing from the rapporteur, </li><li>13 November the request was rejected .</li><li> On the same date, the company also made a request for closed doors and postponement of the meeting, </li><li>15 November the request was rejected.</li><li>22nd November, Google filed a written comments on the report. </li><li>7th December, the rapporteur replied to these observations.</li><li>11th December, Google, which had fifteen days from receipt of the rapporteur\'s to reply, requested to postpone the meeting and extend the deadline to produce new observations.  </li><li>13th December , the request was accepted to postpone for two weeks - until January 7 - the deadline for filing these observations and to postpone the meeting to January 15, 2019.</li><li>4th January, Google filed new observations in response to those of the rapporteur.</li><li>All observations were reiterated orally during the meeting of 15 January 2019.</li><li>21st January the decision was made public.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>On the decision itself, Google argued the French CNIL should not be the competent Data Protection Authority.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on Article 55 (1) of the GDPR states: Each supervisory authority shall be competent to exercise the tasks and powers vested in it in accordance with this Regulation in the territory of the Member State to which it belongs.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 56 (1) of the GDPR provides: Without prejudice to Article 55, the supervisory authority of the principal place of business or of the sole place of business of the controller or processor shall have jurisdiction to act as lead supervisory authority for cross-border processing by that controller or processor, in accordance with the procedure laid down in Article 60.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google argued that the CNIL could not be competent to conduct this procedure and that it should have transmitted the complaints received to the Irish Data Protection Commission (DPC) the lead authority to deal with these cross-border complaints in accordance with Art 60 GDPR. Google Ireland Limited being its main establishment in the EU for some of the its cross-border processing, including those objects of the complaints.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, initial discussions turned around the competent authority as defined by the main establishment of the company. Google arguing Ireland to be its main establishment, the CNIL responding the main Administrative establishment is not the criteria. Based on Article 4 (16) of the RGPD and Recital 36 GDPR, the main establishment to consider should be based on objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes and means of processing trough stable arrangements. The CNIL added that the determination should be analysed in concreto, according to objective criteria. The main establishment could therefore not necessarily correspond to the main designated administrative establishment.  The CNIL based its position on the WP article 29 guidance WP244 of 5th April 2017 \"<em>the central administration is the place where the decisions are made on the purposes and means of processing.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciding otherwise would result on forum shopping, says the CNIL. Google Ireland had no decisional power. Google Ireland Limited is not mentioned in the Company\'s Privacy Policy dated May 25, 2018 as the entity where the main decisions about the purposes and means of the processing are made. covered by the privacy policy presented to the user when creating his account, during the configuration of his mobile phone on Android. In fact Google had not either named any DPO in Ireland who would be in charge of the processing of personal data that it could implement in the European Union. It further notes that the Android operating system is developed solely by Google LLC.. Additionally, the company itself had indicated, by mail dated December 3, 2018 addressed to the DPC, that the transfer of responsibility of Google LLC. to Google Ireland Limited on certain processing of personal data concerning European citizens would be finalized on 31 January 2019. It later specified to update its confidentiality rules which will come into effect on 22 January 2019. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google\'s argument that a reorganisation both operational and organizational was underway to make the company Google Ireland Limited the controller for certain processing of personal data concerning European nationals, was in my view a mistake only proving that at the time of the compliant Google Ireland had no decisional power.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It also considers that the definition of principal place of business should be distinguished from that of controller and that if the</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Arguing that if the European legislator had intended that the concept of principal place of business should be interpreted as the place where decisions concerning \'would have expressly indicated simply ignored the text of the Recital 36.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the absence of a principal establishment allowing the identification of a lead authority, the one stop shop did not apply, and the CNIL was competent to initiate this procedure and to exercise all of its powers under Article 58 of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very interesting analysis to determine the main establishment and the lead authority based on objective criteria and not a subjective decision favouring forum shopping. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>On the Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google argued on the validity of the complaints.  The CNIL responded that the question of the admissibility of the complaints could not affect the legality of the proceedings, as it could self-refer itself based on the findings made by its services. The CNIL had therefore a mission to supervise the application of the regulation and to ensure compliance with it and that it has, for this purpose, the power to carry out investigations, in accordance with Arti 57 1. a) and h) of the RGPD. In fact, the two associations had been mandated to represent the complaints under article 80 of the RGPD.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The second argument claiming that the proceedings breached its right to a fair trial according to Art 6 of the Convention for the Protection of Human Rights and Fundamental Freedoms that the rapport to his observations were addressed in French, sounded rather difficult to succeed. The CNIL responded to that any notification of a penalty report had to be in French based on a legal obligation laid down in Article 111-1 of the Code of relations between the public and the administration which provides that use of the French language is prescribed in the exchanges between the public and the administration, in accordance with the provisions of the law n ° 94-665 of August 4, 1994 relating to the use of the French language. Google has an establishment on the French territory with several hundred employees. Google had in any event sufficient material and human resources enabling it to ensure a translation of the documents in English in sufficient time to become acquainted with it and to make observations within the deadline.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of these elements, the Restricted Training considers that the company had in any event sufficient material and human resources enabling it to ensure a translation of the documents in English in sufficient time to become acquainted with it and to make observations in the the deadline fixed for it.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This point explains why it is important that the Organisations\' representative speak the language of the DPA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also the refusal to extend the time limit he was opposed to produce his first observations and limited the time available to prepare his defence. It also considers that the adjournment of the meeting as well as the additional time it was finally granted to produce its second observations were still not sufficient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>3.Over the scope of investigations</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google argued first of all that the rapporteur has confused the Android operating system and the Google account when they are separate services that implement different treatment activities. Then argued that the scope of control chosen by the CNIL - namely the creation of a Google account when setting up a new device using the Android operating system - is limited in that it only represents a case figure affecting 7% of users. Finally, it indicated that the findings were made on an older version of the Android operating system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL did not disputed the existence of separate services, respectively related to the Android operating system and the Google Account, implementing different processing activities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It observed, however, that the facts covered by the investigations corresponded to the scenario chosen to carry out the on-line check, namely the journey of a user and the documents to which he could have accessed during the initial configuration of his mobile equipment using the Android operating system. This path included the creation of an account. These facts therefore related to the treatments covered by the privacy policy presented to the user when creating an account during the setting up of their mobile phone on Android.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Then, adding that if it was true that the user actually had the choice to create an account and has the opportunity to use some of the services without having to create an account, however, when setting up an Android device, the ability to create a Google account or connect to an existing account naturally appeared at the beginning of the setting process, without specific action of the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In any case, under Article 11.I.2 of the Data Protection Act, the CNIL has a broad discretion as to the scope of the controls it may undertake. A specific control scenario, such as that used in this case, may make it possible to make findings reflecting a more comprehensive privacy policy. The scope of the processing of personal data that is performed is therefore is irrelevant so is the version of the Android operating system since it appears from the documents provided by Google that the user\'s journey is similar in the newer version .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>4.On breach of transparency and information obligations</strong><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 12 (1) GDPR provides: \"<em>1.The controller shall take appropriate measures to provide any information referred to in </em><a href=\"http://www.privacy-regulation.eu/en/article-13-information-to-be-provided-where-personal-data-are-collected-from-the-data-subject-GDPR.htm\"><em>Articles 13</em></a><em> and 14 and any communication under </em><a href=\"http://www.privacy-regulation.eu/en/article-15-right-of-access-by-the-data-subject-GDPR.htm\"><em>Articles 15</em></a><em> to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.\" </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 13 (1) provides that:  <em>\"1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(a)    the identity and the contact details of the controller and, where applicable, of the controller\'s representative;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(b)    the contact details of the data protection officer, where applicable;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(c)    the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(d)    where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(e)    the recipients or categories of recipients of the personal data, if any;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(f)    where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Google Subject to the Biggest Fine Under GDPR','','inherit','closed','closed','','204-revision-v1','','','2019-01-28 03:42:18','2019-01-28 03:42:18','',204,'https://datarainbow.eu/2019/01/28/204-revision-v1/',0,'revision','',0),(206,5,'2019-01-28 04:30:24','2019-01-28 04:30:24','<!-- wp:paragraph -->\n<p>Information retained until you delete it;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Information with a timeout</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Information retained until your Google Account is deleted</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Information kept for long periods of time for specific reasons.</p>\n<!-- /wp:paragraph -->','Untitled Reusable Block','','publish','closed','closed','','untitled-reusable-block','','','2019-01-28 04:30:24','2019-01-28 04:30:24','',0,'https://datarainbow.eu/?wp_block=untitled-reusable-block',0,'wp_block','',0),(207,5,'2019-01-28 05:30:50','2019-01-28 05:30:50','<!-- wp:paragraph -->\n<p>In what is today the biggest fine under the GDPR, the French Data Protection Authority CNIL investigated Google Android transparency in Data procession. The investigation was consecutive to two class actions filed on the 25th of May 2018. One by the Austrian NGO Non Of Your Business (NOYB), another by the French La Quadrature du Net (LQDN). This decision worth a close look.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In its complaint, NOYB stated in particular that users of Android mobile devices are required to accept Google\'s privacy policy and general terms and conditions of service and that, failing such acceptance, they could not use their terminal.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The association LQDN complained that, regardless of the terminal used, Google does not have valid legal bases to implement the processing of personal data for purposes of behaviour analysis and advertising targeting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>First  of all, the CNIL has shown high celerity to deal with the complaints.</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>On 1st June 2018, the CNIL submitted the complaints to its European counterparts via the European information exchange system with a view to the designation of a possible lead authority in accordance with the provisions of Article 56 of the GDPR.</li><li>20 September 2018 : Decision to investigate the Android\'s data procession is taken; </li><li>on 21 September, an online test was carried out  to verify the compliance of any processing relating to the use of the operating system Android for mobile equipment, including the creation of a Google account.</li><li>24 and 25th September, the report was notified to GOOGLE LLC companies. and Google France SARL</li><li>28 September 28,  the two companies also received the aforementioned complaints by courier of the CNIL</li><li>2nd Octobre, Mr. François PELLEGRINI was appointed as rapporteur according to the article 47 French Data Protection law of January 6, 1978</li><li>22nd October, the reporter notified Google LLC and Google France a report detailing shortcomings relating to sections 6, 12 and 13 of the GDPR. The report suggested a fine of 50 million euros to be made public. </li><li>7 November 2018, Google requested a hearing from the rapporteur, </li><li>13 November the request was rejected .</li><li> On the same date, the company also made a request for closed doors and postponement of the meeting, </li><li>15 November the request was rejected.</li><li>22nd November, Google filed a written comments on the report. </li><li>7th December, the rapporteur replied to these observations.</li><li>11th December, Google, which had fifteen days from receipt of the rapporteur\'s to reply, requested to postpone the meeting and extend the deadline to produce new observations.  </li><li>13th December , the request was accepted to postpone for two weeks - until January 7 - the deadline for filing these observations and to postpone the meeting to January 15, 2019.</li><li>4th January, Google filed new observations in response to those of the rapporteur.</li><li>All observations were reiterated orally during the meeting of 15 January 2019.</li><li>21st January the decision was made public.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>On the decision itself, Google argued the French CNIL should not be the competent Data Protection Authority.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Based on Article 55 (1) of the GDPR states: Each supervisory authority shall be competent to exercise the tasks and powers vested in it in accordance with this Regulation in the territory of the Member State to which it belongs.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 56 (1) of the GDPR provides: Without prejudice to Article 55, the supervisory authority of the principal place of business or of the sole place of business of the controller or processor shall have jurisdiction to act as lead supervisory authority for cross-border processing by that controller or processor, in accordance with the procedure laid down in Article 60.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google argued that the CNIL could not be competent to conduct this procedure and that it should have transmitted the complaints received to the Irish Data Protection Commission (DPC) the lead authority to deal with these cross-border complaints in accordance with Art 60 GDPR. Google Ireland Limited being its main establishment in the EU for some of the its cross-border processing, including those objects of the complaints.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, initial discussions turned around the competent authority as defined by the main establishment of the company. Google arguing Ireland to be its main establishment, the CNIL responding the main Administrative establishment is not the criteria. Based on Article 4 (16) of the RGPD and Recital 36 GDPR, the main establishment to consider should be based on objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes and means of processing trough stable arrangements. The CNIL added that the determination should be analysed in concreto, according to objective criteria. The main establishment could therefore not necessarily correspond to the main designated administrative establishment.  The CNIL based its position on the WP article 29 guidance WP244 of 5th April 2017 \"<em>the central administration is the place where the decisions are made on the purposes and means of processing.</em>\"</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Deciding otherwise would result on forum shopping, says the CNIL. Google Ireland had no decisional power. Google Ireland Limited is not mentioned in the Company\'s Privacy Policy dated May 25, 2018 as the entity where the main decisions about the purposes and means of the processing are made. covered by the privacy policy presented to the user when creating his account, during the configuration of his mobile phone on Android. In fact Google had not either named any DPO in Ireland who would be in charge of the processing of personal data that it could implement in the European Union. It further notes that the Android operating system is developed solely by Google LLC.. Additionally, the company itself had indicated, by mail dated December 3, 2018 addressed to the DPC, that the transfer of responsibility of Google LLC. to Google Ireland Limited on certain processing of personal data concerning European citizens would be finalized on 31 January 2019. It later specified to update its confidentiality rules which will come into effect on 22 January 2019. </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google\'s argument that a reorganisation both operational and organizational was underway to make the company Google Ireland Limited the controller for certain processing of personal data concerning European nationals, was in my view a mistake only proving that at the time of the compliant Google Ireland had no decisional power.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It also considers that the definition of principal place of business should be distinguished from that of controller and that if the</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Arguing that if the European legislator had intended that the concept of principal place of business should be interpreted as the place where decisions concerning \'would have expressly indicated simply ignored the text of the Recital 36.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the absence of a principal establishment allowing the identification of a lead authority, the one stop shop did not apply, and the CNIL was competent to initiate this procedure and to exercise all of its powers under Article 58 of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This is a very interesting analysis to determine the main establishment and the lead authority based on objective criteria and not a subjective decision favouring forum shopping.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Once the CNIL confirmed its competence, it goes into a detailed analysis of the transparency requirement and legitimate basis of processing. here after, a free translation is offered:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>On the Procedure</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google argued on the validity of the complaints.  The CNIL responded that the question of the admissibility of the complaints could not affect the legality of the proceedings, as it could self-refer itself based on the findings made by its services. The CNIL had therefore a mission to supervise the application of the regulation and to ensure compliance with it and that it has, for this purpose, the power to carry out investigations, in accordance with Arti 57 1. a) and h) of the RGPD. In fact, the two associations had been mandated to represent the complaints under article 80 of the RGPD.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The second argument claiming that the proceedings breached its right to a fair trial according to Art 6 of the Convention for the Protection of Human Rights and Fundamental Freedoms that the rapport to his observations were addressed in French, sounded rather difficult to succeed. The CNIL responded to that any notification of a penalty report had to be in French based on a legal obligation laid down in Article 111-1 of the Code of relations between the public and the administration which provides that use of the French language is prescribed in the exchanges between the public and the administration, in accordance with the provisions of the law n ° 94-665 of August 4, 1994 relating to the use of the French language. Google has an establishment on the French territory with several hundred employees. Google had in any event sufficient material and human resources enabling it to ensure a translation of the documents in English in sufficient time to become acquainted with it and to make observations within the deadline.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of these elements, the Restricted Training considers that the company had in any event sufficient material and human resources enabling it to ensure a translation of the documents in English in sufficient time to become acquainted with it and to make observations in the the deadline fixed for it.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>This point explains why it is important that the Organisations\' representative speak the language of the DPA.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Also the refusal to extend the time limit he was opposed to produce his first observations and limited the time available to prepare his defence. It also considers that the adjournment of the meeting as well as the additional time it was finally granted to produce its second observations were still not sufficient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>3.Over the scope of investigations</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google argued first of all that the rapporteur has confused the Android operating system and the Google account when they are separate services that implement different treatment activities. Then argued that the scope of control chosen by the CNIL - namely the creation of a Google account when setting up a new device using the Android operating system - is limited in that it only represents a case figure affecting 7% of users. Finally, it indicated that the findings were made on an older version of the Android operating system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL did not disputed the existence of separate services, respectively related to the Android operating system and the Google Account, implementing different processing activities.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It observed, however, that the facts covered by the investigations corresponded to the scenario chosen to carry out the on-line check, namely the journey of a user and the documents to which he could have accessed during the initial configuration of his mobile equipment using the Android operating system. This path included the creation of an account. These facts therefore related to the treatments covered by the privacy policy presented to the user when creating an account during the setting up of their mobile phone on Android.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Then, adding that if it was true that the user actually had the choice to create an account and has the opportunity to use some of the services without having to create an account, however, when setting up an Android device, the ability to create a Google account or connect to an existing account naturally appeared at the beginning of the setting process, without specific action of the user.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In any case, under Article 11.I.2 of the Data Protection Act, the CNIL has a broad discretion as to the scope of the controls it may undertake. A specific control scenario, such as that used in this case, may make it possible to make findings reflecting a more comprehensive privacy policy. The scope of the processing of personal data that is performed is therefore is irrelevant so is the version of the Android operating system since it appears from the documents provided by Google that the user\'s journey is similar in the newer version .</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>4.On breach of transparency and information obligations</strong><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The obligations of transparency resulted on Article 12 (1) GDPR that provides: \"<em>1.The controller shall take appropriate measures to provide any information referred to in </em><a href=\"http://www.privacy-regulation.eu/en/article-13-information-to-be-provided-where-personal-data-are-collected-from-the-data-subject-GDPR.htm\"><em>Articles 13</em></a><em> and 14 and any communication under </em><a href=\"http://www.privacy-regulation.eu/en/article-15-right-of-access-by-the-data-subject-GDPR.htm\"><em>Articles 15</em></a><em> to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by electronic means. When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means.\" </em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 13 (1) provides that:  <em>\"1. Where personal data relating to a data subject are collected from the data subject, the controller shall, at the time when personal data are obtained, provide the data subject with all of the following information:</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(a)    the identity and the contact details of the controller and, where applicable, of the controller\'s representative;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(b)    the contact details of the data protection officer, where applicable;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(c)    the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(d)    where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(e)    the recipients or categories of recipients of the personal data, if any;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><em>(f)    where applicable, the fact that the controller intends to transfer personal data to a third country or international organisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google firstly considered that the Confidentiality rules and conditions of use, accessible when creating an account, constitutes first-level information in accordance with the EDPS Guidelines on Transparency within the meaning of the EU Regulation 2016 / 679 (WP260) of 25 May 2018. It states that the document provides a good overview of the treatments implemented and that the mention of the legal basis of these treatments does not have to be included in this first level information. Information about how long the data is kept is in the section Exporting and Deleting the Information in the Privacy Policy.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google goes on to argue that the information of individuals must, in the light of sections 12 and 13 of the Regulations, be assessed on a global basis. In this regard, it states that the information it issues is also used, in addition to the documents entitled Confidentiality Rules and Conditions of Use, Privacy Policy and Terms of Use, through several other terms and conditions. Additional information messages may appear when creating an account under each of the privacy settings. In addition, an e-mail is sent to the user when an account is created, stating that: it can change the privacy and security settings of the Google account at any time, create reminders to check the privacy or security settings. This e-mail  contains clickable links to various setting tools.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These other control tools, which are made available to the user after the creation of his account from the management interface of his account include for example a tool called check-up confidentiality that allows users to choose privacy settings that suit them, including custom ads, location history, web-based activity, and apps.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google also puts forward a Dashboard tool that allows users to have an overview of the use they make of the services offered by Google such as Gmail or Youtube.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Finally, Google reminds that when a user clicks Create Account without having disabled custom ad settings, an account creation confirmation pop-up appears to remind that the account is set to include customisation features. The company indicates that the user journey is thus configured to slow down the progression of users who would not have spontaneously made the choice of more privacy-friendly settings.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL takes note of the progress made in recent years by the company in its policy of informing users, in the sense of greater transparency and greater control over their data expected by them. For the reasons that follow, however, it considers that the requirements of the GDPR, the implementation of which must be assessed in the light of the concrete scope of the processing of personal data in question, are not respected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Firstly, the CNIL recalls that pursuant to the provisions of Article 12 of the Regulation, information must be provided in an easily accessible way. This accessibility requirement is informed by the transparency guidelines, in which the EDPS considered that a key aspect of the transparency principle highlighted in these provisions is that the data subject should be able to advance what the scope and consequences of the processing encompass so as not to be caught off guard at a later stage as to how its personal data were used. [...] In particular, with regard to complex, technical or non-planned data processing, G29\'s position is that [...] controllers should separately and clearly define the main consequences of treatment: in other words, what will actually be the effect of the specific treatment described in a statement or opinion on the protection of the privacy for the data subject. The CNIL also recalls that the accessibility requirement of Article 12 is based in part on the ergonomic choices made by the controller.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In this case, the CNIL found that the general architecture of the information chosen by the Corporation does not meet the requirements of the Regulations. The information that must be disclosed to individuals pursuant to section 13 is excessively scattered in several documents: Privacy Policy and Terms of Use, displayed during the creation of the account, then Terms of Use and Rules of confidentiality which are accessible in a second time by means of clickable links appearing on the first document. These different documents include buttons and links that must be activated to learn additional information. Such an ergonomic choice leads to a fragmentation of information thus forcing the user to multiply the clicks necessary to access the different documents. The user must then carefully consult a large amount of information before he or she can identify the relevant paragraph (s). However, the work provided by the user does not stop there since it will still have to cross-check and compare the collected information in order to understand which data are collected according to the various settings that he may have chosen.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL noted that, given this architecture, some information is difficult to find. For example, with regard to targeted advertising, to know the information that is collected, a user must perform many actions and combine several documentary resources. As a first step, you should read the General Privacy Policy and Terms of Service, then click the More Options button and then the Read more link to display the Customise Ads page. He will thus have access to a first description of the treatment relating to the personalisation of the advertisement which proves to be incomplete. To complete the information relating to the data processed for this purpose,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Similarly, in terms of geolocation data processing, the CNIL noted that the same course devoid of any intuitive character is required from the user with regard to information relating to geolocation data. The user will have to complete the following steps: Review the Privacy Policy and Terms of Service, click More Options, and then click the Learn more link to view the Location History page and view the displayed text. . However, as this text is only a short description of the processing, the user will need to go to the Privacy Policy document and access the Information about your location to access the rest of the information.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the two cases described, five actions are necessary for the user to access the information relating to the targeted advertisements and six for the geolocation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL stated that if the user wished to have information on the retention periods of his personal data, he must first consult the Privacy Policy found in the main document and then go to the section titled Export and delete the information and finally click on the hyperlink click here contained in a general paragraph on storage times. It is therefore only after four clicks that the user accesses this information. The Restricted Training further notes that the title chosen by the company for Exporting and Deleting Your Information does not easily allow the user to understand that this is a topic to access information about retention periods . </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As a result of all these factors, there is an overall lack of accessibility of the information provided by the company in the context of the processing in question.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, the CNIL considered that the clear and comprehensible nature of the information provided, as required by Article 12 of the GDPR, must be assessed taking into account the nature of each treatment in question and its concrete impact on the persons concerned. concerned.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Beforehand, the CNIL considered it was essential to emphasise that the data processing implemented by the controller was particularly massive and intrusive.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The data Google collects comes from a wide variety of sources.&nbsp;This data is collected both from the use of the phone, the use of the company services, such as the Gmail email service or the Youtube video platform, but also from the data generated by the user activity when they visit third-party sites that use Google services, including Google Analytics cookies placed on these sites.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As such, the Privacy Policy reveals that at least twenty services offered by the company are likely to be involved in the processing, which may concern data such as web browsing history, history from applications, data stored locally on the equipment (such as address books), geolocation of equipment, etc. Therefore, a lot of data is processed as part of these services via or in connection with the Android operating system.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The record shows that, in addition to data from external sources, the company treats at least three categories of data: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>- data produced by the user (for example, their name, password, phone number, email address, payment method, content created, imported or received, such as writings, photos or videos );  </li><li>data generated by its activities (for example, IP address, unique user credentials, mobile network data, data related to wireless networks and Bluetooth devices, timestamp of actions performed, data geolocation, the technical data of the devices used including data relating to the sensors (accelerometer, etc.), the videos viewed, the searches made, the browsing history, the purchases, the applications used, etc .;</li><li>Derived or inferred data from data provided by the user or his activities. In this category, the Privacy Policy lists a number of purposes that can only be accomplished by generating data from the other two categories of data. Thus, the customisation of the ads that the company realises requires to infer the interests of users from their activity in order to offer them to advertisers. In the same way, the purposes of providing content, research and personalised recommendations require inferring new information from those declared, produced or generated by the activity of the user.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Moreover, if the very large number of processed data can characterise alone the massive and intrusive nature of the treatments performed, the very nature of some of the data described, such as geolocation data or content consulted, reinforces this finding. Considered in isolation, the collection of each of these data is likely to reveal with a high degree of precision many of the most intimate aspects of people\'s lives, including their lifestyle, their tastes, their contacts, their opinions or their trips. The result of the combination of these data greatly reinforces the massive and intrusive nature of the processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Consequently, it is in the light of the particular characteristics of these processing of personal data which have just been recalled that the characters are clear and understandable, within the meaning of Art 12 of the GDPR, of the information provided for in Art 13 of the Regulations, must be appreciated. The CNIL considered that these requirements were not respected in this case.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Specifically, the CNIL noted that the information provided by Google did not allow the users to understand sufficiently the particular consequences of the processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the purposes announced in the various documents are described as follows: offer personalised services in terms of content and advertisements, ensure the safety of products and services, provide and develop services, etc. . They are too generic in terms of the scope of the treatments implemented and their consequences. This is also the case when users are told too loosely: <em>The information we collect is used to improve the services offered to all our users. [...] The information we collect and how we use it depends on how you use our services and how you manage your privacy settings.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Therefore, the CNIL noted that the description of the aims pursued did not allow users to measure the extent of the treatments and the degree of intrusion into their private lives that they are likely to take away. It considered, in particular, that such information is not provided in a clear manner, nor at the first level of information provided to users through, in this case, the document entitled Confidentiality rules and conditions of use nor in the other levels of information proposed by the company.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL further noted that the description of the data collected, which could be of such a nature as to clarify the scope of these purposes and to prevent the user from being subsequently caught off guard as to the way in which his data were used and combined, is particularly imprecise and incomplete, both in the analysis of the first level of information and that of the other documents provided.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>For example, the Privacy Policy and Terms of Use document and the Privacy Policy document specify: <em>This may be more complex (...) information, such as the ads you find most useful, the people you care about. interest most on the web or YouTube videos that are likely to interest you.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of the foregoing, the CNIL believed that the user is not able, especially by being aware of the first level of information presented to him in the Privacy Policy and Terms of Use, to measure the scope of the main treatments on his private life. While it noted that exhaustive information, from the first level, would be counterproductive and does not respect the requirement of transparency, it considers that it should contain terms that would objectify the number and scope of implemented. It further considered that it would be possible, by other types of presentation methods adapted to data combining services,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The finding of lack of clarity and comprehensibility must also be made with regard to the mention of the legal basis of targeted advertising . In fact, the company first states in the Privacy Policy: <em>We ask you for permission to process your information for specific purposes, and you are free to revoke your consent at any time. For example, we ask you for permission to provide personalised services, such as ads. The legal basis chosen here therefore appears to be consent. </em>However, the company further adds it relies on the legitimate interest,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL stressed that if Google had indicated before that the only legal basis for the processing of the targeted advertisement was consent, the investigation shows that this clarification is not brought to the attention of the users. The formulations recalled above did not allow the latter to clearly measure the distinction between properly targeted advertising, based on the combination of multiple user data, which is based on the company\'s consent statement , other forms of targeting using for example the context of navigation, based on the legitimate interest. The CNIL stressed the particular importance of the need for clarity in these processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With respect to information on the retention period, the CNIL noted that the How are Google\'s collected information page is maintained has four categories: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li>Information retained until the user deleted it;</li><li>Information with a timeout;</li><li>Information retained until user\'s Google Account is deleted;</li><li>Information kept for long periods of time for specific reasons.</li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>It noted, however, that as regards to the latter category, only very general explanations of the purpose of this retention are provided and no precise duration or the criteria used to determine that duration are indicated. This information is among those that must be issued to users pursuant to Article 13 (2) (a) of the Regulations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Finally, if the company claims that multiple information tools are made available to users concomitantly and after the creation of their account, the restricted training notes that these methods do not make it possible to reach the requirements of transparency and transparency. information from articles 12 and 13 of the GDPR.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>First, the CNIL noted that the tools to which the company refers do contribute, to a certain extent, to the goal of transparency throughout the life of the account and the use of Google\'s services. However, it considered that they do not participate sufficiently in the information provided for in Article 13, which must be provided at the time data are obtained. As mentioned in the EDPS Transparency Guidelines, Article 13 specifies the information to be provided to data subjects from the start of the processing cycle.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If any data other than those strictly necessary to create the account, are collected throughout the life of the account, such as browsing history or purchases, the time of its creation marks the entry of the user in the ecosystem of Google services, whose particularly massive and intrusive nature of processing has been recalled previously. This step marks the beginning of a multitude of treatment operations: collection, combination, analysis, etc. Therefore, since the process of creating the account is essential in the understanding of treatments and their impact and where the proposed user journey itself invites the person concerned to focus his attention at this stage, the information provided for in Rule 13 of the Rules of Procedure at that time must.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Moreover, both the pop-up window appearing at the time of the creation of the account and the electronic message sent as soon as the account is created contain only a summary or very specific information on the processing implemented and can not allow to consier the prior information as sufficient.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In fact, the text of the pop-up window indicates <em>This Google Account is configured to include customisation features (such as recommendations and custom ads) that are based on the information stored in your account. The e-mail indicates the main features of the Google Account and the existence of control tools.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>With regard to the confidentiality check-up tool, this essentially allows the user to set up the collected information such as browsing history or visited places. Finally, the Dashboard consists of an information panel for each Google service overview of the use of the account holder.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Nevertheless, these confidentiality check-up and Dashboard tools can only be used, just like the e-mail mentioned above, after the account creation step, which is nevertheless essential for informing users as well as it has been said. In addition, although their existence and interest are brought to the attention of users, they imply an active and initiative of these. For these reasons, these tools do not allow to consider that sufficient information is provided for the application of Article 13 of the Regulations.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the light of all these elements, the CNIL committee considers that a breach of the transparency and information obligations as provided for in Articles 12 and 13 of the Regulation is characterised.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>5. Failure to provide a legal basis for the processing implemented</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 6 of the RGPD states that: 1.   Processing shall be lawful only if and to the extent that at least one of the following applies:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(a)    the data subject has given consent to the processing of his or her personal data for one or more specific purposes;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(b)    processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(c)    processing is necessary for compliance with a legal obligation to which the controller is subject;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(d)    processing is necessary in order to protect the vital interests of the data subject or of another natural person;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(e)    processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>(f)    processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>the processing is necessary to safeguard the vital interests of the data subject or of another natural person;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Google was criticised for failing to validly collect the consent of individuals for targeted advertising. It was also considered that the company could not claim a legitimate interest for these processing.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In defence, Google specified that it relied solely on the consent for the targeted advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 4 (11) of the above-mentioned Regulations specifies what consent means: <em>any freely given, specific, informed and unambiguous indication of the data subject\'s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Article 7 of the same Regulation provides the conditions that apply to it:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>1.   Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.</em></li><li><em>2.   If the data subject\'s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.</em></li><li><em>3.   The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.</em></li><li><em>4.   When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia , the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>Firstly, Google said that the users\' consent is informed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It believes that simple and clear information is presented to the user when creating an account and allow him to know how the company uses the data for customisation purposes. In particular, the Company refers to the summary entitled Privacy Policy and Terms of Use, the sections dedicated to the targeted advertisements contained in the Privacy Policy and the additional information message entitled Targeted Advertising in the Menu Options account creation setting.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Secondly, Google claimed that the user\'s consent is specific and unambiguous.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In particular, it stated that when setting up the account, the user has the option of making a choice regarding the display of targeted advertising . It considers that this possibility enables to express its consent to the use of its data independently of the other choices it may express with regard to the other purposes relating to the processing associated with the Google Account (eg YouTube search history).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It also considered that the procedures for obtaining consent for the purposes of targeted advertisements it sets up are in line with the recommendations of the CNIL of December 5, 2013 regarding cookies. In particular, it specifies that short information is available on the targeted ads followed by an \"I accept\" button (the Privacy Policy and the Terms of Use), preceded by a \"more options\" button that gives users the ability to disable multiple processing operations, including for targeted ad purposes.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It also argued that the solution presented in the public notice of the president of the CNIL No. MED-2018-023 of November 29, 2018 allows the user to consent to all ends via a button accept all.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Lastly, it considered that explicit consent for the processing of data for the purposes of targeted advertising, within the meaning of Art 9 (2) (a) of the GDPR, could not be required in the absence of sensitive data.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>Regarding the informed consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In the first place, the CNIL specified that this informed character must be examined in the light of the preceding developments concerning the lack of transparency and information of the users during the setting up of their account. It considered that the deficiencies previously identified necessarily have an impact on the information delivered to the users to ensure the informed nature of the consent.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL indicated that the EDPS Guideline of 10 April 2018 on Consent within the meaning of Regulation 2016/679 (WP250) states that the controller must ensure that consent is provided on the basis of information that enables the people concerned to easily identify who is responsible for the data and to understand what they are agreeing to. [It] must clearly describe the purpose of the data processing for which consent is sought.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>These guidelines also state that: In order for consent to be informed, it is necessary to inform the person concerned of certain crucial elements in making a choice. [..] At least the following information is required in order to obtain valid consent: </p>\n<!-- /wp:paragraph -->\n\n<!-- wp:list -->\n<ul><li><em>the identity of the controller,</em></li><li><em>the purpose of each processing operation for which consent is sought,</em></li><li><em>the (types of) data collected and used,</em></li><li><em>the existence of the right to withdraw consent,</em></li><li><em>information on the use of data for automated decision-making [..] and</em></li><li><em>information on the possible risks associated with the transmission of data due to the lack of a decision on adequacy and appropriate safeguards [...].</em></li></ul>\n<!-- /wp:list -->\n\n<!-- wp:paragraph -->\n<p>As it was able to identify under the breach of the transparency and information requirements, the CNIL considered that the information on targeted advertising is excessively disseminated in separate documents and is not, as such, easily accessible. In this respect, the CNIL refered to the preceding developments on the multiple actions that must be performed by a user who wishes to be made aware of available on the processing related to the targeted advertisement.<br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In addition, the CNIL also noted under the breach of transparency obligations, the information provided was not sufficiently clear and understandable in that it was difficult for a user to have a global understanding of the can do the object and their scope.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As an illustration, the information in the targeted Ad section, accessible from the Privacy Policy and Terms and Conditions document through the More Options button, contains the following: Google can show you ads based on your activity in Google services (for example, in the search or on YouTube, as well as on Google\'s websites and partner applications). The CNIL noted that it is not possible to read, for example through clickable links, the services, sites and Google application to which the company refers. Therefore, the user was not able to understand the targeted advertising they are subject to, as well as their scope, even though these treatments nevertheless imply a plurality of services (for example: Google search, YouTube, Google home, Google maps, Playstore, Google photo, Google play, Google analytics, Google translation, Play books) and the processing of a large amount of data personal character. Users are not able to have a proper perception of the nature and volume of data that is collected.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of these elements, the CNIL committee considered that the users\' consent for targeted advertising was not sufficiently informed.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>With regard to the specific and unequivocal nature of the consent</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 32 of the Regulation provides that: <em>Consent must be given by a clear positive act by which the data subject expresses in a free, specific, informed and unambiguous manner his agreement to the processing of his personal data [...]. There can therefore be no consent in the event of silence, boxes checked by default or inactivity.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Recital 43 of the GDPR states that: <em>Consent is presumed not to have been freely given if separate consent can not be given to different personal data processing operations, although this is appropriate in the present case.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The above EDPS guidance on consent states that: <em>In order to comply with the specific nature of consent, the controller must ensure: [...] (ii) the detailed nature of consent requests [...] This means that data controller who seeks consent for various specific purposes should provide separate consent for each purpose so that users can give specific consent for specific purposes.</em></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In this case, the CNIL noted that when the user creates an account, he has the possibility to modify some of the parameters associated with the account. To access these settings, the user must click the more options button, present before the Create Account button. the CNIL also noted that the personalisation settings of the account, which contain the choice for the display of personalised ads, are pre-checked by default, which means, unless otherwise indicated, the agreement of the user to processing of its data for the purposes mentioned (eg YouTube search history, display of personalised ads etc.). The user has the option to uncheck these parameters if he does not want these treatments to be implemented.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL observed that, at the time of the creation of the account, if the user does not click on the button more options to set his account, he must check the boxes <em>I accept the terms of use of Google and I agree that my information will be used as described above and detailed in the Privacy Policy</em>. Subsequently, he must press the <em>Create Account</em> button. A pop-up window appears, titled Simple confirmation that contains the following text This Google Account is set up to include customisation features (such as recommendations and custom ads), which are based on information stored in your account. To change your personalisation settings and the information stored in your account,</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>If it does not click <em>More Options</em>, the user must select the <em>Confirm</em> button to complete the account creation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In view of the foregoing, the CNIL noted that if the user has the possibility to modify the configuration of the parameters of his account prior to its creation, a positive action on his part is necessary to access the possibilities of setting up the account. Thus, the user can completely create his account, and accept the related processing, including targeted advertising, without clicking <em>More options</em>. Therefore, the user\'s consent is not, in this case, validly collected to the extent that it is not given through a positive act by which the person consents specifically and distinctly to the processing of its data for purposes of targeted advertising compared to other purposes of treatment.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL also considered that the actions by which the user proceeds to the creation of his account - by ticking the boxes I accept the conditions of use of Google and I accept that my information is used as described below above and detailed in the privacy rules, and then selecting Create Account - can not be considered as the expression of a valid consent. The specific nature of the consent is not respected because the user, by these actions, accepts all the processing of personal data implemented by the company, including those of targeted advertising.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In addition, the CNIL noted that multiple technology processes are used by the company to combine and analyse data from different external services, applications or sources. They undeniably have a multiplying effect on the precise knowledge society has of its users.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>As a result, the restricted formation believes that the company has operations of combinations with almost unlimited potential allowing a massive and intrusive treatment of the data of the users.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Given the scope of the data processing - in particular that of targeted advertising - and the number of people concerned, the CNIL underlined that the deficiencies previously retained are of a particular gravity. A lack of transparency regarding these wide-scope processing, as well as a lack of valid user consent to targeted advertising, constitute substantial infringements of the protection of their privacy and are contrary to legitimate aspirations of people who want to keep control of their data.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>In this respect, strengthening the rights of individuals is one of the main thrusts of the Regulation. The European legislator recalls that The rapid evolution of technologies and globalization have created new challenges for the protection of personal data. The extent of collection and sharing of personal data has increased significantly. Technologies allow both private and public authorities to use personal data as never before in their business (...) Technologies have transformed both the economy and social relations (recital 6) . It stresses that these developments require a strong data protection framework (...) with rigorous enforcement of the rules, it is important to create the confidence that will enable the digital economy to develop in the internal market as a whole. Individuals should have control over their personal data. (recital 7). The European legislator regrets, finally, that Directive 95/46 / EC has not made it possible to avoid the widespread public perception that significant risks to the protection of individuals still exist, in particular as regards the online environment. (recital 9). whereas Directive 95/46 / EC has not prevented the widespread public perception that significant risks to the protection of individuals still exist, in particular with regard to the online environment. (recital 9). whereas Directive 95/46 / EC has not prevented the widespread public perception that significant risks to the protection of individuals still exist, in particular with regard to the online environment. (recital 9).</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The CNIL thus considered, in view of the scale of the processing carried out and the compelling need for the users to keep control of their data, that they must be put in a position to be sufficiently informed of the scope of the data implemented and to validly consent to it, unless to deprive of basic confidence in the digital ecosystem.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Finally, the CNIL emphasised that shortcomings need to be put into perspective with regard to the company\'s business model, in particular the place of the users\' data processing for advertising purposes via the Android operating system. In view of the benefits it takes from these processing, Google must pay particular attention to its responsibility under the GDPR in their implementation.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>It follows from all the foregoing and the criteria which have been duly taken into account by the Committee, in view of the maximum amount incurred on the basis of 4% of the turnover indicated in point 2 of this Decision, that a financial penalty is justified up to 50 million euros, as well as a supplementary publicising sanction for the same reasons.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>Account is also taken of the company\'s prominent place in the market for operating systems, the seriousness of the deficiencies and the interest this decision represents in informing the public in determining the duration of its publication.</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><strong>FOR THESE REASONS</strong></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>The restricted formation of the CNIL, after having deliberated, decides:</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>to award Google LLC a monetary penalty in the amount of 50 (fifty) million euros;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p>to send this decision to Google France Sarl for the execution of this decision;</p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->\n\n<!-- wp:paragraph -->\n<p><br></p>\n<!-- /wp:paragraph -->','Google Subject to the Biggest Fine Under GDPR','','inherit','closed','closed','','204-revision-v1','','','2019-01-28 05:30:50','2019-01-28 05:30:50','',204,'https://datarainbow.eu/2019/01/28/204-revision-v1/',0,'revision','',0),